“Luck is not an acceptable substitute for early detection.” — Valerie Harper
Three weeks after the Norfolk Southern (NS) derailment in East Palestine, Ohio, the well-meaning editorial board at the Washington Post published an editorial on “how to fix freight rail.” They consulted with a variety of transportation experts to come up with four recommendations:
- Catch bearing problems early
- Better tank car design
- Better brakes
- High-hazard flammable train definition
Interestingly, the recommendations are similar to the concerns that confront process safety engineers, but it doesn’t appear that the editors at the Washington consulted any process safety professionals. A couple of the recommendations make sense from a process safety perspective. A couple don’t.
What could we have told them?
High-Hazard Train Definition from a Process Safety Perspective
Changing the definition of a high-hazard flammable train will not reduce the likelihood of a derailment. Ohio Governor DeWine complained that NS didn’t and wasn’t required to “notify anyone here in Ohio about what was in the rail cars coming to our state.” What would have been different? The train would have still rolled through and would have still derailed.
What could Ohio have done if they had been notified? They could have alerted the first responders in every city, town, and village along the route that a hazardous train was coming. There are so many trains that include tank cars containing hazardous chemicals, however, that the high frequency of the alerts—alarm flooding, as we call it in the process industries—would desensitize the emergency responders to the alerts.
Changing the definition of a high hazard train may be an expedient way to appease anxious politicians, but there shouldn’t be any illusions about how much it will reduce derailments.
Better Tank Car Design from a Process Safety Perspective
Who can be against better design? Some experts describe better tank car design in terms of thicker walls that can hold greater pressure. Supporting that notion is the report of National Transportation Safety Board (NTSB) investigators focusing on the relief valves on the tank cars.
An examination of photographs of the derailment shows a pile-up of intact rail cars. Although engulfed in an external fire, the cars did not rupture. Did they release hazardous vapors? Sure. That’s what relief valves do. When an external fire heats the contents of a rail car, the vapor pressure goes up. When it exceeds the set point pressure of the relief valve, the relief valve opens and, well, relieves. If the relief valve fails or is undersized, the pressure inside the tank car during an external fire will increase to the point that it causes catastrophic rupture.
There is no evidence of that happening at East Palestine.
Better tank car design is welcome, but there needs to be a fundamental understanding of what it means to be “better”. Increasing the design pressure of rail cars as a general requirement is not a move in the right direction.
Catching Wheel Bearing Problems Early from a Process Safety Perspective
The NTSB’s preliminary report states that NS had equipped the track on which the train was running with hot bearing detectors (HBDs). An HBD relies on temperature and can transmit information to the crew. The last HBD that saw the train signaled that an axle on the 23rd car was 253°F above ambient. The 23rd car was not one of the cars loaded with hazardous chemicals. This exceeded NS’s critical safety limit of 200°F above ambient, at which point the crew is required to set out the railcar. This prompted the train’s crew to initiate an emergency stop, which in turn led to the derailment.
The axle bearing on the 23rd car didn’t go from a few degrees above ambient to 253°F above ambient in an instant. The previous HBD signaled that it was 103°F above ambient (not enough to exceed the critical safety condition) and the HBD before that signaled that the axle bearing was 38°F above ambient. This all occurred within the last 40 miles of a 600-mile trip from Madison, Illinois.
From a process safety perspective, the rapid temperature rate-of-rise indicated a problem before the axle temperature exceeded the critical safety condition. However, NS’s “trip” conditions don’t consider trends.
Some argue that railroads should install more HBDs, so exceedances of trip conditions can be detected earlier. Some go so far as to suggest that HBDs be installed on every axle, so exceedances can be detected the instant they occur. Both arguments hinge on the false premise that unsafe conditions exist in the moment, with no context that trends can provide.
Better Brakes from a Process Safety Perspective
There is a principle of process safety that the response time of a safeguard must be less than half the process safety time. The process safety time is the time from the onset of the hazardous sequence of events to the culminating hazardous event. The response time is
- the time it takes to detect the problem,
- the time it takes to decide what action to take,
- the time to take that action, and
- the time for the action to take effect.
Obviously, if the total response time is more than the process safety time, the safeguard cannot prevent the culminating hazardous event.
Changing the arrangement and set points of HBDs should decrease the time it takes to detect a problem. Including a rate-of-rise trip will help even more.
Better procedures and local autonomy should decrease the time it takes to decide what action to take, as should better training and frequent refresher training. Human decisions still take time, however. Sometimes minutes, sometimes longer. Automation reduces that decision time to milliseconds.
The time to take action depends on the process, or in this case, how the train is equipped. When a manual response is required, it might take seconds, it might take minutes. Again, automation may reduce the time to milliseconds.
Reducing the time for the action to take effect is where improved braking systems play a role. The pneumatic brakes that have been in use since George Westinghouse patented them in 1869 send a pneumatic brake signal backward through the train, stopping the car in front first, and in quick sequence, those behind. A quick sequence, however, is still a delay, albeit a short delay. On short trains, the delay is hardly noticeable. When the train is over a hundred cars long, however, those delays add up. The cars pile up; there’s a derailment. Electronic braking systems, on the other hand, send their signal at the speed of electricity, The signal arrives at each car simultaneously, meaning that each car stops simultaneously. No pile up, no derailment. From a process safety perspective, electronic braking systems, which Mitsubishi Electric introduced in 1968, reduce the total response time by reducing the time for action time to take effect.
Process Safety has a Role to Play
Most investigations, criminal and civil, exist to assign blame, to determine who is the villain and who is the victim. By their very nature, these investigations and the judicial system they serve are exclusively backward looking. The purpose of safety investigations, on the other hand, is to understand what happened in order to develop recommendations for reducing the likelihood of recurrence. Assigning responsibility becomes a matter, not determining who is responsible for the incident, but a matter of determining who is responsible for preventing a recurrence.
When NTSB makes recommendations as the result of its investigation of the East Palestine derailment, those recommendations should reduce the likelihood of derailments of tank cars carrying hazardous chemicals. Their recommendations will need to extend beyond tank cars loaded with hazardous chemicals, however; the 23rd car with the bad bearing wasn’t hauling hazardous chemicals.
Many different disciplines contribute to an understanding of safety and on how to improve it. The transport of hazardous chemicals is an activity that calls for contributions from process safety professionals. Let’s step forward and hope the appropriate agencies will accept our help.
