Why New Improved Oil Trains Are Not Nearly Good Enough

Last February to much fanfare, the oil company Tesoro—a firm with big plans for oil trains in the Northwest—announced that it would voluntarily replace older tank cars with newer models.  In the technical parlance of the rail industry, the firm meant that they would upgrade or replace the legacy DOT-111 tank cars to be compliant with the CPC-1232 standard.

The idea sounded promising at first blush, but a closer inspection reveals that Tesoro’s move was more about posturing than public safety. The upgraded standards the company is trumpeting are far from safe enough—a reality that was shortly made clear by a massive oil train fire in downtown Lynchburg, Virginia involving these same tank cars just two months after Tesoro’s announcement. As the flaming oil wreckage in the James River demonstrated, Tesoro’s proposal was little more than a cheapskate’s way of continuing business as usual despite powerful evidence that much more is needed.

To see why the standard favored by Tesoro isn’t good enough, here’s a look at the details.

CPC-1232s

Let’s start with the basics. What is a “CPC-1232” tank car, and why is Tesoro promoting them?

Short for Casualty Prevention Circular, CPC is a design standard for rail cars issued by the American Association of Railroads, an industry association. It does not have the force of law. It is, rather, a voluntary agreement among major industry players to use a set of construction specifications for DOT-111 tank cars (historically the most common tank car in North American service) ordered after October 2011 for use in transporting flammable liquids like ethanol and crude oil.

The CPC standards are not a “best science” approach to safety design. Instead, they are the result of weighing of costs and benefits among competing interests: namely, the railroads, shippers, and lessors of the tank cars. For example, the steel shells on legacy DOT-111 tank cars—a key design element that directly affects the likelihood of ruptures, spills, and fires—are 7/16 of an inch thick. A CPC-1232 compliant rail car increases that to 1/2 inch. As the Columbian newspaper and other outlets have reported, the National Transportation Safety Board (NTSB) finds that the CPC-1232 standard is only a minimal improvement over legacy tank DOT-111s. In fact, NTSB officials say they are “not convinced that these modifications offer significant safety improvements.” (We’ll see why in a moment.)

What’s more, the 1/2 inch CPC shell is thinner than the standards proposed by Transport Canada and the US Department of Transportation. Both governments seem to favor increasing shell thickness to 9/16 inch. Yet the oil-by-rail industry strongly objects to 9/16 inch shells on the grounds that thicker shells and other protection systems add weight to a tank car, which reduces shipping capacity and thereby increases shipping costs.

The design standards sound technical, but they have real-world implications. After an oil train derailed under Seattle’s Magnolia Bridge in July 2014, we got a good look at the tank cars that Tesoro boasts about.

Tesoro tank cars derailed at Magnolia, Seattle. By Dana Robinson Slote (used with photographer’s permission, cropped.)

Tesoro tank cars derailed at Magnolia, Seattle. By Dana Robinson Slote (used with permission, cropped.)

These derailed CPC-1232s exemplify Tesoro’s commitment to safe handling of volatile Bakken crude oil.

Let’s take a closer look at the elements visible in these photographs.

Head shields

The first thing to notice in those tank cars that were bound for the Tesoro Refinery at Anacortes are the “head shields.” These shields are designed to protect the tank car ends (the heads) from being pierced during a derailment by the train’s couplers or other objects. The CPC-1232 standard requires only half-height head shields—shields that protect only the lower half of the tank car end—which is precisely what we see here.

CPC-1232s are available with full height head shields, but Tesoro has opted to forgo this level of protection for its tank cars.

These tank cars may someday run afoul of federal law. Every regulatory scenario proposed by the US government for oil trains of the future will require full-height head shields. And for good reason. In a train derailment, not every object encountered by a tank car sliding along on its side will conveniently strike only the bottom half of the head.

Lac-Mégantic tank car by NTSB (Public domain photo.)

Thermal protection

All tank cars are marked with stenciled specs on their sides. So if we can read the markings, we can consult the American Association of Railroad’s handy Field Guide to Tank Cars to decode the other safety features of Tesoro’s derailed tank cars.

In the photos from the Magnolia derailment, we can see the characters “DOT 111A100W1.” Here’s the translation:

• DOT – The US Dept of Transportation, the authorizing agency;
• 111 – Class designation, meaning that this is a DOT-111 tank car;
• A – Delimiter: An “A” has no significance;
• 100 – Tank test pressure;
• W – Fusion welding;
• 1 – Tank material: carbon steel.

The smoking gun here is the “A” in the midst of all those characters.

It signifies an unsafe tank car. On 111 class tank cars, a “J” would indicate the tank car is equipped with a thermal protection system; so having an “A,” a delimiter with no significance, means there is no thermal protection.

The CPC-1232 standard provides two options for crude oil tank cars: thermally protected with a layer of insulation around the tank car (which is covered by an outer steel jacket) or unjacketed without insulation. Thermal protection matters when a train derails and a tank car ends up lying in a pool of burning crude oil that escaped from a breached tank car. (Yes, this really happens.) At some point, a tank car lying in what first responders call a “pool fire” will heat up enough that its steel shell will experience a “thermal tear” or else fire will burn through the tank shell. When failures like these happen, they release more oil, create a bigger pool fire, involve more tank cars, and so on.

Every one of the 63 derailed tank cars in the deadly Lac-Mégantic oil train explosion lacked thermal protection, according to the Transportation Safety Board of Canada. And Tesoro’s tank cars? As clearly seen by the delimiter “A” in the stenciled specification on the cars derailed at Magnolia, they too have no jacketed thermal protection.

The consequences are potentially devastating.

Lac-Mégantic Tank Car with Thermal Tear by TSBCanada (Used with permission.)

Lac-Megantic Tank Car Burn-Through by TSBCanada (Used with permission.)

Thermal insulation dramatically improves tank car survival time, a reality that even the industry acknowledges. In fact, in a document submitted to the Washington state agency charged with permitting the Tesoro-Savage oil terminal at Vancouver, the American Association of Railroads displays the results of its own modeling of the survival time of different classes of tank cars in a pool fire.

The industry’s data show that Tesoro’s unjacketed, uninsulated “safer” tank cars will survive only nine minutes longer in a diesel pool fire than the legacy DOT-111s that burned up in Lac-Mégantic. By contrast, a jacketed and insulated tank car—-that is, unlike the ones Tesoro is using—would give firefighters over 1,000 more minutes—many hours— to bring an oil pool fire under control before it fails.

How important is that?

According to Kenny Stuart, Union President and Lieutenant in the Seattle Fire Department,  “Having that extra time to get foam on a fire and keeping it from spreading and involving more tank cars could prevent an enormous and deadly fire.”

Bottom outlet valves

CPC-1232 tank cars also have an Achilles Heel: bottom outlet valves “which have been prone to failure in derailment accidents,” according to federal safety investigators. During a derailment, when a tank car skids along the ground, the bottom outlet valves’ operating levers can be bent and pulled, causing the valve to open. Sometimes, the valve shears off altogether. US inspectors have found that the bottom outlet valve handle’s “breakaway” design used by the industry doesn’t work.

It’s not simply a theoretical point. In a 2009 Illinois derailment, for example, the bottom outlet valves in three of the tank cars opened and released most, if not all, of the ethanol within. The result was a catastrophic and deadly fire.

In 2012, the NTSB concluded that the existing standards and regulations for the protection of bottom outlet valves like the ones used to build Tesoro’s tank cars “are insufficient to ensure that the valves remain closed during accidents.”

It’s a risk the government and industry alike have recognized for many years. In fact, based on recommendations by the National Transportation Safety Board, members of the Chemical Manufacturers’ Association, voluntarily upgraded the tank cars used to haul hazardous chemicals (called DOT-105s and DOT-112s) in the early 1990s, eliminating these bottom outlet valves because of their inherent danger.

Tesoro has chosen not to use this safer design.

Tank car involved in Casselton, ND 2013 derailment and Bakken crude oil explosion. Example of bottom-fitting vulnerability. by NTSB (Public domain photo.)

In public, Tesoro says that rail car safety is of “paramount importance.” But the facts tell a different story: Tesoro is choosing the bare minimum standard—the least expensive CPC-1232 compliant tank car design—and in doing so, is putting the public at risk every day.