Accidents NTSB RAR[772]

PB96-916305 NTSB/RAR-96/05 NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, DC 20594 RAILROAD ACCIDENT REPORT DERAILMENT OF FREIGHT TRAIN H-BALT1-31 ATCHISON, TOPEKA AND SANTA FE RAILWAY COMPANY NEAR CAJON JUNCTION, CALIFORNIA ON FEBRUARY 1, 1996 6675A Abstract: On February 1, 1996, Atchison, Topeka and Santa Fe Railway Company freight train HBALT1-31 derailed at milepost 60.4 near Cajon Junction, California. The conductor and the brakeman sustained fatal injuries; the engineer incurred serious injuries. A fire resulting from the derailment and subsequent rail car pileup engulfed the train and adjacent areas. The major safety issues discussed in this report are the lack of Federal and management oversight in the use of two-way end-of-train devices, the adequacy of operating personnel training in the use of two-way end-of-train devices, the carrier compliance with Federal regulations for event recorders, and the adequacy of wreckage removal operations for tank cars containing hazardous materials. The report also discusses safety issues relating to standards for brake pipe configurations, crashworthiness and occupant survivability, and emergency response and evacuation. As a result of its investigation, the National Transportation Safety Board issued safety recommendations to the Burlington Northern and Santa Fe Railway Company, Federal Railroad Administration, Association of American Railroads, International Association of Fire Chiefs, and Chemical Manufacturers Association. The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews. Information about available publications may be obtained by contacting: National Transportation Safety Board Public Inquiries Section, RE-51 490 L’Enfant Plaza, SW Washington, DC 20594 (202) 314-6551 Safety Board publications may be purchased, by individual copy or by subscription, from: National Technical Information Service 5285 Port Royal Road Springfield, Virginia 22161 (703) 487-4600 NTSB/RAR-96/05 PB96-916305 DERAILMENT OF ATCHISON, TOPEKA AND SANTA FE RAILWAY COMPANY TRAIN H-BALT1-31 NEAR CAJON JUNCTION, CALIFORNIA FEBRUARY 1, 1996 RAILROAD ACCIDENT REPORT Adopted: December 11, 1996 Notation 6675A NATIONAL TRANSPORTATION SAFETY BOARD Washington, DC 20594 this page intentionally left blank CONTENTS EXECUTIVE SUMMARY........................................................................................................... v ACRONYMS ................................................................................................................................ vi INVESTIGATION Accident Narrative........................................................................................................................................ 1 Emergency Response.................................................................................................................................... 7 Injuries… .................................................................................................................................................... 10 Damages ..................................................................................................................................................... 10 Traincrew Information................................................................................................................................ 10 Traincrew End-of-Train Device Training................................................................................................... 11 Train Information ....................................................................................................................................... 12 Track and Signal Information..................................................................................................................... 14 Operations Information............................................................................................................................... 15 Meteorological Information........................................................................................................................ 17 Medical, Pathological, and Toxicological Information.............................................................................. 18 Survival Aspects ......................................................................................................................................... 18 Postaccident Train Examination................................................................................................................. 18 Wheel Sets............................................................................................................................................ 18 Train Line............................................................................................................................................. 18 Tank Cars ............................................................................................................................................. 19 Tests and Research ..................................................................................................................................... 21 Signals .................................................................................................................................................. 21 Event Recorder..................................................................................................................................... 21 Train Line............................................................................................................................................. 23 End-of-Train Device ............................................................................................................................ 24 Head-End Device ................................................................................................................................. 24 Train Dynamic Analysis Simulation.................................................................................................... 25 Metallurgical ........................................................................................................................................ 25 Hazardous Materials Information............................................................................................................... 28 Chemical Release ................................................................................................................................. 28 Chemical Product Descriptions............................................................................................................ 28 Local and State Emergency Response Agency Notifications .............................................................. 29 Chemical Shipper Notifications ........................................................................................................... 30 Derailed Tank Car Damage Assessments ............................................................................................ 31 Butyl Acrylate Tank Car ...................................................................................................................... 34 Pipeline Information ................................................................................................................................... 35 Environmental Information ........................................................................................................................ 36 Other Information ....................................................................................................................................... 37 Federal Railroad Administration.......................................................................................................... 37 Atchison, Topeka and Santa Fe Railway Company............................................................................. 38 iii ANALYSIS General Factors........................................................................................................................................... 41 Accident Narrative Review ........................................................................................................................ 41 Train Line Continuity Loss ........................................................................................................................ 42 Kinked Air Hose .................................................................................................................................. 43 Closed Angle Cock .............................................................................................................................. 44 Foreign Object or Debris...................................................................................................................... 45 Two-way End-of-Train Device Operation.................................................................................................. 46 Federal Railroad Administration Oversight......................................................................................... 46 Railroad Industry Inaction.................................................................................................................... 47 Management Oversight ........................................................................................................................ 47 Operating Crew Training ..................................................................................................................... 49 End-of-Train Device and Head-End Device Operation.............................................................................. 49 Event Recorder Maintenance and Placement ............................................................................................. 50 Tank Car Performance................................................................................................................................ 54 Hazardous Materials Management ............................................................................................................. 55 Shipper Notification and Coordination................................................................................................ 55 Tank Car Identification ........................................................................................................................ 57 Derailed Tank Car Handling and Damage Assessments...................................................................... 58 Pipeline Operation ...................................................................................................................................... 60 Operator Notification ........................................................................................................................... 60 Operator Response ............................................................................................................................... 61 Environmental Impact................................................................................................................................. 61 CONCLUSIONS ......................................................................................................................... 62 PROBABLE CAUSE .................................................................................................................. 64 RECOMMENDATIONS ............................................................................................................ 64 APPENDIXES Appendix A--Investigation and Hearing .............................................................................................. 67 Appendix B--Qualifications of Hazardous Materials Response Personnel ......................................... 69 Appendix C--Train Consist .................................................................................................................. 71 Appendix D--Federal Railroad Administration Form F-6180-49A ..................................................... 73 Appendix E--Rules and Regulations for End-of-Train Device ............................................................ 75 Appendix F--Train Dynamic Analysis Simulation Protocol................................................................ 79 iv EXECUTIVE SUMMARY About 4:10 a.m. on February 1, 1996, Atchison, Topeka and Santa Fe Railway Company (ATSF) freight train H-BALT131, en route from Barstow, California, to Los Angeles, was traveling westbound on the ATSF south main track when it derailed at milepost 60.4 near Cajon Junction, California. After the derailment and the subsequent rail car pileup, which involved five cars containing hazardous materials, a fire ignited that engulfed the train and the surrounding area. The conductor and the brakeman sustained fatal injuries; the engineer suffered serious injuries. The National Transportation Safety Board determines that the probable cause of the derailment of freight train H-BALT1-31 was an undetermined restriction or blockage that prevented the traincrew from achieving and maintaining adequate train braking force and also the lack of adequate Federal Railroad Administration and industry, specifically the Atchison, Topeka and Santa Fe Railway Company, regulations, policies, procedures, and standards to consistently utilize two-way end-of-train devices as a redundant braking system to protect trains from catastrophic brake system failure. The major safety issues discussed in this report are the lack of Federal and management oversight in the use of twoway end-of-train devices, the adequacy of operating personnel training in the use of two-way end-of-train devices, the carrier compliance with Federal regulations for event recorders, and the adequacy of wreckage removal operations for tank cars containing hazardous materials. The report also discusses safety issues relating to standards for brake pipe configurations, crashworthiness and occupant survivability, and emergency response and evacuation. As a result of its investigation of this accident, the National Transportation Safety Board makes recommendations to the Burlington Northern and Santa Fe Railway Company, Federal Railroad Administration, Association of American Railroads, International Association of Fire Chiefs, and Chemical Manufacturers Association. v ACRONYMS AAR ATSF BN BNSF Calnev CHEMTREC CHP CMA COES CPUC DOT EPA ETD FRA HED IC I-15 MM MP NPRM NRC POD ppm psi psig R&H RLM RSPA SBCC SOC SR-138 TRANSCAER Association of American Railroads Atchison, Topeka and Santa Fe Railway Company Burlington Northern Railroad Company Burlington Northern and Santa Fe Railway Company Calnev Pipe Line Company Chemical Transportation Emergency Center California Highway Patrol Chemical Manufacturers Association California Office of Emergency Services California Public Utilities Commission U.S. Department of Transportation Environmental Protection Agency end-of-train device Federal Railroad Administration head-end device incident commander Interstate 15 milemarker milepost notice of proposed rulemaking National Response Center point of derailment parts per million pounds per square inch pounds per square inch gauge Rohm and Haas Company receiver logic module Research and Special Programs Administration San Bernardino (County) Communications Center System Operations Center State Route 138 Transportation and Community Awareness and Emergency Response vi INVESTIGATION Accident Narrative About 4:10 a.m., Pacific standard time, on February 1, 1996, westbound Atchison, Topeka and Santa Fe Railway Company1 (ATSF) freight train H-BALT1-31 derailed near Cajon Junction, California. (See figure 1.) The point of derailment (POD) occurred at milepost (MP) 60.4 on the ATSF south main track, southern California division, Cajon subdivision. HBALT1-31 consisted of 4 locomotives and 49 rail cars traveling from Barstow, California, en route to Los Angeles with a traincrew of an engineer, a conductor, and a brakeman. A fire resulted from the derailment and the subsequent car pileup, which involved five cars containing hazardous materials, and the immediate area was evacuated. The conductor and the brakeman sustained fatal injuries; the engineer incurred serious injuries. Barstow and Los Angeles were the designated away-from-home and home terminals, respectively, for all three H-BALT131 crewmembers. The traincrew, having been off duty for 12 hours 50 minutes, had reported for duty at the ATSF yard in Barstow at 5 p.m. on January 31, 1996. They were instructed not to couple the locomotive consist to the train because a yard crew was connecting car ATSF 90033, following its repair, to the train cars. Car ATSF 90033 was joined onto the train as the 16th car from the head end, and the crew then coupled the locomotive consist to the westernmost car on the track. The engineer said that after the locomotive consist was coupled to the train, a carman informed the crew that the car department needed to inspect and to test the air brakes on car ATSF 90033. The test of the ATSF 90033 air brakes was done in conjunction with the initial terminal air brake test. The engineer stated that he performed the initial terminal air brake test with the assistance of a carman, who was at the rear of the train. The engineer continued that after the train line2 was fully charged with air, about 86 pounds per square inch (psi), at the rear of the train, he reduced the train line air pressure by 20 psi and noticed that the head-end device (HED) indicated that the air pressure reading on the end-of-train device (ETD) had decreased accordingly. Located in the locomotive control compartment, the HED displays the brake pipe pressure being transmitted from the ETD on a digital read out and activates the red rear-end marker light. This multipurpose receiver will indicate whether an attempt to “arm” the twoway function on the ETD was successful. When attempting to arm the ETD, an individual at the rear of the train tells the engineer the ETD number, which the engineer enters on the HED key pad. The individual at the rear of the train then pushes the test button, and the engineer waits for the ready-to-arm message to then press the arm button. The message indicates that the ETD is armed after the link is made. The battery-powered ETD is mounted to the rear coupler on the last car of the train, and an air hose connects the ETD to the brake pipe. The one-way ETD has a pressure transducer to monitor the brake pipe pressure and a flashing red marker light to protect the end of the train. A two-way ETD provides the same functions as the one-way ETD except it additionally has the capability of venting the brake pipe for applying The Burlington Northern Railroad Company (BN) and the ATSF merged on October 1, 1995, and formed the Burlington Northern and Santa Fe Railway Company (BNSF). The BN and the ATSF operated independently under the BNSF at the time of the derailment. 1 2 The continuous line of brake pipe extending from the locomotives to the last car in a train with all cars and their air hoses coupled. However, the term is often used to refer to the brake pipe on a single car. San B e r n a d i n o County o Junction point of for 138 Los Angeles San Bernardino Not to scale Source: National Transportation Safety Board Figure I.--Map of California and area of freight train H-BALTI-31 derailment 2 emergency brakes. The signal to vent the brake pipe comes from a starter switch on the HED controlled by the engineer. The advantage of applying emergency brakes from the rear of the train is that any blockage in the brake pipe would be bypassed and braking would occur at both the front and rear of the train simultaneously. The engineer had waited about 1 minute and then did a leakage test, noting the train line leakage was 2 pounds per minute meeting the requirements under 49 Code of Federal Regulations (CFR) 232.12. After the leakage test, the engineer released the train air brakes, and the air pressure at the rear of the train, as indicated by the ETD, returned to 86 pounds. The engineer then informed the carman at the rear of the train that he intended to make an emergency brake application to test that feature of the train brakes. He initiated the emergency brake application from the automatic brake valve3 on the locomotive, and according to the carman, the emergency brake application propagated through the train. The engineer released the brakes, and the air pressure on the ETD returned again to 86 pounds. One of two carmen who were near car ATSF 90033 said that he observed the brakes set and release on the car during the first part of the air test. During the air brake tests with the assistance of the carman at the rear of the train, the engineer also attempted to arm the two-way telemetry feature on the ETD. The engineer stated that he received a "com/test/fail" error message on the HED on the locomotive during the ETD arming procedure. He informed the carman of this error message, and the carman responded, "Okay." The engineer said that they had no further conversation about the ETD. Because of a mudslide in the Cajon area, the ATSF management decided to hold H-BALT131 at the Barstow yard, and the traincrew was taken off duty at 7:30 p.m. The engineer said that before leaving the train, he had applied its air brakes by reducing the brake pipe pressure by approximately 20 pounds. The engineer resided in the nearby town of Newberry Springs, California, and went home; the other two crewmembers returned to the motel. The traincrew was recalled for duty at 11:45 p.m., and another set and release, initiated from the head end of the train, was performed on the air brake system. The braking system was charged for 3 minutes 6 seconds, and then a 12 psi reduction was made. About 1:17 a.m. on February 1, 1996, HBALT1-31 with its 4 locomotives and 45 loaded and 4 empty rail cars departed Barstow and proceeded to and stopped for 30 seconds at Hodge, California, (MP 13.6). The event recorder data indicated that a 7-pound reduction was made to the automatic air brakes of the train. H-BALT1-31continued west and did not stop until 2:30 a.m. at Victorville, California, (MP 36.7). The event recorder registered the use of its automatic air and dynamic brakes. The engineer said he believed that using the air brakes to stop at Victorville complied with the timetable instruction requiring him to make a "running" air brake test at that location and that the air brakes were operating properly at that time also. After 5 minutes 17 seconds at Victorville, H-BALT1-31 continued on to and arrived at Summit, California, (MP 55.9) at 3:40 a.m. (The engineer did not recall making a stop at MP 50.1 [Lugo, California].) The engineer stopped at Summit by using the train air brakes, and the train remained there while the crew waited for a permissive signal permitting them to proceed westward. The engineer said that the conductor and the brakeman were sitting in the cab with him. The engineer stated that after receiving a permissive signal, he made at least a 10-pound brake pipe reduction, as required by timetable instruction. The engineer continued that he moved the three-position cut-out valve from the freight position to the passenger 3 Draws air from the atmosphere and stores it under pressure. Reducing and increasing the brake pipe pressure results in the brakes applying and releasing, respectively, regardless of how initiated. 3 position.4 At 3:50:08 a.m., the train brakes were released, the train brake pipe pressure was 86 psi 1 minute 42 seconds later. The throttle went from zero to one at 3:56 a.m. The engineer said that both the dynamic and the train brakes functioned as expected up to and including the stop at Summit. The engineer reported that H-BALT1-31 crested and began to descend the mountain and at Cajon Pass, he applied the dynamic brakes, “bunching”5 the train toward the engines. He also made a first-service brake application by reducing the brake pipe pressure between 5 and 8 pounds. The engineer noted that the speed of the train was increasing, and he applied more braking. The engineer stated that when the train reached the speed of 18 mph, he and the conductor were aware that the train was moving too fast. They were discussing what action to take when the engineer realized that the speed had reached between 20 and 21 mph, and he said that he wanted to “plug it.”6 The engineer stated that the conductor said, “No, let’s not plug it. Let’s make a full set on it, get it stopped.” The engineer continued that he then initiated a full-service brake application, immediately placing the train in emergency. At this time, the engineer noted that the HED was reading 81 psi on the rear of the train. He said that he put the train into emergency and the air pressure reading did not reduce to zero. The engineer stated that he radioed the ATSF dispatcher to warn all traffic ahead that HBALT1-31 was a runaway train. The engineer recalled that both crewmembers had stood and then proceeded down the steps in the cab to a door leading to the front of the locomotive and that the speed indicator now showed 45 mph. And he felt the wind coming through the front door. The engineer remained in the cab and continued the attempt to stop the train. The event recorder registered that the brakes were charged to 40 pounds and reapplied 8 seconds later. The engineer reversed the engines7 about 7 seconds later, felt the lead locomotive tilting to the right, and then crouched down. The locomotive left the track on the curve at MP 60.4 about 4:10 a.m. After rolling onto its right (engineer's) side into a dry creek bed, it slid to a stop on the sand and came to rest, (see figure 2) without striking anything, south and west of an ATSF trestle. (See figures 3 and 4.) The engineer, who had sustained serious injuries, crawled out of the cab through the window on the left (fireman's) side of the locomotive to reach the ground. Then, hearing someone call on the cab radio, he climbed back into the cab to answer to the call. Two local residents arrived at the locomotive and then assisted the engineer from the cab. The four locomotives and 45 of the 49 cars derailed, and H-BALT1-31 was compressed into a 400- to 500-foot long pileup of cars. (See figure 5.) Five rail cars in the pileup contained hazardous materials. (See figure 6.) In addition, two underground pipelines, which transported petroleum products, were near the derailment site. A fire ignited after the derailment, and the center of the pileup and the surrounding area were engulfed in flames. Sand in the creek bed around the derailed cars north of the trestle and for 0.5 mile south of the trestle was burned. The conductor and the brakeman, who had sustained fatal injuries, were found, respectively, partially buried in the sand 20 feet south and 30 feet west of the trestle and lying in the burned sand creek bed 30 feet south and east of the trestle. The passenger position is designed for a graduated air brake release on passenger trains. The rail cars pushing together that occurs when the slack is taken out of the train. Railroad jargon for placing the train into emergency application. 6 5 4 The action in some locomotives seizes the traction motors, locking the axles. 7 4 Formerly Southern Pacific Lines now Union Pacific double Tracks ATSF February 1996 point of derailment If back ATSF south track SR 13s 138 track Not to scale Source: National Transportation Safety Board Formerly Southern Pacific Lines now Union Pacific double tracks Figure 7.--Freight train H-BALT1-31 derailment site 8 The State forestry and fire protection department division (service area 38) fire chief10 was dispatched from his residence, 20 miles from the accident, at 5:15 a.m. and was on scene at 6:14 a.m. He reestablished the SR-138/I-15 command post at the Mormon Rocks U.S. Forest Service fire station, which was 1 mile from the accident scene (see figure 7), at 6:47 a.m. and, as the Incident Commander (IC), managed the incident, using the incident command system,11 to its completion. An IC deputy, an incident safety officer,12 an operations chief, and a hazardous materials expert were assigned to assist him. In addition, 33 agencies, representing Federal, State, county, and local authorities, with access to resources were available to assist as consultants. joint decision with others, stopped fighting the fire. The firefighters monitored the situation and attempted to cool the rail cars with water while the cars continued to burn between February 1 and 4. The South Coast Air Quality Management District was also at the site of the derailment taking air and soil samples for analysis. About 12:20 p.m., the management district air quality test results indicated that the toxins from the burning wreckage were no longer at a dangerous level. The IC advised that the roads be reopened at 2 p.m.; however, SR-138 between I-15 and SR-2 would remain closed to the public until noon on February 4 to allow the heavy construction and emergency equipment to safely enter and exit the scene for the initial decontamination and removal of debris. At 2:30 p.m., the IC estimated that approximately 90 percent of the train had burned out and, in a At 10:30 p.m. on February 4, the State forestry and fire protection department, together with the ATSF, identified a damaged derailed tank car (NATX 82129), containing the flammable liquid butyl acrylate, that was found to have an increasing internal temperature. Because of the potential for the tank car to explode from the overpressurization, I-15 and SR-138 were closed again at 11:01 p.m. On February 5 at 9:44 p.m., the tank car was ventilated by using plastic explosives and was no longer regarded hazardous to the public; therefore, I-15 and SR-138 were reopened at 11:47 p.m. on February 5 to the public. On February 5, 1996, the State forestry and fire protection department considered the complete incident terminated and suspended command post activities. The notification of and coordination between the railroad, emergency responders, and chemical shippers about the released hazardous materials and the wreckage clearing operations involving the tank cars, as well as the environmental monitoring and impact, are addressed later in the report. For qualifications in hazardous materials response, see appendix B. 11 Combined facilities, equipment, personnel, procedures, and communications operating in a common organizational structure under management responsible for assigning resources to effectively accomplish the stated incident objectives. 12 10 See appendix B for qualifications in hazardous materials response. 9 Injuries* Table 1.--Injuries incurred from accident TYPE Fatal Serious Minor Total TRAINCREW 2 1 0 3 OTHERS** 0 0 32** 32 TOTAL 2 1 32 35 *Based on the injury criteria (49 CFR 830.2) of the International Civil Aviation Organization, which the National Transportation Safety Board uses in accident reports for all transportation modes. **21 police officers, 8 California Transportation Department personnel, and 3 civilians. Damages Estimates are quoted as of April 23, 1996. Equipment $ 3,672,294 Track 71,000 Signal 3,000 Environmental 3,734,044 Other 2,017,000 Total $ 9,497,338 records revealed that he was administered 157 observed efficiency tests, with one failure, in 1995, and 30 observed efficiency tests, with no failures, in 1996. The engineer, according to the ATSF records, underwent and successfully passed an initial comprehensive physical examination on July 21, 1991, and his most recent physical examination before the accident occurred on July 11, 1994. The engineer testified that he had not used alcohol or other drugs, including prescription or over-the-counter medication before the accident. Additionally, the engineer reported that he was not overworked when he departed the yard at Barstow on the evening before the accident. (He and his two crewmembers went off duty and on duty, respectively, at 4:10 a.m. and 5 p.m. on January 31, 1996. At the time of the accident, the three crewmembers had been most recently on duty for about 4 hours 30 minutes.) He said that he had no deadline for completing the trip. The engineer stated that with the exception of the inability to arm the ETD, train operations had not been affected by mechanical factors. He reported that he had previously operated trains over the track where the accident occurred about 200 times and had worked this particular assignment for about 8 months before the accident. Traincrew Information ATSF records indicated that each crewmember was qualified on the physical characteristics of the territory and the operating rules for trains over the southern California division. All had attended the instruction classes in 1995 on the General Code of Operating Rules. The 42-year-old engineer was hired on August 8, 1991, as a switchman and was promoted to conductor and to engineer, respectively, on September 18, 1992, and May 7, 1994. He attended locomotive simulator training in May 1994 and said that during the training, he had activated the simulator emergency brakes on several occasions in response to emergency situations. The ATSF 10 The 25-year-old conductor was hired on October 22, 1992, as a brakeman and was promoted to engine foreman and to engineer, respectively, on May 27, 1994, and February 18, 1995. He was administered 108 and 20 observed efficiency tests with no failures, respectively, in 1995 and 1996. The ATSF records also disclosed that the conductor underwent and successfully passed a preemployment medical examination, which included a drug test, on October 15, 1992. The 38-year-old brakeman was hired as a switchman and was promoted to conductor, respectively, on August 2, 1993, and April 7, 1995. The ATSF administered him 155 and 35 observed efficiency tests with no failures in 1995 and 1996, respectively. According to ATSF records, he successfully passed a preemployment physical examination, which included a drug test, on June 2, 1993. sequence, which establishes the two-way communications and links the HED to an ETD, enabling the two to communicate only with each other and not to conflict with other systems on other trains. He further testified that his knowledge resulted from being “verbally instructed” in 1994 by the manager of training operations in how the HED and the ETD functioned as well as from reading written material in 1995. He added that he had never seen an ETD training video and was not aware of any formal ETD training program offered by the carrier. The director of train handling and the superintendent of field operations in San Bernardino for the ATSF stated that before the accident, the carrier ensured that its road foremen understood the correct procedures for operating a two-way ETD. The road foremen were evaluated on their ability to instruct employees who viewed the video that demonstrated the proper procedures for HED and ETD operation. Since the accident, the ATSF has constructed a fully functional demonstrator that allows hands-on training of both the control HED and the ETD and requires all operating personnel to participate in this training. (Safety Board investigators have observed the demonstrator at the Barstow terminal.) This demonstrator is used in addition to road foremen showing the instructional videos and answering questions. Feedback and additional training are still offered, as needed, and the carrier has created a brochure that outlines the correct procedures for operating personnel to follow should further guidance be necessary. In addition, the director of train handling stated that since the accident, operating crewmembers are required to successfully demonstrate their understanding of arming procedures in their daily operations. One ATSF road foreman of engines recalled asking the engineer assigned to H-BALT1-31 whether he had any problems arming the twoway ETD, and the engineer, according to the road foreman, had no questions about the device during that conversation. However, the road Traincrew End-of-Train Device Training The vice president of operations for the ATSF stated that the training department is responsible for developing appropriate procedures for any task and for distributing the procedure material to the transportation department, which provides instruction or training. The ETD training for operating personnel before February 1, 1996, consisted of instructional videotapes; printed operation procedure material, distributed separately; and the written instructions presented in the ATSF general orders and timetables. Round-the-clock safety meetings also addressed ETD use. Engineers received additional training at the ATSF Lenexa, Kansas, training center in the use of the HED/ETD system, which included, as part of locomotive simulations training, activating the emergency braking function. The H-BALT1-31 engineer testified that he knew how to arm a two-way ETD before the accident. The two-way telemetry system must be armed for two-way operation through an arming 11 foreman was unable to recall when that conversation had occurred. In addition, the road foreman had observed the conductor assigned to H-BALT1-31 successfully arm a two-way ETD on one occasion in 1995 and stated that the conductor would have received ETD training in the engineer training program and ETD information with a January 1996 train brake system class. The road foreman said that he was unable to state whether the brakeman assigned to H-BALT1-31 had received any training about arming a two-way ETD or any H-BALT1-31 crewmember had seen the ETD videos. Before February 1, 1996, the carrier lacked a procedure to record the training class attendees. The road foreman stated that although crewmembers were required to attend various training classes, they were not required before this accident to record their attendance. The vice president of operations said that since the accident, the carrier has implemented a comprehensive procedure to document attendance at the ETD training. The director of train handling stated that operating employees are also required since the accident to successfully demonstrate their understanding of “arming” procedures in daily operations. The Safety Board queried several class I railroads, including the Consolidated Railroad Corporation, the CSX Transportation Inc., and the Southern Pacific Lines about the established (post-March 1996) ETD training programs for operating personnel. The training methods of two carriers which responded included a video presentation and written materials for the personnel; a third carrier provided a quick reference guide to its operating personnel. In addition, one carrier which responded indicated that it will incorporate arming an ETD into its efficiency testing program. trains. It consisted of a 4-unit locomotive, 45 rail cars loaded with miscellaneous merchandise, and 4 empty freight cars. The four-unit locomotive included ATSF 157; ATSF 3853; ATSF 342, which was the only unit equipped with an event recorder; and ATSF 4031. (For a detailed consist, see appendix C.) The locomotive units were equipped with 26L schedule brake equipment. The train had at least the minimum number of operative dynamic brakes, 102.6 tons per operative brake.13 All brakes were inspected and operative, according to an ATSF carman, when the train left Barstow. The lead locomotive, ATSF 157, was equipped with a new safety control compartment, designed in part by the ATSF, that included a desktop control console on the right (engineer's) side and two adjustable seats, one behind the other, for the conductor and the brakeman on the left (brakeman’s) side. This control compartment design was introduced on the ATSF in May 1990. The forward entrance of the locomotive was a heavy metal windowless door on the right side of the front wall. This exterior door opened onto a small vestibule in which an interior door and two steps led to the control compartment. The rear entrance had a door with a fixed upper vertical window at the right rear of the control compartment behind the engineer's seat. The third locomotive unit was equipped with a Q-tron Ltd. DATACORD 3000 model Q888208/01 event recorder. The Federal Railroad Administration (FRA) regulations require the lead locomotive unit on trains operating at speeds greater than 30 mph to be equipped with an event recording device. The event recorder placement, however, did not violate the existing regulation, according to the FRA, which noted that 49 CFR 229.135(a) states, “the duty to equip the lead locomotive may be satisfied with an event recorder located elsewhere than the Train Information H-BALT1-31, which originated at Barstow, was 3,218 feet long with 5,025 trailing tons and had been formed from the cars of other inbound Tons per operative brake is the gross trailing tonnage of the train divided by the total number of cars having operative brakes. 13 12 lead locomotive provided that such event recorder monitors and records the required data as though it were located in the lead locomotive.” Safety Board investigators found an FRA form F6180-49A, known as a blue card, on locomotive unit ATSF 342. On this form is recorded when certain parts of the engine were inspected and by whom. (See appendix D.) According to 49 CFR 229.135(a): The presence of the event recorder shall be noted on Form F6180-49A, under the REMARKS section, except that an event recorder designed to allow the locomotive to assume the lead position only if the recorder is properly functioning is not required to have its presence noted on Form FRA F6180-49A. The carrier is to note in the remarks section on this form whether the engine is equipped with an event recorder. No evidence of this engine being equipped with an event recorder was on this form. Initially, according to the ATSF assistant vice president for technical training and rules, the ATSF policy was to equip all evennumbered locomotives with event recorders. An ATSF study had previously determined that, with 94-percent probability, at least one event recorder-equipped locomotive would then be in every four-unit locomotive consist. (Several odd-numbered locomotives in the ATSF fleet were equipped with event recorders.) Beginning with the delivery of the ATSF class (GE CW449) locomotives, all delivered locomotives were equipped with event recorders. Both the ATSF and the BN current policy is that all new, delivered locomotives have event recorder capability. On February 1, 1996, no Federal regulation required the use of an ETD with the two-way feature for trains traveling westward through Cajon Pass. H-BALT1-31 was equipped with a two-way ETD but had no caboose, and neither were required. (See appendix E for ETD rules and regulations.) With the issuance of the FRA emergency order 18, effective 12:01 a.m., on February 8, 1996, two-way ETDs were required for all westbound trains operated by the ATSF traversing the Cajon Pass. The carrier was required to ensure that it is possible for the traincrew to effect a brake application from the rear of the train by using one of the following methods: a) a two-way ETD, b) an occupied helper locomotive, c) an occupied caboose at the rear of the train, or d) a radio-controlled locomotive in the rear third of the train. Three of the 14 tank cars on H-BALT1-31 were empty, and 11 tank cars contained chemical products. Butyl acrylate (NATX 82129), trimethyl phosphite (GATX 37310), denatured alcohol (MWSX 29654), and methyl ethyl ketone (CELX 2374) are classified under the U.S. Department of Transportation (DOT) hazardous materials regulations as flammable liquids.14 Naphtha solvents (ACFX 79907) were shipped under DOT regulations as combustible liquid.15 Petroleum oil (ECDX 792140) was classified as a hazardous substance (environmentally harmful material) by the U.S. Environmental Protection Agency (EPA) under the provisions of the Comprehensive Environmental Response, Compensation, and Liability Act. Calcium chloride solutions (ACFX 84070 and ACFX 84855), propylene As defined at 49 CFR 173.120, flammable liquids have a flash point of not more than 141oF or are any material in its liquid phase with a flash point at or above 100oF that is intentionally heated and offered for transportation at or above its flash point in a bulk container. The flash point is the minimum temperature at which a liquid gives off vapor within a test vessel in sufficient concentration to form an ignitable mixture with the air near the surface of the liquid. Any liquid that does not meet the definition of any other hazardous class and has a flash point above 141oF and below 200oF. As defined at 49 CFR 173.120(b), certain flammable liquids also may be shipped as combustible liquids for highway and rail transport. 15 14 13 glycol (DOWX 3965), plasticizers (GATX 13571), and petroleum lubrication oil (UTLX 79897) were not regulated under the DOT hazardous materials regulations. Eleven of the 12 tank cars that derailed were DOT specification 111A100W1 or 111A100W3 tank cars ranging in capacity from 8,000 gallons to 30,000 gallons. The thickness of the tank shells and tank heads on these tank cars was typically 7/16 inch, and in one or two instances, 15/32 inch. Eight of these tank cars (DOWX 3965, ECDX 792140, GATX 13571, GATX 18211, GATX 37310, UTLX 41411, UTLX 41424, and UTLX 79897) were insulated and jacketed. The insulation typically was about 4 inches thick. The steel jackets typically are about 1/8 inch thick and hold the insulation in place. None of the 11 DOT specification 111A100W1/3 tank cars were equipped with head shield protection, but all were, as required, equipped with vertical restraint couplers. The remaining (12th) tank car that derailed, NATX 82129, was a DOT specification 105J300W tank car operating under DOT exemption E-11184 that permitted a safety relief valve set to discharge at 75 pounds per square inch, gauge (psig), rather than the required 225 psig. The tank, with a test pressure of 300 psig, had a shell thickness of 9/16 inch and heads 19/32-inch thick. The tank was covered by 4 inches of fiberglass and ½ inch of ceramic fiber as thermal protection and a 1/8-inch steel jacket. The tank car also had ½-inch full head shield protection and vertical restraint couplers. Car ATSF 90033, the 16th and last car of the train added in Barstow, was a heavy-duty flat car, which had been loaded with steel pipe on January 19, 1996, in East St. Louis, Missouri. It had end-of-car cushioning devices16 rather than conventional draft gear behind the couplers. Car ATSF 90033 was bad ordered17 between January 22 and 24 in Kansas City, Kansas, for repairs, which were made to the brake pipe on the “A” end. The car continued on to Barstow, where it was bad ordered for the cushioning unit on the A end and later for damage to the brake pipe on the “B” end.18 The cushioning unit was determined to be serviceable by the Barstow repair track foreman based on FRA criteria, and a piece of the brake pipe on the B end was replaced. The replaced brake pipe was 46.5 inches long with a kink on the inboard end. The brake pipe connected the glad hand hose19 to the flexible armored hose. The foreman stated that a 59-inch pipe was cut and attached in the same manner as the hose arrangement found on the A end of the car. When the foreman was asked whether he had access to any reference manual for the air hose arrangement repair on cushioned underframe cars, he said that no such reference was available at his facility and that the B end of car ATSF 90033 was repaired to match its undamaged A end. Track and Signal Information The tracks at the POD MP 60.4 are designated as south and north tracks. The grade, approaching and at the POD, is, respectively, a 3-percent and 1.73-percent descending from east to west. At the POD is a 7-degree 40-minute 59second curve. Train turn-over speed was calculated at a minimum of 70 mph. The south track, on which the train traveled, was constructed with 136-pound RE section continuous welded rail and was laid in 1980 on concrete ties with Pandrol fastenings. The ties laid in crushed area 24 granite ballast, extending 8 or more inches below the ties, with full tie cribs and shoulder ballast, extending 12 or more Identified by a car inspector as needing mechanical attention or repairs. 18 Rail cars are identifed as having A and B ends. The hand brake is on the B end. 17 Hydraulic shock absorbers designed to absorb shock during train yard impacts. 16 A section of the train line system at which the hose has a quick release coupling. 19 14 inches beyond the tie ends. The track had been inspected on the day before the accident by a qualified track inspector riding a high-rail vehicle, and no anomalies were noted or reported. The main track structure, not damaged or destroyed in the accident, met or exceeded the FRA minimum requirements for class 4 track.20 The Centralized Traffic Control System from the computer-assisted dispatching center in Schaumburg, Illinois, controls train movements through the section of track at the accident site. The signals and signal system were checked and tested 2 days before the accident. An adjustment was made to the switch circuit controller at MP 62.9; no other anomalies were found or noted. and determine from end of train device that brake pipe pressure drops rapidly to zero. Rule 30.13: If train is stopped at Summit for any reason, an automatic brake application of not less than 10 psi must be made and not released until ready to proceed. Rule 30.14: At Summit, westward….freight trains operating between Summit and Cajon must make a running air brake test while passing Victorville and in doing so determine the following: (1) Retarding force of air brake system. (2) If equipped with a functioning ETD, that normal brake pipe pressure changes occur at rear of train. Air brake rule 30.27, as amended, of the timetable contained instructions for testing a two-way ETD and verifying its operation. (See appendix E.) Guidelines for reporting failures of the ETDs were under rule 67 of the general orders. The timetable contained no procedure to follow should the two-way ETD fail the test in the two-way mode or not be operational. The director of train handling testified that after the December 1994 Cajon Pass accident21 at MP 61.55 (see figure 7), the ATSF had committed to install two-way ETDs and receiving units on its locomotives, as the equipment became available from manufacturers. As a result of the Safety Board investigation of the 1994 collision, the Safety Board recognized the following safety Operations Information According to the ATSF, between 70 and 90 trains in both directions pass through the Cajon area daily. The movement of trains, controlled by the Centralized Traffic Control System, over the territory is governed by the ATSF timetable instructions, operating rules, and general orders. The ATSF system timetable no. 5, effective 12:01 a.m. April 16, 1995, was in effect at the time of the accident. Based on the timetable, the maximum permissible speed for H-BALT1-31 between Summit and Cajon was 15 mph and between Cajon and San Bernardino was 20 mph. The timetable contained the following air brake instructions (see appendix E): Rule 30.6, 30.7, 30.10, 30.11: All westward trains at Barstow receiving an Initial Terminal, Intermediate Inspection, Application and Release or Adding Cars Enroute Air Brake Test must, after completion, initiate an emergency application of the brakes At 49 CFR 213.9, maintained to accommodate passenger and freight trains at maximum allowable speeds of 80 and 60 mph, respectively. 20 Railroad Accident Report--Rear-End Collision of Atchison, Topeka and Santa Fe Railway Freight Train PBHLA1-10 and Union Pacific Railroad Freight Train CUWLA-10 near Cajon, California, on December 14, 1994 (NTSB/RAR-95/04). 21 15 accomplishments for ATSF management implementation: 1. Issue systemwide instructions prohibiting the use of the feed-valve braking. 2. Expedite the installation and use of two-way EDT devices. 3. Require an emergency brake application test for any westbound train that receives an initial terminal, intermediate, or application/release test or that has cars added at Barstow. 4. Require each westbound train operating on the Cajon subdivision to make a running air brake test according to the rules before descending Cajon Pass. 5. Establish an additional assistant superintendent of field operations position and two additional manager of training operations positions to ensure compliance with the above train handling and testing rules. 6. Inventory all rubber air brake parts for outof-date components and removed those with expired dates. 7. Suspend temporarily the operation of fivepack double stack trains down grades of 3 percent or more. 8. Issue temporary instructions requiring helper locomotives on train consists of fivepack double-stack cars that exceed over 100 tons per operative brake and 250 tons per dynamic brake on the north Cajon track and 80 tons on trains on the south Cajon track. In a letter to the Safety Board, dated October 30, 1996, the ATSF noted that the following management processes for operations had been implemented since December 30, 1994, and before February 1, 1996: 1. Before departure, trains, which have been made up or had power changes in Barstow, are placed in emergency braking to verify brake operation. 2. En route, between Lenwood, California, (MP 6.7) and Lugo, running air brake tests are made to verify that the brakes are operational. 3. If the train is stopped at Summit, a minimum brake pipe reduction of 10 psi is required. 4. To increase management oversight and assist on-site training, more line supervision (road foreman of engines) has been added. 5. On the use of ETD two-way mode, training has been supplemented to include printed material, increased rule promulgation, additional road foremen to ride with crews, and a video featuring two-way operation of ETDs. 6. Form 1717 (evaluation for engineer compliance with part 240 recertification) has been revised to include a test on the understanding of two-way ETD operation. 7. Additional two-way ETD equipment is to be purchased, as available from manufacturers. 8. Air brake seminars conducted for engineers in Los Angeles. At the time rule 30.27 was amended, the carrier had not procured enough units to equip all trains. The director of train handling said that a crew could, therefore, operate a train down the grade at Cajon Pass without an operational twoway ETD or other method of initiating an emergency brake application from the rear of the train. According to the director of train handling, Generally, the operating practices— anything that affects operations, pertain to operating practices, we have a—we offer it and then we propose it and circulate it around between the SOC staff and the training center staff, director of rules. He added that the executives reviewed the rules and put their stamp of approval on them before any one was issued. 16 The vice president of operations stated that when ATSF began the accelerated purchasing and installing of two-way ETDs, upper-level managers had the “intent” to ultimately equip all westbound trains traversing Cajon Pass with operational devices. When the vice president of operations was asked whether any follow-up procedure was initiated after December 1994 to ensure that the intent was met, he replied, Other than the instructions that were in place, no, there wasn't any other formalized follow up in terms of anything done other than what was done here on the division itself. In other words, there was nothing done other than the issuing of the instructions that we've talked about. The vice president of operations added that since February 1, 1996, the ATSF has initiated a follow-up procedure that ensures front line management is complying with the intent of senior management, and he said, It is mandatory that the train cannot leave Barstow westbound over Cajon Pass without a working two-way device, period. If that device fails in route prior to descending the grade at Summit, then the device is either repaired in route or helpers are added. And those procedures are enforced and followed up. The ATSF has also contracted for a management follow-up audit. The operation and display of one- and twoway ETDs were not required under the CFR but were explained in general order 126, effective April 16, 1995. (No requirement was in effect that the two-way feature be operational before H-BALT1-31 departed Barstow on February 1, 1996.) General order 130, also issued on April 16, 1995, amended general order 126 and stated: Should conditioning 2-way ETD for emergency application capability be unsuccessful, train may still be operated without 2-way capability as long as pressure comparison between control head readout and rear unit ETD does not exceed 3 psi. In addition, rule 67 (B) in the general orders states: Engineers departing or arriving can test their ETD display to verify proper operation of the ETD receiver. Improper operation must be reported to the Train Dispatcher and Customer Quality Support. Also, under (D) of rule 67: All inoperative ETDs ETMs [end of train markers] should be reported to the mechanical coordinator desk in the System Operations Center, Schaumburg, [Illinois] via radio (tone call-in no.4) or phone (821-6800) furnishing location, number of device, train ID or yard engine number. When the engineer was asked whether he was aware in Barstow of any instruction explaining what to do if the two-way ETD was not operational or of any prohibition to operate a train without an operational two-way ETD, the engineer replied, “No, sir.” Also, when asked whether he had taken a train out of Barstow without an operational two-way ETD, the engineer answered, “Yes, sir.” Meteorological Information Weather observations at 3:46 a.m. from the Ontario, California, airport about 14 nautical miles west of Cajon reported a temperature of 53°F, calm winds, cloudy skies, rain showers, and fog with 3-mile visibility. According to the engineer of H-BALT1-31, it was raining at the time of the accident. 17 Medical, Pathological, and Toxicological Information The engineer of H-BALT1-31 was transported after the derailment to San Bernardino Community Hospital, admitted on February 1, 1996, at 5:32 a.m., and released on February 12, 1996. He suffered multiple complex facial lacerations and a compression fracture of the lumbar spine. Autopsies were performed on the conductor and the brakeman by the San Barnardino County Office of the Medical Examiner. The conductor suffered blunt head and torso injuries, fracture of the left femur and upper and lower extremities, and contusions and abrasions. No evidence of major or blunt force trauma was found in the autopsy of the brakeman. He received massive burns, and soot was present in the upper and lower airways of his lungs. The toxicology test results for the brakeman revealed 30-percent carbon monoxide saturation. Blood and urine specimens were taken by 6:23 a.m. on February 1 from the engineer at the San Bernardino Community Hospital. Specimens were taken from the conductor and brakeman by the San Bernardino County Office of the Medical Examiner by 2:53 p.m. on February 3. In addition, specimens were taken from the train dispatcher by 11:05 a.m. on February 1. The toxicology test results for each person were negative, with the exception of the brakeman, whose blood tested positive for ethyl alcohol at 0.012 w\v percent. cab. The collision post right of the corridor was bulged about 2 inches inward toward the center line; the collision post in the rest room on the other side was unaffected. The roof of the passageway, although depressed about 2.5 inches, and the walls were intact. Postaccident Train Examination Wheel Sets--On February 5, 1996, about 70 pairs of wheels from the derailed locomotives and cars were recovered from the wreckage, numbered for identification, and examined at the accident site. Most wheel sets could not be matched to any particular car. Investigators inspected the wheel sets for discoloration, metal flow, or other evidence of excessive braking. Wheels with bluing and other distinct patterns of significant wheel overheating were discovered during the investigation. Train Line--Each car control valve and brake system responds to brake pipe pressure changes. A blockage in the train line restricts a pressure drop beyond the blockage, and the brakes will not effectively apply. Brakes to the rear of the blockage will either not apply or apply weakly. Safety Board investigators examined the train line for possible sources of blockage, such as debris or objects, kinked22 air hose, or a closed angle cock.23 No evidence of debris or objects blocking the train line was found because of the wreckage and fire damage, which also hindered the investigation. Survival Aspects The control compartment windows of locomotive ATSF 157 were broken in front of the engineer’s seat on the right side (see figure 2), and the acoustical panel behind the seat was missing. No intrusion was apparent underneath the cab console, and the console appeared to be intact and fixed squarely onto its original mounting. Superficial damage with minor, localized denting about 6 inches deep and also abrasion evidence were on the right side of the Single sharp bend where interior diameter has collapsed at bend, thus, restricting or closing passage through hose. 23 Type of a 1.25-inch valve, either ball or plug design, at both ends of the brake pipe on locomotives and rail cars and used to control the admission of air to the brake pipe on individual cars. The free end is angled at 45 degrees and threaded to receive the air hose nipple. 22 18 About 60 percent of the structure of car ATSF 90033 (B end) without trucks was removed on February 5, 1996, from the wreckage and examined outside the contaminated area. Safety Board investigators found the cushioning device was burned and still inside the sill. The bottom of the car was cleared of all attachments including the end-ofcar air brake hose. A bent and flattened pipe trolley was still attached. No air hoses or attachments could be found that could be identified as belonging to car ATSF 90033. H-BALT1-31 had four other cars, the 5th and 11 through 13th, with some form of cushioned underframe. Because these cars and their air hoses were destroyed in the derailment and subsequent fire, investigators could not determine whether the cars had kinked air hoses or any other condition that would have restricted the train line. th of Investigation photography laboratory and showed the angle cock in the open position when the photograph was taken. The ATSF wrote the Safety Board on October 7, 1996, about its consultant’s findings on the car ATSF 92018. The carrier concluded that according to the findings, the angle cock on car ATSF 92018 had been “closed prior to the fire and closed prior to the derailment.” The Safety Board laboratory noted that this angle cock was in the closed position when the fire reached its location. On February 10, 1996, the EPA allowed the ATSF contractors on site. ATSF supervisors then notified the subcontracted wreckage clearing personnel to recover all angle cocks found at the scene. Two subcontractors were shown an angle cock on a box car in the debris, and when they returned to the wreck site entrance, they noticed a wrecked car (ATSF 92018) along the right-of-way, which had an attached angle cock. (See figure 8.) The subcontractors notified the ATSF supervisors about the angle cock. The supervisors observed that the angle cock was closed and instructed the subcontractors to retrieve it. This angle cock, which was the first of six angle cocks found in the closed position, was removed, decontaminated, and given to the supervisors. Two of the six angle cocks, one later matched with the B end of car ACFX 84070 and the one from car ATSF 92018, had sustained no major damage. A photograph of car ACFX 84070, taken by Safety Board investigators on February 3, 1996, revealed the B end of the car with the angle cock still attached. (See figure 9.) This photograph was enhanced at the Federal Bureau Tank Cars--Twelve of the 14 tank cars in the train derailed. (Of the two tank cars that did not derail, one was empty, and one contained methyl ethyl ketone, a DOT-regulated flammable liquid.) Three of the derailed tank cars (ACFX 84855, ACFX 84070, and DOWX 3965) were the 3rd, 4th, and 6th cars, respectively, behind the locomotives. The other nine derailed tank cars were between the 26th and 41st cars trailing the locomotives. Two of the 12 derailed tank cars (UTLX 41411 and UTLX 41424) were empty. Of the 10 loaded derailed tank cars, five contained DOT-regulated hazardous materials, and five held nonregulated products. (See table 2 for products and classification.) The paint and identification marks of the 12 derailed tank cars, except for ACFX 84070 and ACFX 84855, had been completely burned away. In addition to the fire and heat damage, the 12 tank cars sustained extensive impact damage, which included crushing, deformation, denting, creases, gouges, tears in the jacket, and punctures of the head and tank shells. The 11 DOT class 111A tank cars, including the seven tank cars with jackets, collectively sustained extensive impact damage, particularly crushing and deformation. Six of the DOT 111A tank cars had longitudinal crushing, deformation, and flattening that was in excess of 2 feet (between ¼ and ½ tank car diameter). One tank car was bent in half around a circumferential plane at the middle of the tank car. The tank heads on about six tank cars had 19 Table 2.--Derailed tank cars with lading TANK CARS ACFX 79907 ACFX 84070 ACFX 84855 DOWX 3965 ECDX 792140 GATX 13571 GATX 37310 MWSX 29654 NATX 82129 UTLX 79897 PRODUCTS Naphtha solvents Calcium chloride solution Calcium chloride solution Propylene glycol Petroleum oil Plasticizers Trimethyl phosphite Denatured alcohol Butyl acrylate Petroleum lube oil DOT CLASSIFICATION Class 3-combustible liquid Not regulated Not regulated Not regulated Class 9-hazardous substance. Not regulated Class 3-flammable liquid Class 3-flammable liquid Class 3-flammable liquid Not regulated punctures and ruptures with dimensions ranging from a 6- by 14-inch hole to a 5-foot per side triangular hole. About half of the vertical restraint couplers were missing, and most of the stub sills were bent, fractured, or deformed. Tank car NATX 82129, containing the butyl acrylate, had indications of exposure to heat and fire and impact damage over its entire surface. All paint and identification marks had burned away. The jacket had dents, tears, and punctures over the entire surface area, and large sections of the jacket were missing. The remaining sections of the jacket were removed by wreckage crews to examine damage to the tank. One tank head was dented in excess of 4 inches between the 12 and 1 o’clock positions. The second tank head had what appeared to be a small dent at the 8 o’clock position, slightly inward of the perimeter of the tank head. The hole in the tank from one of the two shaped charges was at the 1 o’clock position of the weld joint between this tank head and the tank shell. The barrel of the tank had scrape marks and indications of exposure to heat or fire (metal discoloration); no other damages were observed to the barrel of the tank. Both couplers were intact; however, both had been twisted or bent. Tests and Research Signals--Tests for grounds and shorts had been performed on the signals at Summit, on the intermediates at MPs 58 and 60, and on the electrical signals at Cajon, respectively, on January 12, 15, and 26, 1996. No anomalies were found. On January 29, 1996, the signal maintainer for the territory had inspected and tested the switch circuit controller at Cajon, MPs 62.8 and 62.9, and nos. 1 and 2. An adjustment had been made on the circuit controller at MP 62.9. No adjustments or anomalies were found at the other locations. The signal system was checked and tested on February 5, 1996, after the destroyed rail was replaced and the track placed back in service. The system operated as designed; no anomalies were found. Event Recorder--The event recording device from locomotive ATSF 342 was sent under Safety Board supervision to the Q-tron facility in Calgary, Alberta, Canada, where it was tested. (The Safety Board laboratory engineers received the event recorder and found that not all fields were recorded.) No speed or distance data could be calculated from the event recorder because it had not recorded any wheel 21 data during the accident trip. The testing of the event recorder revealed that it was capable of recording wheel rotations normally. The axle generator, which is attached to an axle of the locomotive, sends a signal to the recorder that indicates how fast the wheel is rotating. The generator was found to have been modified to accommodate a nonstandard connector for the cable that connects the generator to the event recorder. A wire used to install the nonstandard connector was found broken inside the axle generator housing, and the generator was unable to produce a signal. Q-tron contacted the carrier that owned the locomotive as well as the locomotive manufacturer about the modification; however, investigators could not determine who had performed it. The event recorder on locomotive ATSF 342 indicated that the last download of data had been performed on December 12, 1994, at the Q-tron facility. No record of the memory card24 door opening or of memory card removal was found in the recorder memory. (The opening or removal will go undetected if occurring with no power applied to the recorder.) Maintenance records indicate that the recorder was sent to Qtron for maintenance, following a failed diagnostics report that indicated a “CARD NOT PRESENT” (event recorder memory card) flag. According to the Q-tron maintenance records, the battery was replaced in the memory card, which satisfied a subsequent diagnostics test of the event recorder. In addition, the analog thresholds for dynamic brake control and traction motor current at that time were 3 percent and 97 amperes, respectively. The manufacturer-recommended settings for these thresholds are about 3 percent and 99 amperes or less. After the last event recorder service at Q-tron on December 28, 1994, the configuration of the recorder was changed to the 146 percent and 1,782 amperes thresholds for dynamic brake control and traction motor current, respectively. As a result of this change, both dynamic brake control and traction motor current were recorded only every 8 minutes. With the manufacturerrecommended settings, the device would record any activity from these two sources whenever the thresholds were exceeded.25 The configuration can be changed with the appropriate software; however, the manufacturer recommends that all configuration settings be set at the factory to preclude such problems as incorrect threshold settings. Both of these problems exist for all data on the event recorder. (The oldest data is dated January 17, 1996, at 11:30 a.m.) In addition, locomotive ATSF 342 was equipped with a microprocessor-based Q-tron event recorder with a self-test function (a small green light indicated when the system had no faults). The assistant vice president for technical training and rules told the Safety Board, “It was the ATSF understanding with the FRA that this type of recorder would not require downloading at quarterly inspection intervals, but would be required during annual inspections.” The FRA regional administrator told the Safety Board that “no such gentlemen’s agreement” was made with the ATSF about this matter. Locomotive ATSF 342, according to the carrier, was assigned to the Corwith, Illinois, Electro Motive Division shop, where its last annual inspection was performed on June 12, 1995. No documentation was found in the unit file about the event recorder for this inspection. Under 49 CFR 229.25(e) (5), Stores a copy of the recorder internal memory and is removable to facilitate convenient readout of recorded data. 24 The thresholds set at the time of the accident would never be exceeded during normal operating procedures. 25 22 A railroad’s event recorder periodic maintenance shall be considered effective if ninety percent (90%) of the recorders inbound in any given month for periodic inspection are still fully functional; maintenance practices and test intervals shall be adjusted as necessary to yield effective periodic maintenance. FRA officials indicated that the FRA has no procedure for monitoring carrier compliance with the 90-percent rule. The ATSF could not provide any statistical information about the pass/fail rate of its quarterly event recorder inspections. However, in an October 21, 1996, letter to the Safety Board, the ATSF reported that event recorder defects generally are between five and 12 a day and “considering an active fleet of 1,692 locomotives the defect rate on October 18, 1996, would be 0.4 percent.” 20 chain supported the hose in the middle, as built, and was attached to the underside of the metal floor by a bracket bolted around the hose. The flexible air hose had been moved back about 3 feet by using two extended pipes according to the March 1, 1976, ATSF angle cock and air hose arrangement drawing. The modified car had a 46.5-inch long pipe, instead of the, as built, 1-foot pipe, connected to the glad hand air hose, and a 16-inch long pipe used in between, instead of the flexible hose attached directly to, the angle cock by a 45-degree elbow. These pipes effectively moved the flexible hose back away from the end of the car. The 46.5inch pipe was attached at two locations because of its length. The end, attached to the flexible hose, was also attached to a welded bracket going through a slot in the cover plate and anchored to the movable cushioning unit. The other end, attached to the glad hand hose, was welded onto two loop brackets that were supported by a bar-type hanger with 15 inches of travel. Safety Board investigators examined five sister cars26 of car ATSF 90033 at San Bernardino to determine whether 1) cushioned car hose arrangements are common and standard, 2) such arrangements may be more susceptible to kinking, and 3) arrangements met Federal, AAR, and carrier requirements. None of the inspected five sister cars had the same hose arrangement on both ends. Three basic arrangements, with differences in each arrangement, were found. Some car ends appeared to retain the original design with return springs; others had the modified design when rebuilt for heavy service; and still others had a design not identifiable. Several car ends, such as the B end of car ATSF 90030, had a longer pipe when compared to the other inspected cars. Train Line--The BNSF provided a copy of the Santa Fe Angle Cock Arrangement Manual, revised September 22, 1995, to the Safety Board. The manual contains over 33 different air hose arrangements for cushioned underframe freight cars. No other reference, except shop or manufacturer drawings, is available as a guide for the repair or replacement of the air hose arrangements on the ends of cushioned underframe freight cars. Car ATSF 90033 was modified, which included adding the end-of-car cushioning units, in January 1976. According to the modification drawings provided by the ATSF, the 15-inch cushioning unit travel required a flexible air hose arrangement at the end of the car to accommodate the movement of the coupled car as slack increased or decreased. The flexible armored hose was bent into a question mark shape and would curl or straighten with the ATSF 90030, 90031, 90032, 90035, and 90036, which were 89-foot flat cars. 26 movement of the coupler slack. A 14-link, no. 23 The following list compares the air brake pipe lengths, attached to the glad hand air hose, on the ends of the five sister cars: ATSF 90032 B 7.0 inches Return springs A 45.5 inches No return springs ATSF 90031 A 22.25 inches Return springs B 10.5 inches No return springs ATSF 90036 A B ATSF 90035 B 11.0 inches No return springs A 11.0 inches Return springs ATSF 90030 B 45.0 inches No return springs A 43.5 inches No return springs According to the senior vice president of the TTX company of Chicago, Illinois, which owns and leases over 50,000 rail cars: There are recommended arrangements that are shown in the various AAR manuals that should be followed. There's -- if you look at angle cock arrangements and hose arrangements in cars, I think it's Rule 4 would be the reference that you would make in the field manual as an example. There's probably, if memory services me, seven or eight different figures that are in there, depending on the type of cars to what that configuration should be. This provides the framework or the guidelines for those applications. The end-of-car cushioning units with hydraulic draft gears typically are either the trolley arrangement, which is, I think, S-427, or also an arrangement which is tied in, where the bracket to move the hose arrangement is actually tied into the hydraulic draft gear itself and moves with the draft gear. 6.5 inches No return springs 7.5 inches No return springs End-of-Train Device--The ETD found on H-BALT1-31, manufactured by Pulse Electronics Inc., was bench tested at the Pulse facility in Rockville, Maryland. The brake pipe pressure accuracy; motion detection; marker, battery, and armed/not armed status; and emergency activation were all tested and found to be fully functional within the Pulse specifications. Head-End Device--The HED components, manufactured by Colt Technology, were tested at the Colt facility in Lee’s Summit, Missouri. The HED consists of two major components, the control head (operates the system and displays the system status) and the receiver logic module (RLM). The HED display window on the control head indicates whether an arming attempt was successful, and a momentary indication occurs immediately after the attempt is completed. An “emergency enabled” indicator constantly lights when the system is armed and the two-way communications are reliable. The HED performs an automatic communications test every 3 minutes when the system is armed for two-way operation. If four successive tests fail, the emergency enabled light will flash on the control head, indicating that two-way communication is no longer reliable. No indication of a transmitter failure displays on the control head when the system is not armed for two-way operation display. A communications failure will be indicated on the control head display only if no data is received from the ETD for approximately 15 minutes. Both the display window and the indicator light functioned as intended during testing. 24 The control head from H-BALT1-31 had a firmware27 version (12) dated January 16, 1995. This version does not allow the emergency brake function to be operated when the control head is being used for any other function, such as the odometer, calibrated mile, or train length functions. Additionally, the control head displays an “arm now” message whenever the HED receives an arming request from any ETD, regardless of the ID code selected armed/not armed status. If the arming button is pressed when this occurs, the HED will only attempt to arm with the ETD that has the selected ID code. Approximately 430 Colt Technologies HEDs were in use as of October 22, 1996, as a oneway device only, according to the ATSF, and none was operated with the “old” firmware version installed. The RLM contains three major modules: the logic, the receiver, and the transmitter. During the Safety Board testing, the transmitter module in the RLM from H-BALT1-31 was found to have an output power of -4 dbm (approximately 0.000350 watt). The design specification for output power of the transmitter module is 2.0 watts. simulations, a train line blockage occurred between the 5th and 9th cars from the engine consist. (See appendix F for simulation protocol.) The last scenario was simulated to determine whether the train could stop if an emergency brake was propagated through the entire train from the automatic brake valve and the emergency feature on the ETD. To simulate the train brakes on the head of the train (ahead of any blockage) being applied from the automatic brake valve on the locomotive and the brakes on the rear of the train (behind any blockage) being applied from the ETD emergency feature that simulates a single point blockage, the computer model was set so that no train line blockage occurred and all train brakes applied in emergency. The train, at MP 57.82 and completely on the downgrade, had already attained a speed of 31.2 mph. The simulation incorporated full dynamic brakes engaged and emergency brake application initiated at MP 58.253 at a speed of 27.6 mph. With the dynamic brake fully engaged, the speed increased from 31.2 mph at MP 57.82 to 35.6 mph at MP 58.01 and then decreased to 27.6 mph at MP 58.253. At that decreased point, an emergency brake application was initiated, and the train stopped at MP 58.435, about 2 miles short of the POD (MP 60.4). Train Dynamic Analysis Simulation-Safety Board investigators and representatives from each party to the investigation conducted 28 computer simulations (27 scenarios plus 1 practice run) at Freightmaster, Inc., in Fort Worth, Texas, on March 19 and 20, 1996. The scenarios used in the simulations were developed from the limited event recorder information, from the dispatcher's Centralized Traffic Control System signal record log information, and from the H-BALT1-31 engineer's statements about the accident. Three simulation scenarios more accurately matched the actual time from Summit to the POD and the speeds that the engineer recalled. In these Metallurgical--The Safety Board sent an angle cock and a portion of the brake pipe from car ATSF 92018 plus five other closed angle cocks found at the accident site to its Washington, DC, laboratory for examination. The remaining three closed angle cock valves from unknown cars were extensively damaged, and the Safety Board considered no purposeful information could be gained from their examination. The first angle cock was a Sloan model 3050A of the type found on the A end of car ATSF 92018. (See figure 8.) The valve had a length of flexible hose attached to the angled inlet (hose side) with two 45-degree elbows and Computer programming, stored on memory chips, which can easily be replaced when computer programs are changed. 27 25 a short length of brake pipe extended from the straight inlet (brake pipe side). A portion of the flexible hose was charred but not obviously penetrated; the handle on the valve was in the closed position oriented 90 degrees to the long body axis; and the threaded end of the brake pipe was fractured. The pipe fracture was later matched to a small piece of fractured pipe threaded into the pipe union that was part of the brake pipe from car ATSF 92018. In addition, the exterior paint matched the paint on the valve and was very similar in color and appearance to the brake pipe reportedly from the flat car found under car ATSF 92018. The valve handle was removed from the valve body after the formed end of the pivot pin was ground away and the pin driven out. Removal of the handle uncovered fine dust and soot deposited on the body top. The inlets were visually inspected after the hose, elbows, and brake pipe pieces were removed from the valve body. On the hose side of the valve, the inlet walls and the visible portions of the ball key were covered in a heavy black layer of soot, while the surfaces on the pipe side inlet showed some corrosion products but no soot. The ball key was removed from the valve body by rotating the key 45 degrees past the closed stop and pulling the key upward. Safety Board investigators later located car ACFX 84070 in a Fontana, California, salvage yard. A portion of the draft gear sleeve was removed where remnants of the angle cock weld were attached to the car on the B end. As received, the end fitting from a hose section was threaded into the hose inlet, and compression fitting hardware were attached to the brake line side of the valve. The car attachment “L” bracket was also attached to the valve body with a “U” bolt and nuts. The horizontal leg of the bracket contained a fractured weld that matched the configuration, orientation, and surface features found on a fractured weld on the end sill mounting plate from car ACFX 84070. A contact pattern and the exterior stoppage of the painted surface on the threaded end of the brake pipe (nearest the valve) were consistent with the pipe being inserted into the compression fitting on the valve to about a 4inch depth. Measurements found that the threaded adapter inside the fitting was 4 inches from the brake pipe end of the compression fitting, which would not allow for significant engagement of the brake pipe threads to the adapter if the pipe were inserted to the depth indicated by the contact pattern. As received, the valve handle was in the closed and down position. During manipulation, the handle was free to lift with only minimal force, and care had to be exercised to prevent unwanted movement. The overall exterior of the valve appeared intact and damage free, except for mechanical damage in the pivot area of the handle. Damage was also found on adjacent areas of the handle and the socket,28 which appeared consistent with glancing contact from a foreign object when the handle was fully in the down position. When this contact was made is not known. The handle and socket were removed from the valve by grinding away the formed heads of the pivot, by positioning pins, and by driving the pins partially out. The open and closed stops on the handle, socket, and valve body were closely examined with no evidence of significant mechanical contact or damage uncovered. The paint layer on many of the stop surfaces was still intact and undamaged. The inspection of the interior of the hose side inlet, after removal of the hose fitting, found corrosion products and darker areas of sooting on the valve body surfaces. In addition, many areas containing a light-colored granular material were visible on top of the corrosion and sooting, particularly near the key window and in the female inlet threads. Under magnification, the granular material appeared consistent with sand particles. These sand-type particles with 28 Mechanical fitting between the valve key and the handle that incorporates the valve position stop lug. 26 the areas of sooting and corrosion were visible. The surface of the closed valve key had a dark brass appearance but did not appear to have a significant surface deposit layer. The brake pipe inlet side of the valve was inspected without disassembling the compression fitting. The surface appeared covered in corrosion products with no sand-type particles or sooting visible. The color and texture of the visible surface of the key in the brake pipe inlet resembled the visible portion of the key surface in the hose inlet. The disassembly of the valve continued with removal of the threaded key cap on the bottom of the valve body. Upon removal, a small amount of water, estimated to be less than a teaspoon, was found in the preload spring cavity below the key.29 The cavity contained significant quantities of a greasy reddish substance containing corrosion products in the area around the spring and of sand-type particles inside the spring inside diameter. When the key was extracted through the bottom of the valve body, more moisture was found on the outer surfaces in the areas that were previously contacted by valve body. These areas also had a slight turquoise coloration that faded as the moisture evaporated. With the outer surfaces of the key exposed, a fine line of corrosion products and debris outlined the assembled locations of the windows in the valve body. The outlining debris and corrosion lightly adhered to the surface and could be easily wiped from the key. The underlying outer surface of the key was scratched in a circumferential pattern consistent with the normal rotation directions of the key. Comparisons of the hose and brake pipe surfaces of the key found little differences in the surface coloration or texture between the two areas or in the pattern of deposits. Large quantities of light-colored particulate material were found on the interior surfaces of the key slot.30 Under magnification, the material appeared to be clumps of sand particles that would easily crumble when probed. Removal of the key from the valve body also exposed similar clumps of sand clinging to the walls of the valve at the key slot. A small sample of the sand material was collected from the surface of the valve body and prepared for energy dispersive x-ray analysis. The spectra, acquired from an area of the sample containing many particles, indicated that the majority of the sample was silicon and oxygen with distinct but much smaller peaks for iron, potassium, and carbon. Additional spectra of individual particles found two types of particles based on composition. The majority of the particles were silicon- and oxygen-based with other minor elements consistent with silicon dioxide sand. The other particle type was mostly iron and oxygen consistent with iron rust. For energy dispersive x-ray analysis of the surface deposits on the key, an approximate 0.25-inch-tall horizontal section was cut from the hose side of the key, as received, and examined in a scanning electron microscope. The section location encompasses regions of the key that, as received, were exposed in the inlet window and surrounding areas that were covered by the valve body. A base metal spectrum was acquired from a location on the section that was scraped to remove surface debris. The spectrum indicated that the key was a copper alloy containing zinc, iron, tin, silicon, and possible traces of lead. The area previously exposed in the hose side inlet window contained scattered surface particles and many embedded particles. A spectrum, acquired from an area encompassing several of the surface particles, showed an increase in the relative heights of the Preloaded upward by a small coil spring assembled between the key and the cap. 29 30 Rectangular passageway through the vertical centerline of the key that, when aligned with windows in the hose and brake pipe inlets, allows flow through the valve. 27 iron and oxygen peaks when compared to the base metal spectrum. Other spectra of the embedded particles produced significant peaks of fluorine, iron, silicon, titanium, and chromium, which is indicative of a Teflon-type material. The number and size of surface particles greatly increased in the areas of the sample segment that were originally hidden by the valve body. Spectra, acquired at several locations, found that the iron, oxygen, and silicon levels were elevated over the base metal contents. In addition, calcium and chlorine peaks were detected in some areas and in some particles. Hazardous Materials Information Chemical Release--Of the nearly 224,000 gallons of regulated and nonregulated chemicals in each of the derailed tank cars, about 198,000 gallons were released or consumed or both in the fire following the derailment.31 No measurable amount of the approximately 25,800 gallons of butyl acrylate in tank car NATX 82129 was known to be released as a result of the derailment and fire. The ATSF chief environmental officer32 estimated that 500 gallons of butyl acrylate or reacted material or both were released from tank car NATX 82129 after explosive charges were used to vent and release internal pressure in the tank car. About 55 gallons of liquid butyl acrylate were also recovered from the tank car before its scrapping, and the remaining butyl acrylate was left in the tank car in a nonliquid state. Nearly 1,000 gallons of propylene glycol were also recovered from a derailed tank car. clear colorless liquid with a pungent odor used in the manufacture of polymers and resins for textile and leather finishes and paint formulations. It has a flash point of 103 oF and a flammability range of 1.3 to 9.9 percent by volume in air. During storage and transportation, a chemical inhibitor is added to butyl acrylate to stabilize the material and prevent an uncontrolled polymerization,33 which can be initiated by excessive heat. Because polymerization also releases heat, uncontrolled polymerization may produce a rapid release of energy with the potential for an explosion in unvented and closed containers. Inhalation of vapors can cause irritation to the nose and throat. Butyl acrylate is highly mobile if released in soil and may leach to groundwater and will not be absorbed to sediment or bioconcentrate in aquatic organisms if released in water. Trimethyl phosphite (shipped in tank car GATX 37310) is a clear colorless liquid with a pungent odor and used as an intermediate product in the manufacture of pesticides and flameretardant polymers for polyurethane foams. It is also used as a fireproofing agent in the production of textiles. Trimethyl phosphite has a flash point of 60 oF. Flammability limits have not been determined. The product is stable but can emit toxic fumes of oxides of phosphorus when it decomposes through heat and combustion. According to the manufacturer34 material safety data sheet, vapors are not irritating to the skin and eyes. However, the U.S. Coast Guard Chemical Hazard Response Information System indicates that vapors cannot be tolerated “even at low concentrations” and can cause severe irritation to the eyes and throat and injury to the eyes and lungs. Data about the environmental effects were not available. Chemical Product Descriptions--Butyl acrylate (shipped in tank car NATX 82129) is a A chemical reaction in which two or more relatively simple molecules combine to form chain-like larger molecules. It often results in an expansion of the material and a generation of heat that can cause overpressurization and rupture of the container. 34 33 The gallon number of product in each loaded tank car was estimated as equal to the tank volume. See appendix B for qualifications in hazardous materials response. 32 31 Albright and Wilson Americas, Inc. 28 Denatured alcohol (shipped in tank car MWSX 29654) is a mixture of predominantly ethyl, methyl, and isopropyl alcohols. The clear liquid is used in the manufacture of other chemicals, solvents, antifreeze, and brake fluids. It has a flash point of 60 oF and a flammability range of 3.3 to 19 percent by volume. The material is stable. Data about environmental effects were not available. Local and State Emergency Response Agency Notifications--Immediately after the derailment, the ATSF System Operations Center (SOC)35 in Schaumburg, Illinois, received telephone notification from the CHP about a train derailment and explosion near Cajon. According to the SOC director of service interruptions, the CHP was notifying each railroad that operates in the area because it was not certain which carrier’s train had derailed. The director of service interruptions then spoke with the director of network operations (SOC supervisor-on-duty), who had been with the dispatcher who had been conversing with the H-BALT1-31 traincrew about the train braking problems. After speaking with the director of network operations, the director of service interruptions realized that HBALT1-31 had derailed and that hazardous materials likely had been released and involved in the explosion. ATSF immediately sent, by fax, the consist copies to the SBCC and the State forestry and fire protection department command center by 4:32 a.m. While en route to the accident, a State forestry and fire protection department firefighter received the consist copy at the department command center and delivered it to a hazardous materials specialist at the scene about 5:15 a.m. The IC indicated that the consist copy and its emergency response information was available to him when he assumed his duties as IC. In the meantime, the SOC had notified the California Office of Emergency Services (COES), the National Response Center (NRC), and the California Public Utilities Commission (CPUC), whose railroad operations and safety section oversees rail transportation within the State, at 4:30, 4:38, and 4:45 a.m., respectively. Before the SOC could notify any emergency response agency, the San Bernardino (County) Communications Center (SBCC) and the State forestry and fire protection department command center had called about 4:20 a.m. to request copies of the train consist, which included emergency response information about the regulated hazardous materials on the train. The About 6:17 a.m. the COES, which is responsible for the notification of other State and local agencies that have responsibilities or jurisdiction in a given emergency situation, notified the Office of the State [California] Fire Marshal36 pipeline safety and enforcement division. (The two underground pipelines adjacent to the accident site about 200 feet north of the wreckage were owned and operated by the Calnev Pipe Line Company [Calnev].) A pipeline safety engineer from the State fire marshal office was dispatched and arrived at the accident site about 8:25 a.m. The COES also notified the CPUC and other agencies, such as the California EPA, California Department of Fish and Game, State Water Resources Control Board, and the regional air and water quality control offices that have jurisdiction over the environment and the public health. All of these agencies responded and sent representatives to the accident scene. The center controls and monitors all train movements and also notifies the appropriate Federal, State, and local emergency response agencies in the event of an accident within the ATSF system. 35 The office is within the California Department of Forestry and Fire Protection and is the State regulatory agency for liquid pipelines. Gas pipelines are regulated by the CPUC utility safety branch of the safety and enforcement division. 36 29 Chemical Shipper Notifications--The IC did not notify or direct that the shippers of the chemicals on the train be contacted to provide technical assistance about their respective chemicals. The IC said that the hazardous materials specialist at the accident scene had a technical library available and was able to provide the needed information about each of the chemicals involved in the derailment. The IC stated that he also assumed that the hazardous materials specialist would verify through the Chemical Transportation Emergency Center37 (CHEMTREC) that the necessary contacts with the shippers had been made. The director of service interruptions said that after receiving the initial notifications, he and other on-duty personnel at the SOC discussed the need to notify and fax CHEMTREC a copy of the train consist. He stated that because of miscommunication and confusion within the SOC, the other on-duty personnel assumed that he would notify CHEMTREC and fax the consist; however, he had understood that he would fax the consist only and that someone else would make the telephone notification. Also, he unknowingly used the fax number for the main office of the Chemical Manufacturers Association (CMA) instead of the fax number for the CHEMTREC operations desk. The director of service interruptions stated that CHEMTREC had first contacted the SOC for an update on the conditions at the accident site on February 1 at 5:32 p.m. and that the CHEMTREC telephone call provided no indication which would cause SOC personnel to realize that the SOC had not previously contacted CHEMTREC. The mistake was realized between 6 and 7 a.m. (8 and 9 a.m., central standard time) on February 2 after the director of service interruptions received a telephone call from a manager in the BNSF logistics department in Fort Worth, Texas, who was responding to customer complaints about the lack of accident notification. (The logistic department notifies customers, including chemical shippers, about incidents or accidents that result in damage or delays of their shipments. These notifications are for operational purposes and are not emergency response notifications.) The director of service interruptions rechecked the SOC telephone log, found no entries for the telephone notification of CHEMTREC, and concluded that the SOC had not notified CHEMTREC. CHEMTREC logs indicate that the first report of the accident was received at 11:01 a.m. (2:01 p.m., eastern standard time) on February 1 from the California EPA. The California EPA requested that CHEMTREC assist with contacting the shippers of the trimethyl phosphite, butyl acrylate, and the methyl ethyl ketone.38 CHEMTREC notified the shipper of the trimethyl phosphite about the accident at 11:08 a.m. and received a call at 11:10 a.m. from a second California EPA representative requesting product information on the trimethyl phosphite and butyl acrylate as well as contacts for the shippers of these two products. At 11:18 a.m., the corporate office of the Rohm and Haas Company (R&H) in Philadelphia, Pennsylvania, notified CHEMTREC to confirm that the R&H had two tank cars involved in the derailment, which were the cars NATX 82129 and UTLX 79897, containing the butyl acrylate and the petroleum lube oil, respectively. The corporate office had been notified of the accident by the BNSF logistics manager about 11 a.m. CHEMTREC provided the contacts for the California EPA to the R&H and, between 11:18 and 11:30 a.m., also contacted the shipper of the methyl ethyl ketone. From its initial notification through February 6, The center, operated by the Chemical Manufacturers Association (CMA), was established to provide initial and immediate information about handling hazardous materials and other chemicals. 37 The three products were not specifically identified in the CHEMTREC logs. They are presumed to be those listed from subsequent telephone calls received from the California EPA and made to the chemical shippers by CHEMTREC. 38 30 CHEMTREC continued to provide communication links and information as requested by the State emergency response agencies, chemical shippers, and ATSF. At 11:45 a.m., the R&H corporate officer notified the shipping manager at the company plant, where the butyl acrylate had been produced, in Deer Park, Texas. The R&H shipping manager attempted to contact the ATSF at 12:18 p.m. for information about the status of the butyl acrylate tank car but failed to reach anyone. After leaving a message at the ATSF, the shipping manager contacted CHEMTREC and was given a California EPA contact. The shipping manager contacted the California EPA and expressed concerns about the polymerization of the butyl acrylate and overpressurization of the tank car. When the California EPA contacted the R&H shipping manager about 1:35 p.m. for information about the butyl acrylate, a R&H technical expert provided information about the decomposition and polymerization of the product. condition and location of the butyl acrylate tank car by 4:30 a.m. on February 2; neither telephone number was answered according to the R&H. At 7:29 a.m., the shipping manager spoke with a California EPA representative at the accident scene who advised the shipping manager that the R&H concerns about the butyl acrylate were discussed at a command post planning meeting during the evening of February 1. The shipping manager stated that during a telephone call to the incident command post about 1:40 p.m., he was told not to send a hazardous materials response team from the R&H. The IC, when asked about making such a statement, indicated that he did not recall making such a statement and would not have made such a statement. The IC stated that during the postaccident critique of the emergency response, this remark was attributed to a California EPA representative. (The IC later confirmed that the telephone number used by the R&H for the command post was for a mobile communications center operated by State forestry and fire protection department personnel at the command post. Department personnel in the mobile communications center would bring incoming information to the IC.) The R&H shipping manager contacted the command post again about 5:16 p.m. and was informed that no attempts were being made to extinguish the fire. After repeated efforts to contact the ATSF and the command post, the R&H still had no information about the A State forestry and fire protection department hazardous materials specialist, who was providing assistance at the command center, contacted the R&H shipping manager about 8:50 a.m. on February 2. The hazardous materials specialist advised him that the fire was still raging and that the condition of the butyl acrylate tank car was unknown, and the shipping manager reiterated the dangers of butyl acrylate at elevated temperatures. Following this conversation, the R&H technical experts in Deer Park faxed to the command post and the SOC copies of the material safety data sheet for butyl acrylate and a statement about the dangers of the butyl acrylate polymerization and the potential for overpressurization and a catastrophic tank car rupture. The R&H statement warned that the chemical stabilizer no longer functions if the internal tank temperature reaches 257 °F and that the temperature rise in the tank car could result in a rapid internal pressurization and catastrophic tank car rupture if a runaway polymerization reaction occurred. The R&H received confirmation at 9:47 a.m. that the faxed information had been received at the command post. The R&H shipping manager said that he was advised about 11:04 a. m. by the State forestry and fire protection department hazardous materials specialist that all tank cars had lost their contents and the fire was still raging. The R&H received no further information on February 2 and 3 about its tank car. Derailed Tank Car Damage Assessments--The damage assessments and handling of the derailed tank cars were primarily under the purview of three 31 individuals: the ATSF superintendent of field operations39 for the region encompassing California, Arizona, and part of New Mexico; the ATSF chief environmental officer; and the State forestry and fire protection department battalion chief who was the incident safety officer. The ATSF superintendent of field operations was responsible for the wreckage clearing operation, including the management and coordination of equipment and personnel during the process. The ATSF chief environmental officer is the ATSF chief officer in areas involving both the environment and hazardous materials, including compliance with DOT hazardous materials regulations. The State forestry and fire protection department incident safety officer was responsible for the safety and health of the emergency response personnel assigned to the incident and also served as the IC’s representative at the derailment site. The ATSF superintendent of field operations was notified of the accident about 4:20 a.m. on February 1 and arrived at the accident scene between 5:45 and 6:15 a.m.. The State forestry and fire protection department incident safety officer indicated that he also arrived on scene about 1 hour after the derailment. The ATSF chief environmental officer arrived at the scene between 6 and 7 p.m. on February 1. After the derailment, rescue teams entered the derailment site in search of the two missing crewmembers. The State forestry and fire protection department incident safety officer, who accompanied the second rescue team into the site about 3 or 4 hours after the derailment, observed that a few tank cars near the locomotives were leaking but were not involved with fire. He also noted that four freight cars, including two tank cars, were still on the track at the east end of the derailment. The remaining tank cars were at various angles and depths within the main pile of burning wreckage. About noon, the State forestry and fire protection department incident safety officer and the ATSF superintendent of field operations were part of a team that entered from the east end of the accident site to pull the last four freight cars, including an empty tank car and a tank car loaded with methyl ethyl ketone, away from the fire. After rerailing one set of wheels for one of the tank cars, the four freight cars were pulled away from the burning wreckage. Between 4 and 6 p.m. the ATSF superintendent of field operations and the State forestry and fire protection department incident safety officer conducted a perimeter assessment of the burning wreckage to ascertain any immediate hazards and determine a plan of action. The incident safety officer later stated that the flames, smoke, and “steam” obstructed their visibility and that the fire had destroyed many of the painted numbers and identification marks on the burning tank cars. The ATSF superintendent of field operations and the ATSF chief environmental officer also noted difficulties in identifying the tank cars because the painted markings and identification marks had been burned away. The incident safety officer observed that because of the massive destruction of the tank cars, identification of the pressure and nonpressure tank cars from configurations specific to each type of tank car was nearly impossible. Fire suppression efforts were not initiated until the evening of February 1, after the missing crew members had been recovered. Because the application of foam and water to the burning wreckage pile failed to lessen the magnitude and intensity of the fire, the IC resorted to cooling the periphery of the burning pile, pulling one freight car out at a time, and then cooling each freight car down individually. With this approach, assessment of the damage to the tank cars became a continuous process. Over February 2 and 3, the State forestry and fire protection department incident safety officer, the ATSF superintendent of field operations, and the ATSF chief environmental officer made additional assessments as access to and visibility of the See appendix B for qualifications in hazardous materials response. 39 32 other tank cars improved and as other wreckage was cleared away. Each of these individuals stated that most tank cars appeared to be severely damaged and that others were burning at ruptures or creases in their tanks. During the night of February 3 or early morning of February 4, one of the tank cars that had been removed and isolated from the wreckage pile on the evening of February 3 began to vent puffs of smoke at irregular intervals. The night operations chief advised the IC of this situation about 6:30 a.m. when he arrived at the incident command post, and the IC ordered the derailment site to be evacuated. The State forestry and fire protection department hazardous materials specialist advised the R&H technical experts in Deer Park about the venting tank car at 8:55 a.m. and the possibility that it might be the butyl acrylate tank car. The R&H experts faxed a picture of the type of tank car containing the butyl acrylate and recommended an immediate 1\2-mile evacuation, which was ordered and in progress by 9:10 a.m. The R&H shipping manager received a telephone call at 9:25 a.m. from an employee of an environmental contractor for the ATSF. According to the R&H, the environmental contractor stated that he was at the accident scene and confirmed that “the car” was venting and flaming. In response to the contractor’s request for information about the butyl acrylate, the shipping manager stated that information had previously been faxed to the incident command post. At 9:30 a.m., the R&H dispatched a hazardous materials response team to the accident scene. Because of the uncertain identity of the venting tank car, the IC decided to determine the identity of that tank car and the status of the other tank cars. The State forestry and fire protection department incident safety officer, the ATSF superintendent of field operations, and the ATSF chief environmental officer entered the derailment site about 10 a.m. to survey the damaged tank cars and to map the car locations. The ATSF superintendent of field operations later testified that they mapped the location of 13 tank cars: 10 “low pressure” tank cars and 3 “pressure” tank cars. The incident safety officer recognized the venting tank car as the propylene glycol tank car, which he had seen before the tank car was involved in fire and while the numbers and identification marks were still readable. The three members of the survey team determined that the butyl acrylate tank car and the trimethyl phosphite tank car remained on the top of the wreckage pile. According to the incident safety officer, the tank car later determined to contain the butyl acrylate was in the middle of the wreckage pile with one end pointing upwards at a 60-degree angle, and from a distance of 70 feet, a large rupture appeared to be toward the end of the tank pointing in the air. The incident safety officer believed that this tank car was the same tank car that he had seen the previous evening burning and venting. All of the other derailed tank cars had been removed and isolated from the burning wreckage pile. The ATSF chief environmental officer and the ATSF superintendent of field operations confirmed that those tank cars that had been removed from the pile were breached or had severe damage. According to the IC, the incident safety officer, the ATSF chief environmental officer and the ATSF superintendent of field operations immediately reported to him that the tank cars containing product had been breached and were “for the most part” empty. The IC said that they had identified the butyl acrylate tank car “with a high degree of certainty,” but they had not been able to reach it. According to the IC, they had spoken with an equipment operator who reportedly saw a hole in the side of the butyl acrylate tank car. He added that he and the others were not aware that the butyl acrylate tank car was a jacketed tank car. On the basis of this assessment, the IC lifted the evacuation about noon and permitted the wreckage clearing operations to continue. About the same time, the State forestry and fire protection department hazardous materials specialist notified R&H personnel in Deer Park that the butyl acrylate tank car had been located and was ruptured. The R&H then advised the hazardous materials specialist that a R&H response team was en route to the accident scene. 33 Butyl Acrylate Tank Car--The ATSF superintendent of field operations, being responsible for the wreckage clearing operations, was present when the butyl acrylate and the trimethyl phosphite tank cars were pulled from the wreckage pile shortly before dusk on February 4. He noted that the manway on the trimethyl phosphite tank car was open and had smoke and fire damage around it. The superintendent of field operations stated that the butyl acrylate tank car was upside down when it was pulled from the wreckage and was left in that position. In addition, he did not inspect or direct anyone else to inspect the butyl acrylate tank car after it was pulled from the wreckage. The superintendent of field operations spoke with the equipment operators who removed the tank car, and they told him that they were able to pull and shove the butyl acrylate tank car easily and that it handled as if it were empty. The superintendent of field operations concluded on the basis of the equipment operators’ observations and the fire and heat damage to the tank car that it was empty. Because he believed the tank car to be empty, the superintendent of field operations found no need either to inspect the tank car after it was removed and isolated or to consult with other tank car experts. Although the ATSF chief environmental officer did not see the butyl acrylate tank car until either late night on February 4 or early morning on February 5, he too believed the tank car had to be empty because the derailment forces were too great for it to survive and, after being exposed to intense fire and heat for over 2 derailment days, it did not vent as he had expected. A temperature gauge was installed on the external tank surface where the thermal protection and jacket were missing; its initial reading was 110 oF. About 7:30 p.m., firefighters began to spray the tank car with water, which initially turned to steam. Within 15 minutes, the temperature of the tank had fallen to 60 oF, and the tank car had cooled sufficiently that the water no longer changed to steam. By the time the R&H team briefed the firefighters on the hazards of the tank car and cautioned them to listen for strange noises from the tank car, the tank temperature had increased to 85 oF. The firefighters reported that by 9 p.m., gurgling noises could be heard from the tank car and the temperature gauge read 114 °F. A 0.5-mile evacuation of the derailment site, including an I-15 and SR-138 closing, was ordered by 9:30 p.m. (In the meantime, the R&H dispatched a second response team that arrived at the accident scene about 7:30 a.m. on February 5.) About 3 a.m. on February 5, the on-scene R&H response team members, still hearing gurgling noises from the tank car, approached the tank car with infrared thermal imaging equipment and obtained a localized temperature of 178 oF at one end of the tank car. The infrared equipment was then used throughout the day to monitor the temperature of the butyl acrylate tank car from a distance of 200 yards. From that distance, an initial temperature of 66 oF at 4:40 a.m., representing an average of the entire tank car and the surroundings, served as a baseline. By 9:28 and 11:03 a.m. and 1:02 p.m., respectively, the temperature was 90, maximum 104, and 78 oF. After the IC consulted with the ATSF, the R&H, Calnev, and other agencies at the scene, the IC with their consensus decided about 2:30 p.m. to have a demolition expert detonate explosive charges to relieve the pressure on the tank car and to allow liquid to drain out. The demolition expert had examined the tank car by 6:15 p.m., and the localized temperature had decreased from 178 to 95 oF. The explosive charges were successfully detonated shortly before 10 p.m., and the evacuation was lifted. After arriving at the accident scene about 5:30 p.m., the R&H response team proceeded to inspect the butyl acrylate tank car, which they found nearly upside down with the dome buried in the ground. After digging dirt away from the valves in the dome, they recognized a fitting that was unique to the butyl acrylate tank car and positively identified the tank car. The response team members found no apparent holes in it and assumed the tank was intact. 34 Pipeline Information Calnev owns and operates the two underground hazardous liquid pipelines that are almost parallel to the railroad tracks at the accident site. The 14- and the 8-inch diameter pipelines originate in Colton, California, and terminate in Las Vegas, Nevada. These pipelines are laid separately from Colton, the Calnev operations control center, to pipeline milemarker (MM) 19 near Cajon Creek and then together to Las Vegas. The 14-inch pipeline transports gasoline, diesel, and military JP-8 aircraft fuels for Las Vegas, the U.S. Air Force, and various commercial trucking and railroad companies. The 8-inch pipeline transports Jet-A turbine fuel for McCarran Airport in Las Vegas. At the time of the accident, the 14- and 8-inch diameter pipelines each had an operating pressure of 425 psig and were transporting JP-8 aircraft and turbine fuels, respectively. Train H-BALT1-31 derailed between pipeline MMs 24 and 25, and wreckage from the train was about 200 feet south of the pipelines. Downstream of the derailment were manually operated main line gate valves at the Cajon pump station at MM 25.5 and remote-controlled main line valves at the California aqueduct at MM 35 for both pipelines. Upstream of the derailment at MMs 1 and 7 were remotely operated line valves, which could be opened or closed from the operations control center, for the 14-inch pipeline. No remotely operated valves for the 8inch pipeline were between Colton and the derailment site. The elevation of the two pipelines at the derailment site was about 2,000 feet higher than at their origin in Colton. A Calnev engineer learned of the train derailment at 5:15 a.m. from a radio news broadcast and then telephoned the incident command post to determine whether Calnev pipelines might be near the accident site. The Calnev engineer notified the Calnev manager of engineering at 6 a.m. and advised him that, based on the description of the accident, Calnev pipelines may be near the derailment site. The manager of engineering proceeded to the accident scene and informed the IC of the two Calnev pipelines about 6:45 a.m. The IC later told Safety Board investigators that he had been aware of the two pipelines and knew the types of product each transported. He stated that because the Calnev manager of engineering had arrived as the incident command post at the Mormon Rocks was being established, Calnev did not need to be contacted. He said that Calnev would have been notified had the Calnev manager of engineering not arrived when he did. The State fire marshal office also indicated that it was in contact with Calnev between the time it was notified and the arrival of its inspector at the accident scene at 8:25 a.m. Calnev initiated procedures to shutdown its 14- and 8-inch pipelines, respectively, at 6:15 and 6:21 a.m. The remotely operated valves at MMs 7 and 35 for the 14-inch pipeline were closed at 6:47 a.m. from the operations control center. At same time, a remotely operated valve at MM 26.2 for the 8-inch pipeline was also closed. Calnev closed the manually operated main line gate valves for both pipelines at the Cajon pump station at MM 25.5 by 9 a.m. Calnev personnel partially marked the location of the pipelines at the derailment site. In addition, the Calnev general manager arrived at the accident scene and consulted with the IC. From the arrival of the manager of engineering at the incident command post throughout the duration of the incident, Calnev had personnel on scene to coordinate with the IC and to observe and monitor wreckage clearing operations near the two pipelines. By 4 p.m. on February 1, Calnev had established its own command post at the Mormon Rocks incident command post. By 6 a.m. on February 2, Calnev had marked the location of the pipelines closest to the wreckage with stakes and yellow warning tape. Calnev also checked the depth of cover over each pipeline, which was, according to the State fire marshal office, between 3.5 and 6.5 feet. At 1:45 p.m., Calnev began startup procedures for the two pipelines with the concurrence of Calnev engineers, the IC, the State fire marshal office, and the ATSF. Both pipelines were in full operation by 4 p.m. with operating pressures between 425 and 500 psig. 35 On February 3, Calnev monitored the construction of a dirt ramp that provided an additional 3 feet of cover over the pipelines before a bulldozer was permitted to cross over the pipelines to build a berm in the dry creek bed to divert water runoff from predicted rains. This activity was completed without incident. At 10:15 a.m. on February 4, the IC requested the shutdown of both pipelines after the evacuation of all personnel from the accident site because of venting from one of the tank cars. At the time the pipelines were shutdown, the 14-inch diameter pipeline contained diesel fuel and the 8inch diameter pipeline contained turbine fuel. The remotely operated valves at MMs 7 (upstream) and 35 (downstream) on the 14-inch pipeline and the remotely operated valve at MM 26.2 on the 8inch pipeline were closed. Operating pressure at the Cajon pump station (MM 25.5) was 374 psig. The manual valves at the Cajon pump station were closed by 11:05 a.m. Calnev was given permission about 11:57 a.m. by the IC, with the concurrence of the State fire marshal office inspector, to restart the two pipelines. Calnev personnel resumed monitoring activities at the accident site at 12:30 p.m., and both pipelines were back in operation by 1:01 p.m. No further incidents occurred that necessitated the shutdown of the two pipelines. The pipelines were not shut down during the controlled detonations on the butyl acrylate tank car because an engineering evaluation determined that the pipelines could withstand any percussion generated by the detonation. However, as a precaution, both pipelines were operating at reduced flow rates, and diesel fuel, which has lower volatility and less flammability hazard than other transported petroleum products, was injected into the 14-inch pipeline. Calnev personnel also continued to monitor wreckage clearing operations until work around the pipelines was completed. established. Participating agencies included the California Department of Fish and Game, the State forestry and fire protection department, the California EPA (department of toxic and substances control and the railroad accident prevention and immediate deployment team), the Santa Ana Regional Water Quality Control Board, the San Bernardino County Fire Department (hazardous materials officer), the California Occupational Safety and Health Administration, the U.S. EPA, the U.S. Forest Service, and the Coast Guard strike team. In accordance with the California hazardous materials incident contingency plan, the department of fish and game was the lead State agency to coordinate and oversee the environmental response. On February 1, the ATSF contracted TRC Environmental Solutions, Inc., to develop work plans for the environmental response and to provide air, water, and soil monitoring and sampling services. The ATSF also contracted Consolidated Waste Industries to provide removal services. Air sampling and monitoring began when the South Coast Air Quality Management District had ATSF personnel obtain air bag samples from the smoke plume at the derailment site and two other downwind locations between 10:33 a.m. and 12:30 p.m. on February 1. The preliminary analysis received at 3:40 p.m. indicated the presence of hydrocarbons in the low parts per billion range, which was attributed to the combustion of the diesel fuel. Two additional air bag samples were taken at the accident site between 9 and 9:30 a.m. on February 2. The analysis of these samples indicated no concentrations of phosphorus compounds were above the minimum detection levels and all hydrocarbon gas concentrations measured in the range of background concentrations. Initial field monitoring with hand-held equipment around the perimeter of the accident site was performed every 2 hours at four designated locations on February 1 and 2. Levels of volatile organic compounds ranged from 3.5 to 5.8 parts per million (ppm). Environmental Information A separate incident command group to oversee the environmental monitoring, cleanup, and restoration and the worker safety was 36 On February 2, three fixed stations to the west, northeast, and southeast of the accident site were installed to take readings at 1-minute intervals on a continuous basis. The monitoring was interrupted during the events involving the butyl acrylate tank car on February 5 but was resumed on February 6. A fourth air monitoring station was installed on February 6 within the exclusion zone (the wreckage area in which personal protective equipment was required). Rain interrupted the air monitoring at the fixed stations from February 21 to 27. The monitoring was resumed on February 27 and was discontinued on March 1. The average daily levels of volatile organic compounds at the three perimeter stations did not exceed 5 ppm, although individual readings above 5 ppm were recorded on numerous occasions. The average daily level of compounds in the exclusion zone exceeded 5 ppm on 3 days. The levels of compounds for March 1, which provided a measure of background levels, ranged from 0.8 to 2 ppm at the four monitoring sites. Soil samples from the derailment site and the areas of Cajon Wash, north and south of the derailment, were obtained from February 3 to March 13 and analyzed for total petroleum hydrocarbons, volatile organic compounds, semivolatile organic compounds, and phosphorus. The collection and analysis of surface and subsurface samples were ongoing as contaminated areas were identified and excavated and as the contaminated soil was removed. About 20,000 cubic yards (27,000 tons) of soil were removed and transported offsite for disposal as of March 15, when the soil removal was completed. The wreckage and debris after decontamination were completely removed from the accident site by February 27. Beginning February 1, the ATSF constructed four earthen dikes across the Cajon Wash upstream (north) and two dikes downstream (south) of the derailment site. The upstream dikes restricted flow through the derailment site, and the downstream dikes allowed passage of water while trapping potential floating contaminants behind the dikes. On March 13, the incident command group determined that further air, water, and soil sampling and monitoring were no longer needed. The ATSF and the State forestry and fire protection department met on March 20 to determine restoration requirements, which involved the removal of emergency access roads to the derailment site and the fertilization of the affected areas. The restoration began and was completed, respectively, on April 1 and 5. Other Information Federal Railroad Administration-Founded in 1966, the FRA is the regulatory agency within the DOT that promotes and enforces safety throughout the U.S. railroad system and consolidates Federal support for research and development for rail transportation. The agency also encourages policies and investment in infrastructure and technology for the railroad industry. The FRA mission is to promote a safe, environmentally sound, successful railroad transportation system and to meet the current and future needs of all railroad passengers. Wells supplying drinking water for designated facilities and residences were tested on February 3 and 4. The ground and the surface water in Cajon Wash, both north and south of the derailment, were sampled and tested between February 3 and March 7 for total petroleum hydrocarbons, volatile organic compounds, phosphorus, and heavy metals. The final report of TRC Environmental Solutions, Inc., on the environmental response indicates that the incident command group agreed that neither water supply wells nor groundwater in the Cajon Wash area was impacted. 37 The FRA and the railroad industry have long been familiar with the technology for the twoway ETD, and before the February 1, 1996, Cajon Pass accident, the Safety Board had recommended its use on trains to the FRA. Following a 1989 run-away train crash in Helena, Montana,40 the Safety Board had asked the FRA to require the use of two-way ETDs on all trains without a caboose. After its investigation of the December 1994 Cajon Pass accident, the Safety Board recommended that the FRA separate the twoway ETD requirements from the power brake notice of proposed rulemaking (NPRM) and conclude the ETD rulemaking to require their use on all cabooseless trains. On February 1, 1996, the same day of the H-BALT1-31 derailment, the FRA advised the Safety Board that it agreed with the recommendation, intended to separate the two-way ETD issue from the power brake NPRM, and issue a final rule as soon as practicable. Following the HBALT1-31 derailment, the FRA issued emergency order 18, effective 12:01 a.m., on February 8, 1996, requiring that all westward trains operated by the ATSF on the Cajon subdivision between MPs 54.9 and 59.9 have the capability to initiate an emergency application of the air brakes from both the head and the rear of the train. On February 22, 1996, the FRA met with railroad industry representatives and obtained a voluntary agreement from them to furnish by December 31, 1996, two-way ETDs on all trains traveling on mountainous grades. The railroad industry, according to the Association of American Railroads (AAR), has also agreed to equip additional required trains with two-way ETDs by a self-imposed June 1997 deadline. Still, as of December 1, 1996, the FRA has not issued its final rule on two-way ETDs. Furthermore, immediately after the HBALT1-31 dreailment, the FRA together with the CPUC conducted an audit of the ATSF train operations at Cajon Pass and the ATSF mechanical inspection and repair facilities at Barstow. The audit involved over 100 FRA and CPUC inspectors in teams who found, according to the FRA, process and communications problems. The FRA worked with the CPUC, labor unions, and ATSF management to address the problems and to develop solutions for them. The audit procedures included group partnership meetings in which the FRA, CPUC, and ATSF labor and management discussed safety and operational concerns. The FRA and CPUC later conducted two additional audits. The first follow-up audit, about 5 weeks after the initial audit, included 56 inspectors, and the second follow-up audit, about 3 months after the initial audit, involved more than 40 inspectors. Atchison, Topeka and Santa Fe Railway Company--Since the accident, the ATSF has employed an independent contractor to audit its management and policies and to encourage increased feedback from operating crews to ensure carrier rules and instructions are being complied with. In a May 1996 letter to the Safety Board, the ATSF assistant vice president of technical training and rules advised that the following actions have been implemented since February 1, 1996: Removal of a flange oiler, on the south track at MP 56.9. Required that all westbound trains have an armed two-way ETD before leaving Barstow. If a two-way ETD loses its continuity after leaving Barstow, continuity must be regained or helpers added to the train prior to passing Summit. Railroad Accident Report--Collision and Derailment of Montana Rail Link Freight Train with Locomotive Units and Hazmat Release, Helena, Montana, February 2, 1989 (NTSB/RAR-89/05). 40 38 Required that all eastbound trains have an armed two-way ETD before leaving Los Angeles. If continuity is lost between Los Angeles and San Bernardino, continuity must be reestablished or helper added to train before passing Baseline. All crewmembers working the San Bernardino or Cajon Subdivisions are required to have “hands-on-training” in arming and disarming two-way ETDs. An eight foot chain link fence with razor wire was installed on both sides of the right-of-way between MPs 56 and 54.2 on the Cajon Subdivision. The fence was also gated at both ends. Lights were installed between MP 56 and MP 54.2 on the Cajon Subdivision. Twenty-four hour manned security has been provided between Hesperia and Summit. The flow chart in the timetable was revised making it more restrictive, in the form of having more axles of dynamic brake for westbound trains leaving Summit. Set up a reporting procedure out of Schaumburg to track problems encountered with two-way ETD’s. Also monitor any air brake problems that develop to a train while on the San Bernardino or Cajon Subdivisions. Smart repeaters [which enhance the radio signals in remote areas] were installed at Barstow, Victorville, Martinez Spur, and Los Angeles to further ensure uninterrupted performance between the ETD and control head on the two-way devices. Also since the February 1996 accident, the ATSF has had the event recorders from all westbound trains over Cajon Pass reviewed at the end of every trip. It additionally has instituted a guidance program in which senior locomotive engineers consult with the junior engineers and counsel them on train operations over Cajon Pass. The ATSF and Calnev have also exchanged lists of their emergency telephone contacts and numbers. The ATSF has also added “pipeline operators” as a line item on its emergency notification checklist for accidents occurring in California. On May 15, 1996, the ATSF asked the AAR to consider affixing a plate, engraved with the tank car reporting mark and identification number, on each tank car. The ATSF stated that an engraved plate would assist in the identification of tank cars whose painted markings and numbers have been destroyed by fire. The AAR tank car committee, after a discussion at its July 1996 meeting, concluded that the ATSF proposal would not make a significant improvement and voted to take no further action. 39 this page intentionally left blank ANALYSIS General Factors Although the H-BALT1-31 engineer encountered rain at the time of the derailment, he reported that the weather did not adversely affect the operation of train. The track had been inspected by a qualified track inspector on January 31, 1996, and no defects were noted at or near the derailment site. The signal system had been inspected and tested shortly before the accident, and no defects were indicated; the postaccident signal testing found no deficiencies. HBALT1-31 was operating on a clear (proceed) signal indication, as intended, and in accordance with the applicable rules and regulations in effect at the time. The train crewmembers were qualified to perform their respective duties and met the off-duty requirements as specified in the Hours-ofService Act. No evidence of traincrew fatigue was indicated. The postaccident toxicological test results for the traincrew and the dispatcher were negative. The alcohol present in the brakeman’s blood specimen was attributable to postmortem microbial ethanol production and not antemortem alcohol ingestion. Therefore, the Safety Board concludes that neither the weather, the track, nor the signal system either caused or contributed to the derailment. The train crewmembers were in compliance with the requirements specified in the Hours-of-Service Act and were qualified to perform their duties; no evidence of fatigue was found. Neither drug nor alcohol use was a factor in the derailment. The following discussion reviews the sequence of events leading to the derailment and examines the lack of Federal and management oversight in the use of two-way end-of-train devices, the adequacy of operating personnel training in the use of two-way end-of-train devices, the carrier compliance with Federal regulations for event recorders, and the adequacy of wreckage removal operations for tank cars containing hazardous materials. In addition, three scenarios will discuss possible circumstances that could have caused a blockage in the train line of freight train H-BALT1-31. Accident Narrative Review ATSF freight train H-BALT1-31, operating in accordance with the carrier timetable instruction, was traveling westbound on the south main track through Cajon Pass. The train received an initial terminal air brake test at Barstow and the braking system was functioning as designed. The train made at least three stops from Barstow to Summit with no anomalies reported. The first severe grade that HBALT131 encountered was at Summit. After the train departed Summit, the engineer engaged the dynamic braking system as the train crested Cajon Pass, which would cause braking concentration to occur on the head end of the train, forcing the balance of the train to bunch toward the engine consist. The bunching of the train would allow the engineer more train control by compacting its length during the braking sequence. Allowing the train to stretch would introduce additional forces to the train draft gear system. The engineer stated that as he encountered the severe grade, he felt no brake reaction as the speed increased and told the traincrew that he was going to make a fullservice brake application. The engineer said that he made the full brake application, which appeared to be futile as the train speed continued to increase. The conductor and the brakeman then exited the cab out of the engineer’s sight and were either thrown from the engine platform when the train derailed or jumped just as the derailment occurred. The engineer remained in the control compartment at the control stand, attempting to recover the air system, and he 41 reapplied the full braking system, which again proved to be a futile attempt. The engineer unsuccessfully employed all means at his disposal to slow or stop H-BALT1-31. Now, 13 minutes after the train had left Summit, it approached the curve at MP 60.4. The loss of braking power appears to have caused the train to reach speeds that were equal to or greater than the rollover speed for the curve a MP 60.4; thus, H-BALT1-31 left the track, derailing all but its last four cars. Locomotive ATSF 157 impacted a relatively flat sand creek bed and did not strike any substantial fixed objects or large rocks. This impact resulted in low decelerative crash forces, as evidenced by the lack of severe damage to the exterior structure of the cab, and the control compartment of locomotive did not sustain any major intrusion. The structural integrity of the cab was maintained and provided interior space for the survivability of the engineer. The engineer sustained his serious injuries as a result of striking the interior surfaces of the control cab when the locomotive rolled onto its right side and slid along the creek bed. The conductor suffered his fatal injuries (blunt force trauma to the head and chest) when he contacted the ground after jumping or being thrown from the locomotive or was hit by flying debris from the derailing rail cars. The brakeman also jumped or was thrown from the locomotive, but he received his fatal injuries from the fire. The absence of any severe head injuries or major blunt trauma, according to the medical examiner, may indicate that the brakeman crawled to the location in the creek bed where he was found, and afterward the fire eventually reached him. Therefore, the Safety Board concludes that had the conductor and the brakeman remained in the control compartment cab of the locomotive, they likely would have survived because the cab survival space was adequate. California Department of Forestry and Fire Protection firefighting vehicles were dispatched within 1 minute of accident notification, the initial incident command post was established 34 minutes later, and the first fire engine arrived on scene 1 minute after that. The forestry and fire protection department IC responded to the scene within 59 minutes of his notification and employed the incident command system throughout the incident. The seriously injured engineer was removed by ambulance from the derailment site within 1 hour 16 minutes. The IC established the incident command post at the Mormon Rocks fire station and staging areas, assigning other forestry and fire protection department officers and a U.S. Forest Service chief to assist in managing the accident. Numerous Federal, State, county and local agencies were available to address environmental concerns and provide resources to the IC. Given the catastrophic size of the overall train fire and the unknown chemical hazards with potential risks to firefighters, the decision not to fight the fire was prudent. The firefighters continued to cool the burning cars and extricate them from the pileup, thus minimizing the risk of injury. Therefore, the Safety Board concludes that the local emergency response was timely and adequate, given the remote location of the derailment, and the IC acted effectively and managed the incident successfully to completion without serious injury to responders, local residents, or officials at the scene. Train Line Continuity Loss The Freightmaster, Inc., train dynamics analyzer simulation results were consistent with a blockage or restriction in the train line between the fifth and ninth cars. This simulation analysis, based on the event recorder transit time from Summit to the POD and the calculated turnover speed of 70-plus mph at the POD, indicated that with three or more working dynamic brakes and a minimum of 16 cars braking, the train would have either stopped or negotiated the derailment curve without serious incident. Thus, the simulation results eliminated 42 the 16th car, ATSF 90033, as causing or contributing to the inability of the train to stop. The simulation remains a valuable diagnostic tool, but by itself, is not conclusive. The Safety Board is aware that the simulations did not have all data necessary, such as unrecorded speed, to perform an absolute test and that a change in a variable would change the outcome of a test. The simulations also depended upon many assumptions and conditions that are uncontrolled in real operating situations. The exact starting point of the train at Summit and the engineer’s use of his dynamic braking were assumed or estimated. However, using the data that were available, the tests disclose that with four dynamic brakes and nine cars braking, HBALT1-31 lacked sufficient braking power to allow it to negotiate the curve at MP 60.4 (POD). Although the simulation results indicate a blockage near the fifth through ninth cars, the Safety Board is not convinced that a blockage could occur only in that area. Thus, the Safety Board considered the possibility that one or more factors caused the loss of continuity to the train line. Because the evidence involving the loss of train line continuity was inclusive, the Safety Board developed three scenarios that might identify a possible cause for the train line blockage or restriction that culminated in the derailment of H-BALT1-31. These scenarios include a kinked air hose (on a cushioned underframe car), a closed angle cock, and a foreign object or debris in the system. train and resulted in the loss of air brake control. (Such a phenomenon is empirically attributed more to cushioned underframe cars than to conventional draft gear cars.) Because of the train line relationship to the undercarriage on cushioned underframe cars, these cars are more susceptible to incur a kink in their train line. The movement of the draft system requires that the train line also be fluid in motion as the rail car moves. The cushioned underframe cars have this extra movement to buffer the forces encountered in the moving car, which offers more protection for the lading of the car. Initially, the investigation had focused on the cushioned underframe car, ATSF 90033, which was the last car added to the train after the repair at Barstow. The Freightmaster, Inc., simulation later eliminated this car as a source of a blockage because the car was too far back (16 cars) in the train to have prevented the engineer from safely stopping or slowing the train for the accident curve. The simulation also indicated that most of the other cushioned underframe cars (11 through 13) in the consist were probably not involved. These cars also were not within the five- to eight-car blockage or restriction zone that the simulation identified as necessary to meet the derailment speed, time, and location. The fifth car in the consist, SFLC 10005, was a cushioned underframe car and within the effective position for a blockage, as identified by the simulation. However, the derailment sequence, subsequent fires, and wreckage movement prevented close inspection of car SFLC 10005 and precluded constructing a timely simulation. Car repair records for car SFLC 10005 showed no history of intermittent problems indicative of hose kinking or restriction. Investigators were unable to find any brake hoses that appeared to have been kinked or crimped before the accident or that could be identified to any particular car in the suspect zone (cars five through eight) of the train. Kinked Air Hose--A crimp or kink in the air brake hose could block or restrict the train line. Such a crimp or kink will generally occur in a worn or damaged hose or in a hose connected to an unauthorized design or repair. As H-BALT1-31 began its descent to Cajon, the slack in the train couplers and draft gear bunched together. The slack action may have bent or crimped an air brake hose that pinched off air flow from the engines to the rear of the 43 Attempting to determine the likelihood and frequency of kinked hoses, Safety Board investigators, therefore, inspected other cushioned underframe cars. The postaccident inspection of the five sister cars to ATSF 90033 for condition and design consistency of the endof-car air hose arrangement revealed three predominate styles of air hose arrangements and several cars having different arrangements at each end. Each of the three predominate styles of air hose arrangement had several customized subversions. Only a few of the air hose arrangements, as found on the sister cars, remained true to the modification drawing arrangement or the manufacturer drawings. One of the greater differences between arrangements was the length of the pipe that attached to the flexible glad-hand air hose, which varied between 6.5 and 45.5 inches. The Safety Board, therefore, concludes that a wide deviation of end-of-car hose arrangements on cushioned underframe cars from the approved end-of-car hose arrangement design is not uncommon and may induce an air hose to kink in operation and block or restrict a train line. Consequently, the Safety Board believes that the BNSF should inspect the end-of-car hose arrangements on its cushioned underframe cars and ensure the hose arrangements match the intended design. In addition, the Safety Board believes that the AAR should inform its member carriers about the circumstances of this accident and alert them to inspect the end-of-car hose arrangements on cushioned underframe cars and ensure the hose arrangements match the intended design. The ATSF Barstow car shop had repaired the car ATSF 90033 but had no references or drawings on which to base the repair of the brake pipe and the end-of-car hose arrangement of the car and, thus, made the repair to match the other end of the car. If a reference of standardized hose arrangement drawings had been readily available to the carmen, no confusion should have existed or questionable repair have been made to car ATSF 90033. The Safety Board concludes that had the Barstow car shop made hose arrangement reference manuals readily available, the carmen could have used guidelines to properly repair the train line on ATSF 90033. Therefore, the Safety Board believes that the BNSF should provide its carmen with readily available means to identify the proper design or specific type of end-of-car hose arrangement on cushioned underframe cars to preclude a possible improper repair or modification. The Safety Board also believes that the AAR should ensure that its member carriers provide carmen with readily available means to identify the proper design or specific type of end-of-car hose arrangement on cushioned underframe cars to preclude a possible improper repair or modification. A severe grade, such as at Cajon Pass, could induce a situation in which the bunching of the train could cause a kink in the air system of a cushioned underframe car. Before H-BALT1-31 reached Summit, it had operated over terrain that could have caused the train to bunch. However, the grades were not as steep as the one at Cajon Pass, and according to the engineer, the brakes were functioning as he stopped H-BALT1-31 at Summit. In addition, Safety Board investigators were unable to examine the train line of either car ATSF 90033 or SFLC 10005 for any evidence of kinking because of the damages incurred from the derailment sequence and ensuing fire. Although the first scenario is plausible, sufficient evidence was not available to make a conclusive determination. Closed Angle Cock--The sooting on the ball key of the Sloan angle cock valve from ATSF 92018 indicated that the valve was in the closed position before the fire reached and charred the attached hose. The hose was still intact when the valve was removed from the car. However, other cars that were involved in the fire sequence had their rubber hoses burned off completely. Therefore, the rubber hose on the angle cock from ATSF 92018 did not appear to be as involved in the fire as did those of the 44 other cars in the train. The accident area was open to numerous personnel before being roped off. With this open access, someone could have had an opportunity to close the angle cock, and then, the fire reached the car later. Furthermore, the bending of the handle pivot pin and lug, which prevented unencumbered movement of the handle, strongly suggests that the valve was in the closed position when damaged. The most likely time for such damage to occur was during the derailment; however, for damage to occur during the recovery process cannot be discounted. Several previous railroad derailments investigated by the Safety Board have involved turned angle cocks from theft and vandalism.41 However, Safety Board investigators found no material evidence of vandalism in this accident. The practice of stopping westbound trains at Summit presents the opportunity for tampering with a train brake system. During the 16-minute stop of H-BALT1-31 at Summit, ample opportunity existed for unknown people to tamper with any angle cock on any car in the train. Although the crew saw no one, the darkness and the open terrain sufficiently allowed for someone not to be sighted by a crew. No definitive physical markers or artifacts as to the position of the angle cock valve from ACFX 84070 at impact were uncovered. The presence of sand inside the key slot and the hose side inlet demonstrates that the valve was open when the sand was introduced but does not establish a time at which it was closed. One possible scenario is that the valve was open at derailment, with sand and water being introduced during the fire suppression process, and was closed during the recovery process. In addition, the Safety Board photograph of car ACFX 84070 taken 2 days after the derailment discounted tampering for its angle cock retrieved in the closed position. This photograph indicates that the angle cock was in the open position 2 days after the derailment and provides evidence that the subsequent change happened after the accident and not before. Because of the damage incurred to the rail cars from the derailment sequence and the subsequent fire, the Safety Board was unable to examine the angle cocks on all cars in the derailment. According to the train simulations, the blockage would need to have occurred in the initial 15 percent of the train. The Safety Board was unable to match any of the other angle cocks found in the closed position to the first eight cars in the consist or to find any turned angle cocks on any of the locomotives or the first 10 cars in the consist. The evidence was insufficient to indicate a closed angle cock was the blockage that resulted in the loss in train line continuity, causing the derailment. This second scenario may also be plausible, but again, sufficient evidence was not available to make a conclusive determination. Foreign Object or Debris--The derailment sequence, ensuing fire, and postaccident activities prevented a timely examination of the cars by the Safety Board to find any evidence of debris in the train line causing a blockage. However, the blockage of a train line from a foreign object or debris is a remote possibility, and such occurrences are relatively rare because of the number of times cars and trains have air brake tests. The predeparture air brake tests on H-BALT1-31 at Barstow and the handling of the train to Summit do not indicate any debris blockage or restriction. Also, with the length of time the train was in operation before the derailment and the constant air pressure in the train line, any significant debris that could cause a blockage 41 Railroad Accident Report--Collision and Derailment of Southern Pacific Train at Garnet, California, August 23, 1986 (NTSB/LAX-86-FR-015) and Railroad Accident Report--Derailment of Burlington Northern Train at Spokane, Washington, December 24, 1991 (NTSB/LAX92-FR-006). would likely have been detected by the 45 engineer, who stated that his brakes were operating up to and including his stop at Summit. A foreign object or debris suddenly positioning itself to block the train line appears very unlikely. Two-way End-of-Train Device Operation An armed two-way ETD offers a key safety advantage over a one-way ETD because the two-way feature allows a traincrew to telemetrically initiate an emergency brake application from the rear of the train forward. Emergency braking, employing the train brakes, propels backward from the locomotive through the train and is enhanced because similar braking forces can be concurrently activated from the rear of the train. Thus, the rapid reduction of pressurized air from two opposite moving directions should cause the brakes on all cars to engage up to and including the point where any restriction in the train line might be located. The emergency braking action initiated from the locomotive without the aid of an armed two-way ETD would be effective up to the point that air encountered a blockage in the train line. Under such circumstances, the amount of effective braking would be dependent upon where the restriction occurred in the train line; the closer the blockage was to the front or rear of the train, the less braking effort would be available. Inadequate or nonexistent airflow at the blockage point would preclude the activation of emergency brakes on all cars behind the blockage. Armed two-way ETDs are proven critical hardware components that can assist a traincrew during a braking emergency and, thus, promote a safe operational environment. Therefore, the Safety Board concludes that had H-BALT1-31 been equipped with a fully functioning two-way ETD, the engineer could have applied the brakes from the rear of train and the derailment may have been avoided. Water may have been introduced into the train line from cars already contaminated by poorly maintained air systems or from air at the Barstow yard. Water contamination may create local air brake problems within a train line; however, such contamination generally is unable to block a train line unless the air temperature is below freezing. The ambient temperature around Barstow was not cold enough to freeze any water contamination in a train line. The cars that made up H-BALT1-31 had been at Barstow from 6 hours to several days, which is sufficient time to melt any ice having formed on the trip west. After a thorough and an exhaustive investigation effort, the Safety Board could not identify what caused the loss of train line continuity on freight train H-BALT1-31. Although the three scenarios offer possible means for such blockage to occur, no evidence was found to give credence to one over another. The most likely event that caused the loss of train line continuity was an undetermined blockage or restriction from unknown origins somewhere in the train line. Because the blockage origin and location is unknown, any one possibility or combination of possibilities could have caused the loss in train line continuity. Therefore, the Safety Board concludes that an unknown train line blockage or restriction, probably between the fifth and ninth cars, resulted in responsive brakes only on the locomotive units and possibly the first eight cars, and, thus, the engineer was unable to slow or stop H-BALT1-31. Federal Railroad Administration Oversight--At the time of this accident, no comprehensive industry guidelines were in effect for the implementation and the usage of two-way ETDs or any other methodology that provides the capability to initiate an emergency brake application from either end of a train. In addition, no industrywide directions addressed 46 the issue of the inability to arm an ETD. After the derailment of H-BALT1-31, the FRA issued emergency order 18 that addressed the safety recommendations previously issued by the Safety Board asking the FRA to require the use of two-way ETDs on all trains without cabooses. Had the FRA initiated its February 1996 action after the December 1995 Safety Board recommendation was issued, this accident may have been avoided. The use of two-way ETDs in mountainous grade territory may have prevented or mitigated the December 1994 and February 1, 1996, accidents at Cajon Pass. The Safety Board concludes that the FRA failure to require the capability to initiate an emergency brake application on either end of a train in mountainous territory after the 1989 Helena, Montana, accident and its failure to take immediate action after receiving the Safety Board recommendation resulting from the 1994 Cajon Pass accident may have contributed to the cause of this accident in 1996. of the conductor and brakeman. Wayside defect detectors now monitor the train for hot journals or dragging equipment and automatically radio the data to the engineer. The one-way ETD provides a red marker light and transmits the brake pipe pressure to the head-end display. The only function lacking was the capability of applying the emergency brakes from the rear of the train, and the development of the two-way ETD filled this void. The Safety Board is pleased with the railroad industry commitment and progress to voluntarily install two-way ETDs on all required trains by June 1997; however, the industry action has come unduly late. The Safety Board first addressed the need for two-way ETDs after its investigation of the 1989 accident in Helena, Montana. The December 1994 Cajon Pass accident again highlighted the necessity for twoway ETDs on freight trains. Had the railroad industry taken voluntary action to adopt twoway ETDs when the need was initially identified then the H-BALT1-31 derailment might have been avoided. Railroad Industry Inaction--When freight train consists included cabooses, the capability to apply emergency brakes from the rear of the train was secured. The railroad industry has long been aware of the benefits of having that capability. Cabooses had always been equipped with an emergency valve that allowed the conductor to apply emergency brakes from the rear of the train. Additionally, they had rear-end marker lights to protect the end of the train. The conductor and other crewmembers in the caboose reported the rearend brake pipe pressure to the engineer so he knew when the air brakes had been applied or released on the last car. The caboose crew also inspected the train for dragging equipment, hot journals,42 or shifted loads. Then, cabooses were eliminated, and technology replaced those duties 42 Part of a rail car axle. Management Oversight--ATSF rule 30.6, 30.7, 30.10, 30.11, 30.13, 30.14 was put into effect after the December 1994 collision between two freight trains at Cajon Pass at almost the same location as this accident. In March 1995, ATSF senior management wrote to the Safety Board and agreed to change their operating practices, which resulted in the above cited rule. The ATSF senior management also agreed to implement train use of two-way ETDs on Cajon Pass as soon as the equipment became available, which amended ATSF air brake rule 30.27 in the section of the timetable that contained special instructions for all subdivisions. (See appendix D.) The amendment details how a two-way ETD is to be tested and its operation is to be verified. However, no instructions were in the timetable about what actions to take should the two-way feature fail the test or should the two-way ETD not to be operational. In addition, the ETD was not 47 required to be operational in the two-way mode before the train proceeded. ATSF general orders 67 and 130 address the usage of the ETD system with no direct reference to the two-way system. General order 67 states that the engineer must report an improper operation of the ETD; however, whether this interpretation was applicable to a two-way ETD that was still functioning properly as a one-way device is unclear to the Safety Board. The ETD on train H-BALT1-31 was functioning properly as a one-way device, and general order 130 specifically allows a train to depart the terminal even when the crew are unable to arm the two-way system. The engineer of H-BALT1-31 told Safety Board investigators that he was not aware of any requirement to report the inability to arm a two-way ETD system and, thus, had not reported the improper operation of the two-way ETD on H-BALT1-31. He said that he had often operated trains down Cajon Pass without a functioning two-way ETD. Other ATSF locomotive engineers who had operated trains over Cajon Pass told Safety Board investigators that they also had often operated trains down the pass without operational two-way ETDs. Departure from Barstow with an unarmed two-way ETD was a common practice that was accepted and condoned by the local ATSF management. The Safety Board therefore concludes that the engineer of H-BALT1-31 was not aware of any requirement to report the inability to arm a twoway ETD system and, consequently, did not report the improper operation of the two-way ETD on train H-BALT1-31 to the train dispatcher and customer quality support, as required under rule 67 (B). Furthermore, the director of train handling who wrote the amendment to rule 30.27 stated that instructions for two-way ETDs that failed the test were covered under general order 130. He later said that subsequent to the accident that had occurred in December 1994 on Cajon Pass, the carrier had committed to purchasing and installing two-way ETDs as well as installing HED units on its locomotives as soon as the equipment became available from the manufacturers. At the time rule 30.27 was amended, the carrier had not procured enough units to equip all of its trains. The director of train handling added that because of the procurement circumstances, a crew could acceptably operate a train down the grade on Cajon Pass without a functioning two-way ETD or another method of initiating an emergency brake application from the rear of the train. The rule assumed that the engineer has sufficient braking power to stop or slow a westbound train through Cajon Pass. Although numerous trains were departing Barstow and descending the grade at Cajon Pass without functioning units, local ATSF officials took no corrective action because the rule did not require a fully functional device. Because of a mudslide in the Cajon area, the traincrew went off duty, and until they returned, HBALT1-31 was delayed for departure and was idle for over 4 hours in Barstow. During that time, no measures were taken to find the cause of the com/test fail that the engineer had received during the arming sequence. The ATSF took no exception with a westbound train leaving Barstow yard with an unarmed two-way ETD, and no procedures were in place to test for a faulty HED or ETD should a traincrew encounter a problem in arming an ETD. The Safety Board understood from the stated commitment of the ATSF senior management after the December 1994 accident that the use of two-way ETDs meant fully functioning devices. The vice president of operations stated that the ATSF intent was ultimately to have two-way ETDs on all westbound trains through Cajon Pass; however, the final result was a rule that allowed trains to proceed westward without a fully functioning two-way ETD. The practice of allowing westbound trains to depart Barstow without a fully functioning two-way ETD should have been evaluated as the equipment 48 became available. In addition, the carrier failed to assess the risks associated with trains leaving Barstow without fully functioning two-way ETDs, and no procedures or guidance were made available for traincrews in the event they were unable to arm the system or encountered a catastrophic system failure en route. Therefore, the Safety Board concludes that the ATSF management failed to ensure the use of fully functioning two-way ETDs on westbound trains over Cajon Pass. On December 15, 1995, in Safety Recommendation R-95-48 to the BNSF, the Safety Board had asked that all Class I Railroads, pending the adoption of a formal rule by the Federal Railroad Administration, implement the use of Two-Way End-of-Train devises on all cabooseless trains by March 31, 1996. The BNSF responded that because of a shortage of two-way ETDs, the carrier is precluded from complying with this recommendation; however, as more of these devices become available, it intends to equip cabooseless trains with them. This recommendation is classified “Open-Acceptable Response.” ATSF management failed to ensure that operating crewmembers received comprehensive training on the proper procedures required for arming two-way ETD operation; although, investigators did not find that lack of training contributed to this accident. The Safety Board is pleased that the ATSF has made revisions to the ETD training program in the aftermath of this accident and understands that the BNSF now ensures that all operating personnel whose duties require them to use a two-way ETD receive comprehensive training and demonstrate proficiency in its use. However, the circumstances surrounding the collision on December 14, 1994, in Cajon Pass should have compelled the ATSF to expeditiously establish a comprehensive ETD training program, which also could identify performance deficiencies and remedy them with additional instruction. A systematic instructional approach would promote the efficient, uniform tracking of employees to avoid any training duplication or omission. End-of-Train Device and Head-End Device Operation The telemetry system tests revealed that the HED could not be operated as a two-way system before the accident since the insufficient power from the transmitter module of the unit would not allow a two-way emergency braking system to arm. The crew could not arm the system for two-way operation before H-BALT1-31 departed Barstow because of this mechanical failure, and the system must be armed to use the emergency brake function of two-way operation. (The system could be operated as a one-way system since the transmitter is not needed for one-way operation.) Therefore, the Safety Board concludes that the failure of the transmitter module of the HED on locomotive ATSF 157 to generate sufficient wattage power would not allow the engineer of H-BALT1-31 to arm the two-way HED/ETD system. Unsuccessful arming attempts are indicated in a Operating Crew Training--The H-BALT1-31 engineer knew the proper procedures required to successfully arm a twoway ETD. The engineer stated that he had read and understood the procedures associated with arming the system and had received instructions from the manager of training operations. He also said that he had experienced a "fifty-fifty" success in arming ETDs. The engineer acquired the arming procedure method essentially on the job and not in association with a comprehensive training program. The Safety Board was unable to document whether the other two crewmembers had received training specifically pertaining to two-way ETD operations or were knowledgeable of the correct procedural method. Their knowledge of the two-way ETD was likely also gained through informal means. The Safety Board, therefore, concludes that the 49 multi-purpose status window on the HED, but unless the system is already armed, a malfunctioning transmitter will not be indicated to the operator. An armed system performs a communications test every 3 minutes that evaluates both the HED and the ETD. If four subsequent automatic tests fail, then a flashing indicator light on the HED informs the crew that communications are unreliable. The H-BALT131 crew would have been informed that the arming attempts were not successful; however, they would not know why. This particular HED has several auxiliary functions in addition to transmitting and receiving information from the ETD. The telemetry system test revealed that when the HED is being employed for auxiliary functions, such as odometer use, mile calibration, train length input, or setup functions, the emergency brake function is deactivated; thus, pressing the emergency button on the HED has no effect. When being used only to communicate with the ETD, the status window displays the brake pipe pressure at the end of the train and indicates whether the ETD is in motion. When any auxiliary function is used, the status window reflects information about that particular function. During the test, the emergency brake could be activated only when the status window displayed the brake pipe pressure and ETD motion status. Had the transmitter in the HED been functioning normally and the system armed for two-way operation, the engineer likely would not have been able to activate the emergency function had he been using the HED for any function other than monitoring the brake pipe pressure. Even had the crewmembers received appropriate formal training in the operation of the system, the additional steps required to initiate an emergency brake application can cause confusion and delay in, if not prevent, the application of the emergency brake valve at the rear of the train. After the accident, the ATSF began phasing out these HEDs in their two-way ETD system. Although 430 of these HEDs were operated as a one-way device only as of October 22, 1996, none was equipped with the old firmware, which required additional actions to initiate the emergency braking function from the rear of the train. Event Recorder Maintenance and Placement The event recorder system installed on locomotive ATSF 342 did not record any wheel data, and, consequently, no speed or distance data could be calculated. Postaccident testing at Q-tron revealed that the axle generator was wired and reassembled in a manner inconsistent with the manufacturer specifications. The Safety Board, therefore, concludes that the wheel data were not recorded due to a broken wire in the axle generator as a result of an improper modification to the axle generator. The event recorder on locomotive ATSF 342 was a microprocessor-based type equipped with a self-test function. The ATSF stated that it had an understanding with the FRA that this type of recorder would require a download and inspection on an annual verses a quarterly basis; therefore, this event recorder was not inspected during the December 1995 quarterly inspection. In addition, the ATSF did not inspect or download the recorder during the most recent annual inspection before the derailment (June 12, 1995). However, the FRA indicated that no such agreement existed between it and the ATSF and that, citing the existing requirement for event recorder maintenance, any such agreement would not be an issue. The engineer testified that he had received no formal training on the operation of the twoway telemetry system, and, therefore, he was likely unaware that the emergency brake function is disabled when the HED is used for other functions and that additional steps are needed to use the emergency brake function. 50 Microprocessor-based event recorders with the self-test function are exempt from quarterly inspections. Under 49 CFR 229.25(e)(2), “A micro-processor based event recorder, equipped to perform self tests, has passed the premaintenance inspection requirement if it has not indicated a failure.” Unless indicating a failure, microprocessor-based event recorders with the self-test function never have to be downloaded or tested. Thus, the Safety Board concludes that the FRA regulations for the periodic inspection of event recorders are inadequate. During postaccident testing, the self-test function indicated no faults, and the recorder was found to be fully operational and within manufacturer specifications. The speed had not been recorded because of a failed axle generator, which sends the speed data to the event recorder. Additionally, the event recorder on locomotive ATSF 342 was found to have been improperly programmed, which resulted in the recording of certain parameters only once every 8 minutes. Because the timing was programmed into the configuration of the event recorder, the self-test function of the event recorder did not identify it as a fault. After the accident in Milford, Connecticut, on October 3, 1995,43 involving a commuter rail control car that had been serviced before the accident, Safety Board investigators found the axle generator was not adjusted properly following the service, and as a result, no speed data were recorded. This event recorder was also a microprocessor-based with a self-test function and indicator light. During the postaccident testing, the self-test function showed no faults, and the event recorder was fully functional and within the manufacturer specifications. The Safety Board is investigating a grade crossing accident which occurred in Tickfaw, Louisiana, on May 27, 1996. Although the investigation is still ongoing, preliminary findings show that two of the inputs to the event recorder were wired incorrectly, resulting in anomalous data being sent to the event recorder. Inspection records reveal that the event recorder was inspected 2 days before the accident and no problems were reported. However, because it was a microprocessor-based and self-test event recorder, the inspection procedure was only a status check of the self-test indicator light on the outside of the event recorder. The self-test functions of existing event recorders do not test speed and other data inputs for validity; as a result during quarterly inspections, failures, such as those noted above, are unnoticed if the sole means of inspecting the event recorder is the self-test function of the event recorder. The Safety Board concludes that had the entire event recorder system from locomotive ATSF 342 been properly tested during the December 1995 quarterly inspection, both the broken speed sensor and the improper configuration of the event recorder would likely have been noticed and corrected at that time. Therefore, the Safety Board believes that the FRA should revise 49 CFR 229.25(e)(2) to require that event recorders, including microprocessor-based event recorders that are equipped with a self-test function, be tested during the quarterly inspections of the locomotive in such a manner that the entire event recording system, including sensors, transducers, and wiring, is evaluated. Such testing should include, at a minimum, a review of the data recorded during actual operation of the locomotive to verify parameter functionality as well as cycling all required recording parameters and determining the full range of each parameter by reading out recorded data. After this accident, the ATSF could not provide any documentation that the ATSF 342 event recorder was ever tested or inspected in Highway Accident Report--Highway/Railroad Grade Crossing Accident, Metro North Commuter Railroad, Milford, Connecticut, October 3, 1995 (NTSB/NRH-96-MH-003). 43 51 accordance with 49 CFR 229.25(e), nor could it provide statistical information about the pass/fail rate of its locomotive event recorder inspections. Title 49 CFR 229.25(e)(5) requires that 90 percent of all event recorders inbound for quarterly inspections be fully functional. The Safety Board concludes that the FRA was not monitoring the compliance of the carrier with periodic inspections of event recorders as prescribed under 49 CFR 229.25(e)(5). Therefore, the Safety Board believes that the FRA should develop and implement a program that specifically addresses carrier compliance with 49 CFR 229.25(e)(5). Had this event recorder system been inspected and tested at the most recent 92-day periodic inspection on December 14, 1995, by downloading the recorded data and evaluating it, the failure in the axle generator and the improper recorder configuration, if existing at that time, should have been noted and corrected. The diagnostic testing would indicate whether the recorder was working but would not show what, if any, type of data was being recorded by the unit. Only by downloading the unit can the type of data being recorded be examined. The H-BALT1-31 consist had an event recorder that was not fully operational. The selfdiagnostic light on the unit was insufficient to fully examine the unit and ensure that it was recording the data. The FRA required that the carrier indicate whether a locomotive is equipped with an event recorder in the remarks section of form F6180-49A. Under 49 CFR part 229.135, “any train operated faster than 30 miles per hour shall have an in-service event recorder in the lead locomotive. The presence of the event recorder shall be noted on Form FRA F6180-49 A, under the REMARKS section.” In so doing, the opportunity for oversight is present: first, the carrier not listing the event recorder for inspection on form F6180-49A, and second, the inspector not observing the remarks section on the back of the form. Consequently, the Safety Board concludes that FRA form F6180-49A is not adequate for recording the inspection of event recorders and allows oversights to be perpetrated during inspection procedures. By revising this form to include the event recorder in the other items to be inspected section, an inspector likely would not overlook examining the event recorder. Therefore, the Safety Board believes that the FRA should revise its form F6180-49A to include event recorders in the other items to be inspected section on the form. In its preamble to the final rule on event recorders (58 Federal Register 36610-11), the FRA advised that it “has determined that the recorder will be most helpful if it records the events happening in the locomotive occupied by the engineer, that is, the lead locomotive.” The final rule stated that all trains traveling faster than 30 mph must have an event recorder in the lead locomotive; however, a petition for reconsideration was filed, and as a result, a clause was added to the final rule that allows placement of the event recorder “elsewhere than the lead locomotive.” Also in response to the petition, the FRA reiterated that its “primary concern is still as it was when the preamble was written: to provide the best data for analysis, the recorder must capture what the engineer sees and does” but determined that requiring the event recorder to be placed in the lead locomotive was “unnecessarily geographically strict.”44 The provision allowed that if the event recorder monitored and recorded the required data as though it were located in the lead locomotive, the event recorder could be placed elsewhere than in the lead locomotive. The Safety Board is concerned that the result of allowing the recorder to be placed elsewhere than in the lead locomotive is not as the FRA intended. One alternative practice, placing the event recorder in any locomotive that is train 44 Federal Register, Volume 60, Number 102, May 26, 1995. 52 lined to the lead locomotive, does not result in monitoring and recording the required data as though it were located in the lead locomotive. The train line data are intended to be the same for all locomotives in the train line so the control inputs made by the crew in the lead unit are carried out by the trailing locomotives as well. In the preamble to the final rule, however, the FRA noted: Only the lead locomotive’s device will record the engineer’s actions in throttle control or in setting up the dynamic brake – recorders in trailing units will note the ‘message’ received, the action they were requested to take, but only the lead locomotive will record the direct input of the person in control. Furthermore, those parameters that are monitored locally can only reflect the condition of the locomotive on which the event recorder is installed and are not shared among locomotives through the train line. Therefore, event recorders installed on trailing locomotives are not capable of recording any parameters that are local to the lead locomotive. Train speed and independent brake are two of the locally sensed parameters required under 49 CFR 229.5(g) to be monitored and recorded. Actual speed will be the same for a trailing locomotive and lead locomotive; however, speed is derived from a signal-generating device, which is attached to the locomotive axle generator. Should an event recorder be installed in the third unit of a locomotive consist, it monitors the third unit axle generator signal and not the lead unit signal. Axle generator signals can vary significantly from locomotive to locomotive; consequently, an event recorder in the third unit cannot monitor and record speed as though it were in the lead locomotive. A locomotive is typically configured to use the axle generator to provide data to the speed indicator in the cab as well as to the event recorder. To best monitor what the engineer sees, the speed signal in the engineer’s locomotive unit should be recorded, as opposed to a signal in a trailing locomotive, and could prove important should the axle generator fail or be improperly adjusted. As speed indicators are required under 49 CFR 229.117 to be tested “as soon as possible after departure,” any anomalies in the speed sensing and recording system are likely to be noticed in a timely manner. A malfunction in the speed system of a trailing locomotive could go unnoticed for extended time, as occurred in this accident. Independent brake is usually recorded as either a discrete value (on or off) or as an actual air pressure. The data come from the locomotive on which the recorder is installed. As a result, an event recorder in the third locomotive unit will only monitor the status of the independent brake in the third unit and not the status of the independent brake in the lead unit. Failure to monitor and record independent brake data in the lead locomotive can result in unnoticed independent brake activity or incorrect indications of the time that an independent brake application is made on the lead locomotive. Other parameters are also only recorded on lead locomotives, including the horn and the engineer-induced emergency. The horn is an important parameter in many grade crossing accidents, and the engineer-induced emergency allows investigators to determine whether an emergency brake application was the result of engineer action. Although not required under regulation, most event recorders monitor and record both of these parameters if the recorder is in the lead locomotive. Other available data that can only be recorded by an event recorder in the lead locomotive are: Cab signal information (aspect or acknowledgment or both) 53 Crew vigilance system data (alerter data and penalty brake) TD data (pressure, marker, battery status, and motion status) Traction motor current for the lead locomotive45 Pneumatic control switch state for the lead locomotive45 Additional train brake data (equalizing reservoir pressure and suppression) Wheel slip data45 Locomotive speed limiter data Overspeed penalty Distributed power data The Safety Board has demonstrated that an event recorder in the lead locomotive can provide more accurate and diverse data than one in a trailing locomotive. The Safety Board, therefore, concludes that the requirement to monitor and record data as though it were in the lead locomotive cannot currently be met by the placement of an event recorder elsewhere than in the lead locomotive. The Safety Board believes that the FRA should inform the industry that the placement of event recorders other than in the lead locomotive will not record the required data as though the event recorders were in the lead locomotive and ensure compliance with 49 CFR 229.135(a). 11 derailed DOT 111A tank cars sustained extensive mechanical damage not limited to any area of the tank cars as a group. Although 7 of these 11 tank cars were jacketed, the jackets did not provide any significant protection in this accident. The damage and deformation to the DOT 111A tank cars was extremely severe in comparison to the DOT 105J tank car with butyl acrylate that survived the derailment and the fire intact. Although the jacket was crushed and dented in all areas on the DOT 105J tank car, visible damage to the tank shell was superficial and limited to denting of one head and a puncture that was caused by the explosive charges used to vent the tank. The two DOT 111A tank cars with the least damage, ACFX 84855 and 84070, were the third and fourth cars behind the locomotives and were either clear of or on the edge of the main wreckage pile following the derailment. A third DOT 111A tank car was the sixth car behind the locomotives. All the other DOT 111A tank cars were between the 26th and 41st cars behind the locomotives, and the DOT 105J tank car was the 33rd car. The positioning of the tank cars in the train consist cannot account for the difference in the damages observed on the DOT 111A tank cars and the DOT 105J tank car. Because the DOT 105J tank car and most of the DOT 111A tank cars were positioned in the middle section of the train, all were subjected to similar impact and derailment forces. Therefore, the Safety Board concludes that the superior strength of the DOT 105J tank car, as a result of its thicker tank shell and heads and head-shield protection, accounted for the difference in the comparative damages between the DOT 111A tank cars and the DOT 105J tank car. This accident again reinforces the need for the FRA, the Research and Special Programs Administration (RSPA), and the tank car industry, to determine through risk assessment which hazardous materials, including environmentally harmful products, can be carried with an acceptable level of risk in DOT 111A Tank Car Performance The high speed of the train at derailment and the relatively short length of destroyed or damaged track in which the four locomotives and 45 freight cars stopped indicate the immense magnitude of the impact forces acting on the 12 tank cars that derailed. In addition to the magnitude of the impact forces acting on these 12 tank cars, the exposure to fire and heat likely reduced their material strength and integrity. The Locally sensed parameters that can be recorded by trailing unit event recorders but would reflect the condition of the trailing unit itself and not the lead unit. 45 54 tank cars and which products should be afforded more protection in pressure tank cars, such as DOT 105J tank cars. The Safety Board has advocated such an approach in previous accident reports and safety studies.46 On September 21, 1995, RSPA, with the cooperation of the FRA, issued new regulations that require a wider variety of hazardous materials, such an nonflammable compressed gases, materials designated as “poisonous by inhalation,” and designated halogenated organic compounds that pose environmental risks, be transported in pressure tank cars equipped with head-shield protection and thermal protection, as appropriate.47 The new regulations also apply to DOT 105 tank cars under 18,500 gallons that were previously exempted from the requirements for head shields and thermal protection. These new regulations are a significant safety improvement by requiring the transportation of products with these hazards in better protected and stronger tank cars. ATSF promptly notified the COES and the NRC. As a result, the appropriate State and Federal agencies were notified in a timely manner. The SOC provided copies of the train consist in a timely manner to the State forestry and fire protection department and the SBCC. The IC also had other technical resources available on the properties and the hazards of the chemicals on the train. Consequently, from the onset of the emergency response operations, the first responders to arrive at the scene and the IC had sufficient preliminary information about the hazardous materials on the train and which products were in each tank car. However, following this initial exchange of information, no direct notification of the chemical shippers was made because of miscommunications between personnel at the SOC about the notification of CHEMTREC. Because the IC believed that he had sufficient information about the hazardous materials involved and assumed someone would contact CHEMTREC, he did not direct that CHEMTREC be notified. CHEMTREC, which can provide a communications link between the chemical manufacturers, shippers, and emergency response agencies, was initially contacted by the California EPA about 7 hours after the accident. Shippers, including the R&H, learned that their products were in the derailment when the BNSF logistics department contacted them about late or lost shipments. Because of its concerns about the polymerization of butyl acrylate and the potential overpressurization of the tank car, R&H immediately attempted to contact the ATSF and the incident command center. The R&H technical experts in Texas faxed guidance about the decomposition and polymerization of the product to the incident command center. However, the R&H encountered difficulties obtaining accurate information on the status of the butyl acrylate tank car until its response team arrived and inspected the isolated butyl acrylate tank car on the afternoon of February 4. Hazardous Materials Management Shipper Notification and Coordination--Once the ATSF SOC had confirmed that freight train H-BALT1-31 had derailed and that hazardous materials likely had been released and were involved in the fire, the Railroad Accident Report--Collision and Derailment of Montana Rail Link Freight Train with Locomotive Units and Hazardous Materials Release, Helena, Montana, February 2, 1989 (NTSB/RAR-89/05); Safety Study-Transport of Hazardous Materials by Rail (NTSB/SS91/01); and Hazardous Materials Accident Report-Derailment of Burlington Northern Freight Train No. 01142030 and Release of Hazardous Materials in the Town of Superior, Wisconsin, June 30, 1992 (NTSB/HZM94/01). Crashworthiness Protection Requirements for Tank Cars; Detection and Repair of Cracks, Pits, Corrosion, Lining Flaws and Other Defects of Tank Car Tanks, docket nos. HM-175A and HM-201 at 60 Federal Register 49048 on September 21, 1995. 47 46 55 Although the technical information faxed by the R&H to the incident command center was received and reviewed, emergency responders were not able to positively identify the butyl acrylate tank car and most of the other tank cars because of the fire, which had burned away the identification marks and numbers on the tank cars. Because identification of the butyl acrylate car now depended on identifying unique fittings and features of the tank car, relying on the technical resources that the R&H could provide became imperative. Had the R&H personnel been early on scene, they could have quickly determined on the morning of February 4 after the discovery of the unidentified, venting tank car that it was not the butyl acrylate tank car, and the subsequent evacuation and the shutdown of the Calnev pipelines might have been averted. In addition, the R&H personnel would have also been available during the removal of the butyl acrylate tank car from the wreckage to ensure that the tank car was left upright to facilitate its venting through its safety relief valve and to verify the condition of the tank car. ATSF wreckage clearing personnel and the IC would have then known that the tank car was full and still a danger. The ATSF superintendent of field operations, who was primarily responsible for wreckage clearing operations, was unsure of the number of pressure and nonpressure tank cars in the train. He believed that 13 tank cars derailed and that 10 and 3 were nonpressure and pressure tank cars, respectively. Twelve tank cars had derailed, and only one was a pressure tank car. Although identification of specific tank cars was extremely difficult, the process may have been facilitated had the tank car experts from the AAR Bureau of Explosives or the other chemical shippers been consulted expeditiously. The explosives bureau or the shippers could have provided certificates of construction, design drawings, and other documentation and records to verify the number of pressure tank cars (DOT classes 105 and 112) and general service tank cars (DOT class 111A) in the train, which tank cars were jacketed, the capacity of each tank car, and any distinguishing features. Had this information been obtained, the superintendent of field operations and other personnel, involved with identifying the tank cars and assessing their condition, would have known that a single pressure tank car containing butyl acrylate was in the train. Knowing the distinguishing features of a pressure tank car, such as protective domes and no bottom outlet valves, they would have been better able to identify the butyl acrylate tank car. Neither a carrier nor an IC are required to contact CHEMTREC, hazardous materials shippers, or the explosives bureau; however, these resources can provide specialized technical assistance about the hazardous materials and tank cars in an accident. Chemical shippers can often assist emergency responders in the identification, handling, and off loading of tank cars transporting hazardous materials. The R&H, the other chemical shippers, and the explosives bureau were not expeditiously contacted or requested to provide technical support. Therefore, the Safety Board concludes that the ATSF officials and emergency responders failed to effectively utilize the technical resources that could have facilitated the identification and condition of the butyl acrylate tank car and the other derailed tank cars in the train. The AAR, CMA, and several other associations48 representing the chemical and transportation industries jointly sponsor the Transportation and Community Awareness and Emergency Response (TRANSCAER) program, a nationwide community outreach program designed to assist communities in the development and evaluation of their emergency response plans for transportation incidents involving hazardous materials. Member National Association of Chemical Distributors, National Tank Truck Carriers, American Petroleum Institute, Hazardous Materials Advisory Council, American Trucking Associations, and The Chlorine Institute. 48 56 companies of the sponsoring associations work with local emergency planning committees and participate in exercises and training with local emergency response agencies to test individual response plans. Although TRANSCAER has fostered greater communication and coordination between local emergency planners, carriers, and chemical shippers, the events in this accident indicate that a renewed emphasis is needed for railroad personnel and emergency responders in a derailment involving the release of hazardous materials to utilize available technical resources and expertise. Therefore, the Safety Board believes that the AAR, the CMA, and the International Association of Fire Chiefs should develop, in cooperation, and distribute to their members information reemphasizing the technical data and assistance that can be provided through CHEMTREC, the AAR Bureau of Explosives, and the chemical shippers when tank cars transporting hazardous materials are involved in a train derailment. emergency responder to safely approach the tank car and climb onto it to reach an identification plate. The Safety Board concludes that the potential danger to emergency response personnel under accident conditions may outweigh the benefit of an engraved plate to identify the mark and number of a tank car. In accidents where the identification and condition of the tank cars containing hazardous materials cannot be verified, emergency responders typically have been trained to evacuate to a safe distance, confer with tank car and product experts, and reach a consensus on a course of action. The difficulties encountered in this accident by emergency response personnel in identifying individual tank cars could have been greatly alleviated through greater coordination with the chemical shippers, the tank car owners, and the explosives bureau personnel. Coordination between the railroad, emergency responders, and the appropriate experts remains the most effective means to minimize the danger to the public and emergency response personnel from accidents involving tank cars that contain hazardous materials. The Safety Board previously addressed the issue of tank car identification in its investigation of the derailment of an Illinois Central Gulf Railroad freight train in Livingston, Louisiana, on September 28, 1982.49 The Safety Board concluded in that accident that the difficulty in identifying potentially dangerous tank cars and their locations in the wreckage delayed attacking the principal source of fire and heat, and as a result, the source of the fire continued to superheat two tank cars which ultimately exploded and rocketed. Consequently, the Safety Board asked the CMA in Safety Recommendation R-83-92 to extend the use of Tank Car Identification--The fire destroyed the painted identification marks and numbers on most of the derailed tank cars and prevented emergency responders and ATSF wreckage clearing personnel from positively identifying individual tank cars. The AAR tank car committee did not act on the ATSF proposal after this accident to affix a permanent plate engraved with the tank car identification mark and number. An engraved plate permanently affixed to the tank car provides a means for emergency responders to identify a tank car when painted markings have been destroyed; however, other safety considerations arise. To obtain the information on an engraved plate, an emergency responder would, as a minimum to reach the plate, need to be near the tank car and, more likely, to climb onto the tank car. A tank car that has been exposed to fire and heat, such as the butyl acrylate tank car in this accident, has a greatly increased potential for overpressurization and catastrophic failure. Also, the external temperature of the tank car may be too high or the tank car may be precariously positioned for an Railroad Accident Report--Derailment of Illinois Central Gulf Railroad Freight Train Extra 9629 East (GS2-28) and Release of Hazardous Materials at Livingston, Louisiana, September 28, 1982 (NTSB/RAR-83/05). 49 57 color coding of tank cars or adopt some other effective means of identifying high-risk commodity tank cars in switching operations and in wreck clearing operations. The CMA responded that it did not consider color coding to be effective and would not support the color coding of tank cars because tank cars were already required to have reporting marks, numbers, and placards that served to identify the tank car and the product carried. The CMA also cited the practicality of color coding tank cars because of the wide variety of chemical products transported by tank cars and the use of individual tank cars to carry multiple products. The CMA indicated, however, that it was reviewing other means to improve the identification of tank cars, such as the use of radio transponders. Because the CMA did not change its position on color coding or demonstrate that other methods were seriously being investigated, the Safety Board classified Safety Recommendation R-83-92 “Closed-Unacceptable Action” on February 18, 1987. Although color coding of tank cars relies on painted markings that may be destroyed in intense fires, as occurred in this accident, positive methods for identifying tank cars need further investigation and evaluation. The FRA conducted research in the 1980s on the use of radio transponders to track tank cars, and the AAR is now evaluating the use of global satellite tracking systems to collect impact data on tank cars while in transport. Enhancement of such technologies may feasibly include the identification of tank cars. Therefore, the Safety Board believes that the AAR should investigate and evaluate means to improve the ability of emergency response personnel to identify tank cars involved in accidents. Derailed Tank Car Handling and Damage Assessments--After the derailment, conditions at the accident scene precluded the ability of emergency responders and the ATSF wreckage clearing personnel to survey and assess the conditions of the derailed tank cars. Nine or 10 of the 12 derailed tank cars were mixed throughout the burning wreckage pile. Fire and smoke reduced visibility and limited tank car observation. In addition, the efforts to extinguish the fire with the application of water and foam on the wreckage pile was ineffective, and a process of cooling the perimeter of the wreckage and then removing, isolating, and cooling individual freight cars was implemented. Damage assessments, therefore, could not be performed until each tank car was isolated from the other wreckage and fire. With this approach to extinguishing the fire, emergency responders and the ATSF wreckage clearing personnel indicated that damage assessments of the tank cars were made continuously as the visibility improved and wreckage was cleared away. The alternative was to let the fire burn itself out; however, the closure of I-15 and the evacuation of the immediate area for an undetermined time would probably have been necessary. After each tank car had been removed and isolated, it should have been visually inspected to identify the specific tank car or type of tank car and to verify, if possible, whether the tank car had been breached and any cargo remained in the tank. Had a definite breach in a tank car not been seen, the most prudent assumption was that the tank car remained full and should be handled with care. Furthermore, such a tank car should have been closely monitored until its true condition could be ascertained. Because of the severity of the damage to most of the DOT 111A tank cars, determining the condition of those tank cars may have been relatively easy. Before the tank car was removed from the wreckage, an observer who was 70 feet away saw a hole reportedly near one end of the butyl acrylate tank car, which was not a reliable indicator of the tank car condition. The lack of visual inspection of the butyl acrylate tank car after its removal from the wreckage on February 4 indicates that ATSF personnel did not perform a complete and careful damage assessment of any of the tank cars. The ATSF superintendent of field operations who was responsible for wreckage clearing 58 operations had the primary responsibility to assess the derailed tank car damage and to oversee the movement and handling of the tank cars at the site. He was assisted by the ATSF chief environmental officer. The determination of the superintendent of field operations that the butyl acrylate tank car was empty was not based on a physical examination of the tank car after its removal from the wreckage but on the impressions of the equipment operators who pulled the tank car from the wreckage and on the lengthy exposure of the tank car to fire and heat. Because he concluded that the tank car was empty, he did not perform a visual inspection to determine whether the tank car had been breached or direct that the tank car be left positioned upright, cooled with water, or monitored. The chief environmental officer resolved that the tank car could not have survived the impact forces and the fire and heat. Although both individuals had sufficient training and experience about railroad tank cars to perform their respective duties (see appendix B), they relied on their impressions rather than verification of the physical tank car condition. The Safety Board, therefore, concludes that both the ATSF superintendent of field operations and chief environmental officer exercised poor judgment in their assessment and handling of the butyl acrylate tank car. The State forestry and fire protection department incident safety officer and IC, who each had some knowledge and experience with hazardous materials and tank cars, relied on the expertise of the two ATSF officials for the handling of the damaged tank cars. Because firefighters and other emergency responders typically are not experts about tank cars and railroad operations, they depend on the railroad officials for guidance. Both railroad officials may have exercised better judgment had written guidance and recommended practices been available about the assessment and handling of tank cars exposed to sustained fire and heat following a derailment. Although criteria exist to assess mechanical damage to a tank car, guidance could not be found on the cumulative effects from fire, heat, and mechanical damage on the strength and integrity of a derailed tank car. The guidance about moving and handling loaded or partially loaded tank cars that have sustained mechanical or fire and heat damage or both is also lacking. The integrity of tank cars, subjected to severe accident forces and fire, should be adequately assessed before moving the tanks. Awareness of the tank car integrity minimizes the potential of a catastrophic failure of the tank car and release of any remaining cargo. The Safety Board had expressed concern about the need for written technical guidance to help emergency response personnel assess the severity of tank car damage and select the appropriate means to remove the wreckage after its investigation of a freight train derailment involving hazardous materials near Inwood, Indiana, on November 8, 1979.50 In Safety Recommendation I-80-2, the Safety Board asked the FRA to develop guidelines for handling tank cars containing pressurized liquefied gases at accident sites based on research and tests of a representative sample of damaged tank cars. As a result of various FRA-sponsored research studies and industry-initiated reports, Safety Recommendation I-80-2 was classified “Closed-Acceptable Action” on May 25, 1994. These research studies address mechanical damage but not the effects of fire and heat. In addition, the tank car safety courses offered at the AAR transportation test center in Pueblo, Colorado, and the AAR annual hazardous materials seminars provide training and instruction on assessing mechanical damage to tank cars, but not the effects from fire and heat. Special Investigation Report--Tank Car Structural Integrity after Derailment (NTSB/SIR-80/1). 50 59 Because many emergency responders rely on railroad personnel to provide guidance about handling and moving damaged tank cars, railroad personnel involved with wreckage clearing operations should have sufficient guidance to assess all types of damages and the combination of damages that can result from a derailment. Because tank cars involved in a derailment can sustain mechanical or fire and heat damage or both, wreckage clearing personnel need to be aware of the effects of each type of damage and any combined effects. The Safety Board, therefore, believes that the AAR should develop written guidelines for assessing the individual and combined effects of mechanical or fire and heat damage or both to tank cars involved in a derailment and for the handling and movement of such tank cars. Pipeline Operation Operator Notification--Calnev became aware of the accident when an employee heard a radio news broadcast about the derailment and verified that the derailment site was near two Calnev underground pipelines. The ATSF notification of the COES and its subsequent notifications of the appropriate state agencies, including the State fire marshal office and the State forestry and fire protection department, were timely and prompt; however, the ATSF did not contact Calnev directly about the derailment and potential threat to its pipelines. In previous accident investigations,51 including a collision between two ATSF freight trains in Corona, California, on November 7, 1990, the Safety Board found that railroads have the responsibility to notify pipeline operators about derailments and wreckage clearing operations that occur near pipelines that may impact the safe operation of such pipelines. After its investigation of the Corona accident, the Safety Board asked in Safety Recommendation R-91-44 that the ATSF, in cooperation with the California Public Utilities Commission and the California Office of the State Fire Marshal, develop a complete list of 24-hour emergency telephone numbers for those pipeline operators whose transmission lines are near the ATSF property. In its November 11, 1993, response to the recommendation, the ATSF stated that it had participated in the information gathering efforts of the CPUC concerning pipelines along ATSF rights-of-way and that ATSF distributed a listing of pipeline operator emergency telephone numbers provided by the State fire marshal office to appropriate personnel in the SOC. On the basis of this response, Safety Recommendation R-9144 was classified “Closed--Acceptable Action” on February 14, 1994. After the February 1, 1996, derailment near Cajon Junction, the ATSF indicated that as a corrective measure, pipeline operators had been added as a line item on its emergency notification check list for accidents occurring in California. This measure should have been a logical step for the ATSF to have taken when implementing Safety Recommendation R-91-44 rather than as a corrective action for the current derailment. The Safety Board, consequently, concludes that the ATSF management failed to ensure that effective procedures to notify pipeline operators were implemented and that its employees complied with them. Therefore, the Safety Board believes that the BNSF should develop and maintain a list Railroad Accident Report--Derailment of Southern Pacific Transportation Company Freight Train on May 12, 1989, and Subsequent Rupture of Calnev Petroleum Pipeline on May 25, 1989, at San Bernardino, California (NTSB/RAR-90/02); Railroad Accident Report--Atchison, Topeka and Santa Fe Railway Company (ATSF) Freight Trains ATSF 818 and ATSF 891 on the ATSF Railway, Corona, California, November 8, 1990 (NTSB/RAR91/03); and Highway Accident Report--Collision of Amtrak 51 of 24-hour emergency telephone numbers for all Train No. 88 with Rountree Transport and Rigging, Inc., Vehicle on CSX Transportation, Inc., Railroad Near Intercession City, Florida, November 30, 1993 (NTSB/HAR-95/01). 60 pipeline operators that have transmission pipelines on or adjoining any BNSF property and distribute the list with written instructions for notifying pipeline operators to all employees who are responsible for completing emergency notifications. Operator Response--After the Calnev engineer had verified that company pipelines were near the derailment, Calnev initiated a shutdown and isolation of the affected pipelines even before determining whether the pipelines were damaged. These actions were the proper precautions to avoid a potential pipeline release. The Calnev manager of engineering was dispatched immediately and arrived at the incident command post within minutes of the IC, which resulted in early coordination and communication between Calnev and the IC. The IC was aware of the Calnev pipelines and, had the engineering manager not arrived so promptly, would have directed that Calnev be notified. The establishment of a Calnev command post at the IC post on February 1 ensured that the communication and coordination continued throughout the duration of the emergency. The train wreckage was more than 200 feet from the pipeline right-of-way, and the pipelines were undamaged. Calnev, however, monitored the wreckage clearing operations to ensure that no heavy equipment would inadvertently work over or cross the pipelines. Calnev also responded promptly when the IC requested a pipeline shutdown because of the venting tank car on February 4. Therefore, the Safety Board concludes that the Calnev response to the derailment was appropriate and timely and the coordination between Calnev and the IC was effective. functions. Air monitoring and water and soil sampling were initiated and conducted in a sufficiently timely and efficient manner. The results of the air monitoring immediately following the derailment indicate low levels of volatile organic compounds and no detectable levels of phosphorus compounds generated from the combustion and release of the trimethyl phosphite at the accident site. Subsequent air monitoring results through March 1 yielded average concentrations of volatile organic compounds that exceeded a 5 ppm threshold only in the immediate area of the derailment on 3 days during the monitoring period. The results of the water sampling indicated no impact on groundwater or supply wells in the area. All contaminated soil was removed, and the area was restored. Therefore, the Safety Board concludes that the release and combustion of hazardous materials created no prolonged environmental impact. Environmental Impact The number of State and Federal agencies monitoring the site and environmental safety efforts necessitated the formation of an environmental response group to fulfill all 61 CONCLUSIONS 1. Neither the weather, the track, nor the signal system either caused or contributed to the derailment. The train crewmembers were in compliance with the requirements specified in the Hours-of-Service Act and were qualified to perform their duties; no evidence of fatigue was found. Neither drug nor alcohol use was a factor in the derailment. 2. Had the conductor and the brakeman remained in the control compartment cab of the locomotive, they likely would have survived because the cab survival space was adequate. 3. The local emergency response was timely and adequate, given the remote location of the derailment, and the incident commander acted effectively and managed the incident successfully to completion without serious injury to responders, local residents, or officials at the scene. 4. A wide deviation of end-of-car hose arrangements on cushioned underframe cars from the approved end-of-car hose arrangement design is not uncommon and may induce an air hose to kink in operation and block or restrict a train line. 5. Had the Barstow car shop made hose arrangement reference manuals readily available, the carmen could have used guidelines to properly repair the train line on ATSF 90033. 6. An unknown train line blockage or restriction, probably between the fifth and ninth cars, resulted in responsive brakes only on the locomotive units and possibly the first eight cars, and, thus, the engineer was unable to slow or stop H-BALT1-31. 7. Had H-BALT1-31 been equipped with a fully functioning two-way end-of-train device, the engineer could have applied the brakes from the rear of train and the derailment may have been avoided. 8. The Federal Railroad Administration failure to require the capability to initiate an emergency brake application on either end of a train in mountainous territory after the 1989 Helena, Montana, accident and its failure to take immediate action after receiving the Safety Board recommendation resulting from the 1994 Cajon Pass accident may have contributed to the cause of this accident in 1996. 9. The engineer of H-BALT1-31 was not aware of any requirement to report the inability to arm a two-way end-of-train device system and, consequently, did not report the improper operation of the twoway end-of train device on train H-BALT131 to the train dispatcher and customer quality support, as required under rule 67 (B). 10. The Atchison, Topeka and Santa Fe Railway Company management failed to ensure the use of fully functioning two-way end-oftrain devices on westbound trains over Cajon Pass. 11. The Atchison, Topeka and Santa Fe Railway Company management failed to ensure that operating crewmembers received comprehensive training on the proper procedures required for arming two-way end-of-train device operation; although, investigators did not find that lack of training contributed to this accident. 62 12. The failure of the transmitter module of the head-end device on locomotive ATSF 157 to generate sufficient wattage power would not allow the engineer of H-BALT1-31 to arm the two-way head-end/end-of-train device system. 13. The wheel data were not recorded due to a broken wire in the axle generator as a result of an improper modification to the axle generator. 14. The Federal Railroad Administration regulations for the periodic inspection of event recorders are inadequate. 15. Had the entire event recorder system from locomotive ATSF 342 been properly tested during the December 1995 quarterly inspection, both the broken speed sensor and the improper configuration of the event recorder would likely have been noticed and corrected at that time. 16. The Federal Railroad Administration was not monitoring the compliance of the carrier with periodic inspections of event recorders as prescribed under 49 Code of Federal Regulations 229.25(e)(5). 17. The Federal Railroad Administration form F6180-49A is not adequate for recording the inspection of event recorders and allows oversights to be perpetrated during inspection procedures. 18. The requirement to monitor and record data as though it were in the lead locomotive cannot currently be met by the placement of an event recorder elsewhere than in the lead locomotive. 19. The superior strength of the U.S. Department of Transportation class 105J tank car as a result of its thicker tank shell and heads, and the head shield protection accounted for the difference in the comparative damages between the U.S. Department of Transportation class 111A tank cars and the U.S. Department of Transportation class 105J tank car. 20. The Atchison, Topeka and Santa Fe Railway Company officials and emergency responders failed to effectively utilize the technical resources that could have facilitated the identification and condition of the butyl acrylate tank car and the other derailed tank cars in the train. 21. The potential danger to emergency response personnel under accident conditions may outweigh the benefit of an engraved plate to identify the mark and number of a tank car. 22. Both the Atchison, Topeka and Santa Fe Railway Company superintendent of field operations and chief environmental officer exercised poor judgment in their assessment and handling of the butyl acrylate tank car. 23. The Atchison, Topeka and Santa Fe Railway Company management failed to ensure that effective procedures to notify pipeline operators were implemented and that its employees complied with them. 24. The Calnev Pipe Line Company response to the derailment was appropriate and timely and the coordination between the Calnev Pipe Line Company and the incident commander was effective. 25. The release and combustion of hazardous materials created no prolonged environmental impact. 63 PROBABLE CAUSE The National Transportation Safety Board determines that the probable cause of the derailment of freight train H-BALT1-31 was an undetermined restriction or blockage that prevented the traincrew from achieving and maintaining adequate train braking force and also the lack of adequate Federal Railroad Administration and industry, specifically the Atchison Topeka and Santa Fe Railway Company, regulations, policies, procedures, and standards to consistently utilize two-way end-oftrain devices as a redundant braking system to protect trains from catastrophic brake system failure. RECOMMENDATIONS As a result of its investigation, the National Transportation Safety Board makes the following recommendations: --to the Burlington Northern and Santa Fe Railway Company: Inspect the end-of-car hose arrangements on your cushioned underframe cars and ensure the hose arrangements match the intended design. (R-96-67) Provide your carmen with readily available means to identify the proper design or specific type of end-of-car hose arrangement on cushioned underframe cars to preclude a possible improper repair or modification. (R-96-68) Develop and maintain a current list of 24-hour emergency telephone numbers for all pipeline operators that have transmission pipelines on or adjoining any Burlington Northern and Santa Fe Railway Company property and periodically update, at least annually, and distribute the list with written instructions for notifying pipeline operators to all employees who are responsible for completing emergency notifications. (R-96-69) 64 --to the Federal Railroad Administration: Revise 49 Code of Federal Regulations 229.25(e)(2) to require that event recorders, including microprocessor-based event recorders that are equipped with a self-test function, be tested during the quarterly inspections of the locomotive in such a manner that the entire event recording system, including sensors, transducers, and wiring, is evaluated. Such testing should include, at a minimum, a review of the data recorded during actual operation of the locomotive to verify parameter functionality as well as cycling all required recording parameters and determining the full range of each parameter by reading out recorded data. (R-96-70) Develop and implement a program that specifically addresses carrier compliance with 49 Code of Federal Regulations 229.25(e)(5). (R-96-71) Revise your form F6180-49A to include event recorders in the other items to be inspected section on the form. (R-96-72) Inform the industry that the placement of event recorders other than in the lead locomotive will not record the required data as though the event recorders were in the lead locomotive and ensure compliance with 49 Code of Federal Regulations 229.135(a). (R-96-73) --to the Association of American Railroads: Inform your member carriers about the circumstances of this accident and alert them to inspect the end-of-car hose arrangements on cushioned underframe cars and ensure the hose arrangements match the intended design. (R-96-74) Ensure that your member carriers provide carmen with readily available means to identify the proper design or specific type of end-of-car hose arrangement on cushioned underframe cars to preclude a possible improper repair or modification. (R-96-75) Develop, in cooperation with the Chemical Manufacturers Association and the International Association of Fire Chiefs, and distribute to your carrier members information reemphasizing the technical data and assistance that can be provided through the Chemical Manufacturers Association Chemical Transportation Emergency Center, the Association of American Railroads Bureau of Explosives, and the chemical shippers when tank cars transporting hazardous materials are involved in a train derailment. (R-96-76) Investigate and evaluate means to improve the ability of emergency response personnel to identify tank cars involved in accidents. (R-96-77) Develop written guidelines for assessing the individual and combined effects of mechanical or fire and heat damage or both to tank cars involved in a derailment and for the handling and movement of such tank cars. (R96-78) 65 --to the International Association of Fire Chiefs: Develop, in cooperation with the Association of American Railroads and the Chemical Manufacturers Association, and distribute to your members information reemphasizing the technical data and assistance that can be provided through the Chemical Manufacturers Association Chemical Transportation Emergency Center, the Association of American Railroads Bureau of Explosives, and the chemical shippers when tank cars transporting hazardous materials are involved in a train derailment. (R-9679) --to the Chemical Manufacturers Association: Develop, in cooperation with the Association of American Railroads and the International Association of Fire Chiefs, and distribute to your members information reemphasizing the technical data and assistance that can be provided through the Chemical Manufacturers Association Chemical Transportation Emergency Center, the Association of American Railroads Bureau of Explosives, and the chemical shippers when tank cars transporting hazardous materials are involved in a train derailment. (R-9680) BY THE NATIONAL TRANSPORTATION SAFETY BOARD JAMES E. HALL Chairman ROBERT T. FRANCIS II Vice Chairman JOHN A. HAMMERSCHMIDT Member JOHN J. GOGLIA Member GEORGE W. BLACK, JR Member December 11, 1996 66 APPENDIXES APPENDIX A INVESTIGATION AND HEARING The National Transportation Safety Board was notified at 10 a.m., eastern standard time, on February 1, 1996, that an Atchison, Topeka and Santa Fe Railway (ATSF) freight train derailed in Cajon Pass, California. The investigator-in-charge and other members of the Safety Board investigative team were dispatched from the Washington, DC, headquarters and the Atlanta, Georgia, and Chicago, Illinois, regional offices. The investigative groups studied operations, track and signals, mechanical, survival factors, human performance, and hazardous materials. The Federal Railroad Administration, ATSF, California Public Utilities Commission, Brotherhood of Locomotive Engineers, Brotherhood of Carmen, and the United Transportation Union assisted in the Safety Board investigation. The Safety Board staff conducted a deposition proceeding as part of its investigation on April 23, 1996, in San Bernardino, California, at which eight witnesses testified. 67 this page intentionally left blank APPENDIX B QUALIFICATIONS OF HAZARDOUS MATERIALS RESPONSE PERSONNEL The incident commander (IC) had 29 years experience as a firefighter and as a training officer. He attended a 6-week hazardous materials course at the National Fire Academy in 1981. He estimated that 40 hours may have been dedicated to railroad tank cars. Although he has since taken refresher training in hazardous materials, he has not received any specific training about railroad tank cars. The IC also completed the following hazardous materials courses through the California Specialized Training Institute under the sponsorship of the California Office of Emergency Services: First Responder Operational in September 1991, IC/On-scene Manager in June 1992, and instructor certifications for first responders and ICs/on-scene managers in July 1992. Before this accident, the IC had been involved in one minor derailment. The California Department of Forestry and Fire Protection incident safety officer had numerous courses on hazardous materials since 1981, including 80 hours of chemistry training dating back to 1985. Since 1991, he has been teaching classes on hazardous materials operations and scene management for the California Specialized Training Institute. During the past 10 years, he has received training at the General American Transportation rail car repair facility in Colton, California. He had responded to approximately nine rail car incidents in the last 12 years. The Atchison, Topeka and Santa Fe Railway Company (ATSF) superintendent of field operations had 23 years experience and had been involved with between 20 and 25 derailments that included hazardous materials. The superintendent stated that he was in the original group of employees that became hazardous materials responders for the ATSF. He attended a 1-week course in hazardous materials at Texas A&M University in 1984 and has attended the tank car safety course at the Association of American Railroad (AAR) transportation test center in Pueblo, Colorado, annually since 1987 to maintain his certification as a hazardous materials technician. The superintendent also cited his experience working with companies that specialize in wreckage clearing at derailments. The superintendent was familiar with the guidelines for assessing tank car damage that are covered in the AAR tank car safety course. (These guidelines cover mechanical damage, such as gouges, dents, scores, and wheel burns, but do not address fire and heat damage.) The ATSF chief environmental officer had degrees in civil engineering with a primary emphasis on structural engineering and a secondary emphasis on environmental engineering and had been in the environmental department of the ATSF since 1982. He also attended the Texas A&M course in 1984 or 1985, the AAR tank car safety course in 1986 or 1987, other courses at the AAR center, and participated in at least one symposium in the late 1980s on damage to tank cars. He had participated in four or five other derailments involving tank cars. He too was aware of the AAR guidance for assessing tank car damage. 69 this page intentionally left blank APPENDIX C TRAIN CONSIST According to the automatic equipment identification (AEI) reader 586 at Lenwood. California, (milepost 6.7), train H-BALT1-31 passed the AEI reader at 1:37 a.m. on February 1, 1996 at 38 mph with the following ordered consist. Locomotives 1 2 3 4 Unit ATSF 157 ATSF 3853 ATSF 342 ATSF 4031 Model GP60M GP50 GP60B GP60 Manufacturer EMD EMD EMD EMD Remarks Cabless Unit Event Recorder Cars 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 Number WC 28076 WC 28125 ACFX 84855 ACFX 84070 SFLC 10005 DOWX 3965 TQEX 58464 CNW 128078 ACFX 66459 BN 249296 ATSF 45841 ATSF 45920 ATSF 46034 WC 28047 ALAX 61489 ATSF 90033 Type box car box car tank car tank car box car tank car covered hopper GSC gondola C5P covered hopper A23 box car AB6 box car AB6 box car AB6 box car A63 box car C5P covered hopper FP7 flat car A63 A63 T5F T5F LB4 T5G C5P Commodity fiber board fiber board calcium chloride calcium chloride corn meal glycol plastic pellets steel shapes plastic pellets fiber board fiber board fiber board fiber board fiber board plastic pellets steel pipe Remarks cushioned underframe cushioned underframe cushioned underframe cushioned underframe cushioned underframe 71 APPENDIX C 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 ABOX 52396 ITTX 912296 ATSF 45712 ATSF 46151 ATSF 45990 CR 297851 CR 627150 CR 627333 IHB 1209 ECDX 792140 UTLX 79897 WC 20252 ATSF 92018 ATSF 73758 ACFX 79907 SOU 17010 NATX 82129 GATX 13571 ATSF 622893 ATSF 622600 CSXT 496026 MWSX 29654 GATX 37310 UTLX 41424 UTLX 41411 ATSF 611088 SP 247682 SOU 525865 NOKL 4574 CELX 2374 NAHX 550724 ACFX 99289 GATX 18211 B24 box car FM7 flat car AB6 box car AB6 box car AB6 box car D7C box car FS flat car FS flat car FS flat car T5F tank car T3D tank car A65 box car FS flat car GSC gondola T5I tank car D6N box car T5H tank car T5G tank car LC5 box car LC5 box car FS flat car T6I tank car T4F tank car T5F tank car T5F tank car B75 box car A64 box car A23 box car D5N box car T6I tank car C6 covered hopper C6 covered hopper T4F tank car lumber pipe fiber board fiber board fiber board auto parts iron iron iron lube oil lube oil printing paper iron iron petroleum distillates textiles butyl acrylate ind chemical veneer salt iron denatured alcohol flammable liquid empty empty flour lumber tires lumber methyl ethyl ketone empty plastic pellets empty hazmat hazmat hazmat hazmat hazmat 72 APPENDIX E RULES AND REGULATIONS FOR END-OF-TRAIN DEVICE 232.19 End of Train Device (a) An end-of-train device shall be comprised of a rear-of-train unit (rear unit) located on the last car of a train and a front-of-train (front unit) unit located in the cab of the locomotive controlling the train. (b) Rear unit. The rear unit shall be capable of determining the rear car brake pipe pressure and transmitting that information to the front unit for display to the locomotive engineer. The rear unit shall be— + (1) Capable of measuring the rear car brake pipe pressure with an accuracy of /- 3 psig and brake + pipe pressure variations of /- 1 psig; (2) Equipped with a “bleeder valve” that permits the release of any air under pressure from the rear of train unit or the associated air hoses prior to detaching the rear unit from the brake pipe; (3) Designed so that an internal failure will not cause an undesired emergency brake application; (4) Equipped with either an air gauge or a means of visually displaying the rear unit’s brake pipe pressure measurement; and (5) Equipped with a pressure relief safety valve to prevent explosion from a high pressure air leak inside the rear unit. (c) Reporting rate. Multiple data transmissions from the rear unit shall occur immediately after a variation in the rear car brake pipe pressure of +/- 2 psig and at intervals of not greater than 70 seconds when the rear car brake pipe pressure variation over the 70-second interval is less that +/- 2 psig. (d) Operating environment- The rear unit shall be designed to meet the performance requirements of paragraphs (b) and (C) of this section under the following environmental conditions: o o (1) At temperatures from -40 C to 60 C; o (2) At a relative humidity of 95% noncondensing at 50 C; (3) At altitudes of zero to 12,000 feet mean sea level; (4) During vertical and lateral vibrations of 1 to 15 Hz., with 0.5 g peak to peak, an 15 to 500 Hz., with 5g. peak to peak; (5) During the longitudinal vibrations of 1 to 15 Hz., with 3g. peak to peak and 15 to 500 Hz., with 5g. peak to peak; and (6) During a shock of 10g. peak for 0.1 seconds in any axis. 75 APPENDIX E (e) Unique code. Each rear unit will have a unique and permanent identification code that is transmitted along with the pressure message to the front-of-train unit. A code obtained from the Association of American Railroads, 50 F Street, NW., Washington, DC 20036 shall be deemed to be a unique code for purposed of this section. A unique code also may be obtained from the Office of Safety Enforcement (RRS-10), Federal Railroad Administration, Washington, DC 20590. (f) Front unit. (1) The front unit shall be designed to receive data messages from the rear unit and shall be capable of displaying the rear car brake pipe pressure in not more that one-pound increments. (2) The display shall be clearly visible and legible in daylight and darkness from the engineer’s normal operating position. (3) The front device shall have a means for entry of the unique identification code of the rear unit being used. The front unit shall be designed so that it will display a message only from the rear unit with the same code as entered into the front unit. (4) The front unit shall be designed to meet the requirements of 232.19(d) (2), (3), (4), and (5). It shall also be designed to meet the performance requirements in this paragraph. o o (i) At temperatures from 0 C to 60 C; (ii) During a vertical or lateral shock of 2g. peak for 0.1 second; and (iii) During a longitudinal shock of 5g. peak for 0.1 second. (g) Radio equipment. (1) The radio transmitter in the rear unit and the radio receiver in the front unit shall comply with the applicable regulatory requirements of the FCC and use of a transmission format acceptable to the FCC. (2) If power is supplied by one or more batteries, the operating life shall be a minimum of 36 hours at 0o C. (H) Inspection. (1) Upon installation of the end-of-train device, it shall be determined that the identification code entered into the front unit is identical to the unique identification code on the rear-of-train unit. (2) The functional capability of the device shall be determined at the point of installation, after charging the train, by comparing the quantitative value displayed on the rear unit or on an air gauge. The end device may not be used if the difference between the two readings exceeds three pounds. (3) The rear unit shall be calibrated for accuracy at least every 92 days. A tag, sticker, or other method of information storage that provides that date of the last calibration was made, and the name of the person doing the calibration shall be affixed to the rear unit. [51 FR 17303, May 9, 1986] 76 APPENDIX F TRAIN DYNAMIC ANALYSIS SIMULATION PROTOCOL Train conditions: 2 pounds leakage, braking ratio 26 percent, 90 pounds brake pipe Time 0:00 0:05 1:03 3:16 3:29 4:34 5:00 7:04 7:11 8:07 9:33 9:41 10:03 10:28 10:38 10:43 Action independent reduced to release (automatic brakes already released) throttle 1 throttle 2 throttle 1 throttle off dynamic brake applied full dynamic minimum reduction (6 pounds) bail off independent 2 pounds additional reduction another 2 pounds additional reduction 1 pound additional reduction (75 pounds brake pipe) another 2 pounds additional reduction (73 pounds brake pipe) another 2 pounds additional reduction (71 pounds brake pipe) full service (64 pounds brake pipe) emergency (no bail) knock off dynamic 79