PB96-916305NTSB/RAR-96/05

NATIONALTRANSPORTATIONSAFETYBOARD

WASHINGTON,

RAILROAD

DC 20594

ACCIDENT REPORT

DERAILMENT OF FREIGHT TRAIN H-BALT1-31ATCHISON, TOPEKA AND SANTA FE RAILWAY COMPANYNEAR CAJON JUNCTION, CALIFORNIAON FEBRUARY 1, 1996

6675A

Abstract: On February 1, 1996, Atchison, Topeka and Santa Fe Railway Company freight train H-BALT1-31 derailed at milepost 60.4 near Cajon Junction, California. The conductor and the brakemansustained fatal injuries; the engineer incurred serious injuries. A fire resulting from the derailment andsubsequent rail car pileup engulfed the train and adjacent areas.

The major safety issues discussed in this report are the lack of Federal and management oversight in theuse of two-way end-of-train devices, the adequacy of operating personnel training in the use of two-wayend-of-train devices, the carrier compliance with Federal regulations for event recorders, and theadequacy of wreckage removal operations for tank cars containing hazardous materials. The report alsodiscusses safety issues relating to standards for brake pipe configurations, crashworthiness and occupantsurvivability, and emergency response and evacuation.

As a result of its investigation, the National Transportation Safety Board issued safety recommendations tothe Burlington Northern and Santa Fe Railway Company, Federal Railroad Administration, Association ofAmerican Railroads, International Association of Fire Chiefs, and Chemical Manufacturers Association.

The National Transportation Safety Board is an independent Federal agency dedicated to promotingaviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, theagency is mandated by Congress through the Independent Safety Board Act of 1974 to investigatetransportation accidents, determine the probable causes of the accidents, issue safety recommendations,study transportation safety issues, and evaluate the safety effectiveness of government agencies involved intransportation. The Safety Board makes public its actions and decisions through accident reports, safetystudies, special investigation reports, safety recommendations, and statistical reviews.

Information about available publications may be obtained by contacting:

National Transportation Safety BoardPublic Inquiries Section, RE-51490 L’Enfant Plaza, SWWashington, DC 20594(202) 314-6551

Safety Board publications may be purchased, by individual copy or by subscription, from:

National Technical Information Service5285 Port Royal RoadSpringfield, Virginia 22161(703) 487-4600

NTSB/RAR-96/05 PB96-916305

DERAILMENT

OF ATCHISON, TOPEKA AND SANTA FE

RAILWAY COMPANY TRAIN H-BALT1-31

NEAR CAJON JUNCTION, CALIFORNIA

FEBRUARY 1, 1996

RAILROAD ACCIDENT REPORT

Adopted: December 11, 1996Notation 6675A

NATIONALTRANSPORTATION

SAFETY BOARD

Washington, DC 20594

iii

CONTENTS

EXECUTIVE SUMMARY ........................................................................................................... v

ACRONYMS ................................................................................................................................ vi

INVESTIGATIONAccident Narrative........................................................................................................................................ 1Emergency Response.................................................................................................................................... 7Injuries….................................................................................................................................................... 10Damages ..................................................................................................................................................... 10Traincrew Information................................................................................................................................ 10Traincrew End-of-Train Device Training................................................................................................... 11Train Information ....................................................................................................................................... 12Track and Signal Information..................................................................................................................... 14Operations Information............................................................................................................................... 15Meteorological Information........................................................................................................................ 17Medical, Pathological, and Toxicological Information.............................................................................. 18Survival Aspects ......................................................................................................................................... 18Postaccident Train Examination................................................................................................................. 18

Wheel Sets............................................................................................................................................ 18Train Line............................................................................................................................................. 18Tank Cars ............................................................................................................................................. 19

Tests and Research ..................................................................................................................................... 21Signals .................................................................................................................................................. 21Event Recorder..................................................................................................................................... 21Train Line............................................................................................................................................. 23End-of-Train Device ............................................................................................................................ 24Head-End Device ................................................................................................................................. 24Train Dynamic Analysis Simulation.................................................................................................... 25Metallurgical ........................................................................................................................................ 25

Hazardous Materials Information............................................................................................................... 28Chemical Release................................................................................................................................. 28Chemical Product Descriptions............................................................................................................ 28Local and State Emergency Response Agency Notifications .............................................................. 29Chemical Shipper Notifications........................................................................................................... 30Derailed Tank Car Damage Assessments ............................................................................................ 31Butyl Acrylate Tank Car ...................................................................................................................... 34

Pipeline Information ................................................................................................................................... 35Environmental Information ........................................................................................................................ 36Other Information ....................................................................................................................................... 37

Federal Railroad Administration.......................................................................................................... 37Atchison, Topeka and Santa Fe Railway Company............................................................................. 38

iv

ANALYSISGeneral Factors........................................................................................................................................... 41Accident Narrative Review ........................................................................................................................ 41Train Line Continuity Loss ........................................................................................................................ 42

Kinked Air Hose .................................................................................................................................. 43Closed Angle Cock .............................................................................................................................. 44Foreign Object or Debris...................................................................................................................... 45

Two-way End-of-Train Device Operation.................................................................................................. 46Federal Railroad Administration Oversight......................................................................................... 46Railroad Industry Inaction.................................................................................................................... 47Management Oversight ........................................................................................................................ 47Operating Crew Training ..................................................................................................................... 49

End-of-Train Device and Head-End Device Operation..............................................................................49Event Recorder Maintenance and Placement ............................................................................................. 50Tank Car Performance................................................................................................................................ 54Hazardous Materials Management ............................................................................................................. 55

Shipper Notification and Coordination................................................................................................ 55Tank Car Identification ........................................................................................................................ 57Derailed Tank Car Handling and Damage Assessments...................................................................... 58

Pipeline Operation ...................................................................................................................................... 60Operator Notification ........................................................................................................................... 60Operator Response ............................................................................................................................... 61

Environmental Impact................................................................................................................................. 61

CONCLUSIONS ......................................................................................................................... 62

PROBABLE CAUSE .................................................................................................................. 64

RECOMMENDATIONS ............................................................................................................ 64

APPENDIXESAppendix A--Investigation and Hearing.............................................................................................. 67Appendix B--Qualifications of Hazardous Materials Response Personnel ......................................... 69Appendix C--Train Consist .................................................................................................................. 71Appendix D--Federal Railroad Administration Form F-6180-49A ..................................................... 73Appendix E--Rules and Regulations for End-of-Train Device............................................................ 75Appendix F--Train Dynamic Analysis Simulation Protocol................................................................ 79

v

EXECUTIVE SUMMARY

About 4:10 a.m. on February 1, 1996,Atchison, Topeka and Santa Fe RailwayCompany (ATSF) freight train H-BALT1-31, en route from Barstow, California, toLos Angeles, was traveling westbound onthe ATSF south main track when it derailedat milepost 60.4 near Cajon Junction,California. After the derailment and thesubsequent rail car pileup, which involvedfive cars containing hazardous materials, afire ignited that engulfed the train and thesurrounding area. The conductor and thebrakeman sustained fatal injuries; theengineer suffered serious injuries.

The National Transportation SafetyBoard determines that the probable cause ofthe derailment of freight train H-BALT1-31was an undetermined restriction or blockagethat prevented the traincrew from achievingand maintaining adequate train brakingforce and also the lack of adequate FederalRailroad Administration and industry,specifically the Atchison, Topeka and SantaFe Railway Company, regulations, policies,procedures, and standards to consistentlyutilize two-way end-of-train devices as aredundant braking system to protect trainsfrom catastrophic brake system failure.

The major safety issues discussed in thisreport are the lack of Federal andmanagement oversight in the use of two-way end-of-train devices, the adequacy ofoperating personnel training in the use oftwo-way end-of-train devices, the carriercompliance with Federal regulations forevent recorders, and the adequacy ofwreckage removal operations for tank carscontaining hazardous materials. The reportalso discusses safety issues relating tostandards for brake pipe configurations,crashworthiness and occupant survivability,and emergency response and evacuation.

As a result of its investigation of thisaccident, the National Transportation SafetyBoard makes recommendations to theBurlington Northern and Santa Fe RailwayCompany, Federal Railroad Administration,Association of American Railroads,International Association of Fire Chiefs, andChemical Manufacturers Association.

vi

ACRONYMS

AAR Association of American RailroadsATSF Atchison, Topeka and Santa Fe Railway CompanyBN Burlington Northern Railroad CompanyBNSF Burlington Northern and Santa Fe Railway CompanyCalnev Calnev Pipe Line CompanyCHEMTREC Chemical Transportation Emergency CenterCHP California Highway PatrolCMA Chemical Manufacturers AssociationCOES California Office of Emergency ServicesCPUC California Public Utilities CommissionDOT U.S. Department of TransportationEPA Environmental Protection AgencyETD end-of-train deviceFRA Federal Railroad AdministrationHED head-end deviceIC incident commanderI-15 Interstate 15MM milemarkerMP milepostNPRM notice of proposed rulemakingNRC National Response CenterPOD point of derailmentppm parts per millionpsi pounds per square inchpsig pounds per square inch gaugeR&H Rohm and Haas CompanyRLM receiver logic moduleRSPA Research and Special Programs AdministrationSBCC San Bernardino (County) Communications CenterSOC System Operations CenterSR-138 State Route 138TRANSCAER Transportation and Community Awareness and Emergency

Response

INVESTIGATION

Accident NarrativeAbout 4:10 a.m., Pacific standard time, on

February 1, 1996, westbound Atchison, Topekaand Santa Fe Railway Company1 (ATSF) freighttrain H-BALT1-31 derailed near CajonJunction, California. (See figure 1.) The point ofderailment (POD) occurred at milepost (MP)60.4 on the ATSF south main track, southernCalifornia division, Cajon subdivision. H-BALT1-31 consisted of 4 locomotives and 49rail cars traveling from Barstow, California, enroute to Los Angeles with a traincrew of anengineer, a conductor, and a brakeman. A fireresulted from the derailment and the subsequentcar pileup, which involved five cars containinghazardous materials, and the immediate areawas evacuated. The conductor and the brakemansustained fatal injuries; the engineer incurredserious injuries.

Barstow and Los Angeles were thedesignated away-from-home and hometerminals, respectively, for all three H-BALT1-31 crewmembers. The traincrew, having beenoff duty for 12 hours 50 minutes, had reportedfor duty at the ATSF yard in Barstow at 5 p.m.on January 31, 1996. They were instructed notto couple the locomotive consist to the trainbecause a yard crew was connecting car ATSF90033, following its repair, to the train cars. CarATSF 90033 was joined onto the train as the16th car from the head end, and the crew thencoupled the locomotive consist to thewesternmost car on the track.

The engineer said that after the locomotiveconsist was coupled to the train, a carmaninformed the crew that the car departmentneeded to inspect and to test the air brakes on

1The Burlington Northern Railroad Company (BN)and the ATSF merged on October 1, 1995, and formed theBurlington Northern and Santa Fe Railway Company(BNSF). The BN and the ATSF operated independentlyunder the BNSF at the time of the derailment.

car ATSF 90033. The test of the ATSF 90033air brakes was done in conjunction with theinitial terminal air brake test. The engineerstated that he performed the initial terminal airbrake test with the assistance of a carman, whowas at the rear of the train. The engineercontinued that after the train line2 was fullycharged with air, about 86 pounds per squareinch (psi), at the rear of the train, he reduced thetrain line air pressure by 20 psi and noticed thatthe head-end device (HED) indicated that the airpressure reading on the end-of-train device(ETD) had decreased accordingly.

Located in the locomotive controlcompartment, the HED displays the brake pipepressure being transmitted from the ETD on adigital read out and activates the red rear-endmarker light. This multipurpose receiver willindicate whether an attempt to “arm” the two-way function on the ETD was successful. Whenattempting to arm the ETD, an individual at therear of the train tells the engineer the ETDnumber, which the engineer enters on the HEDkey pad. The individual at the rear of the trainthen pushes the test button, and the engineerwaits for the ready-to-arm message to then pressthe arm button. The message indicates that theETD is armed after the link is made.

The battery-powered ETD is mounted to therear coupler on the last car of the train, and anair hose connects the ETD to the brake pipe.The one-way ETD has a pressure transducer tomonitor the brake pipe pressure and a flashingred marker light to protect the end of the train. Atwo-way ETD provides the same functions asthe one-way ETD except it additionally has thecapability of venting the brake pipe for applying

2The continuous line of brake pipe extending from thelocomotives to the last car in a train with all cars and theirair hoses coupled. However, the term is often used to referto the brake pipe on a single car.

San B e r n a d i n o

County

o Junctionpoint of

for

Los Angeles

138

San Bernardino

Not to scaleSource: National Transportation Safety Board

Figure I.--Map of California and area of freight train H-BALTI-31 derailment

2

3

emergency brakes. The signal to vent the brakepipe comes from a starter switch on the HEDcontrolled by the engineer. The advantage ofapplying emergency brakes from the rear of thetrain is that any blockage in the brake pipewould be bypassed and braking would occur atboth the front and rear of the trainsimultaneously.

The engineer had waited about 1 minute andthen did a leakage test, noting the train lineleakage was 2 pounds per minute meeting therequirements under 49 Code of FederalRegulations (CFR) 232.12. After the leakagetest, the engineer released the train air brakes,and the air pressure at the rear of the train, asindicated by the ETD, returned to 86 pounds.The engineer then informed the carman at therear of the train that he intended to make anemergency brake application to test that featureof the train brakes. He initiated the emergencybrake application from the automatic brakevalve3 on the locomotive, and according to thecarman, the emergency brake applicationpropagated through the train. The engineerreleased the brakes, and the air pressure on theETD returned again to 86 pounds. One of twocarmen who were near car ATSF 90033 saidthat he observed the brakes set and release onthe car during the first part of the air test.

During the air brake tests with the assistanceof the carman at the rear of the train, theengineer also attempted to arm the two-waytelemetry feature on the ETD. The engineerstated that he received a "com/test/fail" errormessage on the HED on the locomotive duringthe ETD arming procedure. He informed thecarman of this error message, and the carmanresponded, "Okay." The engineer said that theyhad no further conversation about the ETD.

3Draws air from the atmosphere and stores it underpressure. Reducing and increasing the brake pipe pressureresults in the brakes applying and releasing, respectively,regardless of how initiated.

Because of a mudslide in the Cajon area, theATSF management decided to hold H-BALT1-31 at the Barstow yard, and the traincrew wastaken off duty at 7:30 p.m. The engineer saidthat before leaving the train, he had applied itsair brakes by reducing the brake pipe pressureby approximately 20 pounds. The engineerresided in the nearby town of Newberry Springs,California, and went home; the other twocrewmembers returned to the motel. Thetraincrew was recalled for duty at 11:45 p.m.,and another set and release, initiated from thehead end of the train, was performed on the airbrake system. The braking system was chargedfor 3 minutes 6 seconds, and then a 12 psireduction was made.

About 1:17 a.m. on February 1, 1996, H-BALT1-31 with its 4 locomotives and 45 loadedand 4 empty rail cars departed Barstow andproceeded to and stopped for 30 seconds atHodge, California, (MP 13.6). The eventrecorder data indicated that a 7-pound reductionwas made to the automatic air brakes of thetrain. H-BALT1-31continued west and did notstop until 2:30 a.m. at Victorville, California,(MP 36.7). The event recorder registered the useof its automatic air and dynamic brakes. Theengineer said he believed that using the airbrakes to stop at Victorville complied with thetimetable instruction requiring him to make a"running" air brake test at that location and thatthe air brakes were operating properly at thattime also. After 5 minutes 17 seconds atVictorville, H-BALT1-31 continued on to andarrived at Summit, California, (MP 55.9) at 3:40a.m. (The engineer did not recall making a stopat MP 50.1 [Lugo, California].) The engineerstopped at Summit by using the train air brakes,and the train remained there while the crewwaited for a permissive signal permitting themto proceed westward. The engineer said that theconductor and the brakeman were sitting in thecab with him. The engineer stated that afterreceiving a permissive signal, he made at least a10-pound brake pipe reduction, as required bytimetable instruction. The engineer continuedthat he moved the three-position cut-out valvefrom the freight position to the passenger

4

position.4 At 3:50:08 a.m., the train brakes werereleased, the train brake pipe pressure was 86psi 1 minute 42 seconds later. The throttle wentfrom zero to one at 3:56 a.m. The engineer saidthat both the dynamic and the train brakesfunctioned as expected up to and including thestop at Summit.

The engineer reported that H-BALT1-31crested and began to descend the mountain andat Cajon Pass, he applied the dynamic brakes,“bunching”5 the train toward the engines. Healso made a first-service brake application byreducing the brake pipe pressure between 5 and8 pounds. The engineer noted that the speed ofthe train was increasing, and he applied morebraking. The engineer stated that when the trainreached the speed of 18 mph, he and theconductor were aware that the train was movingtoo fast. They were discussing what action totake when the engineer realized that the speedhad reached between 20 and 21 mph, and hesaid that he wanted to “plug it.”6 The engineerstated that the conductor said, “No, let’s notplug it. Let’s make a full set on it, get itstopped.” The engineer continued that he theninitiated a full-service brake application,immediately placing the train in emergency. Atthis time, the engineer noted that the HED wasreading 81 psi on the rear of the train. He saidthat he put the train into emergency and the airpressure reading did not reduce to zero. Theengineer stated that he radioed the ATSFdispatcher to warn all traffic ahead that H-BALT1-31 was a runaway train.

The engineer recalled that bothcrewmembers had stood and then proceededdown the steps in the cab to a door leading to

4The passenger position is designed for a graduated airbrake release on passenger trains.

5The rail cars pushing together that occurs when theslack is taken out of the train.

6Railroad jargon for placing the train into emergencyapplication.

the front of the locomotive and that the speedindicator now showed 45 mph. And he felt thewind coming through the front door. Theengineer remained in the cab and continued theattempt to stop the train. The event recorderregistered that the brakes were charged to 40pounds and reapplied 8 seconds later. Theengineer reversed the engines7 about 7 secondslater, felt the lead locomotive tilting to the right,and then crouched down. The locomotive leftthe track on the curve at MP 60.4 about 4:10a.m. After rolling onto its right (engineer's) sideinto a dry creek bed, it slid to a stop on the sandand came to rest, (see figure 2) without strikinganything, south and west of an ATSF trestle.(See figures 3 and 4.) The engineer, who hadsustained serious injuries, crawled out of the cabthrough the window on the left (fireman's) sideof the locomotive to reach the ground. Then,hearing someone call on the cab radio, heclimbed back into the cab to answer to the call.Two local residents arrived at the locomotiveand then assisted the engineer from the cab.

The four locomotives and 45 of the 49 carsderailed, and H-BALT1-31 was compressed intoa 400- to 500-foot long pileup of cars. (Seefigure 5.) Five rail cars in the pileup containedhazardous materials. (See figure 6.) In addition,two underground pipelines, which transportedpetroleum products, were near the derailmentsite. A fire ignited after the derailment, and thecenter of the pileup and the surrounding areawere engulfed in flames. Sand in the creek bedaround the derailed cars north of the trestle andfor 0.5 mile south of the trestle was burned. Theconductor and the brakeman, who had sustainedfatal injuries, were found, respectively, partiallyburied in the sand 20 feet south and 30 feet westof the trestle and lying in the burned sand creekbed 30 feet south and east of the trestle.

7The action in some locomotives seizes the tractionmotors, locking the axles.

Formerly Southern Pacific Lines

February 1996

point of derailment If

SR13s

now Union Pacificdouble Tracks

ATSF

back

ATSFsouthtrack

138

Formerly Southern Pacific Linesnow Union Pacific

Not to scale double tracksSource: National Transportation Safety Board

track

Figure 7.--Freight train H-BALT1-31 derailment site

8

9

The State forestry and fire protectiondepartment division (service area 38) fire chief10

was dispatched from his residence, 20 milesfrom the accident, at 5:15 a.m. and was on sceneat 6:14 a.m. He reestablished the SR-138/I-15command post at the Mormon Rocks U.S. ForestService fire station, which was 1 mile from theaccident scene (see figure 7), at 6:47 a.m. and,as the Incident Commander (IC), managed theincident, using the incident command system,11

to its completion. An IC deputy, an incidentsafety officer,12 an operations chief, and ahazardous materials expert were assigned toassist him. In addition, 33 agencies, representingFederal, State, county, and local authorities,with access to resources were available to assistas consultants.

The South Coast Air Quality ManagementDistrict was also at the site of the derailmenttaking air and soil samples for analysis. About12:20 p.m., the management district air qualitytest results indicated that the toxins from theburning wreckage were no longer at a dangerouslevel. The IC advised that the roads be reopenedat 2 p.m.; however, SR-138 between I-15 andSR-2 would remain closed to the public untilnoon on February 4 to allow the heavyconstruction and emergency equipment to safelyenter and exit the scene for the initialdecontamination and removal of debris. At 2:30p.m., the IC estimated that approximately 90percent of the train had burned out and, in a

10For qualifications in hazardous materials response,see appendix B.

11Combined facilities, equipment, personnel,procedures, and communications operating in a commonorganizational structure under management responsible forassigning resources to effectively accomplish the statedincident objectives.

12See appendix B for qualifications in hazardousmaterials response.

joint decision with others, stopped fighting thefire. The firefighters monitored the situation andattempted to cool the rail cars with water whilethe cars continued to burn between February 1and 4.

At 10:30 p.m. on February 4, the Stateforestry and fire protection department, togetherwith the ATSF, identified a damaged derailedtank car (NATX 82129), containing theflammable liquid butyl acrylate, that was foundto have an increasing internal temperature.Because of the potential for the tank car toexplode from the overpressurization, I-15 andSR-138 were closed again at 11:01 p.m. OnFebruary 5 at 9:44 p.m., the tank car wasventilated by using plastic explosives and wasno longer regarded hazardous to the public;therefore, I-15 and SR-138 were reopened at11:47 p.m. on February 5 to the public. OnFebruary 5, 1996, the State forestry and fireprotection department considered the completeincident terminated and suspended commandpost activities.

The notification of and coordination betweenthe railroad, emergency responders, and chemicalshippers about the released hazardous materialsand the wreckage clearing operations involvingthe tank cars, as well as the environmentalmonitoring and impact, are addressed later in thereport.

10

Injuries*

Table 1.-- Injuries incurred from accident

TYPE TRAINCREW OTHERS** TOTAL

Fatal 2 0 2

Serious 1 0 1

Minor 0 32** 32

Total 3 32 35*Based on the injury criteria (49 CFR 830.2) of the International Civil Aviation Organization, which the National

Transportation Safety Board uses in accident reports for all transportation modes.**21 police officers, 8 California Transportation Department personnel, and 3 civilians.

DamagesEstimates are quoted as of April 23, 1996.

Equipment $ 3,672,294Track 71,000Signal 3,000Environmental 3,734,044Other 2,017,000Total $ 9,497,338

Traincrew InformationATSF records indicated that each

crewmember was qualified on the physicalcharacteristics of the territory and the operatingrules for trains over the southern Californiadivision. All had attended the instruction classesin 1995 on the General Code of OperatingRules.

The 42-year-old engineer was hired onAugust 8, 1991, as a switchman and waspromoted to conductor and to engineer,respectively, on September 18, 1992, and May7, 1994. He attended locomotive simulatortraining in May 1994 and said that during thetraining, he had activated the simulatoremergency brakes on several occasions inresponse to emergency situations. The ATSF

records revealed that he was administered 157observed efficiency tests, with one failure, in1995, and 30 observed efficiency tests, with nofailures, in 1996. The engineer, according to theATSF records, underwent and successfullypassed an initial comprehensive physicalexamination on July 21, 1991, and his mostrecent physical examination before the accidentoccurred on July 11, 1994. The engineertestified that he had not used alcohol or otherdrugs, including prescription or over-the-countermedication before the accident.

Additionally, the engineer reported that hewas not overworked when he departed the yardat Barstow on the evening before the accident.(He and his two crewmembers went off duty andon duty, respectively, at 4:10 a.m. and 5 p.m. onJanuary 31, 1996. At the time of the accident,the three crewmembers had been most recentlyon duty for about 4 hours 30 minutes.) He saidthat he had no deadline for completing the trip.The engineer stated that with the exception ofthe inability to arm the ETD, train operationshad not been affected by mechanical factors. Hereported that he had previously operated trainsover the track where the accident occurred about200 times and had worked this particularassignment for about 8 months before theaccident.

11

The 25-year-old conductor was hired onOctober 22, 1992, as a brakeman and waspromoted to engine foreman and to engineer,respectively, on May 27, 1994, and February 18,1995. He was administered 108 and 20 observedefficiency tests with no failures, respectively, in1995 and 1996. The ATSF records alsodisclosed that the conductor underwent andsuccessfully passed a preemployment medicalexamination, which included a drug test, onOctober 15, 1992.

The 38-year-old brakeman was hired as aswitchman and was promoted to conductor,respectively, on August 2, 1993, and April 7,1995. The ATSF administered him 155 and 35observed efficiency tests with no failures in1995 and 1996, respectively. According toATSF records, he successfully passed apreemployment physical examination, whichincluded a drug test, on June 2, 1993.

Traincrew End-of-TrainDevice Training

The vice president of operations for theATSF stated that the training department isresponsible for developing appropriateprocedures for any task and for distributing theprocedure material to the transportationdepartment, which provides instruction ortraining. The ETD training for operatingpersonnel before February 1, 1996, consisted ofinstructional videotapes; printed operationprocedure material, distributed separately; andthe written instructions presented in the ATSFgeneral orders and timetables. Round-the-clocksafety meetings also addressed ETD use.Engineers received additional training at theATSF Lenexa, Kansas, training center in the useof the HED/ETD system, which included, aspart of locomotive simulations training,activating the emergency braking function.

The H-BALT1-31 engineer testified that heknew how to arm a two-way ETD before theaccident. The two-way telemetry system must bearmed for two-way operation through an arming

sequence, which establishes the two-waycommunications and links the HED to an ETD,enabling the two to communicate only with eachother and not to conflict with other systems onother trains. He further testified that hisknowledge resulted from being “verballyinstructed” in 1994 by the manager of trainingoperations in how the HED and the ETDfunctioned as well as from reading writtenmaterial in 1995. He added that he had neverseen an ETD training video and was not awareof any formal ETD training program offered bythe carrier.

The director of train handling and thesuperintendent of field operations in SanBernardino for the ATSF stated that before theaccident, the carrier ensured that its roadforemen understood the correct procedures foroperating a two-way ETD. The road foremenwere evaluated on their ability to instructemployees who viewed the video thatdemonstrated the proper procedures for HEDand ETD operation. Since the accident, theATSF has constructed a fully functionaldemonstrator that allows hands-on training ofboth the control HED and the ETD and requiresall operating personnel to participate in thistraining. (Safety Board investigators haveobserved the demonstrator at the Barstowterminal.) This demonstrator is used in additionto road foremen showing the instructionalvideos and answering questions. Feedback andadditional training are still offered, as needed,and the carrier has created a brochure thatoutlines the correct procedures for operatingpersonnel to follow should further guidance benecessary. In addition, the director of trainhandling stated that since the accident, operatingcrewmembers are required to successfullydemonstrate their understanding of armingprocedures in their daily operations.

One ATSF road foreman of engines recalledasking the engineer assigned to H-BALT1-31whether he had any problems arming the two-way ETD, and the engineer, according to theroad foreman, had no questions about the deviceduring that conversation. However, the road

12

foreman was unable to recall when thatconversation had occurred. In addition, the roadforeman had observed the conductor assigned toH-BALT1-31 successfully arm a two-way ETDon one occasion in 1995 and stated that theconductor would have received ETD training inthe engineer training program and ETDinformation with a January 1996 train brakesystem class. The road foreman said that he wasunable to state whether the brakeman assignedto H-BALT1-31 had received any training aboutarming a two-way ETD or any H-BALT1-31crewmember had seen the ETD videos.

Before February 1, 1996, the carrier lacked aprocedure to record the training class attendees.The road foreman stated that althoughcrewmembers were required to attend varioustraining classes, they were not required beforethis accident to record their attendance. The vicepresident of operations said that since theaccident, the carrier has implemented acomprehensive procedure to documentattendance at the ETD training. The director oftrain handling stated that operating employeesare also required since the accident tosuccessfully demonstrate their understanding of“arming” procedures in daily operations.

The Safety Board queried several class Irailroads, including the Consolidated RailroadCorporation, the CSX Transportation Inc., andthe Southern Pacific Lines about the established(post-March 1996) ETD training programs foroperating personnel. The training methods oftwo carriers which responded included a videopresentation and written materials for thepersonnel; a third carrier provided a quickreference guide to its operating personnel. Inaddition, one carrier which responded indicatedthat it will incorporate arming an ETD into itsefficiency testing program.

Train InformationH-BALT1-31, which originated at Barstow,

was 3,218 feet long with 5,025 trailing tons andhad been formed from the cars of other inbound

trains. It consisted of a 4-unit locomotive, 45rail cars loaded with miscellaneousmerchandise, and 4 empty freight cars. Thefour-unit locomotive included ATSF 157; ATSF3853; ATSF 342, which was the only unitequipped with an event recorder; and ATSF4031. (For a detailed consist, see appendix C.)The locomotive units were equipped with 26Lschedule brake equipment. The train had at leastthe minimum number of operative dynamicbrakes, 102.6 tons per operative brake.13 Allbrakes were inspected and operative, accordingto an ATSF carman, when the train left Barstow.

The lead locomotive, ATSF 157, wasequipped with a new safety controlcompartment, designed in part by the ATSF,that included a desktop control console on theright (engineer's) side and two adjustable seats,one behind the other, for the conductor and thebrakeman on the left (brakeman’s) side. Thiscontrol compartment design was introduced onthe ATSF in May 1990. The forward entrance ofthe locomotive was a heavy metal windowlessdoor on the right side of the front wall. Thisexterior door opened onto a small vestibule inwhich an interior door and two steps led to thecontrol compartment. The rear entrance had adoor with a fixed upper vertical window at theright rear of the control compartment behind theengineer's seat.

The third locomotive unit was equipped witha Q-tron Ltd. DATACORD 3000 model Q-888208/01 event recorder. The Federal RailroadAdministration (FRA) regulations require thelead locomotive unit on trains operating atspeeds greater than 30 mph to be equipped withan event recording device. The event recorderplacement, however, did not violate the existingregulation, according to the FRA, which notedthat 49 CFR 229.135(a) states, “the duty toequip the lead locomotive may be satisfied withan event recorder located elsewhere than the

13Tons per operative brake is the gross trailing tonnageof the train divided by the total number of cars havingoperative brakes.

13

lead locomotive provided that such eventrecorder monitors and records the required dataas though it were located in the leadlocomotive.”

Safety Board investigators found an FRAform F6180-49A, known as a blue card, onlocomotive unit ATSF 342. On this form isrecorded when certain parts of the engine wereinspected and by whom. (See appendix D.)According to 49 CFR 229.135(a):

The presence of the event recordershall be noted on Form F6180-49A,under the REMARKS section, exceptthat an event recorder designed toallow the locomotive to assume thelead position only if the recorder isproperly functioning is not required tohave its presence noted on Form FRAF6180-49A.

The carrier is to note in the remarks section onthis form whether the engine is equipped withan event recorder. No evidence of this enginebeing equipped with an event recorder was onthis form.

Initially, according to the ATSF assistantvice president for technical training and rules,the ATSF policy was to equip all even-numbered locomotives with event recorders. AnATSF study had previously determined that,with 94-percent probability, at least one eventrecorder-equipped locomotive would then be inevery four-unit locomotive consist. (Severalodd-numbered locomotives in the ATSF fleetwere equipped with event recorders.) Beginningwith the delivery of the ATSF class (GE CW44-9) locomotives, all delivered locomotives wereequipped with event recorders. Both the ATSFand the BN current policy is that all new,delivered locomotives have event recordercapability.

On February 1, 1996, no Federal regulationrequired the use of an ETD with the two-wayfeature for trains traveling westward throughCajon Pass. H-BALT1-31 was equipped with a

two-way ETD but had no caboose, and neitherwere required. (See appendix E for ETD rulesand regulations.) With the issuance of the FRAemergency order 18, effective 12:01 a.m., onFebruary 8, 1996, two-way ETDs were requiredfor all westbound trains operated by the ATSFtraversing the Cajon Pass. The carrier wasrequired to ensure that it is possible for thetraincrew to effect a brake application from therear of the train by using one of the followingmethods: a) a two-way ETD, b) an occupiedhelper locomotive, c) an occupied caboose at therear of the train, or d) a radio-controlledlocomotive in the rear third of the train.

Three of the 14 tank cars on H-BALT1-31were empty, and 11 tank cars containedchemical products. Butyl acrylate (NATX82129), trimethyl phosphite (GATX 37310),denatured alcohol (MWSX 29654), and methylethyl ketone (CELX 2374) are classified underthe U.S. Department of Transportation (DOT)hazardous materials regulations as flammableliquids.14 Naphtha solvents (ACFX 79907)were shipped under DOT regulations ascombustible liquid.15 Petroleum oil (ECDX792140) was classified as a hazardous substance(environmentally harmful material) by the U.S.Environmental Protection Agency (EPA) underthe provisions of the ComprehensiveEnvironmental Response, Compensation, andLiability Act. Calcium chloride solutions(ACFX 84070 and ACFX 84855), propylene

14As defined at 49 CFR 173.120, flammable liquidshave a flash point of not more than 141oF or are anymaterial in its liquid phase with a flash point at or above100oF that is intentionally heated and offered fortransportation at or above its flash point in a bulkcontainer. The flash point is the minimum temperature atwhich a liquid gives off vapor within a test vessel insufficient concentration to form an ignitable mixture withthe air near the surface of the liquid.

15Any liquid that does not meet the definition of anyother hazardous class and has a flash point above 141oFand below 200oF. As defined at 49 CFR 173.120(b),certain flammable liquids also may be shipped ascombustible liquids for highway and rail transport.

14

glycol (DOWX 3965), plasticizers (GATX13571), and petroleum lubrication oil (UTLX79897) were not regulated under the DOThazardous materials regulations.

Eleven of the 12 tank cars that derailed wereDOT specification 111A100W1 or 111A100W3tank cars ranging in capacity from 8,000 gallonsto 30,000 gallons. The thickness of the tankshells and tank heads on these tank cars wastypically 7/16 inch, and in one or two instances,15/32 inch. Eight of these tank cars (DOWX3965, ECDX 792140, GATX 13571, GATX18211, GATX 37310, UTLX 41411, UTLX41424, and UTLX 79897) were insulated andjacketed. The insulation typically was about 4inches thick. The steel jackets typically areabout 1/8 inch thick and hold the insulation inplace. None of the 11 DOT specification111A100W1/3 tank cars were equipped withhead shield protection, but all were, as required,equipped with vertical restraint couplers. Theremaining (12th) tank car that derailed, NATX82129, was a DOT specification 105J300W tankcar operating under DOT exemption E-11184that permitted a safety relief valve set todischarge at 75 pounds per square inch, gauge(psig), rather than the required 225 psig. Thetank, with a test pressure of 300 psig, had a shellthickness of 9/16 inch and heads 19/32-inchthick. The tank was covered by 4 inches offiberglass and ½ inch of ceramic fiber asthermal protection and a 1/8-inch steel jacket.The tank car also had ½-inch full head shieldprotection and vertical restraint couplers.

Car ATSF 90033, the 16th and last car of thetrain added in Barstow, was a heavy-duty flatcar, which had been loaded with steel pipe onJanuary 19, 1996, in East St. Louis, Missouri. Ithad end-of-car cushioning devices16 rather thanconventional draft gear behind the couplers. Car

16Hydraulic shock absorbers designed to absorb shockduring train yard impacts.

ATSF 90033 was bad ordered17 betweenJanuary 22 and 24 in Kansas City, Kansas, forrepairs, which were made to the brake pipe onthe “A” end. The car continued on to Barstow,where it was bad ordered for the cushioning uniton the A end and later for damage to the brakepipe on the “B” end.18 The cushioning unit wasdetermined to be serviceable by the Barstowrepair track foreman based on FRA criteria, anda piece of the brake pipe on the B end wasreplaced. The replaced brake pipe was 46.5inches long with a kink on the inboard end. Thebrake pipe connected the glad hand hose19 to theflexible armored hose. The foreman stated that a59-inch pipe was cut and attached in the samemanner as the hose arrangement found on the Aend of the car. When the foreman was askedwhether he had access to any reference manualfor the air hose arrangement repair on cushionedunderframe cars, he said that no such referencewas available at his facility and that the B end ofcar ATSF 90033 was repaired to match itsundamaged A end.

Track and Signal InformationThe tracks at the POD MP 60.4 are

designated as south and north tracks. The grade,approaching and at the POD, is, respectively, a3-percent and 1.73-percent descending from eastto west. At the POD is a 7-degree 40-minute 59-second curve. Train turn-over speed wascalculated at a minimum of 70 mph. The southtrack, on which the train traveled, wasconstructed with 136-pound RE sectioncontinuous welded rail and was laid in 1980 onconcrete ties with Pandrol fastenings. The tieslaid in crushed area 24 granite ballast, extending8 or more inches below the ties, with full tiecribs and shoulder ballast, extending 12 or more

17Identified by a car inspector as needing mechanicalattention or repairs.

18Rail cars are identifed as having A and B ends. Thehand brake is on the B end.

19A section of the train line system at which the hosehas a quick release coupling.

15

inches beyond the tie ends. The track had beeninspected on the day before the accident by aqualified track inspector riding a high-railvehicle, and no anomalies were noted orreported. The main track structure, not damagedor destroyed in the accident, met or exceededthe FRA minimum requirements for class 4track.20

The Centralized Traffic Control System fromthe computer-assisted dispatching center inSchaumburg, Illinois, controls train movementsthrough the section of track at the accident site.The signals and signal system were checked andtested 2 days before the accident. An adjustmentwas made to the switch circuit controller at MP62.9; no other anomalies were found or noted.

Operations InformationAccording to the ATSF, between 70 and 90

trains in both directions pass through the Cajonarea daily. The movement of trains, controlledby the Centralized Traffic Control System, overthe territory is governed by the ATSF timetableinstructions, operating rules, and general orders.

The ATSF system timetable no. 5, effective12:01 a.m. April 16, 1995, was in effect at thetime of the accident. Based on the timetable, themaximum permissible speed for H-BALT1-31between Summit and Cajon was 15 mph andbetween Cajon and San Bernardino was 20 mph.The timetable contained the following air brakeinstructions (see appendix E):

Rule 30.6, 30.7, 30.10, 30.11: Allwestward trains at Barstow receivingan Initial Terminal, IntermediateInspection, Application and Release orAdding Cars Enroute Air Brake Testmust, after completion, initiate anemergency application of the brakes

20At 49 CFR 213.9, maintained to accommodatepassenger and freight trains at maximum allowable speedsof 80 and 60 mph, respectively.

and determine from end of train devicethat brake pipe pressure drops rapidlyto zero.

Rule 30.13: If train is stopped atSummit for any reason, an automaticbrake application of not less than 10psi must be made and not releaseduntil ready to proceed.

Rule 30.14: At Summit,westward….freight trains operatingbetween Summit and Cajon must makea running air brake test while passingVictorville and in doing so determinethe following:

(1) Retarding force of airbrake system.(2) If equipped with afunctioning ETD, that normalbrake pipe pressure changesoccur at rear of train.

Air brake rule 30.27, as amended, of thetimetable contained instructions for testing atwo-way ETD and verifying its operation. (Seeappendix E.) Guidelines for reporting failures ofthe ETDs were under rule 67 of the generalorders. The timetable contained no procedure tofollow should the two-way ETD fail the test inthe two-way mode or not be operational.

The director of train handling testified thatafter the December 1994 Cajon Pass accident21

at MP 61.55 (see figure 7), the ATSF hadcommitted to install two-way ETDs andreceiving units on its locomotives, as theequipment became available frommanufacturers. As a result of the Safety Boardinvestigation of the 1994 collision, the SafetyBoard recognized the following safety

21Railroad Accident Report--Rear-End Collision ofAtchison, Topeka and Santa Fe Railway Freight TrainPBHLA1-10 and Union Pacific Railroad Freight TrainCUWLA-10 near Cajon, California, on December 14, 1994(NTSB/RAR-95/04).

16

accomplishments for ATSF managementimplementation:

1. Issue systemwide instructions prohibitingthe use of the feed-valve braking.

2. Expedite the installation and use of two-wayEDT devices.

3. Require an emergency brake application testfor any westbound train that receives aninitial terminal, intermediate, orapplication/release test or that has carsadded at Barstow.

4. Require each westbound train operating onthe Cajon subdivision to make a running airbrake test according to the rules beforedescending Cajon Pass.

5. Establish an additional assistantsuperintendent of field operations positionand two additional manager of trainingoperations positions to ensure compliancewith the above train handling and testingrules.

6. Inventory all rubber air brake parts for out-of-date components and removed those withexpired dates.

7. Suspend temporarily the operation of five-pack double stack trains down grades of 3percent or more.

8. Issue temporary instructions requiringhelper locomotives on train consists of five-pack double-stack cars that exceed over 100tons per operative brake and 250 tons perdynamic brake on the north Cajon track and80 tons on trains on the south Cajon track.

In a letter to the Safety Board, dated October30, 1996, the ATSF noted that the followingmanagement processes for operations had beenimplemented since December 30, 1994, andbefore February 1, 1996:

1. Before departure, trains, which have beenmade up or had power changes in Barstow,are placed in emergency braking to verifybrake operation.

2. En route, between Lenwood, California,(MP 6.7) and Lugo, running air brake testsare made to verify that the brakes areoperational.

3. If the train is stopped at Summit, a minimumbrake pipe reduction of 10 psi is required.

4. To increase management oversight andassist on-site training, more line supervision(road foreman of engines) has been added.

5. On the use of ETD two-way mode, traininghas been supplemented to include printedmaterial, increased rule promulgation,additional road foremen to ride with crews,and a video featuring two-way operation ofETDs.

6. Form 1717 (evaluation for engineercompliance with part 240 recertification)has been revised to include a test on theunderstanding of two-way ETD operation.

7. Additional two-way ETD equipment is to bepurchased, as available from manufacturers.

8. Air brake seminars conducted for engineersin Los Angeles.

At the time rule 30.27 was amended, thecarrier had not procured enough units to equipall trains. The director of train handling said thata crew could, therefore, operate a train down thegrade at Cajon Pass without an operational two-way ETD or other method of initiating anemergency brake application from the rear ofthe train. According to the director of trainhandling,

Generally, the operating practices—anything that affects operations,pertain to operating practices, we havea—we offer it and then we propose itand circulate it around between theSOC staff and the training center staff,director of rules.

He added that the executives reviewed the rulesand put their stamp of approval on them beforeany one was issued.

17

The vice president of operations stated thatwhen ATSF began the accelerated purchasingand installing of two-way ETDs, upper-levelmanagers had the “intent” to ultimately equip allwestbound trains traversing Cajon Pass withoperational devices. When the vice president ofoperations was asked whether any follow-upprocedure was initiated after December 1994 toensure that the intent was met, he replied,

Other than the instructions that werein place, no, there wasn't any otherformalized follow up in terms ofanything done other than what wasdone here on the division itself. Inother words, there was nothing doneother than the issuing of theinstructions that we've talked about.

The vice president of operations added thatsince February 1, 1996, the ATSF has initiated afollow-up procedure that ensures front linemanagement is complying with the intent ofsenior management, and he said,

It is mandatory that the train cannotleave Barstow westbound over CajonPass without a working two-waydevice, period. If that device fails inroute prior to descending the grade atSummit, then the device is eitherrepaired in route or helpers are added.And those procedures are enforcedand followed up.

The ATSF has also contracted for amanagement follow-up audit.

The operation and display of one- and two-way ETDs were not required under the CFR butwere explained in general order 126, effectiveApril 16, 1995. (No requirement was in effectthat the two-way feature be operational beforeH-BALT1-31 departed Barstow on February 1,1996.) General order 130, also issued on April16, 1995, amended general order 126 and stated:

Should conditioning 2-way ETD foremergency application capability beunsuccessful, train may still beoperated without 2-way capability aslong as pressure comparison betweencontrol head readout and rear unitETD does not exceed 3 psi.

In addition, rule 67 (B) in the general ordersstates:

Engineers departing or arriving cantest their ETD display to verify properoperation of the ETD receiver.Improper operation must be reportedto the Train Dispatcher and CustomerQuality Support.

Also, under (D) of rule 67:

All inoperative ETDs ETMs [end oftrain markers] should be reported tothe mechanical coordinator desk in theSystem Operations Center,Schaumburg, [Illinois] via radio (tonecall-in no.4) or phone (821-6800)furnishing location, number of device,train ID or yard engine number.

When the engineer was asked whether he wasaware in Barstow of any instruction explainingwhat to do if the two-way ETD was notoperational or of any prohibition to operate atrain without an operational two-way ETD, theengineer replied, “No, sir.” Also, when askedwhether he had taken a train out of Barstowwithout an operational two-way ETD, theengineer answered, “Yes, sir.”

Meteorological InformationWeather observations at 3:46 a.m. from the

Ontario, California, airport about 14 nauticalmiles west of Cajon reported a temperature of53°F, calm winds, cloudy skies, rain showers,and fog with 3-mile visibility. According to theengineer of H-BALT1-31, it was raining at thetime of the accident.

18

Medical, Pathological, andToxicological Information

The engineer of H-BALT1-31 wastransported after the derailment to SanBernardino Community Hospital, admitted onFebruary 1, 1996, at 5:32 a.m., and released onFebruary 12, 1996. He suffered multiplecomplex facial lacerations and a compressionfracture of the lumbar spine.

Autopsies were performed on the conductorand the brakeman by the San Barnardino CountyOffice of the Medical Examiner. The conductorsuffered blunt head and torso injuries, fractureof the left femur and upper and lowerextremities, and contusions and abrasions. Noevidence of major or blunt force trauma wasfound in the autopsy of the brakeman. Hereceived massive burns, and soot was present inthe upper and lower airways of his lungs. Thetoxicology test results for the brakeman revealed30-percent carbon monoxide saturation.

Blood and urine specimens were taken by6:23 a.m. on February 1 from the engineer at theSan Bernardino Community Hospital.Specimens were taken from the conductor andbrakeman by the San Bernardino County Officeof the Medical Examiner by 2:53 p.m. onFebruary 3. In addition, specimens were takenfrom the train dispatcher by 11:05 a.m. onFebruary 1. The toxicology test results for eachperson were negative, with the exception of thebrakeman, whose blood tested positive for ethylalcohol at 0.012 w\v percent.

Survival AspectsThe control compartment windows of

locomotive ATSF 157 were broken in front ofthe engineer’s seat on the right side (see figure2), and the acoustical panel behind the seat wasmissing. No intrusion was apparent underneaththe cab console, and the console appeared to beintact and fixed squarely onto its originalmounting. Superficial damage with minor,localized denting about 6 inches deep and alsoabrasion evidence were on the right side of the

cab. The collision post right of the corridor wasbulged about 2 inches inward toward the centerline; the collision post in the rest room on theother side was unaffected. The roof of thepassageway, although depressed about 2.5inches, and the walls were intact.

Postaccident Train Examination

Wheel Sets-- On February 5, 1996, about70 pairs of wheels from the derailedlocomotives and cars were recovered from thewreckage, numbered for identification, andexamined at the accident site. Most wheel setscould not be matched to any particular car.Investigators inspected the wheel sets fordiscoloration, metal flow, or other evidence ofexcessive braking. Wheels with bluing and otherdistinct patterns of significant wheeloverheating were discovered during theinvestigation.

Train Line-- Each car control valve andbrake system responds to brake pipe pressurechanges. A blockage in the train line restricts apressure drop beyond the blockage, and thebrakes will not effectively apply. Brakes to therear of the blockage will either not apply orapply weakly. Safety Board investigatorsexamined the train line for possible sources ofblockage, such as debris or objects, kinked22 airhose, or a closed angle cock.23 No evidence ofdebris or objects blocking the train line wasfound because of the wreckage and fire damage,which also hindered the investigation.

22Single sharp bend where interior diameter hascollapsed at bend, thus, restricting or closing passagethrough hose.

23Type of a 1.25-inch valve, either ball or plug design,at both ends of the brake pipe on locomotives and rail carsand used to control the admission of air to the brake pipeon individual cars. The free end is angled at 45 degrees andthreaded to receive the air hose nipple.

19

About 60 percent of the structure of carATSF 90033 (B end) without trucks wasremoved on February 5, 1996, from thewreckage and examined outside thecontaminated area. Safety Board investigatorsfound the cushioning device was burned andstill inside the sill. The bottom of the car wascleared of all attachments including the end-of-car air brake hose. A bent and flattened pipetrolley was still attached. No air hoses orattachments could be found that could beidentified as belonging to car ATSF 90033.

H-BALT1-31 had four other cars, the 5th and11th through 13th, with some form of cushionedunderframe. Because these cars and their airhoses were destroyed in the derailment andsubsequent fire, investigators could notdetermine whether the cars had kinked air hosesor any other condition that would have restrictedthe train line.

On February 10, 1996, the EPA allowed theATSF contractors on site. ATSF supervisorsthen notified the subcontracted wreckageclearing personnel to recover all angle cocksfound at the scene. Two subcontractors wereshown an angle cock on a box car in the debris,and when they returned to the wreck siteentrance, they noticed a wrecked car (ATSF92018) along the right-of-way, which had anattached angle cock. (See figure 8.) Thesubcontractors notified the ATSF supervisorsabout the angle cock. The supervisors observedthat the angle cock was closed and instructed thesubcontractors to retrieve it. This angle cock,which was the first of six angle cocks found inthe closed position, was removed,decontaminated, and given to the supervisors.Two of the six angle cocks, one later matchedwith the B end of car ACFX 84070 and the onefrom car ATSF 92018, had sustained no majordamage.

A photograph of car ACFX 84070, taken bySafety Board investigators on February 3, 1996,revealed the B end of the car with the anglecock still attached. (See figure 9.) Thisphotograph was enhanced at the Federal Bureau

of Investigation photography laboratory andshowed the angle cock in the open positionwhen the photograph was taken.

The ATSF wrote the Safety Board onOctober 7, 1996, about its consultant’s findingson the car ATSF 92018. The carrier concludedthat according to the findings, the angle cock oncar ATSF 92018 had been “closed prior to thefire and closed prior to the derailment.” TheSafety Board laboratory noted that this anglecock was in the closed position when the firereached its location.

Tank Cars-- Twelve of the 14 tank cars inthe train derailed. (Of the two tank cars that didnot derail, one was empty, and one containedmethyl ethyl ketone, a DOT-regulated flammableliquid.) Three of the derailed tank cars (ACFX84855, ACFX 84070, and DOWX 3965) were the3rd, 4th, and 6th cars, respectively, behind thelocomotives. The other nine derailed tank carswere between the 26th and 41st cars trailing thelocomotives. Two of the 12 derailed tank cars(UTLX 41411 and UTLX 41424) were empty. Ofthe 10 loaded derailed tank cars, five containedDOT-regulated hazardous materials, and five heldnonregulated products. (See table 2 for productsand classification.)

The paint and identification marks of the 12derailed tank cars, except for ACFX 84070 andACFX 84855, had been completely burnedaway. In addition to the fire and heat damage,the 12 tank cars sustained extensive impactdamage, which included crushing, deformation,denting, creases, gouges, tears in the jacket, andpunctures of the head and tank shells.

The 11 DOT class 111A tank cars,including the seven tank cars with jackets,collectively sustained extensive impact damage,particularly crushing and deformation. Six of theDOT 111A tank cars had longitudinal crushing,deformation, and flattening that was in excess of2 feet (between ¼ and ½ tank car diameter).One tank car was bent in half around acircumferential plane at the middle of the tankcar. The tank heads on about six tank cars had

21

punctures and ruptures with dimensions rangingfrom a 6- by 14-inch hole to a 5-foot per sidetriangular hole. About half of the verticalrestraint couplers were missing, and most of thestub sills were bent, fractured, or deformed.

Tank car NATX 82129, containing the butylacrylate, had indications of exposure to heat andfire and impact damage over its entire surface.All paint and identification marks had burnedaway. The jacket had dents, tears, and puncturesover the entire surface area, and large sectionsof the jacket were missing. The remainingsections of the jacket were removed by wreck-age crews to examine damage to the tank. Onetank head was dented in excess of 4 inchesbetween the 12 and 1 o’clock positions. Thesecond tank head had what appeared to be asmall dent at the 8 o’clock position, slightlyinward of the perimeter of the tank head. Thehole in the tank from one of the two shapedcharges was at the 1 o’clock position of the weldjoint between this tank head and the tank shell.The barrel of the tank had scrape marks andindications of exposure to heat or fire (metaldiscoloration); no other damages were observedto the barrel of the tank. Both couplers wereintact; however, both had been twisted or bent.

Tests and Research

Signals-- Tests for grounds and shorts hadbeen performed on the signals at Summit, on theintermediates at MPs 58 and 60, and on theelectrical signals at Cajon, respectively, onJanuary 12, 15, and 26, 1996. No anomalieswere found. On January 29, 1996, the signalmaintainer for the territory had inspected andtested the switch circuit controller at Cajon,MPs 62.8 and 62.9, and nos. 1 and 2. Anadjustment had been made on the circuitcontroller at MP 62.9. No adjustments oranomalies were found at the other locations. Thesignal system was checked and tested onFebruary 5, 1996, after the destroyed rail wasreplaced and the track placed back in service.The system operated as designed; no anomalieswere found.

Event Recorder-- The event recordingdevice from locomotive ATSF 342 was sentunder Safety Board supervision to the Q-tronfacility in Calgary, Alberta, Canada, where itwas tested. (The Safety Board laboratoryengineers received the event recorder and foundthat not all fields were recorded.) No speed ordistance data could be calculated from the eventrecorder because it had not recorded any wheel

Table 2.--Derailed tank cars with lading

TANK CARS PRODUCTS DOT CLASSIFICATIONACFX 79907 Naphtha solvents Class 3-combustible liquid

ACFX 84070 Calcium chloride solution Not regulated

ACFX 84855 Calcium chloride solution Not regulated

DOWX 3965 Propylene glycol Not regulated

ECDX 792140 Petroleum oil Class 9-hazardous substance.

GATX 13571 Plasticizers Not regulated

GATX 37310 Trimethyl phosphite Class 3-flammable liquid

MWSX 29654 Denatured alcohol Class 3-flammable liquid

NATX 82129 Butyl acrylate Class 3-flammable liquid

UTLX 79897 Petroleum lube oil Not regulated

22

data during the accident trip. The testing of theevent recorder revealed that it was capable ofrecording wheel rotations normally. The axlegenerator, which is attached to an axle of thelocomotive, sends a signal to the recorder thatindicates how fast the wheel is rotating. Thegenerator was found to have been modified toaccommodate a nonstandard connector for thecable that connects the generator to the eventrecorder. A wire used to install the nonstandardconnector was found broken inside the axlegenerator housing, and the generator was unableto produce a signal. Q-tron contacted the carrierthat owned the locomotive as well as thelocomotive manufacturer about themodification; however, investigators could notdetermine who had performed it.

The event recorder on locomotive ATSF 342indicated that the last download of data hadbeen performed on December 12, 1994, at theQ-tron facility. No record of the memory card24

door opening or of memory card removal wasfound in the recorder memory. (The opening orremoval will go undetected if occurring with nopower applied to the recorder.) Maintenancerecords indicate that the recorder was sent to Q-tron for maintenance, following a faileddiagnostics report that indicated a “CARD NOTPRESENT” (event recorder memory card) flag.According to the Q-tron maintenance records,the battery was replaced in the memory card,which satisfied a subsequent diagnostics test ofthe event recorder. In addition, the analogthresholds for dynamic brake control andtraction motor current at that time were 3percent and 97 amperes, respectively. Themanufacturer-recommended settings for thesethresholds are about 3 percent and 99 amperesor less.

24Stores a copy of the recorder internal memory and isremovable to facilitate convenient readout of recorded data.

After the last event recorder service at Q-tronon December 28, 1994, the configuration of therecorder was changed to the 146 percent and1,782 amperes thresholds for dynamic brakecontrol and traction motor current, respectively.As a result of this change, both dynamic brakecontrol and traction motor current were recordedonly every 8 minutes. With the manufacturer-recommended settings, the device would recordany activity from these two sources wheneverthe thresholds were exceeded.25 Theconfiguration can be changed with theappropriate software; however, the manufacturerrecommends that all configuration settings beset at the factory to preclude such problems asincorrect threshold settings. Both of theseproblems exist for all data on the event recorder.(The oldest data is dated January 17, 1996, at11:30 a.m.)

In addition, locomotive ATSF 342 wasequipped with a microprocessor-based Q-tronevent recorder with a self-test function (a smallgreen light indicated when the system had nofaults). The assistant vice president for technicaltraining and rules told the Safety Board, “It wasthe ATSF understanding with the FRA that thistype of recorder would not require downloadingat quarterly inspection intervals, but would berequired during annual inspections.” The FRAregional administrator told the Safety Board that“no such gentlemen’s agreement” was madewith the ATSF about this matter.

Locomotive ATSF 342, according to thecarrier, was assigned to the Corwith, Illinois,Electro Motive Division shop, where its lastannual inspection was performed on June 12,1995. No documentation was found in the unitfile about the event recorder for this inspection.Under 49 CFR 229.25(e) (5),

25The thresholds set at the time of the accident wouldnever be exceeded during normal operating procedures.

23

A railroad’s event recorder periodicmaintenance shall be consideredeffective if ninety percent (90%) ofthe recorders inbound in any givenmonth for periodic inspection are stillfully functional; maintenance practicesand test intervals shall be adjusted asnecessary to yield effective periodicmaintenance.

FRA officials indicated that the FRA has noprocedure for monitoring carrier compliancewith the 90-percent rule. The ATSF could notprovide any statistical information about thepass/fail rate of its quarterly event recorderinspections. However, in an October 21, 1996,letter to the Safety Board, the ATSF reportedthat event recorder defects generally arebetween five and 12 a day and “considering anactive fleet of 1,692 locomotives the defect rateon October 18, 1996, would be 0.4 percent.”

Train Line-- The BNSF provided a copy ofthe Santa Fe Angle Cock Arrangement Manual,revised September 22, 1995, to the SafetyBoard. The manual contains over 33 differentair hose arrangements for cushioned underframefreight cars. No other reference, except shop ormanufacturer drawings, is available as a guidefor the repair or replacement of the air hosearrangements on the ends of cushionedunderframe freight cars.

Car ATSF 90033 was modified, whichincluded adding the end-of-car cushioning units,in January 1976. According to the modificationdrawings provided by the ATSF, the 15-inchcushioning unit travel required a flexible airhose arrangement at the end of the car toaccommodate the movement of the coupled caras slack increased or decreased. The flexiblearmored hose was bent into a question markshape and would curl or straighten with the

movement of the coupler slack. A 14-link, no.

20 chain supported the hose in the middle, asbuilt, and was attached to the underside of themetal floor by a bracket bolted around the hose.The flexible air hose had been moved backabout 3 feet by using two extended pipesaccording to the March 1, 1976, ATSF anglecock and air hose arrangement drawing. Themodified car had a 46.5-inch long pipe, insteadof the, as built, 1-foot pipe, connected to theglad hand air hose, and a 16-inch long pipe usedin between, instead of the flexible hose attacheddirectly to, the angle cock by a 45-degree elbow.These pipes effectively moved the flexible hoseback away from the end of the car. The 46.5-inch pipe was attached at two locations becauseof its length. The end, attached to the flexiblehose, was also attached to a welded bracketgoing through a slot in the cover plate andanchored to the movable cushioning unit. Theother end, attached to the glad hand hose, waswelded onto two loop brackets that weresupported by a bar-type hanger with 15 inchesof travel.

Safety Board investigators examined fivesister cars26 of car ATSF 90033 at SanBernardino to determine whether 1) cushionedcar hose arrangements are common andstandard, 2) such arrangements may be moresusceptible to kinking, and 3) arrangements metFederal, AAR, and carrier requirements. Noneof the inspected five sister cars had the samehose arrangement on both ends. Three basicarrangements, with differences in eacharrangement, were found. Some car endsappeared to retain the original design withreturn springs; others had the modified designwhen rebuilt for heavy service; and still othershad a design not identifiable. Several car ends,such as the B end of car ATSF 90030, had alonger pipe when compared to the otherinspected cars.

26ATSF 90030, 90031, 90032, 90035, and 90036,which were 89-foot flat cars.

24

The following list compares the air brakepipe lengths, attached to the glad hand air hose,on the ends of the five sister cars:

ATSF 90032B 7.0 inches Return springsA 45.5 inches No return springs

ATSF 90031A 22.25 inches Return springsB 10.5 inches No return springs

ATSF 90036A 6.5 inches No return springsB 7.5 inches No return springs

ATSF 90035B 11.0 inches No return springsA 11.0 inches Return springs

ATSF 90030B 45.0 inches No return springsA 43.5 inches No return springs

According to the senior vice president of theTTX company of Chicago, Illinois, which ownsand leases over 50,000 rail cars:

There are recommended arrangementsthat are shown in the various AARmanuals that should be followed.There's -- if you look at angle cockarrangements and hose arrangementsin cars, I think it's Rule 4 would be thereference that you would make in thefield manual as an example. There'sprobably, if memory services me,seven or eight different figures that arein there, depending on the type of carsto what that configuration should be.This provides the framework or theguidelines for those applications. Theend-of-car cushioning units withhydraulic draft gears typically areeither the trolley arrangement, whichis, I think, S-427, or also anarrangement which is tied in, wherethe bracket to move the hosearrangement is actually tied into thehydraulic draft gear itself and moveswith the draft gear.

End-of-Train Device-- The ETD found onH-BALT1-31, manufactured by PulseElectronics Inc., was bench tested at the Pulsefacility in Rockville, Maryland. The brake pipepressure accuracy; motion detection; marker,battery, and armed/not armed status; andemergency activation were all tested and foundto be fully functional within the Pulsespecifications.

Head-End Device-- The HED components,manufactured by Colt Technology, were testedat the Colt facility in Lee’s Summit, Missouri.The HED consists of two major components, thecontrol head (operates the system and displaysthe system status) and the receiver logic module(RLM).

The HED display window on the controlhead indicates whether an arming attempt wassuccessful, and a momentary indication occursimmediately after the attempt is completed. An“emergency enabled” indicator constantly lightswhen the system is armed and the two-waycommunications are reliable. The HED performsan automatic communications test every 3minutes when the system is armed for two-wayoperation. If four successive tests fail, theemergency enabled light will flash on thecontrol head, indicating that two-waycommunication is no longer reliable. Noindication of a transmitter failure displays on thecontrol head when the system is not armed fortwo-way operation display. A communicationsfailure will be indicated on the control headdisplay only if no data is received from the ETDfor approximately 15 minutes. Both the displaywindow and the indicator light functioned asintended during testing.

25

The control head from H-BALT1-31 had afirmware27 version (12) dated January 16, 1995.This version does not allow the emergencybrake function to be operated when the controlhead is being used for any other function, suchas the odometer, calibrated mile, or train lengthfunctions. Additionally, the control headdisplays an “arm now” message whenever theHED receives an arming request from any ETD,regardless of the ID code selected armed/notarmed status. If the arming button is pressedwhen this occurs, the HED will only attempt toarm with the ETD that has the selected ID code.Approximately 430 Colt Technologies HEDswere in use as of October 22, 1996, as a one-way device only, according to the ATSF, andnone was operated with the “old” firmwareversion installed.

The RLM contains three major modules: thelogic, the receiver, and the transmitter. Duringthe Safety Board testing, the transmitter modulein the RLM from H-BALT1-31 was found tohave an output power of -4 dbm (approximately0.000350 watt). The design specification foroutput power of the transmitter module is 2.0watts.

Train Dynamic Analysis Simulation--Safety Board investigators and representativesfrom each party to the investigation conducted28 computer simulations (27 scenarios plus 1practice run) at Freightmaster, Inc., in FortWorth, Texas, on March 19 and 20, 1996. Thescenarios used in the simulations weredeveloped from the limited event recorderinformation, from the dispatcher's CentralizedTraffic Control System signal record loginformation, and from the H-BALT1-31engineer's statements about the accident. Threesimulation scenarios more accurately matchedthe actual time from Summit to the POD and thespeeds that the engineer recalled. In these

27Computer programming, stored on memory chips,which can easily be replaced when computer programs arechanged.

simulations, a train line blockage occurredbetween the 5th and 9th cars from the engineconsist. (See appendix F for simulationprotocol.)

The last scenario was simulated to determinewhether the train could stop if an emergencybrake was propagated through the entire trainfrom the automatic brake valve and theemergency feature on the ETD. To simulate thetrain brakes on the head of the train (ahead ofany blockage) being applied from the automaticbrake valve on the locomotive and the brakes onthe rear of the train (behind any blockage) beingapplied from the ETD emergency feature thatsimulates a single point blockage, the computermodel was set so that no train line blockageoccurred and all train brakes applied inemergency. The train, at MP 57.82 andcompletely on the downgrade, had alreadyattained a speed of 31.2 mph. The simulationincorporated full dynamic brakes engaged andemergency brake application initiated at MP58.253 at a speed of 27.6 mph. With thedynamic brake fully engaged, the speedincreased from 31.2 mph at MP 57.82 to 35.6mph at MP 58.01 and then decreased to 27.6mph at MP 58.253. At that decreased point, anemergency brake application was initiated, andthe train stopped at MP 58.435, about 2 milesshort of the POD (MP 60.4).

Metallurgical-- The Safety Board sent anangle cock and a portion of the brake pipe fromcar ATSF 92018 plus five other closed anglecocks found at the accident site to itsWashington, DC, laboratory for examination.The remaining three closed angle cock valvesfrom unknown cars were extensively damaged,and the Safety Board considered no purposefulinformation could be gained from theirexamination.

The first angle cock was a Sloan model3050A of the type found on the A end of carATSF 92018. (See figure 8.) The valve had alength of flexible hose attached to the angledinlet (hose side) with two 45-degree elbows and

26

a short length of brake pipe extended from thestraight inlet (brake pipe side). A portion of theflexible hose was charred but not obviouslypenetrated; the handle on the valve was in theclosed position oriented 90 degrees to the longbody axis; and the threaded end of the brakepipe was fractured. The pipe fracture was latermatched to a small piece of fractured pipethreaded into the pipe union that was part of thebrake pipe from car ATSF 92018. In addition,the exterior paint matched the paint on the valveand was very similar in color and appearance tothe brake pipe reportedly from the flat car foundunder car ATSF 92018.

The valve handle was removed from thevalve body after the formed end of the pivot pinwas ground away and the pin driven out.Removal of the handle uncovered fine dust andsoot deposited on the body top. The inlets werevisually inspected after the hose, elbows, andbrake pipe pieces were removed from the valvebody. On the hose side of the valve, the inletwalls and the visible portions of the ball keywere covered in a heavy black layer of soot,while the surfaces on the pipe side inlet showedsome corrosion products but no soot. The ballkey was removed from the valve body byrotating the key 45 degrees past the closed stopand pulling the key upward.

Safety Board investigators later located carACFX 84070 in a Fontana, California, salvageyard. A portion of the draft gear sleeve wasremoved where remnants of the angle cock weldwere attached to the car on the B end. Asreceived, the end fitting from a hose section wasthreaded into the hose inlet, and compressionfitting hardware were attached to the brake lineside of the valve. The car attachment “L”bracket was also attached to the valve body witha “U” bolt and nuts. The horizontal leg of thebracket contained a fractured weld that matchedthe configuration, orientation, and surfacefeatures found on a fractured weld on the endsill mounting plate from car ACFX 84070.

A contact pattern and the exterior stoppageof the painted surface on the threaded end of the

brake pipe (nearest the valve) were consistentwith the pipe being inserted into thecompression fitting on the valve to about a 4-inch depth. Measurements found that thethreaded adapter inside the fitting was 4 inchesfrom the brake pipe end of the compressionfitting, which would not allow for significantengagement of the brake pipe threads to theadapter if the pipe were inserted to the depthindicated by the contact pattern.

As received, the valve handle was in theclosed and down position. During manipulation,the handle was free to lift with only minimalforce, and care had to be exercised to preventunwanted movement. The overall exterior of thevalve appeared intact and damage free, exceptfor mechanical damage in the pivot area of thehandle. Damage was also found on adjacentareas of the handle and the socket,28 whichappeared consistent with glancing contact froma foreign object when the handle was fully inthe down position. When this contact was madeis not known. The handle and socket wereremoved from the valve by grinding away theformed heads of the pivot, by positioning pins,and by driving the pins partially out. The openand closed stops on the handle, socket, andvalve body were closely examined with noevidence of significant mechanical contact ordamage uncovered. The paint layer on many ofthe stop surfaces was still intact and undamaged.

The inspection of the interior of the hose sideinlet, after removal of the hose fitting, foundcorrosion products and darker areas of sootingon the valve body surfaces. In addition, manyareas containing a light-colored granularmaterial were visible on top of the corrosion andsooting, particularly near the key window and inthe female inlet threads. Under magnification,the granular material appeared consistent withsand particles. These sand-type particles with

28Mechanical fitting between the valve key and thehandle that incorporates the valve position stop lug.

27

the areas of sooting and corrosion were visible.The surface of the closed valve key had a darkbrass appearance but did not appear to have asignificant surface deposit layer. The brake pipeinlet side of the valve was inspected withoutdisassembling the compression fitting. Thesurface appeared covered in corrosion productswith no sand-type particles or sooting visible.The color and texture of the visible surface ofthe key in the brake pipe inlet resembled thevisible portion of the key surface in the hoseinlet.

The disassembly of the valve continued withremoval of the threaded key cap on the bottomof the valve body. Upon removal, a smallamount of water, estimated to be less than ateaspoon, was found in the preload spring cavitybelow the key.29 The cavity containedsignificant quantities of a greasy reddishsubstance containing corrosion products in thearea around the spring and of sand-type particlesinside the spring inside diameter. When the keywas extracted through the bottom of the valvebody, more moisture was found on the outersurfaces in the areas that were previouslycontacted by valve body. These areas also had aslight turquoise coloration that faded as themoisture evaporated. With the outer surfaces ofthe key exposed, a fine line of corrosionproducts and debris outlined the assembledlocations of the windows in the valve body. Theoutlining debris and corrosion lightly adhered tothe surface and could be easily wiped from thekey. The underlying outer surface of the keywas scratched in a circumferential patternconsistent with the normal rotation directions ofthe key. Comparisons of the hose and brake pipesurfaces of the key found little differences in thesurface coloration or texture between the twoareas or in the pattern of deposits. Largequantities of light-colored particulate materialwere found on the interior surfaces of the key

29Preloaded upward by a small coil spring assembledbetween the key and the cap.

slot.30 Under magnification, the materialappeared to be clumps of sand particles thatwould easily crumble when probed. Removal ofthe key from the valve body also exposedsimilar clumps of sand clinging to the walls ofthe valve at the key slot.

A small sample of the sand material wascollected from the surface of the valve body andprepared for energy dispersive x-ray analysis.The spectra, acquired from an area of the samplecontaining many particles, indicated that themajority of the sample was silicon and oxygenwith distinct but much smaller peaks for iron,potassium, and carbon. Additional spectra ofindividual particles found two types of particlesbased on composition. The majority of theparticles were silicon- and oxygen-based withother minor elements consistent with silicondioxide sand. The other particle type was mostlyiron and oxygen consistent with iron rust.

For energy dispersive x-ray analysis of thesurface deposits on the key, an approximate0.25-inch-tall horizontal section was cut fromthe hose side of the key, as received, andexamined in a scanning electron microscope.The section location encompasses regions of thekey that, as received, were exposed in the inletwindow and surrounding areas that werecovered by the valve body. A base metalspectrum was acquired from a location on thesection that was scraped to remove surfacedebris. The spectrum indicated that the key wasa copper alloy containing zinc, iron, tin, silicon,and possible traces of lead. The area previouslyexposed in the hose side inlet window containedscattered surface particles and many embeddedparticles. A spectrum, acquired from an areaencompassing several of the surface particles,showed an increase in the relative heights of the

30Rectangular passageway through the verticalcenterline of the key that, when aligned with windows inthe hose and brake pipe inlets, allows flow through thevalve.

28

iron and oxygen peaks when compared to thebase metal spectrum. Other spectra of theembedded particles produced significant peaksof fluorine, iron, silicon, titanium, andchromium, which is indicative of a Teflon-typematerial. The number and size of surfaceparticles greatly increased in the areas of thesample segment that were originally hidden bythe valve body. Spectra, acquired at severallocations, found that the iron, oxygen, andsilicon levels were elevated over the base metalcontents. In addition, calcium and chlorinepeaks were detected in some areas and in someparticles.

Hazardous Materials Information

Chemical Release-- Of the nearly 224,000gallons of regulated and nonregulated chemicalsin each of the derailed tank cars, about 198,000gallons were released or consumed or both in thefire following the derailment.31 No measurableamount of the approximately 25,800 gallons ofbutyl acrylate in tank car NATX 82129 wasknown to be released as a result of the derailmentand fire. The ATSF chief environmental officer32

estimated that 500 gallons of butyl acrylate orreacted material or both were released from tankcar NATX 82129 after explosive charges wereused to vent and release internal pressure in thetank car. About 55 gallons of liquid butyl acrylatewere also recovered from the tank car before itsscrapping, and the remaining butyl acrylate wasleft in the tank car in a nonliquid state. Nearly1,000 gallons of propylene glycol were alsorecovered from a derailed tank car.

Chemical Product Descriptions-- Butylacrylate (shipped in tank car NATX 82129) is a

31The gallon number of product in each loaded tankcar was estimated as equal to the tank volume.

32See appendix B for qualifications in hazardousmaterials response.

clear colorless liquid with a pungent odor used inthe manufacture of polymers and resins for textileand leather finishes and paint formulations. It hasa flash point of 103 oF and a flammability rangeof 1.3 to 9.9 percent by volume in air. Duringstorage and transportation, a chemical inhibitor isadded to butyl acrylate to stabilize the materialand prevent an uncontrolled polymerization,33

which can be initiated by excessive heat. Becausepolymerization also releases heat, uncontrolledpolymerization may produce a rapid release ofenergy with the potential for an explosion inunvented and closed containers. Inhalation ofvapors can cause irritation to the nose and throat.Butyl acrylate is highly mobile if released in soiland may leach to groundwater and will not beabsorbed to sediment or bioconcentrate in aquaticorganisms if released in water.

Trimethyl phosphite (shipped in tank carGATX 37310) is a clear colorless liquid with apungent odor and used as an intermediate productin the manufacture of pesticides and flame-retardant polymers for polyurethane foams. It isalso used as a fireproofing agent in the productionof textiles. Trimethyl phosphite has a flash pointof 60 oF. Flammability limits have not beendetermined. The product is stable but can emittoxic fumes of oxides of phosphorus when itdecomposes through heat and combustion.According to the manufacturer34 material safetydata sheet, vapors are not irritating to the skin andeyes. However, the U.S. Coast Guard ChemicalHazard Response Information System indicatesthat vapors cannot be tolerated “even at lowconcentrations” and can cause severe irritation tothe eyes and throat and injury to the eyes andlungs. Data about the environmental effects werenot available.

33A chemical reaction in which two or more relativelysimple molecules combine to form chain-like largermolecules. It often results in an expansion of the materialand a generation of heat that can cause overpressurizationand rupture of the container.

34Albright and Wilson Americas, Inc.

29

Denatured alcohol (shipped in tank carMWSX 29654) is a mixture of predominantlyethyl, methyl, and isopropyl alcohols. The clearliquid is used in the manufacture of otherchemicals, solvents, antifreeze, and brake fluids.It has a flash point of 60 oF and a flammabilityrange of 3.3 to 19 percent by volume. Thematerial is stable. Data about environmentaleffects were not available.

Local and State Emergency ResponseAgency Notifications-- Immediately after thederailment, the ATSF System Operations Center(SOC)35 in Schaumburg, Illinois, receivedtelephone notification from the CHP about a trainderailment and explosion near Cajon. Accordingto the SOC director of service interruptions, theCHP was notifying each railroad that operates inthe area because it was not certain which carrier’strain had derailed. The director of serviceinterruptions then spoke with the director ofnetwork operations (SOC supervisor-on-duty),who had been with the dispatcher who had beenconversing with the H-BALT1-31 traincrewabout the train braking problems. After speakingwith the director of network operations, thedirector of service interruptions realized that H-BALT1-31 had derailed and that hazardousmaterials likely had been released and involved inthe explosion.

Before the SOC could notify any emergencyresponse agency, the San Bernardino (County)Communications Center (SBCC) and the Stateforestry and fire protection department commandcenter had called about 4:20 a.m. to requestcopies of the train consist, which includedemergency response information about theregulated hazardous materials on the train. The

35The center controls and monitors all trainmovements and also notifies the appropriate Federal, State,and local emergency response agencies in the event of anaccident within the ATSF system.

ATSF immediately sent, by fax, the consistcopies to the SBCC and the State forestry and fireprotection department command center by 4:32a.m. While en route to the accident, a Stateforestry and fire protection department firefighterreceived the consist copy at the departmentcommand center and delivered it to a hazardousmaterials specialist at the scene about 5:15 a.m.The IC indicated that the consist copy and itsemergency response information was available tohim when he assumed his duties as IC. In themeantime, the SOC had notified the CaliforniaOffice of Emergency Services (COES), theNational Response Center (NRC), and theCalifornia Public Utilities Commission (CPUC),whose railroad operations and safety sectionoversees rail transportation within the State, at4:30, 4:38, and 4:45 a.m., respectively.

About 6:17 a.m. the COES, which isresponsible for the notification of other State andlocal agencies that have responsibilities orjurisdiction in a given emergency situation,notified the Office of the State [California] FireMarshal36 pipeline safety and enforcementdivision. (The two underground pipelinesadjacent to the accident site about 200 feet northof the wreckage were owned and operated by theCalnev Pipe Line Company [Calnev].) A pipelinesafety engineer from the State fire marshal officewas dispatched and arrived at the accident siteabout 8:25 a.m. The COES also notified theCPUC and other agencies, such as the CaliforniaEPA, California Department of Fish and Game,State Water Resources Control Board, and theregional air and water quality control offices thathave jurisdiction over the environment and thepublic health. All of these agencies respondedand sent representatives to the accident scene.

36The office is within the California Department ofForestry and Fire Protection and is the State regulatoryagency for liquid pipelines. Gas pipelines are regulated bythe CPUC utility safety branch of the safety andenforcement division.

30

Chemical Shipper Notifications-- The ICdid not notify or direct that the shippers of thechemicals on the train be contacted to providetechnical assistance about their respectivechemicals. The IC said that the hazardousmaterials specialist at the accident scene had atechnical library available and was able toprovide the needed information about each of thechemicals involved in the derailment. The ICstated that he also assumed that the hazardousmaterials specialist would verify through theChemical Transportation Emergency Center37

(CHEMTREC) that the necessary contacts withthe shippers had been made.

The director of service interruptions said thatafter receiving the initial notifications, he andother on-duty personnel at the SOC discussed theneed to notify and fax CHEMTREC a copy of thetrain consist. He stated that because ofmiscommunication and confusion within theSOC, the other on-duty personnel assumed thathe would notify CHEMTREC and fax theconsist; however, he had understood that hewould fax the consist only and that someoneelse would make the telephone notification.Also, he unknowingly used the fax number forthe main office of the Chemical ManufacturersAssociation (CMA) instead of the fax numberfor the CHEMTREC operations desk. Thedirector of service interruptions stated thatCHEMTREC had first contacted the SOC for anupdate on the conditions at the accident site onFebruary 1 at 5:32 p.m. and that the CHEMTRECtelephone call provided no indication whichwould cause SOC personnel to realize that theSOC had not previously contacted CHEMTREC.The mistake was realized between 6 and 7 a.m.(8 and 9 a.m., central standard time) onFebruary 2 after the director of serviceinterruptions received a telephone call from amanager in the BNSF logistics department in

37The center, operated by the Chemical ManufacturersAssociation (CMA), was established to provide initial andimmediate information about handling hazardous materialsand other chemicals.

Fort Worth, Texas, who was responding tocustomer complaints about the lack of accidentnotification. (The logistic department notifiescustomers, including chemical shippers, aboutincidents or accidents that result in damage ordelays of their shipments. These notificationsare for operational purposes and are notemergency response notifications.) The directorof service interruptions rechecked the SOCtelephone log, found no entries for the telephonenotification of CHEMTREC, and concluded thatthe SOC had not notified CHEMTREC.

CHEMTREC logs indicate that the first reportof the accident was received at 11:01 a.m. (2:01p.m., eastern standard time) on February 1 fromthe California EPA. The California EPArequested that CHEMTREC assist withcontacting the shippers of the trimethylphosphite, butyl acrylate, and the methyl ethylketone.38 CHEMTREC notified the shipper of thetrimethyl phosphite about the accident at 11:08a.m. and received a call at 11:10 a.m. from asecond California EPA representative requestingproduct information on the trimethyl phosphiteand butyl acrylate as well as contacts for theshippers of these two products.

At 11:18 a.m., the corporate office of theRohm and Haas Company (R&H) inPhiladelphia, Pennsylvania, notifiedCHEMTREC to confirm that the R&H had twotank cars involved in the derailment, which werethe cars NATX 82129 and UTLX 79897,containing the butyl acrylate and the petroleumlube oil, respectively. The corporate office hadbeen notified of the accident by the BNSFlogistics manager about 11 a.m. CHEMTRECprovided the contacts for the California EPA tothe R&H and, between 11:18 and 11:30 a.m., alsocontacted the shipper of the methyl ethyl ketone.From its initial notification through February 6,

38The three products were not specifically identified inthe CHEMTREC logs. They are presumed to be thoselisted from subsequent telephone calls received from theCalifornia EPA and made to the chemical shippers byCHEMTREC.

31

CHEMTREC continued to providecommunication links and information asrequested by the State emergency responseagencies, chemical shippers, and ATSF.

At 11:45 a.m., the R&H corporate officernotified the shipping manager at the companyplant, where the butyl acrylate had beenproduced, in Deer Park, Texas. The R&Hshipping manager attempted to contact the ATSFat 12:18 p.m. for information about the status ofthe butyl acrylate tank car but failed to reachanyone. After leaving a message at the ATSF, theshipping manager contacted CHEMTREC andwas given a California EPA contact. The shippingmanager contacted the California EPA andexpressed concerns about the polymerization ofthe butyl acrylate and overpressurization of thetank car. When the California EPA contacted theR&H shipping manager about 1:35 p.m. forinformation about the butyl acrylate, a R&Htechnical expert provided information about thedecomposition and polymerization of the product.

The shipping manager stated that during atelephone call to the incident command postabout 1:40 p.m., he was told not to send ahazardous materials response team from theR&H. The IC, when asked about making such astatement, indicated that he did not recall makingsuch a statement and would not have made such astatement. The IC stated that during thepostaccident critique of the emergency response,this remark was attributed to a California EPArepresentative. (The IC later confirmed that thetelephone number used by the R&H for thecommand post was for a mobile communicationscenter operated by State forestry and fireprotection department personnel at the commandpost. Department personnel in the mobilecommunications center would bring incominginformation to the IC.) The R&H shippingmanager contacted the command post again about5:16 p.m. and was informed that no attempts werebeing made to extinguish the fire. After repeatedefforts to contact the ATSF and the commandpost, the R&H still had no information about the

condition and location of the butyl acrylate tankcar by 4:30 a.m. on February 2; neither telephonenumber was answered according to the R&H. At7:29 a.m., the shipping manager spoke with aCalifornia EPA representative at the accidentscene who advised the shipping manager that theR&H concerns about the butyl acrylate werediscussed at a command post planning meetingduring the evening of February 1.

A State forestry and fire protection departmenthazardous materials specialist, who wasproviding assistance at the command center,contacted the R&H shipping manager about 8:50a.m. on February 2. The hazardous materialsspecialist advised him that the fire was still ragingand that the condition of the butyl acrylate tankcar was unknown, and the shipping managerreiterated the dangers of butyl acrylate at elevatedtemperatures. Following this conversation, theR&H technical experts in Deer Park faxed to thecommand post and the SOC copies of thematerial safety data sheet for butyl acrylate and astatement about the dangers of the butyl acrylatepolymerization and the potential foroverpressurization and a catastrophic tank carrupture. The R&H statement warned that thechemical stabilizer no longer functions if theinternal tank temperature reaches 257 °F and thatthe temperature rise in the tank car could result ina rapid internal pressurization and catastrophictank car rupture if a runaway polymerizationreaction occurred. The R&H receivedconfirmation at 9:47 a.m. that the faxedinformation had been received at the commandpost. The R&H shipping manager said that hewas advised about 11:04 a. m. by the Stateforestry and fire protection department hazardousmaterials specialist that all tank cars had lost theircontents and the fire was still raging. The R&Hreceived no further information on February 2and 3 about its tank car.

Derailed Tank CarDamage Assessments-- The damageassessments and handling of the derailed tankcars were primarily under the purview of three

32

individuals: the ATSF superintendent of fieldoperations39 for the region encompassingCalifornia, Arizona, and part of New Mexico; theATSF chief environmental officer; and the Stateforestry and fire protection department battalionchief who was the incident safety officer. TheATSF superintendent of field operations wasresponsible for the wreckage clearing operation,including the management and coordination ofequipment and personnel during the process. TheATSF chief environmental officer is the ATSFchief officer in areas involving both theenvironment and hazardous materials, includingcompliance with DOT hazardous materialsregulations. The State forestry and fire protectiondepartment incident safety officer wasresponsible for the safety and health of theemergency response personnel assigned to theincident and also served as the IC’s representativeat the derailment site. The ATSF superintendentof field operations was notified of the accidentabout 4:20 a.m. on February 1 and arrived at theaccident scene between 5:45 and 6:15 a.m.. TheState forestry and fire protection departmentincident safety officer indicated that he alsoarrived on scene about 1 hour after thederailment. The ATSF chief environmentalofficer arrived at the scene between 6 and 7 p.m.on February 1.

After the derailment, rescue teams entered thederailment site in search of the two missingcrewmembers. The State forestry and fireprotection department incident safety officer, whoaccompanied the second rescue team into the siteabout 3 or 4 hours after the derailment, observedthat a few tank cars near the locomotives wereleaking but were not involved with fire. He alsonoted that four freight cars, including two tankcars, were still on the track at the east end of thederailment. The remaining tank cars were atvarious angles and depths within the main pile ofburning wreckage.

39See appendix B for qualifications in hazardousmaterials response.

About noon, the State forestry and fireprotection department incident safety officer andthe ATSF superintendent of field operations werepart of a team that entered from the east end ofthe accident site to pull the last four freight cars,including an empty tank car and a tank car loadedwith methyl ethyl ketone, away from the fire.After rerailing one set of wheels for one of thetank cars, the four freight cars were pulled awayfrom the burning wreckage.

Between 4 and 6 p.m. the ATSFsuperintendent of field operations and the Stateforestry and fire protection department incidentsafety officer conducted a perimeter assessmentof the burning wreckage to ascertain anyimmediate hazards and determine a plan ofaction. The incident safety officer later stated thatthe flames, smoke, and “steam” obstructed theirvisibility and that the fire had destroyed many ofthe painted numbers and identification marks onthe burning tank cars. The ATSF superintendentof field operations and the ATSF chiefenvironmental officer also noted difficulties inidentifying the tank cars because the paintedmarkings and identification marks had beenburned away. The incident safety officerobserved that because of the massive destructionof the tank cars, identification of the pressure andnonpressure tank cars from configurationsspecific to each type of tank car was nearlyimpossible.

Fire suppression efforts were not initiateduntil the evening of February 1, after the missingcrew members had been recovered. Because theapplication of foam and water to the burningwreckage pile failed to lessen the magnitude andintensity of the fire, the IC resorted to cooling theperiphery of the burning pile, pulling one freightcar out at a time, and then cooling each freight cardown individually. With this approach,assessment of the damage to the tank cars becamea continuous process. Over February 2 and 3, theState forestry and fire protection departmentincident safety officer, the ATSF superintendentof field operations, and the ATSF chiefenvironmental officer made additionalassessments as access to and visibility of the

33

other tank cars improved and as other wreckagewas cleared away. Each of these individualsstated that most tank cars appeared to be severelydamaged and that others were burning at rupturesor creases in their tanks.

During the night of February 3 or earlymorning of February 4, one of the tank cars thathad been removed and isolated from thewreckage pile on the evening of February 3 beganto vent puffs of smoke at irregular intervals. Thenight operations chief advised the IC of thissituation about 6:30 a.m. when he arrived at theincident command post, and the IC ordered thederailment site to be evacuated. The State forestryand fire protection department hazardousmaterials specialist advised the R&H technicalexperts in Deer Park about the venting tank car at8:55 a.m. and the possibility that it might be thebutyl acrylate tank car. The R&H experts faxed apicture of the type of tank car containing the butylacrylate and recommended an immediate 1\2-mileevacuation, which was ordered and in progress by9:10 a.m. The R&H shipping manager received atelephone call at 9:25 a.m. from an employee ofan environmental contractor for the ATSF.According to the R&H, the environmentalcontractor stated that he was at the accident sceneand confirmed that “the car” was venting andflaming. In response to the contractor’s requestfor information about the butyl acrylate, theshipping manager stated that information hadpreviously been faxed to the incident commandpost. At 9:30 a.m., the R&H dispatched ahazardous materials response team to the accidentscene.

Because of the uncertain identity of theventing tank car, the IC decided to determine theidentity of that tank car and the status of the othertank cars. The State forestry and fire protectiondepartment incident safety officer, the ATSFsuperintendent of field operations, and the ATSFchief environmental officer entered thederailment site about 10 a.m. to survey thedamaged tank cars and to map the car locations.The ATSF superintendent of field operations latertestified that they mapped the location of 13 tankcars: 10 “low pressure” tank cars and 3

“pressure” tank cars. The incident safety officerrecognized the venting tank car as the propyleneglycol tank car, which he had seen before the tankcar was involved in fire and while the numbersand identification marks were still readable. Thethree members of the survey team determined thatthe butyl acrylate tank car and the trimethylphosphite tank car remained on the top of thewreckage pile. According to the incident safetyofficer, the tank car later determined to containthe butyl acrylate was in the middle of thewreckage pile with one end pointing upwards at a60-degree angle, and from a distance of 70 feet, alarge rupture appeared to be toward the end of thetank pointing in the air. The incident safetyofficer believed that this tank car was the sametank car that he had seen the previous eveningburning and venting. All of the other derailedtank cars had been removed and isolated from theburning wreckage pile. The ATSF chiefenvironmental officer and the ATSFsuperintendent of field operations confirmed thatthose tank cars that had been removed from thepile were breached or had severe damage.According to the IC, the incident safety officer,the ATSF chief environmental officer and theATSF superintendent of field operationsimmediately reported to him that the tank carscontaining product had been breached and were“for the most part” empty. The IC said that theyhad identified the butyl acrylate tank car “with ahigh degree of certainty,” but they had not beenable to reach it. According to the IC, they hadspoken with an equipment operator whoreportedly saw a hole in the side of the butylacrylate tank car. He added that he and the otherswere not aware that the butyl acrylate tank carwas a jacketed tank car.

On the basis of this assessment, the IC liftedthe evacuation about noon and permitted thewreckage clearing operations to continue. Aboutthe same time, the State forestry and fireprotection department hazardous materialsspecialist notified R&H personnel in Deer Parkthat the butyl acrylate tank car had been locatedand was ruptured. The R&H then advised thehazardous materials specialist that a R&Hresponse team was en route to the accident scene.

34

Butyl Acrylate Tank Car-- The ATSFsuperintendent of field operations, beingresponsible for the wreckage clearing operations,was present when the butyl acrylate and thetrimethyl phosphite tank cars were pulled fromthe wreckage pile shortly before dusk onFebruary 4. He noted that the manway on thetrimethyl phosphite tank car was open and hadsmoke and fire damage around it. Thesuperintendent of field operations stated that thebutyl acrylate tank car was upside down when itwas pulled from the wreckage and was left in thatposition. In addition, he did not inspect or directanyone else to inspect the butyl acrylate tank carafter it was pulled from the wreckage. Thesuperintendent of field operations spoke with theequipment operators who removed the tank car,and they told him that they were able to pull andshove the butyl acrylate tank car easily and that ithandled as if it were empty. The superintendentof field operations concluded on the basis of theequipment operators’ observations and the fireand heat damage to the tank car that it was empty.Because he believed the tank car to be empty, thesuperintendent of field operations found no needeither to inspect the tank car after it was removedand isolated or to consult with other tank carexperts. Although the ATSF chief environmentalofficer did not see the butyl acrylate tank car untileither late night on February 4 or early morningon February 5, he too believed the tank car had tobe empty because the derailment forces were toogreat for it to survive and, after being exposed tointense fire and heat for over 2 derailment days, itdid not vent as he had expected.

After arriving at the accident scene about 5:30p.m., the R&H response team proceeded toinspect the butyl acrylate tank car, which theyfound nearly upside down with the dome buriedin the ground. After digging dirt away from thevalves in the dome, they recognized a fitting thatwas unique to the butyl acrylate tank car andpositively identified the tank car. The responseteam members found no apparent holes in it andassumed the tank was intact.

A temperature gauge was installed on theexternal tank surface where the thermalprotection and jacket were missing; its initialreading was 110 oF. About 7:30 p.m., firefightersbegan to spray the tank car with water, whichinitially turned to steam. Within 15 minutes, thetemperature of the tank had fallen to 60 oF, andthe tank car had cooled sufficiently that the waterno longer changed to steam. By the time the R&Hteam briefed the firefighters on the hazards of thetank car and cautioned them to listen for strangenoises from the tank car, the tank temperature hadincreased to 85 oF. The firefighters reported thatby 9 p.m., gurgling noises could be heard fromthe tank car and the temperature gauge read 114°F. A 0.5-mile evacuation of the derailment site,including an I-15 and SR-138 closing, wasordered by 9:30 p.m. (In the meantime, the R&Hdispatched a second response team that arrived atthe accident scene about 7:30 a.m. on February5.)

About 3 a.m. on February 5, the on-sceneR&H response team members, still hearinggurgling noises from the tank car, approached thetank car with infrared thermal imaging equipmentand obtained a localized temperature of 178 oF atone end of the tank car. The infrared equipmentwas then used throughout the day to monitor thetemperature of the butyl acrylate tank car from adistance of 200 yards. From that distance, aninitial temperature of 66 oF at 4:40 a.m.,representing an average of the entire tank car andthe surroundings, served as a baseline. By 9:28and 11:03 a.m. and 1:02 p.m., respectively, thetemperature was 90, maximum 104, and 78 oF.

After the IC consulted with the ATSF, theR&H, Calnev, and other agencies at the scene, theIC with their consensus decided about 2:30 p.m.to have a demolition expert detonate explosivecharges to relieve the pressure on the tank car andto allow liquid to drain out. The demolitionexpert had examined the tank car by 6:15 p.m.,and the localized temperature had decreased from178 to 95 oF. The explosive charges weresuccessfully detonated shortly before 10 p.m., andthe evacuation was lifted.

35

Pipeline InformationCalnev owns and operates the two

underground hazardous liquid pipelines that arealmost parallel to the railroad tracks at theaccident site. The 14- and the 8-inch diameterpipelines originate in Colton, California, andterminate in Las Vegas, Nevada. These pipelinesare laid separately from Colton, the Calnevoperations control center, to pipeline milemarker(MM) 19 near Cajon Creek and then together toLas Vegas. The 14-inch pipeline transportsgasoline, diesel, and military JP-8 aircraft fuelsfor Las Vegas, the U.S. Air Force, and variouscommercial trucking and railroad companies. The8-inch pipeline transports Jet-A turbine fuel forMcCarran Airport in Las Vegas. At the time ofthe accident, the 14- and 8-inch diameterpipelines each had an operating pressure of 425psig and were transporting JP-8 aircraft andturbine fuels, respectively.

Train H-BALT1-31 derailed between pipelineMMs 24 and 25, and wreckage from the train wasabout 200 feet south of the pipelines.Downstream of the derailment were manuallyoperated main line gate valves at the Cajon pumpstation at MM 25.5 and remote-controlled mainline valves at the California aqueduct at MM 35for both pipelines. Upstream of the derailment atMMs 1 and 7 were remotely operated line valves,which could be opened or closed from theoperations control center, for the 14-inchpipeline. No remotely operated valves for the 8-inch pipeline were between Colton and thederailment site. The elevation of the two pipelinesat the derailment site was about 2,000 feet higherthan at their origin in Colton.

A Calnev engineer learned of the trainderailment at 5:15 a.m. from a radio newsbroadcast and then telephoned the incidentcommand post to determine whether Calnevpipelines might be near the accident site. TheCalnev engineer notified the Calnev manager ofengineering at 6 a.m. and advised him that, basedon the description of the accident, Calnevpipelines may be near the derailment site. Themanager of engineering proceeded to the accidentscene and informed the IC of the two Calnevpipelines about 6:45 a.m. The IC later told Safety

Board investigators that he had been aware of thetwo pipelines and knew the types of product eachtransported. He stated that because the Calnevmanager of engineering had arrived as theincident command post at the Mormon Rockswas being established, Calnev did not need to becontacted. He said that Calnev would have beennotified had the Calnev manager of engineeringnot arrived when he did. The State fire marshaloffice also indicated that it was in contact withCalnev between the time it was notified and thearrival of its inspector at the accident scene at8:25 a.m.

Calnev initiated procedures to shutdown its14- and 8-inch pipelines, respectively, at 6:15 and6:21 a.m. The remotely operated valves at MMs 7and 35 for the 14-inch pipeline were closed at6:47 a.m. from the operations control center. Atsame time, a remotely operated valve at MM 26.2for the 8-inch pipeline was also closed. Calnevclosed the manually operated main line gatevalves for both pipelines at the Cajon pumpstation at MM 25.5 by 9 a.m. Calnev personnelpartially marked the location of the pipelines atthe derailment site. In addition, the Calnevgeneral manager arrived at the accident scene andconsulted with the IC. From the arrival of themanager of engineering at the incident commandpost throughout the duration of the incident,Calnev had personnel on scene to coordinate withthe IC and to observe and monitor wreckageclearing operations near the two pipelines. By 4p.m. on February 1, Calnev had established itsown command post at the Mormon Rocksincident command post.

By 6 a.m. on February 2, Calnev had markedthe location of the pipelines closest to thewreckage with stakes and yellow warning tape.Calnev also checked the depth of cover over eachpipeline, which was, according to the State firemarshal office, between 3.5 and 6.5 feet. At 1:45p.m., Calnev began startup procedures for the twopipelines with the concurrence of Calnevengineers, the IC, the State fire marshal office,and the ATSF. Both pipelines were in fulloperation by 4 p.m. with operating pressuresbetween 425 and 500 psig.

36

On February 3, Calnev monitored theconstruction of a dirt ramp that provided anadditional 3 feet of cover over the pipelinesbefore a bulldozer was permitted to cross over thepipelines to build a berm in the dry creek bed todivert water runoff from predicted rains. Thisactivity was completed without incident.

At 10:15 a.m. on February 4, the IC requestedthe shutdown of both pipelines after theevacuation of all personnel from the accident sitebecause of venting from one of the tank cars. Atthe time the pipelines were shutdown, the 14-inchdiameter pipeline contained diesel fuel and the 8-inch diameter pipeline contained turbine fuel. Theremotely operated valves at MMs 7 (upstream)and 35 (downstream) on the 14-inch pipeline andthe remotely operated valve at MM 26.2 on the 8-inch pipeline were closed. Operating pressure atthe Cajon pump station (MM 25.5) was 374 psig.The manual valves at the Cajon pump stationwere closed by 11:05 a.m. Calnev was givenpermission about 11:57 a.m. by the IC, with theconcurrence of the State fire marshal officeinspector, to restart the two pipelines. Calnevpersonnel resumed monitoring activities at theaccident site at 12:30 p.m., and both pipelineswere back in operation by 1:01 p.m.

No further incidents occurred that necessitatedthe shutdown of the two pipelines. The pipelineswere not shut down during the controlleddetonations on the butyl acrylate tank car becausean engineering evaluation determined that thepipelines could withstand any percussiongenerated by the detonation. However, as aprecaution, both pipelines were operating atreduced flow rates, and diesel fuel, which haslower volatility and less flammability hazard thanother transported petroleum products, wasinjected into the 14-inch pipeline. Calnevpersonnel also continued to monitor wreckageclearing operations until work around thepipelines was completed.

Environmental InformationA separate incident command group to

oversee the environmental monitoring, cleanup,and restoration and the worker safety was

established. Participating agencies included theCalifornia Department of Fish and Game, theState forestry and fire protection department, theCalifornia EPA (department of toxic andsubstances control and the railroad accidentprevention and immediate deployment team), theSanta Ana Regional Water Quality ControlBoard, the San Bernardino County FireDepartment (hazardous materials officer), theCalifornia Occupational Safety and HealthAdministration, the U.S. EPA, the U.S. ForestService, and the Coast Guard strike team. Inaccordance with the California hazardousmaterials incident contingency plan, thedepartment of fish and game was the lead Stateagency to coordinate and oversee theenvironmental response.

On February 1, the ATSF contracted TRCEnvironmental Solutions, Inc., to develop workplans for the environmental response and toprovide air, water, and soil monitoring andsampling services. The ATSF also contractedConsolidated Waste Industries to provideremoval services.

Air sampling and monitoring began when theSouth Coast Air Quality Management Districthad ATSF personnel obtain air bag samples fromthe smoke plume at the derailment site and twoother downwind locations between 10:33 a.m.and 12:30 p.m. on February 1. The preliminaryanalysis received at 3:40 p.m. indicated thepresence of hydrocarbons in the low parts perbillion range, which was attributed to thecombustion of the diesel fuel. Two additional airbag samples were taken at the accident sitebetween 9 and 9:30 a.m. on February 2. Theanalysis of these samples indicated noconcentrations of phosphorus compounds wereabove the minimum detection levels and allhydrocarbon gas concentrations measured in therange of background concentrations.

Initial field monitoring with hand-heldequipment around the perimeter of the accidentsite was performed every 2 hours at fourdesignated locations on February 1 and 2. Levelsof volatile organic compounds ranged from 3.5 to5.8 parts per million (ppm).

37

On February 2, three fixed stations to thewest, northeast, and southeast of the accident sitewere installed to take readings at 1-minuteintervals on a continuous basis. The monitoringwas interrupted during the events involving thebutyl acrylate tank car on February 5 but wasresumed on February 6. A fourth air monitoringstation was installed on February 6 within theexclusion zone (the wreckage area in whichpersonal protective equipment was required).Rain interrupted the air monitoring at the fixedstations from February 21 to 27. The monitoringwas resumed on February 27 and wasdiscontinued on March 1. The average dailylevels of volatile organic compounds at the threeperimeter stations did not exceed 5 ppm, althoughindividual readings above 5 ppm were recordedon numerous occasions. The average daily levelof compounds in the exclusion zone exceeded 5ppm on 3 days. The levels of compounds forMarch 1, which provided a measure ofbackground levels, ranged from 0.8 to 2 ppm atthe four monitoring sites.

Beginning February 1, the ATSF constructedfour earthen dikes across the Cajon Washupstream (north) and two dikes downstream(south) of the derailment site. The upstream dikesrestricted flow through the derailment site, andthe downstream dikes allowed passage of waterwhile trapping potential floating contaminantsbehind the dikes.

Wells supplying drinking water for designatedfacilities and residences were tested on February3 and 4. The ground and the surface water inCajon Wash, both north and south of thederailment, were sampled and tested betweenFebruary 3 and March 7 for total petroleumhydrocarbons, volatile organic compounds,phosphorus, and heavy metals. The final report ofTRC Environmental Solutions, Inc., on theenvironmental response indicates that the incidentcommand group agreed that neither water supplywells nor groundwater in the Cajon Wash areawas impacted.

Soil samples from the derailment site and theareas of Cajon Wash, north and south of thederailment, were obtained from February 3 toMarch 13 and analyzed for total petroleumhydrocarbons, volatile organic compounds,semivolatile organic compounds, and phosphorus.The collection and analysis of surface andsubsurface samples were ongoing ascontaminated areas were identified and excavatedand as the contaminated soil was removed. About20,000 cubic yards (27,000 tons) of soil wereremoved and transported offsite for disposal as ofMarch 15, when the soil removal was completed.The wreckage and debris after decontaminationwere completely removed from the accident siteby February 27.

On March 13, the incident command groupdetermined that further air, water, and soilsampling and monitoring were no longer needed.The ATSF and the State forestry and fireprotection department met on March 20 todetermine restoration requirements, whichinvolved the removal of emergency access roadsto the derailment site and the fertilization of theaffected areas. The restoration began and wascompleted, respectively, on April 1 and 5.

Other Information

Federal Railroad Administration--Founded in 1966, the FRA is the regulatoryagency within the DOT that promotes andenforces safety throughout the U.S. railroadsystem and consolidates Federal support forresearch and development for rail transportation.The agency also encourages policies andinvestment in infrastructure and technology forthe railroad industry. The FRA mission is topromote a safe, environmentally sound,successful railroad transportation system and tomeet the current and future needs of all railroadpassengers.

38

The FRA and the railroad industry have longbeen familiar with the technology for the two-way ETD, and before the February 1, 1996,Cajon Pass accident, the Safety Board hadrecommended its use on trains to the FRA.Following a 1989 run-away train crash inHelena, Montana,40 the Safety Board had askedthe FRA to require the use of two-way ETDs onall trains without a caboose.

After its investigation of the December 1994Cajon Pass accident, the Safety Boardrecommended that the FRA separate the two-way ETD requirements from the power brakenotice of proposed rulemaking (NPRM) andconclude the ETD rulemaking to require theiruse on all cabooseless trains. On February 1,1996, the same day of the H-BALT1-31derailment, the FRA advised the Safety Boardthat it agreed with the recommendation,intended to separate the two-way ETD issuefrom the power brake NPRM, and issue a finalrule as soon as practicable. Following the H-BALT1-31 derailment, the FRA issuedemergency order 18, effective 12:01 a.m., onFebruary 8, 1996, requiring that all westwardtrains operated by the ATSF on the Cajonsubdivision between MPs 54.9 and 59.9 havethe capability to initiate an emergencyapplication of the air brakes from both the headand the rear of the train.

On February 22, 1996, the FRA met withrailroad industry representatives and obtained avoluntary agreement from them to furnish byDecember 31, 1996, two-way ETDs on all trainstraveling on mountainous grades. The railroadindustry, according to the Association ofAmerican Railroads (AAR), has also agreed toequip additional required trains with two-wayETDs by a self-imposed June 1997 deadline.Still, as of December 1, 1996, the FRA has notissued its final rule on two-way ETDs.

40Railroad Accident Report--Collision and Derailmentof Montana Rail Link Freight Train with Locomotive Unitsand Hazmat Release, Helena, Montana, February 2, 1989(NTSB/RAR-89/05).

Furthermore, immediately after the H-BALT1-31 dreailment, the FRA together withthe CPUC conducted an audit of the ATSF trainoperations at Cajon Pass and the ATSFmechanical inspection and repair facilities atBarstow. The audit involved over 100 FRA andCPUC inspectors in teams who found, accordingto the FRA, process and communicationsproblems. The FRA worked with the CPUC,labor unions, and ATSF management to addressthe problems and to develop solutions for them.The audit procedures included group partnershipmeetings in which the FRA, CPUC, and ATSFlabor and management discussed safety andoperational concerns. The FRA and CPUC laterconducted two additional audits. The firstfollow-up audit, about 5 weeks after the initialaudit, included 56 inspectors, and the secondfollow-up audit, about 3 months after the initialaudit, involved more than 40 inspectors.

Atchison, Topeka and Santa FeRailway Company-- Since the accident, theATSF has employed an independent contractorto audit its management and policies and toencourage increased feedback from operatingcrews to ensure carrier rules and instructions arebeing complied with. In a May 1996 letter to theSafety Board, the ATSF assistant vice presidentof technical training and rules advised that thefollowing actions have been implemented sinceFebruary 1, 1996:

Removal of a flange oiler, on the southtrack at MP 56.9.

Required that all westbound trains have anarmed two-way ETD before leavingBarstow. If a two-way ETD loses itscontinuity after leaving Barstow,continuity must be regained or helpersadded to the train prior to passingSummit.

39

Required that all eastbound trains havean armed two-way ETD before leavingLos Angeles. If continuity is lostbetween Los Angeles and SanBernardino, continuity must be re-established or helper added to trainbefore passing Baseline. All crewmembers working the SanBernardino or Cajon Subdivisions arerequired to have “hands-on-training”in arming and disarming two-wayETDs.

An eight foot chain link fence withrazor wire was installed on both sidesof the right-of-way between MPs 56and 54.2 on the Cajon Subdivision.The fence was also gated at both ends. Lights were installed between MP 56and MP 54.2 on the CajonSubdivision. Twenty-four hour manned security hasbeen provided between Hesperia andSummit. The flow chart in the timetable wasrevised making it more restrictive, inthe form of having more axles ofdynamic brake for westbound trainsleaving Summit.

Set up a reporting procedure out ofSchaumburg to track problemsencountered with two-way ETD’s.Also monitor any air brake problemsthat develop to a train while on theSan Bernardino or CajonSubdivisions.

Smart repeaters [which enhance theradio signals in remote areas] wereinstalled at Barstow, Victorville,Martinez Spur, and Los Angeles tofurther ensure uninterruptedperformance between the ETD andcontrol head on the two-way devices.

Also since the February 1996 accident, theATSF has had the event recorders from allwestbound trains over Cajon Pass reviewed atthe end of every trip. It additionally hasinstituted a guidance program in which seniorlocomotive engineers consult with the juniorengineers and counsel them on train operationsover Cajon Pass. The ATSF and Calnev havealso exchanged lists of their emergencytelephone contacts and numbers. The ATSF hasalso added “pipeline operators” as a line item onits emergency notification checklist foraccidents occurring in California.

On May 15, 1996, the ATSF asked the AARto consider affixing a plate, engraved with thetank car reporting mark and identificationnumber, on each tank car. The ATSF stated thatan engraved plate would assist in theidentification of tank cars whose paintedmarkings and numbers have been destroyed byfire. The AAR tank car committee, after adiscussion at its July 1996 meeting, concludedthat the ATSF proposal would not make asignificant improvement and voted to take nofurther action.

41

ANALYSIS

General FactorsAlthough the H-BALT1-31 engineer

encountered rain at the time of the derailment,he reported that the weather did not adverselyaffect the operation of train. The track had beeninspected by a qualified track inspector onJanuary 31, 1996, and no defects were noted ator near the derailment site. The signal systemhad been inspected and tested shortly before theaccident, and no defects were indicated; thepostaccident signal testing found nodeficiencies. HBALT1-31 was operating on aclear (proceed) signal indication, as intended,and in accordance with the applicable rules andregulations in effect at the time. The traincrewmembers were qualified to perform theirrespective duties and met the off-dutyrequirements as specified in the Hours-of-Service Act. No evidence of traincrew fatiguewas indicated. The postaccident toxicologicaltest results for the traincrew and the dispatcherwere negative. The alcohol present in thebrakeman’s blood specimen was attributable topostmortem microbial ethanol production andnot antemortem alcohol ingestion. Therefore,the Safety Board concludes that neither theweather, the track, nor the signal system eithercaused or contributed to the derailment. Thetrain crewmembers were in compliance with therequirements specified in the Hours-of-ServiceAct and were qualified to perform their duties;no evidence of fatigue was found. Neither drugnor alcohol use was a factor in the derailment.

The following discussion reviews thesequence of events leading to the derailment andexamines the lack of Federal and managementoversight in the use of two-way end-of-traindevices, the adequacy of operating personneltraining in the use of two-way end-of-traindevices, the carrier compliance with Federalregulations for event recorders, and theadequacy of wreckage removal operations for

tank cars containing hazardous materials. Inaddition, three scenarios will discuss possiblecircumstances that could have caused a blockagein the train line of freight train H-BALT1-31.

Accident Narrative ReviewATSF freight train H-BALT1-31, operating

in accordance with the carrier timetableinstruction, was traveling westbound on thesouth main track through Cajon Pass. The trainreceived an initial terminal air brake test atBarstow and the braking system was functioningas designed. The train made at least three stopsfrom Barstow to Summit with no anomaliesreported. The first severe grade that HBALT1-31 encountered was at Summit. After the traindeparted Summit, the engineer engaged thedynamic braking system as the train crestedCajon Pass, which would cause brakingconcentration to occur on the head end of thetrain, forcing the balance of the train to bunchtoward the engine consist. The bunching of thetrain would allow the engineer more traincontrol by compacting its length during thebraking sequence. Allowing the train to stretchwould introduce additional forces to the traindraft gear system. The engineer stated that as heencountered the severe grade, he felt no brakereaction as the speed increased and told thetraincrew that he was going to make a full-service brake application. The engineer said thathe made the full brake application, whichappeared to be futile as the train speedcontinued to increase.

The conductor and the brakeman then exitedthe cab out of the engineer’s sight and wereeither thrown from the engine platform whenthe train derailed or jumped just as thederailment occurred. The engineer remained inthe control compartment at the control stand,attempting to recover the air system, and he

42

reapplied the full braking system, which againproved to be a futile attempt. The engineerunsuccessfully employed all means at hisdisposal to slow or stop H-BALT1-31. Now, 13minutes after the train had left Summit, itapproached the curve at MP 60.4. The loss ofbraking power appears to have caused the trainto reach speeds that were equal to or greaterthan the rollover speed for the curve a MP 60.4;thus, H-BALT1-31 left the track, derailing allbut its last four cars.

Locomotive ATSF 157 impacted a relativelyflat sand creek bed and did not strike anysubstantial fixed objects or large rocks. Thisimpact resulted in low decelerative crash forces,as evidenced by the lack of severe damage to theexterior structure of the cab, and the controlcompartment of locomotive did not sustain anymajor intrusion. The structural integrity of thecab was maintained and provided interior spacefor the survivability of the engineer. Theengineer sustained his serious injuries as a resultof striking the interior surfaces of the controlcab when the locomotive rolled onto its rightside and slid along the creek bed. The conductorsuffered his fatal injuries (blunt force trauma tothe head and chest) when he contacted theground after jumping or being thrown from thelocomotive or was hit by flying debris from thederailing rail cars. The brakeman also jumped orwas thrown from the locomotive, but hereceived his fatal injuries from the fire. Theabsence of any severe head injuries or majorblunt trauma, according to the medicalexaminer, may indicate that the brakemancrawled to the location in the creek bed wherehe was found, and afterward the fire eventuallyreached him. Therefore, the Safety Boardconcludes that had the conductor and thebrakeman remained in the control compartmentcab of the locomotive, they likely would havesurvived because the cab survival space wasadequate.

California Department of Forestry and FireProtection firefighting vehicles were dispatched

within 1 minute of accident notification, theinitial incident command post was established34 minutes later, and the first fire engine arrivedon scene 1 minute after that. The forestry andfire protection department IC responded to thescene within 59 minutes of his notification andemployed the incident command systemthroughout the incident. The seriously injuredengineer was removed by ambulance from thederailment site within 1 hour 16 minutes. The ICestablished the incident command post at theMormon Rocks fire station and staging areas,assigning other forestry and fire protectiondepartment officers and a U.S. Forest Servicechief to assist in managing the accident.Numerous Federal, State, county and localagencies were available to addressenvironmental concerns and provide resourcesto the IC. Given the catastrophic size of theoverall train fire and the unknown chemicalhazards with potential risks to firefighters, thedecision not to fight the fire was prudent. Thefirefighters continued to cool the burning carsand extricate them from the pileup, thusminimizing the risk of injury. Therefore, theSafety Board concludes that the local emergencyresponse was timely and adequate, given theremote location of the derailment, and the ICacted effectively and managed the incidentsuccessfully to completion without seriousinjury to responders, local residents, or officialsat the scene.

Train Line Continuity LossThe Freightmaster, Inc., train dynamics

analyzer simulation results were consistent witha blockage or restriction in the train linebetween the fifth and ninth cars. This simulationanalysis, based on the event recorder transit timefrom Summit to the POD and the calculatedturnover speed of 70-plus mph at the POD,indicated that with three or more workingdynamic brakes and a minimum of 16 carsbraking, the train would have either stopped ornegotiated the derailment curve without seriousincident. Thus, the simulation results eliminated

43

the 16th car, ATSF 90033, as causing orcontributing to the inability of the train to stop.

The simulation remains a valuable diagnostictool, but by itself, is not conclusive. The SafetyBoard is aware that the simulations did not haveall data necessary, such as unrecorded speed, toperform an absolute test and that a change in avariable would change the outcome of a test.The simulations also depended upon manyassumptions and conditions that areuncontrolled in real operating situations. Theexact starting point of the train at Summit andthe engineer’s use of his dynamic braking wereassumed or estimated. However, using the datathat were available, the tests disclose that withfour dynamic brakes and nine cars braking, H-BALT1-31 lacked sufficient braking power toallow it to negotiate the curve at MP 60.4(POD). Although the simulation results indicatea blockage near the fifth through ninth cars, theSafety Board is not convinced that a blockagecould occur only in that area.

Thus, the Safety Board considered thepossibility that one or more factors caused theloss of continuity to the train line. Because theevidence involving the loss of train linecontinuity was inclusive, the Safety Boarddeveloped three scenarios that might identify apossible cause for the train line blockage orrestriction that culminated in the derailment ofH-BALT1-31. These scenarios include a kinkedair hose (on a cushioned underframe car), aclosed angle cock, and a foreign object or debrisin the system.

Kinked Air Hose-- A crimp or kink in theair brake hose could block or restrict the trainline. Such a crimp or kink will generally occurin a worn or damaged hose or in a hoseconnected to an unauthorized design or repair.As H-BALT1-31 began its descent to Cajon, theslack in the train couplers and draft gearbunched together. The slack action may havebent or crimped an air brake hose that pinchedoff air flow from the engines to the rear of the

train and resulted in the loss of air brake control.(Such a phenomenon is empirically attributedmore to cushioned underframe cars than toconventional draft gear cars.) Because of thetrain line relationship to the undercarriage oncushioned underframe cars, these cars are moresusceptible to incur a kink in their train line.The movement of the draft system requires thatthe train line also be fluid in motion as the railcar moves. The cushioned underframe cars havethis extra movement to buffer the forcesencountered in the moving car, which offersmore protection for the lading of the car.

Initially, the investigation had focused on thecushioned underframe car, ATSF 90033, whichwas the last car added to the train after therepair at Barstow. The Freightmaster, Inc.,simulation later eliminated this car as a sourceof a blockage because the car was too far back(16 cars) in the train to have prevented theengineer from safely stopping or slowing thetrain for the accident curve. The simulation alsoindicated that most of the other cushionedunderframe cars (11 through 13) in the consistwere probably not involved. These cars alsowere not within the five- to eight-car blockageor restriction zone that the simulation identifiedas necessary to meet the derailment speed, time,and location.

The fifth car in the consist, SFLC 10005,was a cushioned underframe car and within theeffective position for a blockage, as identifiedby the simulation. However, the derailmentsequence, subsequent fires, and wreckagemovement prevented close inspection of carSFLC 10005 and precluded constructing atimely simulation. Car repair records for carSFLC 10005 showed no history of intermittentproblems indicative of hose kinking orrestriction. Investigators were unable to find anybrake hoses that appeared to have been kinkedor crimped before the accident or that could beidentified to any particular car in the suspectzone (cars five through eight) of the train.

44

Attempting to determine the likelihood andfrequency of kinked hoses, Safety Boardinvestigators, therefore, inspected othercushioned underframe cars. The postaccidentinspection of the five sister cars to ATSF 90033for condition and design consistency of the end-of-car air hose arrangement revealed threepredominate styles of air hose arrangements andseveral cars having different arrangements ateach end. Each of the three predominate stylesof air hose arrangement had several customizedsubversions. Only a few of the air hosearrangements, as found on the sister cars,remained true to the modification drawingarrangement or the manufacturer drawings. Oneof the greater differences between arrangementswas the length of the pipe that attached to theflexible glad-hand air hose, which variedbetween 6.5 and 45.5 inches. The Safety Board,therefore, concludes that a wide deviation ofend-of-car hose arrangements on cushionedunderframe cars from the approved end-of-carhose arrangement design is not uncommon andmay induce an air hose to kink in operation andblock or restrict a train line. Consequently, theSafety Board believes that the BNSF shouldinspect the end-of-car hose arrangements on itscushioned underframe cars and ensure the hosearrangements match the intended design. Inaddition, the Safety Board believes that theAAR should inform its member carriers aboutthe circumstances of this accident and alert themto inspect the end-of-car hose arrangements oncushioned underframe cars and ensure the hosearrangements match the intended design.

The ATSF Barstow car shop had repaired thecar ATSF 90033 but had no references ordrawings on which to base the repair of thebrake pipe and the end-of-car hose arrangementof the car and, thus, made the repair to matchthe other end of the car. If a reference ofstandardized hose arrangement drawings hadbeen readily available to the carmen, noconfusion should have existed or questionablerepair have been made to car ATSF 90033. TheSafety Board concludes that had the Barstow car

shop made hose arrangement reference manualsreadily available, the carmen could have usedguidelines to properly repair the train line onATSF 90033. Therefore, the Safety Boardbelieves that the BNSF should provide itscarmen with readily available means to identifythe proper design or specific type of end-of-carhose arrangement on cushioned underframe carsto preclude a possible improper repair ormodification. The Safety Board also believesthat the AAR should ensure that its membercarriers provide carmen with readily availablemeans to identify the proper design or specifictype of end-of-car hose arrangement oncushioned underframe cars to preclude apossible improper repair or modification.

A severe grade, such as at Cajon Pass, couldinduce a situation in which the bunching of thetrain could cause a kink in the air system of acushioned underframe car. Before H-BALT1-31reached Summit, it had operated over terrainthat could have caused the train to bunch.However, the grades were not as steep as theone at Cajon Pass, and according to theengineer, the brakes were functioning as hestopped H-BALT1-31 at Summit. In addition,Safety Board investigators were unable toexamine the train line of either car ATSF 90033or SFLC 10005 for any evidence of kinkingbecause of the damages incurred from thederailment sequence and ensuing fire. Althoughthe first scenario is plausible, sufficientevidence was not available to make a conclusivedetermination.

Closed Angle Cock-- The sooting on theball key of the Sloan angle cock valve fromATSF 92018 indicated that the valve was in theclosed position before the fire reached andcharred the attached hose. The hose was stillintact when the valve was removed from the car.However, other cars that were involved in thefire sequence had their rubber hoses burned offcompletely. Therefore, the rubber hose on theangle cock from ATSF 92018 did not appear tobe as involved in the fire as did those of the

45

other cars in the train. The accident area wasopen to numerous personnel before being ropedoff. With this open access, someone could havehad an opportunity to close the angle cock, andthen, the fire reached the car later. Furthermore,the bending of the handle pivot pin and lug,which prevented unencumbered movement ofthe handle, strongly suggests that the valve wasin the closed position when damaged. The mostlikely time for such damage to occur was duringthe derailment; however, for damage to occurduring the recovery process cannot bediscounted.

Several previous railroad derailmentsinvestigated by the Safety Board have involvedturned angle cocks from theft and vandalism.41

However, Safety Board investigators found nomaterial evidence of vandalism in this accident.The practice of stopping westbound trains atSummit presents the opportunity for tamperingwith a train brake system. During the 16-minutestop of H-BALT1-31 at Summit, ampleopportunity existed for unknown people totamper with any angle cock on any car in thetrain. Although the crew saw no one, thedarkness and the open terrain sufficientlyallowed for someone not to be sighted by acrew.

No definitive physical markers or artifacts asto the position of the angle cock valve fromACFX 84070 at impact were uncovered. Thepresence of sand inside the key slot and the hoseside inlet demonstrates that the valve was openwhen the sand was introduced but does notestablish a time at which it was closed. Onepossible scenario is that the valve was open atderailment, with sand and water being

41Railroad Accident Report--Collision and Derailmentof Southern Pacific Train at Garnet, California, August 23,1986 (NTSB/LAX-86-FR-015) and Railroad AccidentReport--Derailment of Burlington Northern Train atSpokane, Washington, December 24, 1991 (NTSB/LAX-92-FR-006).

introduced during the fire suppression process,and was closed during the recovery process. Inaddition, the Safety Board photograph of carACFX 84070 taken 2 days after the derailmentdiscounted tampering for its angle cockretrieved in the closed position. This photographindicates that the angle cock was in the openposition 2 days after the derailment and providesevidence that the subsequent change happenedafter the accident and not before.

Because of the damage incurred to the railcars from the derailment sequence and thesubsequent fire, the Safety Board was unable toexamine the angle cocks on all cars in thederailment. According to the train simulations,the blockage would need to have occurred in theinitial 15 percent of the train. The Safety Boardwas unable to match any of the other anglecocks found in the closed position to the firsteight cars in the consist or to find any turnedangle cocks on any of the locomotives or thefirst 10 cars in the consist. The evidence wasinsufficient to indicate a closed angle cock wasthe blockage that resulted in the loss in train linecontinuity, causing the derailment. This secondscenario may also be plausible, but again,sufficient evidence was not available to make aconclusive determination.

Foreign Object or Debris-- The derailmentsequence, ensuing fire, and postaccident activitiesprevented a timely examination of the cars by theSafety Board to find any evidence of debris in thetrain line causing a blockage. However, the blockageof a train line from a foreign object or debris is aremote possibility, and such occurrences arerelatively rare because of the number of times carsand trains have air brake tests. The predeparture airbrake tests on H-BALT1-31 at Barstow and thehandling of the train to Summit do not indicate anydebris blockage or restriction. Also, with the length oftime the train was in operation before the derailmentand the constant air pressure in the train line, anysignificant debris that could cause a blockagewould likely have been detected by the

46

engineer, who stated that his brakes wereoperating up to and including his stop atSummit. A foreign object or debris suddenlypositioning itself to block the train line appearsvery unlikely.

Water may have been introduced into thetrain line from cars already contaminated bypoorly maintained air systems or from air at theBarstow yard. Water contamination may createlocal air brake problems within a train line;however, such contamination generally is unableto block a train line unless the air temperature isbelow freezing. The ambient temperature aroundBarstow was not cold enough to freeze anywater contamination in a train line. The cars thatmade up H-BALT1-31 had been at Barstowfrom 6 hours to several days, which is sufficienttime to melt any ice having formed on the tripwest.

After a thorough and an exhaustiveinvestigation effort, the Safety Board could notidentify what caused the loss of train linecontinuity on freight train H-BALT1-31.Although the three scenarios offer possiblemeans for such blockage to occur, no evidencewas found to give credence to one over another.The most likely event that caused the loss oftrain line continuity was an undeterminedblockage or restriction from unknown originssomewhere in the train line. Because theblockage origin and location is unknown, anyone possibility or combination of possibilitiescould have caused the loss in train linecontinuity. Therefore, the Safety Boardconcludes that an unknown train line blockageor restriction, probably between the fifth andninth cars, resulted in responsive brakes only onthe locomotive units and possibly the first eightcars, and, thus, the engineer was unable to slowor stop H-BALT1-31.

Two-way End-of-TrainDevice Operation

An armed two-way ETD offers a key safetyadvantage over a one-way ETD because thetwo-way feature allows a traincrew totelemetrically initiate an emergency brakeapplication from the rear of the train forward.Emergency braking, employing the train brakes,propels backward from the locomotive throughthe train and is enhanced because similarbraking forces can be concurrently activatedfrom the rear of the train. Thus, the rapidreduction of pressurized air from two oppositemoving directions should cause the brakes on allcars to engage up to and including the pointwhere any restriction in the train line might belocated. The emergency braking action initiatedfrom the locomotive without the aid of an armedtwo-way ETD would be effective up to the pointthat air encountered a blockage in the train line.Under such circumstances, the amount ofeffective braking would be dependent uponwhere the restriction occurred in the train line;the closer the blockage was to the front or rearof the train, the less braking effort would beavailable. Inadequate or nonexistent airflow atthe blockage point would preclude the activationof emergency brakes on all cars behind theblockage. Armed two-way ETDs are provencritical hardware components that can assist atraincrew during a braking emergency and, thus,promote a safe operational environment.Therefore, the Safety Board concludes that hadH-BALT1-31 been equipped with a fullyfunctioning two-way ETD, the engineer couldhave applied the brakes from the rear of trainand the derailment may have been avoided.

Federal Railroad AdministrationOversight-- At the time of this accident, nocomprehensive industry guidelines were ineffect for the implementation and the usage oftwo-way ETDs or any other methodology thatprovides the capability to initiate an emergencybrake application from either end of a train. Inaddition, no industrywide directions addressed

47

the issue of the inability to arm an ETD. Afterthe derailment of H-BALT1-31, the FRA issuedemergency order 18 that addressed the safetyrecommendations previously issued by theSafety Board asking the FRA to require the useof two-way ETDs on all trains withoutcabooses. Had the FRA initiated its February1996 action after the December 1995 SafetyBoard recommendation was issued, this accidentmay have been avoided.

The use of two-way ETDs in mountainousgrade territory may have prevented or mitigatedthe December 1994 and February 1, 1996,accidents at Cajon Pass. The Safety Boardconcludes that the FRA failure to require thecapability to initiate an emergency brakeapplication on either end of a train inmountainous territory after the 1989 Helena,Montana, accident and its failure to takeimmediate action after receiving the SafetyBoard recommendation resulting from the 1994Cajon Pass accident may have contributed to thecause of this accident in 1996.

Railroad Industry Inaction-- Whenfreight train consists included cabooses, thecapability to apply emergency brakes from therear of the train was secured. The railroadindustry has long been aware of the benefits ofhaving that capability. Cabooses had alwaysbeen equipped with an emergency valve thatallowed the conductor to apply emergencybrakes from the rear of the train. Additionally,they had rear-end marker lights to protect theend of the train. The conductor and othercrewmembers in the caboose reported the rear-end brake pipe pressure to the engineer so heknew when the air brakes had been applied orreleased on the last car. The caboose crew alsoinspected the train for dragging equipment, hotjournals,42 or shifted loads. Then, cabooses wereeliminated, and technology replaced those duties

42Part of a rail car axle.

of the conductor and brakeman. Wayside defectdetectors now monitor the train for hot journalsor dragging equipment and automatically radiothe data to the engineer. The one-way ETDprovides a red marker light and transmits thebrake pipe pressure to the head-end display. Theonly function lacking was the capability ofapplying the emergency brakes from the rear ofthe train, and the development of the two-wayETD filled this void.

The Safety Board is pleased with the railroadindustry commitment and progress to voluntarilyinstall two-way ETDs on all required trains byJune 1997; however, the industry action hascome unduly late. The Safety Board firstaddressed the need for two-way ETDs after itsinvestigation of the 1989 accident in Helena,Montana. The December 1994 Cajon Passaccident again highlighted the necessity for two-way ETDs on freight trains. Had the railroadindustry taken voluntary action to adopt two-way ETDs when the need was initially identifiedthen the H-BALT1-31 derailment might havebeen avoided.

Management Oversight-- ATSF rule 30.6,30.7, 30.10, 30.11, 30.13, 30.14 was put intoeffect after the December 1994 collisionbetween two freight trains at Cajon Pass atalmost the same location as this accident. InMarch 1995, ATSF senior management wrote tothe Safety Board and agreed to change theiroperating practices, which resulted in the abovecited rule. The ATSF senior management alsoagreed to implement train use of two-way ETDson Cajon Pass as soon as the equipment becameavailable, which amended ATSF air brake rule30.27 in the section of the timetable thatcontained special instructions for allsubdivisions. (See appendix D.) The amendmentdetails how a two-way ETD is to be tested andits operation is to be verified. However, noinstructions were in the timetable about whatactions to take should the two-way feature failthe test or should the two-way ETD not to beoperational. In addition, the ETD was not

48

required to be operational in the two-way modebefore the train proceeded.

ATSF general orders 67 and 130 address theusage of the ETD system with no directreference to the two-way system. General order67 states that the engineer must report animproper operation of the ETD; however,whether this interpretation was applicable to atwo-way ETD that was still functioning properlyas a one-way device is unclear to the SafetyBoard. The ETD on train H-BALT1-31 wasfunctioning properly as a one-way device, andgeneral order 130 specifically allows a train todepart the terminal even when the crew areunable to arm the two-way system. The engineerof H-BALT1-31 told Safety Board investigatorsthat he was not aware of any requirement toreport the inability to arm a two-way ETDsystem and, thus, had not reported the improperoperation of the two-way ETD on H-BALT1-31.He said that he had often operated trains downCajon Pass without a functioning two-way ETD.Other ATSF locomotive engineers who hadoperated trains over Cajon Pass told SafetyBoard investigators that they also had oftenoperated trains down the pass withoutoperational two-way ETDs. Departure fromBarstow with an unarmed two-way ETD was acommon practice that was accepted andcondoned by the local ATSF management. TheSafety Board therefore concludes that theengineer of H-BALT1-31 was not aware of anyrequirement to report the inability to arm a two-way ETD system and, consequently, did notreport the improper operation of the two-wayETD on train H-BALT1-31 to the traindispatcher and customer quality support, asrequired under rule 67 (B).

Furthermore, the director of train handlingwho wrote the amendment to rule 30.27 statedthat instructions for two-way ETDs that failedthe test were covered under general order 130.He later said that subsequent to the accident thathad occurred in December 1994 on Cajon Pass,the carrier had committed to purchasing and

installing two-way ETDs as well as installingHED units on its locomotives as soon as theequipment became available from themanufacturers. At the time rule 30.27 wasamended, the carrier had not procured enoughunits to equip all of its trains. The director oftrain handling added that because of theprocurement circumstances, a crew couldacceptably operate a train down the grade onCajon Pass without a functioning two-way ETDor another method of initiating an emergencybrake application from the rear of the train. Therule assumed that the engineer has sufficientbraking power to stop or slow a westbound trainthrough Cajon Pass. Although numerous trainswere departing Barstow and descending thegrade at Cajon Pass without functioning units,local ATSF officials took no corrective actionbecause the rule did not require a fullyfunctional device.

Because of a mudslide in the Cajon area, thetraincrew went off duty, and until they returned,HBALT1-31 was delayed for departure and wasidle for over 4 hours in Barstow. During thattime, no measures were taken to find the causeof the com/test fail that the engineer hadreceived during the arming sequence. The ATSFtook no exception with a westbound trainleaving Barstow yard with an unarmed two-wayETD, and no procedures were in place to test fora faulty HED or ETD should a traincrewencounter a problem in arming an ETD.

The Safety Board understood from the statedcommitment of the ATSF senior managementafter the December 1994 accident that the use oftwo-way ETDs meant fully functioning devices.The vice president of operations stated that theATSF intent was ultimately to have two-wayETDs on all westbound trains through CajonPass; however, the final result was a rule thatallowed trains to proceed westward without afully functioning two-way ETD. The practice ofallowing westbound trains to depart Barstowwithout a fully functioning two-way ETDshould have been evaluated as the equipment

49

became available. In addition, the carrier failedto assess the risks associated with trains leavingBarstow without fully functioning two-wayETDs, and no procedures or guidance weremade available for traincrews in the event theywere unable to arm the system or encountered acatastrophic system failure en route. Therefore,the Safety Board concludes that the ATSFmanagement failed to ensure the use of fullyfunctioning two-way ETDs on westbound trainsover Cajon Pass.

On December 15, 1995, in SafetyRecommendation R-95-48 to the BNSF, theSafety Board had asked that all Class IRailroads, pending the adoption of a formalrule by the Federal Railroad Administration,implement the use of Two-Way End-of-Traindevises on all cabooseless trains by March 31,1996. The BNSF responded that because of ashortage of two-way ETDs, the carrier isprecluded from complying with thisrecommendation; however, as more of thesedevices become available, it intends to equipcabooseless trains with them. Thisrecommendation is classified “Open--Acceptable Response.”

Operating Crew Training-- TheH-BALT1-31 engineer knew the properprocedures required to successfully arm a two-way ETD. The engineer stated that he had readand understood the procedures associated witharming the system and had received instructionsfrom the manager of training operations. He alsosaid that he had experienced a "fifty-fifty"success in arming ETDs. The engineer acquiredthe arming procedure method essentially on thejob and not in association with a comprehensivetraining program. The Safety Board was unableto document whether the other twocrewmembers had received training specificallypertaining to two-way ETD operations or wereknowledgeable of the correct proceduralmethod. Their knowledge of the two-way ETDwas likely also gained through informal means.The Safety Board, therefore, concludes that the

ATSF management failed to ensure thatoperating crewmembers received comprehensivetraining on the proper procedures required forarming two-way ETD operation; although,investigators did not find that lack of trainingcontributed to this accident.

The Safety Board is pleased that the ATSFhas made revisions to the ETD training programin the aftermath of this accident and understandsthat the BNSF now ensures that all operatingpersonnel whose duties require them to use atwo-way ETD receive comprehensive trainingand demonstrate proficiency in its use.However, the circumstances surrounding thecollision on December 14, 1994, in Cajon Passshould have compelled the ATSF toexpeditiously establish a comprehensive ETDtraining program, which also could identifyperformance deficiencies and remedy them withadditional instruction. A systematic instructionalapproach would promote the efficient, uniformtracking of employees to avoid any trainingduplication or omission.

End-of-Train Device andHead-End Device Operation

The telemetry system tests revealed that theHED could not be operated as a two-way systembefore the accident since the insufficient powerfrom the transmitter module of the unit wouldnot allow a two-way emergency braking systemto arm. The crew could not arm the system fortwo-way operation before H-BALT1-31departed Barstow because of this mechanicalfailure, and the system must be armed to use theemergency brake function of two-way operation.(The system could be operated as a one-waysystem since the transmitter is not needed forone-way operation.) Therefore, the Safety Boardconcludes that the failure of the transmittermodule of the HED on locomotive ATSF 157 togenerate sufficient wattage power would notallow the engineer of H-BALT1-31 to arm thetwo-way HED/ETD system.Unsuccessful arming attempts are indicated in a

50

multi-purpose status window on the HED, butunless the system is already armed, amalfunctioning transmitter will not be indicatedto the operator. An armed system performs acommunications test every 3 minutes thatevaluates both the HED and the ETD. If foursubsequent automatic tests fail, then a flashingindicator light on the HED informs the crew thatcommunications are unreliable. The H-BALT1-31 crew would have been informed that thearming attempts were not successful; however,they would not know why.

This particular HED has several auxiliaryfunctions in addition to transmitting andreceiving information from the ETD. Thetelemetry system test revealed that when theHED is being employed for auxiliary functions,such as odometer use, mile calibration, trainlength input, or setup functions, the emergencybrake function is deactivated; thus, pressing theemergency button on the HED has no effect.When being used only to communicate with theETD, the status window displays the brake pipepressure at the end of the train and indicateswhether the ETD is in motion. When anyauxiliary function is used, the status windowreflects information about that particularfunction. During the test, the emergency brakecould be activated only when the status windowdisplayed the brake pipe pressure and ETDmotion status. Had the transmitter in the HEDbeen functioning normally and the system armedfor two-way operation, the engineer likelywould not have been able to activate theemergency function had he been using the HEDfor any function other than monitoring the brakepipe pressure.

The engineer testified that he had receivedno formal training on the operation of the two-way telemetry system, and, therefore, he waslikely unaware that the emergency brakefunction is disabled when the HED is used forother functions and that additional steps areneeded to use the emergency brake function.

Even had the crewmembers received appropriateformal training in the operation of the system,the additional steps required to initiate anemergency brake application can causeconfusion and delay in, if not prevent, theapplication of the emergency brake valve at therear of the train. After the accident, the ATSFbegan phasing out these HEDs in their two-wayETD system. Although 430 of these HEDs wereoperated as a one-way device only as of October22, 1996, none was equipped with the oldfirmware, which required additional actions toinitiate the emergency braking function from therear of the train.

Event Recorder Maintenanceand Placement

The event recorder system installed onlocomotive ATSF 342 did not record any wheeldata, and, consequently, no speed or distancedata could be calculated. Postaccident testing atQ-tron revealed that the axle generator waswired and reassembled in a manner inconsistentwith the manufacturer specifications. The SafetyBoard, therefore, concludes that the wheel datawere not recorded due to a broken wire in theaxle generator as a result of an impropermodification to the axle generator.

The event recorder on locomotive ATSF 342was a microprocessor-based type equipped witha self-test function. The ATSF stated that it hadan understanding with the FRA that this type ofrecorder would require a download andinspection on an annual verses a quarterly basis;therefore, this event recorder was not inspectedduring the December 1995 quarterly inspection.In addition, the ATSF did not inspect ordownload the recorder during the most recentannual inspection before the derailment (June12, 1995). However, the FRA indicated that nosuch agreement existed between it and theATSF and that, citing the existing requirementfor event recorder maintenance, any suchagreement would not be an issue.

51

Microprocessor-based event recorders withthe self-test function are exempt from quarterlyinspections. Under 49 CFR 229.25(e)(2), “Amicro-processor based event recorder, equippedto perform self tests, has passed the pre-maintenance inspection requirement if it has notindicated a failure.” Unless indicating a failure,microprocessor-based event recorders with theself-test function never have to be downloadedor tested. Thus, the Safety Board concludes thatthe FRA regulations for the periodic inspectionof event recorders are inadequate.

During postaccident testing, the self-testfunction indicated no faults, and the recorderwas found to be fully operational and withinmanufacturer specifications. The speed had notbeen recorded because of a failed axlegenerator, which sends the speed data to theevent recorder. Additionally, the event recorderon locomotive ATSF 342 was found to havebeen improperly programmed, which resulted inthe recording of certain parameters only onceevery 8 minutes. Because the timing wasprogrammed into the configuration of the eventrecorder, the self-test function of the eventrecorder did not identify it as a fault.

After the accident in Milford, Connecticut,on October 3, 1995,43 involving a commuter railcontrol car that had been serviced before theaccident, Safety Board investigators found theaxle generator was not adjusted properlyfollowing the service, and as a result, no speeddata were recorded. This event recorder wasalso a microprocessor-based with a self-testfunction and indicator light. During thepostaccident testing, the self-test functionshowed no faults, and the event recorder wasfully functional and within the manufacturerspecifications.

43Highway Accident Report--Highway/RailroadGrade Crossing Accident, Metro North CommuterRailroad, Milford, Connecticut, October 3, 1995(NTSB/NRH-96-MH-003).

The Safety Board is investigating a gradecrossing accident which occurred in Tickfaw,Louisiana, on May 27, 1996. Although theinvestigation is still ongoing, preliminaryfindings show that two of the inputs to the eventrecorder were wired incorrectly, resulting inanomalous data being sent to the event recorder.Inspection records reveal that the event recorderwas inspected 2 days before the accident and noproblems were reported. However, because itwas a microprocessor-based and self-test eventrecorder, the inspection procedure was only astatus check of the self-test indicator light on theoutside of the event recorder.

The self-test functions of existing eventrecorders do not test speed and other data inputsfor validity; as a result during quarterlyinspections, failures, such as those noted above,are unnoticed if the sole means of inspecting theevent recorder is the self-test function of theevent recorder. The Safety Board concludes thathad the entire event recorder system fromlocomotive ATSF 342 been properly testedduring the December 1995 quarterly inspection,both the broken speed sensor and the improperconfiguration of the event recorder would likelyhave been noticed and corrected at that time.Therefore, the Safety Board believes that theFRA should revise 49 CFR 229.25(e)(2) torequire that event recorders, includingmicroprocessor-based event recorders that areequipped with a self-test function, be testedduring the quarterly inspections of thelocomotive in such a manner that the entireevent recording system, including sensors,transducers, and wiring, is evaluated. Suchtesting should include, at a minimum, a reviewof the data recorded during actual operation ofthe locomotive to verify parameter functionalityas well as cycling all required recordingparameters and determining the full range ofeach parameter by reading out recorded data.

After this accident, the ATSF could notprovide any documentation that the ATSF 342event recorder was ever tested or inspected in

52

accordance with 49 CFR 229.25(e), nor could itprovide statistical information about thepass/fail rate of its locomotive event recorderinspections. Title 49 CFR 229.25(e)(5) requiresthat 90 percent of all event recorders inboundfor quarterly inspections be fully functional. TheSafety Board concludes that the FRA was notmonitoring the compliance of the carrier withperiodic inspections of event recorders asprescribed under 49 CFR 229.25(e)(5).Therefore, the Safety Board believes that theFRA should develop and implement a programthat specifically addresses carrier compliancewith 49 CFR 229.25(e)(5).

Had this event recorder system beeninspected and tested at the most recent 92-dayperiodic inspection on December 14, 1995, bydownloading the recorded data and evaluating it,the failure in the axle generator and theimproper recorder configuration, if existing atthat time, should have been noted and corrected.The diagnostic testing would indicate whetherthe recorder was working but would not showwhat, if any, type of data was being recorded bythe unit. Only by downloading the unit can thetype of data being recorded be examined.

The H-BALT1-31 consist had an eventrecorder that was not fully operational. The self-diagnostic light on the unit was insufficient tofully examine the unit and ensure that it wasrecording the data. The FRA required that thecarrier indicate whether a locomotive isequipped with an event recorder in the remarkssection of form F6180-49A. Under 49 CFR part229.135, “any train operated faster than 30 milesper hour shall have an in-service event recorderin the lead locomotive. The presence of theevent recorder shall be noted on Form FRAF6180-49 A, under the REMARKS section.” Inso doing, the opportunity for oversight ispresent: first, the carrier not listing the eventrecorder for inspection on form F6180-49A, andsecond, the inspector not observing the remarkssection on the back of the form. Consequently,the Safety Board concludes that FRA form

F6180-49A is not adequate for recording theinspection of event recorders and allowsoversights to be perpetrated during inspectionprocedures. By revising this form to include theevent recorder in the other items to be inspectedsection, an inspector likely would not overlookexamining the event recorder. Therefore, theSafety Board believes that the FRA shouldrevise its form F6180-49A to include eventrecorders in the other items to be inspectedsection on the form.

In its preamble to the final rule on eventrecorders (58 Federal Register 36610-11), theFRA advised that it “has determined that therecorder will be most helpful if it records theevents happening in the locomotive occupied bythe engineer, that is, the lead locomotive.” Thefinal rule stated that all trains traveling fasterthan 30 mph must have an event recorder in thelead locomotive; however, a petition forreconsideration was filed, and as a result, aclause was added to the final rule that allowsplacement of the event recorder “elsewhere thanthe lead locomotive.” Also in response to thepetition, the FRA reiterated that its “primaryconcern is still as it was when the preamble waswritten: to provide the best data for analysis, therecorder must capture what the engineer seesand does” but determined that requiring theevent recorder to be placed in the leadlocomotive was “unnecessarily geographicallystrict.”44 The provision allowed that if the eventrecorder monitored and recorded the requireddata as though it were located in the leadlocomotive, the event recorder could be placedelsewhere than in the lead locomotive.

The Safety Board is concerned that the resultof allowing the recorder to be placed elsewherethan in the lead locomotive is not as the FRAintended. One alternative practice, placing theevent recorder in any locomotive that is train

44Federal Register, Volume 60, Number 102, May 26,1995.

53

lined to the lead locomotive, does not result inmonitoring and recording the required data asthough it were located in the lead locomotive.The train line data are intended to be the samefor all locomotives in the train line so thecontrol inputs made by the crew in the lead unitare carried out by the trailing locomotives aswell. In the preamble to the final rule, however,the FRA noted:

Only the lead locomotive’s device willrecord the engineer’s actions inthrottle control or in setting up thedynamic brake – recorders in trailingunits will note the ‘message’ received,the action they were requested to take,but only the lead locomotive willrecord the direct input of the person incontrol.

Furthermore, those parameters that aremonitored locally can only reflect the conditionof the locomotive on which the event recorder isinstalled and are not shared among locomotivesthrough the train line. Therefore, event recordersinstalled on trailing locomotives are not capableof recording any parameters that are local to thelead locomotive.

Train speed and independent brake are twoof the locally sensed parameters required under49 CFR 229.5(g) to be monitored and recorded.Actual speed will be the same for a trailinglocomotive and lead locomotive; however,speed is derived from a signal-generatingdevice, which is attached to the locomotive axlegenerator. Should an event recorder be installedin the third unit of a locomotive consist, itmonitors the third unit axle generator signal andnot the lead unit signal. Axle generator signalscan vary significantly from locomotive tolocomotive; consequently, an event recorder inthe third unit cannot monitor and record speedas though it were in the lead locomotive. Alocomotive is typically configured to use theaxle generator to provide data to the speedindicator in the cab as well as to the event

recorder. To best monitor what the engineersees, the speed signal in the engineer’slocomotive unit should be recorded, as opposedto a signal in a trailing locomotive, and couldprove important should the axle generator fail orbe improperly adjusted. As speed indicators arerequired under 49 CFR 229.117 to be tested “assoon as possible after departure,” any anomaliesin the speed sensing and recording system arelikely to be noticed in a timely manner. Amalfunction in the speed system of a trailinglocomotive could go unnoticed for extendedtime, as occurred in this accident.

Independent brake is usually recorded aseither a discrete value (on or off) or as an actualair pressure. The data come from the locomotiveon which the recorder is installed. As a result,an event recorder in the third locomotive unitwill only monitor the status of the independentbrake in the third unit and not the status of theindependent brake in the lead unit. Failure tomonitor and record independent brake data inthe lead locomotive can result in unnoticedindependent brake activity or incorrectindications of the time that an independentbrake application is made on the leadlocomotive.

Other parameters are also only recorded onlead locomotives, including the horn and theengineer-induced emergency. The horn is animportant parameter in many grade crossingaccidents, and the engineer-induced emergencyallows investigators to determine whether anemergency brake application was the result ofengineer action. Although not required underregulation, most event recorders monitor andrecord both of these parameters if the recorder isin the lead locomotive.

Other available data that can only berecorded by an event recorder in the leadlocomotive are:

Cab signal information (aspect oracknowledgment or both)

54

Crew vigilance system data (alerter data andpenalty brake)

TD data (pressure, marker, battery status,and motion status)

Traction motor current for the leadlocomotive45

Pneumatic control switch state for the leadlocomotive45

Additional train brake data (equalizingreservoir pressure and suppression)

Wheel slip data45

Locomotive speed limiter dataOverspeed penaltyDistributed power data

The Safety Board has demonstrated that anevent recorder in the lead locomotive canprovide more accurate and diverse data than onein a trailing locomotive. The Safety Board,therefore, concludes that the requirement tomonitor and record data as though it were in thelead locomotive cannot currently be met by theplacement of an event recorder elsewhere thanin the lead locomotive. The Safety Boardbelieves that the FRA should inform theindustry that the placement of event recordersother than in the lead locomotive will not recordthe required data as though the event recorderswere in the lead locomotive and ensurecompliance with 49 CFR 229.135(a).

Tank Car PerformanceThe high speed of the train at derailment and

the relatively short length of destroyed ordamaged track in which the four locomotives and45 freight cars stopped indicate the immensemagnitude of the impact forces acting on the 12tank cars that derailed. In addition to themagnitude of the impact forces acting on these 12tank cars, the exposure to fire and heat likelyreduced their material strength and integrity. The

45Locally sensed parameters that can be recorded bytrailing unit event recorders but would reflect the conditionof the trailing unit itself and not the lead unit.

11 derailed DOT 111A tank cars sustainedextensive mechanical damage not limited to anyarea of the tank cars as a group. Although 7 ofthese 11 tank cars were jacketed, the jackets didnot provide any significant protection in thisaccident. The damage and deformation to theDOT 111A tank cars was extremely severe incomparison to the DOT 105J tank car with butylacrylate that survived the derailment and the fireintact. Although the jacket was crushed anddented in all areas on the DOT 105J tank car,visible damage to the tank shell was superficialand limited to denting of one head and a puncturethat was caused by the explosive charges used tovent the tank.

The two DOT 111A tank cars with the leastdamage, ACFX 84855 and 84070, were the thirdand fourth cars behind the locomotives and wereeither clear of or on the edge of the mainwreckage pile following the derailment. A thirdDOT 111A tank car was the sixth car behind thelocomotives. All the other DOT 111A tank carswere between the 26th and 41st cars behind thelocomotives, and the DOT 105J tank car was the33rd car. The positioning of the tank cars in thetrain consist cannot account for the difference inthe damages observed on the DOT 111A tankcars and the DOT 105J tank car. Because theDOT 105J tank car and most of the DOT 111Atank cars were positioned in the middle section ofthe train, all were subjected to similar impact andderailment forces. Therefore, the Safety Boardconcludes that the superior strength of the DOT105J tank car, as a result of its thicker tank shelland heads and head-shield protection, accountedfor the difference in the comparative damagesbetween the DOT 111A tank cars and the DOT105J tank car.

This accident again reinforces the need for theFRA, the Research and Special ProgramsAdministration (RSPA), and the tank carindustry, to determine through risk assessmentwhich hazardous materials, includingenvironmentally harmful products, can be carriedwith an acceptable level of risk in DOT 111A

55

tank cars and which products should be affordedmore protection in pressure tank cars, such asDOT 105J tank cars. The Safety Board hasadvocated such an approach in previous accidentreports and safety studies.46 On September 21,1995, RSPA, with the cooperation of the FRA,issued new regulations that require a widervariety of hazardous materials, such annonflammable compressed gases, materialsdesignated as “poisonous by inhalation,” anddesignated halogenated organic compounds thatpose environmental risks, be transported inpressure tank cars equipped with head-shieldprotection and thermal protection, asappropriate.47 The new regulations also apply toDOT 105 tank cars under 18,500 gallons thatwere previously exempted from the requirementsfor head shields and thermal protection. Thesenew regulations are a significant safetyimprovement by requiring the transportation ofproducts with these hazards in better protectedand stronger tank cars.

Hazardous Materials Management

Shipper Notification and Coordination-- Once the ATSF SOC hadconfirmed that freight train H-BALT1-31 hadderailed and that hazardous materials likely hadbeen released and were involved in the fire, the

46Railroad Accident Report--Collision and Derailmentof Montana Rail Link Freight Train with Locomotive Unitsand Hazardous Materials Release, Helena, Montana,February 2, 1989 (NTSB/RAR-89/05); Safety Study--Transport of Hazardous Materials by Rail (NTSB/SS-91/01); and Hazardous Materials Accident Report--Derailment of Burlington Northern Freight Train No. 01-142030 and Release of Hazardous Materials in the Townof Superior, Wisconsin, June 30, 1992 (NTSB/HZM-94/01).

47Crashworthiness Protection Requirements for TankCars; Detection and Repair of Cracks, Pits, Corrosion,Lining Flaws and Other Defects of Tank Car Tanks, docketnos. HM-175A and HM-201 at 60 Federal Register 49048on September 21, 1995.

ATSF promptly notified the COES and the NRC.As a result, the appropriate State and Federalagencies were notified in a timely manner. TheSOC provided copies of the train consist in atimely manner to the State forestry and fireprotection department and the SBCC. The IC alsohad other technical resources available on theproperties and the hazards of the chemicals on thetrain. Consequently, from the onset of theemergency response operations, the firstresponders to arrive at the scene and the IC hadsufficient preliminary information about thehazardous materials on the train and whichproducts were in each tank car.

However, following this initial exchange ofinformation, no direct notification of the chemicalshippers was made because ofmiscommunications between personnel at theSOC about the notification of CHEMTREC.Because the IC believed that he had sufficientinformation about the hazardous materialsinvolved and assumed someone would contactCHEMTREC, he did not direct that CHEMTRECbe notified. CHEMTREC, which can provide acommunications link between the chemicalmanufacturers, shippers, and emergency responseagencies, was initially contacted by the CaliforniaEPA about 7 hours after the accident. Shippers,including the R&H, learned that their productswere in the derailment when the BNSF logisticsdepartment contacted them about late or lostshipments.

Because of its concerns about thepolymerization of butyl acrylate and the potentialoverpressurization of the tank car, R&Himmediately attempted to contact the ATSF andthe incident command center. The R&H technicalexperts in Texas faxed guidance about thedecomposition and polymerization of the productto the incident command center. However, theR&H encountered difficulties obtaining accurateinformation on the status of the butyl acrylatetank car until its response team arrived andinspected the isolated butyl acrylate tank car onthe afternoon of February 4.

56

Although the technical information faxed bythe R&H to the incident command center wasreceived and reviewed, emergency responderswere not able to positively identify the butylacrylate tank car and most of the other tank carsbecause of the fire, which had burned away theidentification marks and numbers on the tankcars. Because identification of the butyl acrylatecar now depended on identifying unique fittingsand features of the tank car, relying on thetechnical resources that the R&H could providebecame imperative. Had the R&H personnel beenearly on scene, they could have quicklydetermined on the morning of February 4 afterthe discovery of the unidentified, venting tank carthat it was not the butyl acrylate tank car, and thesubsequent evacuation and the shutdown of theCalnev pipelines might have been averted. Inaddition, the R&H personnel would have alsobeen available during the removal of the butylacrylate tank car from the wreckage to ensure thatthe tank car was left upright to facilitate itsventing through its safety relief valve and toverify the condition of the tank car. ATSFwreckage clearing personnel and the IC wouldhave then known that the tank car was full andstill a danger.

The ATSF superintendent of field operations,who was primarily responsible for wreckageclearing operations, was unsure of the number ofpressure and nonpressure tank cars in the train.He believed that 13 tank cars derailed and that 10and 3 were nonpressure and pressure tank cars,respectively. Twelve tank cars had derailed, andonly one was a pressure tank car. Althoughidentification of specific tank cars was extremelydifficult, the process may have been facilitatedhad the tank car experts from the AAR Bureau ofExplosives or the other chemical shippers beenconsulted expeditiously. The explosives bureauor the shippers could have provided certificates ofconstruction, design drawings, and otherdocumentation and records to verify the numberof pressure tank cars (DOT classes 105 and 112)and general service tank cars (DOT class 111A)in the train, which tank cars were jacketed, the

capacity of each tank car, and any distinguishingfeatures. Had this information been obtained, thesuperintendent of field operations and otherpersonnel, involved with identifying the tank carsand assessing their condition, would have knownthat a single pressure tank car containing butylacrylate was in the train. Knowing thedistinguishing features of a pressure tank car,such as protective domes and no bottom outletvalves, they would have been better able toidentify the butyl acrylate tank car. Neither acarrier nor an IC are required to contactCHEMTREC, hazardous materials shippers, orthe explosives bureau; however, these resourcescan provide specialized technical assistance aboutthe hazardous materials and tank cars in anaccident. Chemical shippers can often assistemergency responders in the identification,handling, and off loading of tank carstransporting hazardous materials. The R&H, theother chemical shippers, and the explosivesbureau were not expeditiously contacted orrequested to provide technical support. Therefore,the Safety Board concludes that the ATSFofficials and emergency responders failed toeffectively utilize the technical resources thatcould have facilitated the identification andcondition of the butyl acrylate tank car and theother derailed tank cars in the train.

The AAR, CMA, and several otherassociations48 representing the chemical andtransportation industries jointly sponsor theTransportation and Community Awareness andEmergency Response (TRANSCAER) program,a nationwide community outreach programdesigned to assist communities in thedevelopment and evaluation of their emergencyresponse plans for transportation incidentsinvolving hazardous materials. Member

48National Association of Chemical Distributors,National Tank Truck Carriers, American PetroleumInstitute, Hazardous Materials Advisory Council, AmericanTrucking Associations, and The Chlorine Institute.

57

companies of the sponsoring associations workwith local emergency planning committees andparticipate in exercises and training with localemergency response agencies to test individualresponse plans. Although TRANSCAER hasfostered greater communication and coordinationbetween local emergency planners, carriers, andchemical shippers, the events in this accidentindicate that a renewed emphasis is needed forrailroad personnel and emergency responders in aderailment involving the release of hazardousmaterials to utilize available technical resourcesand expertise. Therefore, the Safety Boardbelieves that the AAR, the CMA, and theInternational Association of Fire Chiefs shoulddevelop, in cooperation, and distribute to theirmembers information reemphasizing the technicaldata and assistance that can be provided throughCHEMTREC, the AAR Bureau of Explosives,and the chemical shippers when tank carstransporting hazardous materials are involved in atrain derailment.

Tank Car Identification-- The firedestroyed the painted identification marks andnumbers on most of the derailed tank cars andprevented emergency responders and ATSFwreckage clearing personnel from positivelyidentifying individual tank cars. The AAR tankcar committee did not act on the ATSF proposalafter this accident to affix a permanent plateengraved with the tank car identification markand number. An engraved plate permanentlyaffixed to the tank car provides a means foremergency responders to identify a tank car whenpainted markings have been destroyed; however,other safety considerations arise. To obtain theinformation on an engraved plate, an emergencyresponder would, as a minimum to reach theplate, need to be near the tank car and, morelikely, to climb onto the tank car. A tank car thathas been exposed to fire and heat, such as thebutyl acrylate tank car in this accident, has agreatly increased potential for overpressurizationand catastrophic failure. Also, the externaltemperature of the tank car may be too high or thetank car may be precariously positioned for an

emergency responder to safely approach the tankcar and climb onto it to reach an identificationplate. The Safety Board concludes that thepotential danger to emergency response personnelunder accident conditions may outweigh thebenefit of an engraved plate to identify the markand number of a tank car.

In accidents where the identification andcondition of the tank cars containing hazardousmaterials cannot be verified, emergencyresponders typically have been trained toevacuate to a safe distance, confer with tank carand product experts, and reach a consensus on acourse of action. The difficulties encountered inthis accident by emergency response personnel inidentifying individual tank cars could have beengreatly alleviated through greater coordinationwith the chemical shippers, the tank car owners,and the explosives bureau personnel.Coordination between the railroad, emergencyresponders, and the appropriate experts remainsthe most effective means to minimize the dangerto the public and emergency response personnelfrom accidents involving tank cars that containhazardous materials.

The Safety Board previously addressed theissue of tank car identification in its investigationof the derailment of an Illinois Central GulfRailroad freight train in Livingston, Louisiana, onSeptember 28, 1982.49 The Safety Boardconcluded in that accident that the difficulty inidentifying potentially dangerous tank cars andtheir locations in the wreckage delayed attackingthe principal source of fire and heat, and as aresult, the source of the fire continued tosuperheat two tank cars which ultimatelyexploded and rocketed. Consequently, the SafetyBoard asked the CMA in SafetyRecommendation R-83-92 to extend the use of

49Railroad Accident Report--Derailment of IllinoisCentral Gulf Railroad Freight Train Extra 9629 East (GS-2-28) and Release of Hazardous Materials at Livingston,Louisiana, September 28, 1982 (NTSB/RAR-83/05).

58

color coding of tank cars or adopt some othereffective means of identifying high-riskcommodity tank cars in switching operations andin wreck clearing operations. The CMAresponded that it did not consider color coding tobe effective and would not support the colorcoding of tank cars because tank cars werealready required to have reporting marks,numbers, and placards that served to identify thetank car and the product carried. The CMA alsocited the practicality of color coding tank carsbecause of the wide variety of chemical productstransported by tank cars and the use of individualtank cars to carry multiple products. The CMAindicated, however, that it was reviewing othermeans to improve the identification of tank cars,such as the use of radio transponders. Because theCMA did not change its position on color codingor demonstrate that other methods were seriouslybeing investigated, the Safety Board classifiedSafety Recommendation R-83-92 “Closed--Unacceptable Action” on February 18, 1987.

Although color coding of tank cars relies onpainted markings that may be destroyed in intensefires, as occurred in this accident, positivemethods for identifying tank cars need furtherinvestigation and evaluation. The FRA conductedresearch in the 1980s on the use of radiotransponders to track tank cars, and the AAR isnow evaluating the use of global satellite trackingsystems to collect impact data on tank cars whilein transport. Enhancement of such technologiesmay feasibly include the identification of tankcars. Therefore, the Safety Board believes that theAAR should investigate and evaluate means toimprove the ability of emergency responsepersonnel to identify tank cars involved inaccidents.

Derailed Tank Car Handling andDamage Assessments-- After the derailment,conditions at the accident scene precluded theability of emergency responders and the ATSFwreckage clearing personnel to survey and assessthe conditions of the derailed tank cars. Nine or10 of the 12 derailed tank cars were mixed

throughout the burning wreckage pile. Fire andsmoke reduced visibility and limited tank carobservation. In addition, the efforts to extinguishthe fire with the application of water and foam onthe wreckage pile was ineffective, and a processof cooling the perimeter of the wreckage and thenremoving, isolating, and cooling individualfreight cars was implemented. Damageassessments, therefore, could not be performeduntil each tank car was isolated from the otherwreckage and fire. With this approach toextinguishing the fire, emergency responders andthe ATSF wreckage clearing personnel indicatedthat damage assessments of the tank cars weremade continuously as the visibility improved andwreckage was cleared away. The alternative wasto let the fire burn itself out; however, the closureof I-15 and the evacuation of the immediate areafor an undetermined time would probably havebeen necessary.

After each tank car had been removed andisolated, it should have been visually inspected toidentify the specific tank car or type of tank carand to verify, if possible, whether the tank car hadbeen breached and any cargo remained in thetank. Had a definite breach in a tank car not beenseen, the most prudent assumption was that thetank car remained full and should be handled withcare. Furthermore, such a tank car should havebeen closely monitored until its true conditioncould be ascertained. Because of the severity ofthe damage to most of the DOT 111A tank cars,determining the condition of those tank cars mayhave been relatively easy. Before the tank car wasremoved from the wreckage, an observer whowas 70 feet away saw a hole reportedly near oneend of the butyl acrylate tank car, which was nota reliable indicator of the tank car condition. Thelack of visual inspection of the butyl acrylate tankcar after its removal from the wreckage onFebruary 4 indicates that ATSF personnel did notperform a complete and careful damageassessment of any of the tank cars.

The ATSF superintendent of field operationswho was responsible for wreckage clearing

59

operations had the primary responsibility toassess the derailed tank car damage and tooversee the movement and handling of the tankcars at the site. He was assisted by the ATSFchief environmental officer. The determination ofthe superintendent of field operations that thebutyl acrylate tank car was empty was not basedon a physical examination of the tank car after itsremoval from the wreckage but on theimpressions of the equipment operators whopulled the tank car from the wreckage and on thelengthy exposure of the tank car to fire and heat.Because he concluded that the tank car wasempty, he did not perform a visual inspection todetermine whether the tank car had beenbreached or direct that the tank car be leftpositioned upright, cooled with water, ormonitored. The chief environmental officerresolved that the tank car could not have survivedthe impact forces and the fire and heat. Althoughboth individuals had sufficient training andexperience about railroad tank cars to performtheir respective duties (see appendix B), theyrelied on their impressions rather than verificationof the physical tank car condition. The SafetyBoard, therefore, concludes that both the ATSFsuperintendent of field operations and chiefenvironmental officer exercised poor judgment intheir assessment and handling of the butylacrylate tank car.

The State forestry and fire protectiondepartment incident safety officer and IC, whoeach had some knowledge and experience withhazardous materials and tank cars, relied on theexpertise of the two ATSF officials for thehandling of the damaged tank cars. Becausefirefighters and other emergency responderstypically are not experts about tank cars andrailroad operations, they depend on the railroadofficials for guidance.

Both railroad officials may have exercisedbetter judgment had written guidance andrecommended practices been available about theassessment and handling of tank cars exposed tosustained fire and heat following a derailment.

Although criteria exist to assess mechanicaldamage to a tank car, guidance could not befound on the cumulative effects from fire, heat,and mechanical damage on the strength andintegrity of a derailed tank car. The guidanceabout moving and handling loaded or partiallyloaded tank cars that have sustained mechanicalor fire and heat damage or both is also lacking.The integrity of tank cars, subjected to severeaccident forces and fire, should be adequatelyassessed before moving the tanks. Awareness ofthe tank car integrity minimizes the potential of acatastrophic failure of the tank car and release ofany remaining cargo.

The Safety Board had expressed concernabout the need for written technical guidance tohelp emergency response personnel assess theseverity of tank car damage and select theappropriate means to remove the wreckage afterits investigation of a freight train derailmentinvolving hazardous materials near Inwood,Indiana, on November 8, 1979.50 In SafetyRecommendation I-80-2, the Safety Board askedthe FRA to develop guidelines for handling tankcars containing pressurized liquefied gases ataccident sites based on research and tests of arepresentative sample of damaged tank cars. As aresult of various FRA-sponsored research studiesand industry-initiated reports, SafetyRecommendation I-80-2 was classified “Closed--Acceptable Action” on May 25, 1994. Theseresearch studies address mechanical damage butnot the effects of fire and heat. In addition, thetank car safety courses offered at the AARtransportation test center in Pueblo, Colorado,and the AAR annual hazardous materialsseminars provide training and instruction onassessing mechanical damage to tank cars, but notthe effects from fire and heat.

50Special Investigation Report--Tank Car StructuralIntegrity after Derailment (NTSB/SIR-80/1).

60

Because many emergency responders rely onrailroad personnel to provide guidance abouthandling and moving damaged tank cars, railroadpersonnel involved with wreckage clearingoperations should have sufficient guidance toassess all types of damages and the combinationof damages that can result from a derailment.Because tank cars involved in a derailment cansustain mechanical or fire and heat damage orboth, wreckage clearing personnel need to beaware of the effects of each type of damage andany combined effects. The Safety Board,therefore, believes that the AAR should developwritten guidelines for assessing the individual andcombined effects of mechanical or fire and heatdamage or both to tank cars involved in aderailment and for the handling and movement ofsuch tank cars.

Pipeline Operation

Operator Notification-- Calnev becameaware of the accident when an employee heard aradio news broadcast about the derailment andverified that the derailment site was near twoCalnev underground pipelines. The ATSFnotification of the COES and its subsequentnotifications of the appropriate state agencies,including the State fire marshal office and theState forestry and fire protection department,were timely and prompt; however, the ATSF didnot contact Calnev directly about the derailmentand potential threat to its pipelines.

In previous accident investigations,51

including a collision between two ATSF freight

51Railroad Accident Report--Derailment of SouthernPacific Transportation Company Freight Train on May 12,1989, and Subsequent Rupture of Calnev PetroleumPipeline on May 25, 1989, at San Bernardino, California(NTSB/RAR-90/02); Railroad Accident Report--Atchison,Topeka and Santa Fe Railway Company (ATSF) FreightTrains ATSF 818 and ATSF 891 on the ATSF Railway,Corona, California, November 8, 1990 (NTSB/RAR-91/03); and Highway Accident Report--Collision of Amtrak

trains in Corona, California, on November 7,1990, the Safety Board found that railroads havethe responsibility to notify pipeline operatorsabout derailments and wreckage clearingoperations that occur near pipelines that mayimpact the safe operation of such pipelines. Afterits investigation of the Corona accident, theSafety Board asked in Safety RecommendationR-91-44 that the ATSF, in cooperation with theCalifornia Public Utilities Commission and theCalifornia Office of the State Fire Marshal,develop a complete list of 24-hour emergencytelephone numbers for those pipeline operatorswhose transmission lines are near the ATSFproperty. In its November 11, 1993, response tothe recommendation, the ATSF stated that it hadparticipated in the information gathering effortsof the CPUC concerning pipelines along ATSFrights-of-way and that ATSF distributed a listingof pipeline operator emergency telephonenumbers provided by the State fire marshal officeto appropriate personnel in the SOC. On the basisof this response, Safety Recommendation R-91-44 was classified “Closed--Acceptable Action”on February 14, 1994.

After the February 1, 1996, derailment near CajonJunction, the ATSF indicated that as a correctivemeasure, pipeline operators had been added as a lineitem on its emergency notification check list foraccidents occurring in California. This measure shouldhave been a logical step for the ATSF to have takenwhen implementing Safety Recommendation R-91-44rather than as a corrective action for the currentderailment. The Safety Board, consequently, concludesthat the ATSF management failed to ensure thateffective procedures to notify pipeline operators wereimplemented and that its employees complied withthem. Therefore, the Safety Board believes that theBNSF should develop and maintain a listof 24-hour emergency telephone numbers for all

Train No. 88 with Rountree Transport and Rigging, Inc.,Vehicle on CSX Transportation, Inc., Railroad NearIntercession City, Florida, November 30, 1993(NTSB/HAR-95/01).

61

pipeline operators that have transmissionpipelines on or adjoining any BNSF property anddistribute the list with written instructions fornotifying pipeline operators to all employees whoare responsible for completing emergencynotifications.

Operator Response-- After the Calnevengineer had verified that company pipelineswere near the derailment, Calnev initiated ashutdown and isolation of the affected pipelineseven before determining whether the pipelineswere damaged. These actions were the properprecautions to avoid a potential pipeline release.The Calnev manager of engineering wasdispatched immediately and arrived at theincident command post within minutes of the IC,which resulted in early coordination andcommunication between Calnev and the IC. TheIC was aware of the Calnev pipelines and, had theengineering manager not arrived so promptly,would have directed that Calnev be notified. Theestablishment of a Calnev command post at theIC post on February 1 ensured that thecommunication and coordination continuedthroughout the duration of the emergency. Thetrain wreckage was more than 200 feet from thepipeline right-of-way, and the pipelines wereundamaged. Calnev, however, monitored thewreckage clearing operations to ensure that noheavy equipment would inadvertently work overor cross the pipelines. Calnev also respondedpromptly when the IC requested a pipelineshutdown because of the venting tank car onFebruary 4. Therefore, the Safety Boardconcludes that the Calnev response to thederailment was appropriate and timely and thecoordination between Calnev and the IC waseffective.

Environmental ImpactThe number of State and Federal agencies

monitoring the site and environmental safetyefforts necessitated the formation of anenvironmental response group to fulfill all

functions. Air monitoring and water and soilsampling were initiated and conducted in asufficiently timely and efficient manner. Theresults of the air monitoring immediatelyfollowing the derailment indicate low levels ofvolatile organic compounds and no detectablelevels of phosphorus compounds generated fromthe combustion and release of the trimethylphosphite at the accident site. Subsequent airmonitoring results through March 1 yieldedaverage concentrations of volatile organiccompounds that exceeded a 5 ppm threshold onlyin the immediate area of the derailment on 3 daysduring the monitoring period. The results of thewater sampling indicated no impact ongroundwater or supply wells in the area. Allcontaminated soil was removed, and the area wasrestored. Therefore, the Safety Board concludesthat the release and combustion of hazardousmaterials created no prolonged environmentalimpact.

62

CONCLUSIONS

1. Neither the weather, the track, nor the signalsystem either caused or contributed to thederailment. The train crewmembers were incompliance with the requirements specifiedin the Hours-of-Service Act and werequalified to perform their duties; noevidence of fatigue was found. Neither drugnor alcohol use was a factor in thederailment.

2. Had the conductor and the brakemanremained in the control compartment cab ofthe locomotive, they likely would havesurvived because the cab survival space wasadequate.

3. The local emergency response was timelyand adequate, given the remote location ofthe derailment, and the incident commanderacted effectively and managed the incidentsuccessfully to completion without seriousinjury to responders, local residents, orofficials at the scene.

4. A wide deviation of end-of-car hosearrangements on cushioned underframe carsfrom the approved end-of-car hosearrangement design is not uncommon andmay induce an air hose to kink in operationand block or restrict a train line.

5. Had the Barstow car shop made hosearrangement reference manuals readilyavailable, the carmen could have usedguidelines to properly repair the train lineon ATSF 90033.

6. An unknown train line blockage orrestriction, probably between the fifth andninth cars, resulted in responsive brakesonly on the locomotive units and possiblythe first eight cars, and, thus, the engineerwas unable to slow or stop H-BALT1-31.

7. Had H-BALT1-31 been equipped with afully functioning two-way end-of-traindevice, the engineer could have applied thebrakes from the rear of train and thederailment may have been avoided.

8. The Federal Railroad Administration failureto require the capability to initiate anemergency brake application on either endof a train in mountainous territory after the1989 Helena, Montana, accident and itsfailure to take immediate action afterreceiving the Safety Board recommendationresulting from the 1994 Cajon Pass accidentmay have contributed to the cause of thisaccident in 1996.

9. The engineer of H-BALT1-31 was notaware of any requirement to report theinability to arm a two-way end-of-traindevice system and, consequently, did notreport the improper operation of the two-way end-of train device on train H-BALT1-31 to the train dispatcher and customerquality support, as required under rule 67(B).

10. The Atchison, Topeka and Santa Fe RailwayCompany management failed to ensure theuse of fully functioning two-way end-of-train devices on westbound trains overCajon Pass.

11. The Atchison, Topeka and Santa Fe RailwayCompany management failed to ensure thatoperating crewmembers receivedcomprehensive training on the properprocedures required for arming two-wayend-of-train device operation; although,investigators did not find that lack oftraining contributed to this accident.

63

12. The failure of the transmitter module of thehead-end device on locomotive ATSF 157to generate sufficient wattage power wouldnot allow the engineer of H-BALT1-31 toarm the two-way head-end/end-of-traindevice system.

13. The wheel data were not recorded due to abroken wire in the axle generator as a resultof an improper modification to the axlegenerator.

14. The Federal Railroad Administrationregulations for the periodic inspection ofevent recorders are inadequate.

15. Had the entire event recorder system fromlocomotive ATSF 342 been properly testedduring the December 1995 quarterlyinspection, both the broken speed sensorand the improper configuration of the eventrecorder would likely have been noticed andcorrected at that time.

16. The Federal Railroad Administration wasnot monitoring the compliance of the carrierwith periodic inspections of event recordersas prescribed under 49 Code of FederalRegulations 229.25(e)(5).

17. The Federal Railroad Administration formF6180-49A is not adequate for recording theinspection of event recorders and allowsoversights to be perpetrated duringinspection procedures.

18. The requirement to monitor and record dataas though it were in the lead locomotivecannot currently be met by the placement ofan event recorder elsewhere than in the leadlocomotive.

19. The superior strength of the U.S. Departmentof Transportation class 105J tank car as aresult of its thicker tank shell and heads, andthe head shield protection accounted for thedifference in the comparative damagesbetween the U.S. Department ofTransportation class 111A tank cars and theU.S. Department of Transportation class 105Jtank car.

20. The Atchison, Topeka and Santa Fe RailwayCompany officials and emergency respondersfailed to effectively utilize the technicalresources that could have facilitated theidentification and condition of the butylacrylate tank car and the other derailed tankcars in the train.

21. The potential danger to emergency responsepersonnel under accident conditions mayoutweigh the benefit of an engraved plate toidentify the mark and number of a tank car.

22. Both the Atchison, Topeka and Santa FeRailway Company superintendent of fieldoperations and chief environmental officerexercised poor judgment in their assessmentand handling of the butyl acrylate tank car.

23. The Atchison, Topeka and Santa Fe RailwayCompany management failed to ensure thateffective procedures to notify pipelineoperators were implemented and that itsemployees complied with them.

24. The Calnev Pipe Line Company response tothe derailment was appropriate and timelyand the coordination between the CalnevPipe Line Company and the incidentcommander was effective.

25. The release and combustion of hazardousmaterials created no prolonged environmentalimpact.

64

PROBABLE CAUSE

The National Transportation Safety Boarddetermines that the probable cause of thederailment of freight train H-BALT1-31 was anundetermined restriction or blockage thatprevented the traincrew from achieving andmaintaining adequate train braking force andalso the lack of adequate Federal Railroad

Administration and industry, specifically theAtchison Topeka and Santa Fe RailwayCompany, regulations, policies, procedures, andstandards to consistently utilize two-way end-of-train devices as a redundant braking system toprotect trains from catastrophic brake systemfailure.

RECOMMENDATIONS

As a result of its investigation, theNational Transportation Safety Board makesthe following recommendations:

--to the Burlington Northern and SantaFe Railway Company:

Inspect the end-of-car hosearrangements on your cushionedunderframe cars and ensure the hosearrangements match the intendeddesign. (R-96-67)

Provide your carmen with readilyavailable means to identify the properdesign or specific type of end-of-carhose arrangement on cushionedunderframe cars to preclude apossible improper repair ormodification. (R-96-68)

Develop and maintain a current list of24-hour emergency telephone numbersfor all pipeline operators that havetransmission pipelines on or adjoiningany Burlington Northern and Santa FeRailway Company property andperiodically update, at least annually,and distribute the list with writteninstructions for notifying pipelineoperators to all employees who areresponsible for completing emergencynotifications. (R-96-69)

65

--to the Federal Railroad Administration:

Revise 49 Code of FederalRegulations 229.25(e)(2) to requirethat event recorders, includingmicroprocessor-based event recordersthat are equipped with a self-testfunction, be tested during thequarterly inspections of thelocomotive in such a manner that theentire event recording system,including sensors, transducers, andwiring, is evaluated. Such testingshould include, at a minimum, areview of the data recorded duringactual operation of the locomotive toverify parameter functionality as wellas cycling all required recordingparameters and determining the fullrange of each parameter by readingout recorded data. (R-96-70)

Develop and implement a programthat specifically addresses carriercompliance with 49 Code of FederalRegulations 229.25(e)(5). (R-96-71)

Revise your form F6180-49A toinclude event recorders in the otheritems to be inspected section on theform. (R-96-72)

Inform the industry that theplacement of event recorders otherthan in the lead locomotive will notrecord the required data as though theevent recorders were in the leadlocomotive and ensure compliancewith 49 Code of Federal Regulations229.135(a). (R-96-73)

--to the Association of American Railroads:

Inform your member carriers aboutthe circumstances of this accident andalert them to inspect the end-of-carhose arrangements on cushionedunderframe cars and ensure the hosearrangements match the intendeddesign. (R-96-74)

Ensure that your member carriersprovide carmen with readily availablemeans to identify the proper design orspecific type of end-of-car hosearrangement on cushionedunderframe cars to preclude apossible improper repair ormodification. (R-96-75)

Develop, in cooperation with theChemical Manufacturers Associationand the International Association ofFire Chiefs, and distribute to yourcarrier members informationreemphasizing the technical data andassistance that can be providedthrough the Chemical ManufacturersAssociation Chemical TransportationEmergency Center, the Association ofAmerican Railroads Bureau ofExplosives, and the chemical shipperswhen tank cars transporting hazardousmaterials are involved in a trainderailment. (R-96-76)

Investigate and evaluate means toimprove the ability of emergencyresponse personnel to identify tankcars involved in accidents. (R-96-77)

Develop written guidelines forassessing the individual and combinedeffects of mechanical or fire and heatdamage or both to tank cars involvedin a derailment and for the handlingand movement of such tank cars. (R-96-78)

66

--to the International Association of Fire Chiefs:

Develop, in cooperation with theAssociation of American Railroadsand the Chemical ManufacturersAssociation, and distribute to yourmembers information reemphasizingthe technical data and assistance thatcan be provided through the ChemicalManufacturers Association ChemicalTransportation Emergency Center, theAssociation of American RailroadsBureau of Explosives, and thechemical shippers when tank carstransporting hazardous materials areinvolved in a train derailment. (R-96-79)

--to the Chemical Manufacturers Association:

Develop, in cooperation with theAssociation of American Railroadsand the International Association ofFire Chiefs, and distribute to yourmembers information reemphasizingthe technical data and assistance thatcan be provided through the ChemicalManufacturers Association ChemicalTransportation Emergency Center, theAssociation of American RailroadsBureau of Explosives, and thechemical shippers when tank carstransporting hazardous materials areinvolved in a train derailment. (R-96-80)

BY THE NATIONAL TRANSPORTATION SAFETY BOARD

JAMES E. HALLChairman

ROBERT T. FRANCIS IIVice Chairman

JOHN A. HAMMERSCHMIDTMember

JOHN J. GOGLIAMember

GEORGE W. BLACK, JRMember

December 11, 1996

67

APPENDIXES

APPENDIX A

INVESTIGATION AND HEARING

The National Transportation Safety Board was notified at 10 a.m., eastern standard time, on February1, 1996, that an Atchison, Topeka and Santa Fe Railway (ATSF) freight train derailed in Cajon Pass,California. The investigator-in-charge and other members of the Safety Board investigative team weredispatched from the Washington, DC, headquarters and the Atlanta, Georgia, and Chicago, Illinois,regional offices. The investigative groups studied operations, track and signals, mechanical, survivalfactors, human performance, and hazardous materials.

The Federal Railroad Administration, ATSF, California Public Utilities Commission, Brotherhood ofLocomotive Engineers, Brotherhood of Carmen, and the United Transportation Union assisted in theSafety Board investigation.

The Safety Board staff conducted a deposition proceeding as part of its investigation on April 23,1996, in San Bernardino, California, at which eight witnesses testified.

69

APPENDIX B

QUALIFICATIONS OF HAZARDOUS MATERIALS RESPONSE PERSONNEL

The incident commander (IC) had 29 years experience as a firefighter and as a training officer. Heattended a 6-week hazardous materials course at the National Fire Academy in 1981. He estimated that 40hours may have been dedicated to railroad tank cars. Although he has since taken refresher training inhazardous materials, he has not received any specific training about railroad tank cars. The IC alsocompleted the following hazardous materials courses through the California Specialized Training Instituteunder the sponsorship of the California Office of Emergency Services: First Responder Operational inSeptember 1991, IC/On-scene Manager in June 1992, and instructor certifications for first responders andICs/on-scene managers in July 1992. Before this accident, the IC had been involved in one minorderailment.

The California Department of Forestry and Fire Protection incident safety officer had numerous courseson hazardous materials since 1981, including 80 hours of chemistry training dating back to 1985. Since1991, he has been teaching classes on hazardous materials operations and scene management for theCalifornia Specialized Training Institute. During the past 10 years, he has received training at the GeneralAmerican Transportation rail car repair facility in Colton, California. He had responded to approximatelynine rail car incidents in the last 12 years.

The Atchison, Topeka and Santa Fe Railway Company (ATSF) superintendent of field operations had 23years experience and had been involved with between 20 and 25 derailments that included hazardousmaterials. The superintendent stated that he was in the original group of employees that became hazardousmaterials responders for the ATSF. He attended a 1-week course in hazardous materials at Texas A&MUniversity in 1984 and has attended the tank car safety course at the Association of American Railroad(AAR) transportation test center in Pueblo, Colorado, annually since 1987 to maintain his certification as ahazardous materials technician. The superintendent also cited his experience working with companies thatspecialize in wreckage clearing at derailments. The superintendent was familiar with the guidelines forassessing tank car damage that are covered in the AAR tank car safety course. (These guidelines covermechanical damage, such as gouges, dents, scores, and wheel burns, but do not address fire and heatdamage.)

The ATSF chief environmental officer had degrees in civil engineering with a primary emphasis onstructural engineering and a secondary emphasis on environmental engineering and had been in theenvironmental department of the ATSF since 1982. He also attended the Texas A&M course in 1984 or1985, the AAR tank car safety course in 1986 or 1987, other courses at the AAR center, and participated inat least one symposium in the late 1980s on damage to tank cars. He had participated in four or five otherderailments involving tank cars. He too was aware of the AAR guidance for assessing tank car damage.

71

APPENDIX C

TRAIN CONSIST

According to the automatic equipment identification (AEI) reader 586 at Lenwood. California,(milepost 6.7), train H-BALT1-31 passed the AEI reader at 1:37 a.m. on February 1, 1996 at 38 mph withthe following ordered consist.

Locomotives Unit Model Manufacturer Remarks

1 ATSF 157 GP60M EMD2 ATSF 3853 GP50 EMD3 ATSF 342 GP60B EMD Cabless Unit Event Recorder4 ATSF 4031 GP60 EMD

Cars Number Type Commodity Remarks

1 WC 28076 A63 box car fiber board 2 WC 28125 A63 box car fiber board 3 ACFX 84855 T5F tank car calcium chloride 4 ACFX 84070 T5F tank car calcium chloride 5 SFLC 10005 LB4 box car corn meal cushioned underframe 6 DOWX 3965 T5G tank car glycol 7 TQEX 58464 C5P covered

hopper plastic pellets 8 CNW 128078 GSC gondola steel shapes 9 ACFX 66459 C5P covered

hopper plastic pellets10 BN 249296 A23 box car fiber board11 ATSF 45841 AB6 box car fiber board cushioned underframe12 ATSF 45920 AB6 box car fiber board cushioned underframe13 ATSF 46034 AB6 box car fiber board cushioned underframe14 WC 28047 A63 box car fiber board15 ALAX 61489 C5P covered

hopper plastic pellets16 ATSF 90033 FP7 flat car steel pipe cushioned underframe

72

APPENDIX C

17 ABOX 52396 B24 box car lumber18 ITTX 912296 FM7 flat car pipe19 ATSF 45712 AB6 box car fiber board20 ATSF 46151 AB6 box car fiber board21 ATSF 45990 AB6 box car fiber board22 CR 297851 D7C box car auto parts23 CR 627150 FS flat car iron24 CR 627333 FS flat car iron25 IHB 1209 FS flat car iron26 ECDX 792140 T5F tank car lube oil27 UTLX 79897 T3D tank car lube oil28 WC 20252 A65 box car printing paper29 ATSF 92018 FS flat car iron30 ATSF 73758 GSC gondola iron31 ACFX 79907 T5I tank car petroleum distillates hazmat32 SOU 17010 D6N box car textiles33 NATX 82129 T5H tank car butyl acrylate hazmat34 GATX 13571 T5G tank car ind chemical35 ATSF 622893 LC5 box car veneer36 ATSF 622600 LC5 box car salt37 CSXT 496026 FS flat car iron38 MWSX 29654 T6I tank car denatured alcohol hazmat39 GATX 37310 T4F tank car flammable liquid hazmat40 UTLX 41424 T5F tank car empty41 UTLX 41411 T5F tank car empty42 ATSF 611088 B75 box car flour43 SP 247682 A64 box car lumber44 SOU 525865 A23 box car tires45 NOKL 4574 D5N box car lumber46 CELX 2374 T6I tank car methyl ethyl ketone hazmat47 NAHX 550724 C6 covered

hopper empty48 ACFX 99289 C6 covered

hopper plastic pellets49 GATX 18211 T4F tank car empty

75

APPENDIX E

RULES AND REGULATIONS FOR END-OF-TRAIN DEVICE

232.19 End of Train Device

(a) An end-of-train device shall be comprised of a rear-of-train unit (rear unit) located on the last car ofa train and a front-of-train (front unit) unit located in the cab of the locomotive controlling the train.

(b) Rear unit. The rear unit shall be capable of determining the rear car brake pipe pressure andtransmitting that information to the front unit for display to the locomotive engineer.The rear unit shall be—(1) Capable of measuring the rear car brake pipe pressure with an accuracy of +/- 3 psig and brake

pipe pressure variations of +/- 1 psig;(2) Equipped with a “bleeder valve” that permits the release of any air under pressure from the rear

of train unit or the associated air hoses prior to detaching the rear unit from the brake pipe;(3) Designed so that an internal failure will not cause an undesired emergency brake application;(4) Equipped with either an air gauge or a means of visually displaying the rear unit’s brake pipe

pressure measurement; and(5) Equipped with a pressure relief safety valve to prevent explosion from a high pressure air leak

inside the rear unit.(c) Reporting rate. Multiple data transmissions from the rear unit shall occur immediately after a

variation in the rear car brake pipe pressure of +/- 2 psig and at intervals of not greater than 70seconds when the rear car brake pipe pressure variation over the 70-second interval is less that +/- 2psig.

(d) Operating environment- The rear unit shall be designed to meet the performance requirements ofparagraphs (b) and (C) of this section under the following environmental conditions:(1) At temperatures from -40o C to 60 o C;(2) At a relative humidity of 95% noncondensing at 50 o C;(3) At altitudes of zero to 12,000 feet mean sea level;(4) During vertical and lateral vibrations of 1 to 15 Hz., with 0.5 g peak to peak, an 15 to 500 Hz.,

with 5g. peak to peak;(5) During the longitudinal vibrations of 1 to 15 Hz., with 3g. peak to peak and 15 to 500 Hz., with

5g. peak to peak; and(6) During a shock of 10g. peak for 0.1 seconds in any axis.

76

APPENDIX E (e) Unique code. Each rear unit will have a unique and permanent identification code that is transmitted

along with the pressure message to the front-of-train unit. A code obtained from the Association ofAmerican Railroads, 50 F Street, NW., Washington, DC 20036 shall be deemed to be a unique codefor purposed of this section. A unique code also may be obtained from the Office of SafetyEnforcement (RRS-10), Federal Railroad Administration, Washington, DC 20590.

(f) Front unit. (1) The front unit shall be designed to receive data messages from the rear unit and shallbe capable of displaying the rear car brake pipe pressure in not more that one-pound increments.(2) The display shall be clearly visible and legible in daylight and darkness from the engineer’s

normal operating position.(3) The front device shall have a means for entry of the unique identification code of the rear unit

being used. The front unit shall be designed so that it will display a message only from the rearunit with the same code as entered into the front unit.

(4) The front unit shall be designed to meet the requirements of 232.19(d) (2), (3), (4), and (5). Itshall also be designed to meet the performance requirements in this paragraph.(i) At temperatures from 0o C to 60o C;(ii) During a vertical or lateral shock of 2g. peak for 0.1 second; and(iii) During a longitudinal shock of 5g. peak for 0.1 second.

(g) Radio equipment. (1) The radio transmitter in the rear unit and the radio receiver in the front unitshall comply with the applicable regulatory requirements of the FCC and use of a transmissionformat acceptable to the FCC.(2) If power is supplied by one or more batteries, the operating life shall be a minimum of 36 hours

at 0o C.(H) Inspection. (1) Upon installation of the end-of-train device, it shall be determined that the

identification code entered into the front unit is identical to the unique identification code on therear-of-train unit.(2) The functional capability of the device shall be determined at the point of installation, after

charging the train, by comparing the quantitative value displayed on the rear unit or on an airgauge. The end device may not be used if the difference between the two readings exceeds threepounds.

(3) The rear unit shall be calibrated for accuracy at least every 92 days. A tag, sticker, or othermethod of information storage that provides that date of the last calibration was made, and thename of the person doing the calibration shall be affixed to the rear unit.

[51 FR 17303, May 9, 1986]

79

APPENDIX F

TRAIN DYNAMIC ANALYSIS SIMULATION PROTOCOL

Train conditions: 2 pounds leakage, braking ratio 26 percent, 90 pounds brake pipe

Time Action

0:00 independent reduced to release(automatic brakes already released)

0:05 throttle 1 1:03 throttle 2 3:16 throttle 1 3:29 throttle off 4:34 dynamic brake applied 5:00 full dynamic 7:04 minimum reduction (6 pounds) bail off independent 7:11 2 pounds additional reduction 8:07 another 2 pounds additional reduction 9:33 1 pound additional reduction (75 pounds brake pipe) 9:41 another 2 pounds additional reduction (73 pounds brake pipe)10:03 another 2 pounds additional reduction (71 pounds brake pipe)10:28 full service (64 pounds brake pipe)10:38 emergency (no bail)10:43 knock off dynamic