Two railroad accidents involving fire and explosions of Class A explosives were located for this study. Both involved transportation of general purpose bombs.

2.4.1. Benson, AZ 24 May 1973 Fire & Explosions

This accident involved a fire which originated on a carload of #000080 bombs during a train movement, and the eventual explosion of twelve carloads in a desert area near Benson, AZ. The accident information was reported in an NTSB report.

2.4.1.1. Initial fire events

In this case, the events constituting the beginning of the accident occurred over a year previous to the explosions at Benson.

Oxidizer residue from previous shipment soaks into floor of Car 38 in April '72[3-1.0]

Car 38 caught fire on June 10, 1972[2-1.2]

MKT Repaired and washed out car 38 [6-1.3]

This events set suggests that fire Car 38 was susceptible to fire, but this susceptibility was not detected before its last trip. It also suggests that spills of oxidizers in rail cars poses risks which have not been fully addressed in the regulations, specifically with respect to spills which have been partially absorbed by the materials such as the floor and side boards that line the car interiors. The oxidizer spill event is addressed by the regulations, but the proper investigation of the car fire is not addressed. The fire resulted in the car being given special care in a shop, yet its susceptibility to fire was not remedied in the shop before the car was offered for transportation of Class A explosives. The persistence of the oxidizer after the car was washed out suggests possible problems with either the cleaning methods used after the oxidizer spill, difficulty in determining the presence of the residue s or some other problem. It raises questions about the practicality of the regulatory approach with its "single point failure" potential if the clean up is not done promptly and adequately after a hazmat spill in a car.

Repaired and washed out car 38[6-1.3]

Shipper loaded car as furnished by MKT [7-1.6]

This even set suggests that the shipper of a Class A explosive should not be relied on to detect contamination of a car interior by a spill of soluble oxidizers in a prior load in a railroad owned car. It also supports the single point failure argument described above, which inevitably increases safety risks when present in an operation, and the risks would be present across the full spectrum of hazardous materials shipped in box cars.

Regulations specify specific car selection criteria to be applied to the shipment of Class A explosives in rail cars. However, the regulation is worded so the car selection decision and criteria may be ambiguous, particularly with respect to cleanliness of cars.

Engineer applied train brakes [1-2.6]

Brake shoes shower floor with hot metal fragments during brake application [5-2/8]

Fire begins in Car 38 at contaminated floor above wheel [4-3.0]

The current fire events began unnoticed while the train was being operated in a routine manner by an interline rail carrier.

In this case, the energy sources present included the rotating car wheels, the brake shoes and the shot metal which came off the brake shoes during braking of the train. Brake shoes capable of functioning without the release of hot sparks were available at the time this accident occurred, but they were not used on this car. The FRA amended its regulations to require "spark shields" which constitute a barrier between the energy source that ignited this fire, and the vulnerable exposure - the contaminated floor boards. If cars are so equipped this should provide an effective barrier to this kind of fire origin. However, it should be noted that a spark shield is a barrier to only one of the energy sources which have the potential for starting a car floor fire. Other should have been investigated, such as journal bearing fires, if this risk control action was intended to stop all similar fires.

The point must be made here that energy sources associated with the trucks of a rail car are numerous, and should all be considered events likely to occur over the life cycle of a long term industry transport activity when assessing these transportation safety risks.

2.4.1.2. Crew actions after accident began.

In this case the fire remained undetected by the train driver/engineer and crew until after the train had passed the point of the first explosion. When the second explosion occurred the conductor reportedly placed the train brakes in emergency, although the explosion might have produced the same effect. Unlike truck drivers, train engineers or conductors who are nominally in charge of the train, have few action choices when a fire starts, but they are likely to survive and be able to contribute to the control of the resulting accident emergency situation. Their task load was not reported in this case.

2.4.1.3. Crew fire fighting actions.

Not applicable.

2.4.1.4. Crew rescue efforts

Not applicable.

2.4.1.5. Police response

The report is unclear about how authorities learned of the accident, and their actions upon being notified.

2.4.1.6. Fire behavior after initiation.

The fire in this case burned about 25 minutes before the explosion sequences began. During this time period, the train observed frequently by a large number of persons.

Fire burns through car floor [4-4.1]

(Fire intensifies inside the car) [4-5.0]

Fire overheats bomb stowed in pallet over wheel [4-6.0]

This event set was indicated by the debris recovered after the accident, along the pathway the train had traveled just before subsequent explosions. The set suggests that the likelihood of detecting a fire once it has begun in a box car is low, and detection should not be given significant weight as a risk control measure. No regulations address detection of fires in cars in these circumstances. While undetected, the fires can grow to unmanageable size with results demonstrated in this accident.

2.4.1.7. Crew traffic control actions

Not applicable in this case, because of the accident location.

2.4.1.8. Firefighter actions.

Not relevant. The isolated site was secured and cleared by an Army explosives ordnance disposal team when it was safe to enter.

2.4.1.9. Crew-firefighter interactions.

Not relevant in this case.

2.4.1.10. Cargo behavior in fire

Nobody did anything to control or extinguish the fire in car 38, so it burned a sufficiently long time for one of the bombs to rupture.

Fire overheats bomb stowed in pallet over wheel [4-6.0]

First bomb ruptures [3-6.6]

Rupture spews hot debris, explosive along tracks at MP 1052.6 [3-7.4]

The duration of the fire before the first rupture was estimated to be about 25 minutes from the depth of the char on debris found along the tracks at MP 1052.6. This events set suggests that the fire was localized, affecting only one bomb which, when it ruptured, did not release enough energy to trigger sympathetic detonation of adjacent bombs in the pallet. The lesson seems to be that a very localized fire will produce relative modest effects. This offers potentially useful diagnostic guidance for assessing the risks during fires involving this kind of cargo.

First bomb ruptures [3-6.6]

(Car confines most of heat from fire inside cargo space) [ 2-6.8]

( Fire intensifies inside the car) [4-7.6]

Second explosion in car 38 scatters debris, expels hot bombs, debris from car 38 at MP 1048.4 [3-8.6]

This set suggests that the first rupture did not diminish the fire in the car. By opening a small hole in the car floor the first "explosion" probably provided more air for the fire, which would intensify the fire to the degree required to get a more violent explosion, and induce subsequent events.

These events also demonstrate that this type of fire does not always result in an initial en-masse explosion of a Class A bomb cargo, but rather that the loss events can start small and get worse over time. The time from the first event involving the bombs until the massive explosions was the time it took the car with the fire to go about 5 miles. At a train speed of around 30 mph, that would provide about 10 minutes between the first and second loss events to change the course of events. Whether any action is feasible at this stage of the accident process would require further analysis.

This set has implications beyond this case. Delays between initial bomb rupture events and the first extremely destructive en masse detonations were also noted in Cases 1 and 4. Their importance is that if a fire involving this particular cargo occurs in an area where severe damage of loss of life will occur if the load detonates, the 10 minute or so delay could be utilized to control the fire with relatively less risk than trying to evacuate or shelter the exposures before en masse detonation, or to move the vehicle to a location where smaller losses would occur. Overall, the eventual delay was 35 minutes from the onset of the fire until the en masse explosion. The set, when compared with similar sets in the other cases, shows the importance of analyzing the emergency response tasks to determine how the time might best be utilized in future accidents, and what workloads might be established for the persons available in such situations.

Second explosion in car 38 scatters debris, expels hot bombs, debris from car 38 at MP 1048.4 [3-8.6]

(fire intensifies in car) [4-10.2]

First of three large explosions occurred near MP 1047.6 as train braked [3-10.8]

The second explosion produced a lot of actions, including opening up a hole in the side of Car 38 through which several hot bombs and debris were expelled. The intensification of the fire is an assumed event, but logical because more fuel (tritonal) became available in the car, and because more air could get to the fire now. Had the explosion quenched the fire, the next event would have been less likely to occur.

The large explosions that followed suggest that many of the remaining bombs detonated en masse. The continued heating of the remaining bombs in car 38 would increase their sensitivity to sympathetic detonation within that car, which apparently occurred within about the next minute after the explosion at MP 1048.4.

First of three large explosions occurred near MP 1047.6 as train braked [3-10.8]

? designed train with 12 cars adjacent to each other in train [6-2.2]

1047.6 as train braked [3-10.8]

The events set reflects the decision to locate all 12 cars next to each other in the train, which was necessary for the explosions to propagate to the remaining 11 cars.

2.4.1.11. Post-explosion firefighter actions.

None reported.

2.4.1.12. Post-explosion cargo behavior.

In this case, six "explosions" occurred, so consideration of the post explosion behavior requires clarification of which explosion is being examined. Taking the explosions in order of occurrence, the first "explosion" was a pressure rupture, rather than an explosive detonation. The second explosion could have been a low order explosive detonation, since it did substantial damage (work) to car 38, and moved substantial weight of cargo. The third explosion was one of the expelled bombs, and the fourth, fifth and sixth explosions were en masse explosions of the twelve cars, in three bunches, at the main crater area.

Cargo behavior after the first explosion was described in section

Second explosion in car 38 scatters debris, expels hot bombs, debris from car at MP 1048.4 [3-8.6]

? [3-9.6]

Expelled bomb explodes at MP 1048.4 as car 98 passes [3-10.0]

This events set is of special interest because it demonstrates a phenomenon that may be involved in Class A explosive accidents involving bombs, and -- potentially -- other devices with similar attributes. The bomb that was expelled from the car was heated substantially while it was still in the car with the fire in it - car 38. Apparently it was exposed to sufficient heat that the chemical constituents began to decompose, accelerating later to detonation. This occurred after about 50 cars had passed the point where it was expelled from car 38, or about 45-60 seconds after being expelled, assuming the train was traveling around 30 mph at the time. The events set suggests a non-zero risk of explosions along or adjacent to the pathway of moving vehicles as a fire in a vehicle grows progressively more intense, and should be better understood in connection with the driver task analysis proposed.

The second explosion had other effects on the cargo behavior.

Second explosion in car 38 scatters debris, expels hot bombs, debris from car at MP 1048.4 [3-8.6]

(fire intensifies in car) [4-10.2]

First of three large explosions occurred near MP 1047.6 [3-10.8]

It resulted in an even larger explosion shortly after the second explosion. While the evidence is not complete, it is logical to presume that the first of the three large explosions occurred in the car that was experiencing the fire. This behavior is characteristic of two other explosions involving bombs (Cases 1 and 4) in fires during transportation. The report estimates 25 minutes elapsed from the time of the initial fire until the first explosion, and at a speed of 1/2 mile per minute (30 mph). This would add an additional 10 minutes or so to the potential response time to control the fire before potential control of the fire was no longer feasible, or 35 minutes.

2.4.1.13. Explosion consequences

The first explosion resulted in a small quantity of debris along the tracks, and intensified the fire. The second explosion resulted in more severe damage to the rail car, and an explosion along the right-of-way. The third explosion, of the bomb at MP 1048.4 did little damage because the area was isolated and the timing was such that no vulnerable cars in the train were passing that point at the time of the explosion. The fourth explosion was different.

The explosion produced sympathetic detonation additional bombs in car 38, and the Class A cargo of bombs in adjacent rail cars. The magnitude of this explosion escalated the severity of the accident via at least two additional sympathetic detonations affecting a large area. The report discusses ways to reduce this phenomenon, proposing separation of cars while a search is undertaken for optional ways to accomplish this control.

First of three large explosions occurred near MP 1047.6 as train braked [3-10.8]

Explosions propagated to adjacent cars near MP 1047 [3-12.0]

fire scorched desert for 1/4 mile in all directions [4-11.2]

The series of explosions produced other effects.

Explosions propagated to adjacent cars near MP 1047 [3-12.0]

Explosions destroyed 460 feet of track [3-13.4]

Explosions threw about 500 unexploded bombs, explosive up to 1 mile from cratered right of way [3-13.4]

About 2100 bombs detonated [3-13.4]

These events set provide validating information about the range of effects resulting from a major explosion of this kind of Class A explosive. That kind of information can be used to compare the quantity/distance estimates for Class A explosives on which regulations and recommended emergency response actions are based. Guides for Explosives A in use at that time indicated 1/2 mile, rather than the 5000+ ft radius demonstrated in this accident. These events sets indicate a review of the size-up or diagnostic practices should be a routine part of investigations of this kind of mishap for a shipment susceptible to multiple-car detonation.

2.4.1.14. Shipper response actions

The shipper provided an experienced explosive ordnance disposal team to clean up the unexploded ordnance and debris. The report does not specify how the shipper became involved in the incident.

Train crew radios railroad control point about accident [1-15.9]

? Notifies County Sheriff/Benson Police and AZ Highway Patrol [7-16.4]

? Notifies ? Ft. Huachuca Army EOD team [7-17.6]

The location of these explosions was such that earlier shipper intervention in the emergency response would not have made a difference in the outcome. All the major explosions were over before the shipper could get to the scene.

2.4.1.15. Evacuation

Not relevant - the area was uninhabited.

2.4.1.16. Accident reporting

Insufficient detailed data is reported about initial fire events, police response, fire behavior after initiation, firefighter actions, cargo behavior in fire, post-explosion firefighter or emergency response actions, post-explosion cargo behavior, explosion consequences, shipper response actions, and evacuation to permit specific recommendations.

2.4.2. Roseville, CA 28 April 1973 Fire and Explosions

This accident involved a box car fire in a train moving 16 carloads of #000080 bombs, and the eventual explosion of all 16 carloads of bombs in a railroad yard near Roseville, CA.

2.4.2.1. Initial fire events

The initial fire events for this case were similar to the Benson case, in that sparks from wheels apparently initiated the car fire. The car in which the first fire occurred was equipped with spark shields which proved ineffective in this case.

Applies train brakes [1-1.6]

Brake shoes shower floor with hot metal fragments during brake application [5-2.0]

Fire begins in car floor above wheel[4-2.2]

? [4-3.2]

This is another instance where a foreseeable and well-known phenomenon must be considered likely to occur frequently during the life cycle of rail movements on this line. The report state 237 car fires had occurred on this Division of the railroad in the past 5 years, and that 77% had resulted from brake shoe sparks.

The available reports did not address what happened after the fire started in the flooring in any detail.

2.4.2.2. Crew fire fighting actions.

The train apparently came to rest in a railroad yard without the crew being aware of the fire, so no fire fighting action was taken.

A yard crew broke up the train to store it properly in the yard shortly after it arrived, and that crew apparently saw no evidence of fire. Three of the twenty one cars in the #000080 shipment were moved to another track as the train was spotted in the Yard. They survived the explosions.

2.4.2.3. Crew rescue efforts

Not applicable

2.4.2.4. Police response

No data in reports acquired.

2.4.2.5. Fire behavior after initiation.

Little is known about the fire because in this case, the cars were standing still during the portion of the fire just before the explosion, and thus the explosions obscured evidence that might have existed before the explosion.

2.4.2.6. Crew traffic control actions

Not applicable. However, the Railroad yard was evacuated after the initial explosion.

2.4.2.7. Firefighter actions

The accident report did not address these actions.

2.4.2.8. Crew-firefighter interactions

Not applicable.

2.4.2.9. Cargo behavior in fire

The fire continued to burn undetected for at least 23 minutes in the railroad yard, and for an unknown period of time prior to that interval.

The fire was not observed before 7:40 am. This suggests that it was burning on the inside of the car that first exploded.

(Fire burns on inside of the car) [4-5.8]

Switchman concluded that source of observed smoke was burning railroad ties [6-6.2]

(Car contains much of heat from fire inside car) [2-6.4]

? [4-6.8]

Fire burns through north side of car on track 7 at least 2 min. before explosion [4-7.0]

This events set is instructive in several ways. First, it is a classic example of a risk being analyzed and accepted at the wrong level of on organization. The switchman, apparently in the absence of training in change control or risk detection, analysis and acceptance procedures, made an independent determination that the smoke observed 23 minutes before the explosion posed no special risk, and accepted the risk of the type of fire he assume for his employer. That decision foreclosed a subsequent chance for the railroad to attempt to respond to the fire and achieve timely control over it.

The second significant point is that the observer who saw the fire burning through the side of the car about 2 minutes before it exploded demonstrates the survivability possibilities offered by shelters, rather than evacuations. This data would be useful for assessing recommended emergency response actions that would reduce losses in future accidents, and might be worth investigating in more detail, even at this late date. It certainly suggests that detailed inquiry into the actions by survivors immediately prior to such explosions would be worth while in selected future accidents. This would require coordination among investigating agencies because of the potential scope of the interview efforts, but properly guided and coordinated, the data would be easy to acquire and analyze.

A third point is that fire in box cars is not likely to be detected and properly diagnosed during its initial stages in railroad operations, given the state of the art in diagnosing fire signals involving hazmat in rail operations.

There is no information in the available reports to indicate what happened in the car after that, until the first explosion occurred. The fire probably intensified but the process is not detailed. The absence of other observations of smoke suggests that the most of the products of combustion and also the heat of combustion from the fire inside the car was retained inside the car, building up the temperature to which the cargo was exposed during the 23 minute period, and making the cargo more sensitive to subsequent detonation in a shorter period of time than in the Benson case. The trade-offs between venting fire combustion products and potential of the additional oxygen to intensify the fire are not clear, but might merit further consideration to determine whether confinement or ventilation are most desirable.

? [3-10.0]

Additional bombs explode until 2 pm 29 Apr [3-10.6]

? [ 4-9.6]

This events set is not instructive because so little information is provided about the progression of the explosions. It does suggest that additional explosions should be considered likely in accidents involving aggregated shipments and fires. It also indicates the continuing risk of explosions in such accidents as long as fire continues.

2.4.2.10. Post-explosion firefighter actions.

Few details about fire-fighting actions in the community are provided in the reports. See 2.4.2.14 below for information about actions in the railroad yard.

2.4.2.11. Post-explosion cargo behavior.

Few details are provided about post-explosion cargo behavior after the first explosion, except that, like in the Benson case, the explosions propagated to 15 adjacent cars. The report states that one crater suggests three carloads of bombs detonated at one time. Newspapers carried reports of numerous explosions, presumably individual bombs exploding after they were expelled from cars during the explosions. These were not flow charted.

The events sets suggests that the likelihood of detonations communicating to adjacent cars of bombs in a train should be considered high.

2.4.2.12. Explosion consequences .

Explosions of this magnitude produce wide ranging consequences in populated areas. A full listing of injuries and destruction produced by the explosions was not reported. Damage was widespread in the railroad yard and surrounding buildings. Remarkably, no person was fatally injured. The gradual escalation of the explosions probably contributed to these results.

Additional bombs explode until 2 pm 29 Apr [3-10.6]

2 unexploded bombs landed about a mile away [3-11.5]

Debris from explosions damaged/ignited 140 homes, up to 300 rail cars [3-11.5]

Explosions formed 5 large craters up to 35' w x 150' l x 15' deep + several smaller ones [3-11.5]

Explosions injure 17 -52 persons

This events set offers three points. First, the size of the loss demonstrates the severity of the accident for risk assessment purposes. Secondly, in this case, unexploded bombs were reported to have been thrown about 1 mile from the explosions, providing data about the range of the effects of such mishaps, which could be overlaid on the routes used to show the severity range for risk assessment at any point along the railroad. This distance issue is discussed in 2.3.1.13. Third, the set indicates the types of harm that can flow from this kind of mishap - air blast damages, fire damages, and mechanical damage from flying debris.

The debris remaining after the accident provided information about the progression of explosions, their sequence, the energy releases and the range at which different effects can pose risks. However, at the time these accidents were investigated, demands imposed on investigators had not progressed to the point that this kind of information was deemed necessary.

2.4.2.13. Shipper response actions

The report does not state how the emergency response information was handled, or how the Sheriff became involved. It is unclear how the Army was notified, but an Army EOD team arrived from Sacramento to perform cleanup operations shortly after the first explosions..

? [4-12.4]

Sheriff took charge of evacuation, site control operations [8-12.0]

Arrived from Sacramento base to take charge of cleanup operations [9.12.2]

The explosions severely damaged the railroad yard of a major national carrier. The disruption of this vital facility produced another risk acceptance situation of interest in this study.

EOD team warned Railroad Officials of hazard, to enter area at own risk [9-13.4]

Railroad officials entered hazardous area to supervise yard cleanup and fire suppression [7-13.8]

The persons at the site with expert knowledge of the potential behavior of the Class A explosives warned the railroad officials "of the hazard" in the area. The report is unclear about the precise nature of the warning. The railroad officials were confronted with the need to restore the damaged transportation arteries to service. The trade-offs between safety and the need to restore service posed a difficult dilemma for the railroad officials and the EOD team. The events set hints at the special problems posed by the explosion of some Class A explosives, during clean up operations, when all the explosives do not explode. In this case, at least 1233 of the 7056 bombs were recovered unexploded, and substantial amounts of the explosive ingredient, tritonal, were scattered over the area.

No injuries attributable to the Class A explosives during the cleanup and restoration of the railroad yard were reported. The absence of injuries suggests that the risks posed by these surviving items is low when handled by knowledgeable personnel, even considering the massive destruction that had occurred.

2.4.2.14. Evacuation

An extensive evacuation was implemented, but few details were reported, and the information that was reported was too ambiguous to use.

2.4.2.16. Accident reporting

Insufficient detailed data is reported about initial fire events, police response, fire behavior after initiation, firefighter actions, cargo behavior in fire, post-explosion firefighter or emergency response actions, post-explosion cargo behavior, explosion consequences, shipper response actions, and evacuation to permit definitive and prioritized recommendations.

2.5 General Models

In the eight highway and two railroad accident cases studied, three distinctive accident types were discerned: The accident types can be described by selectively specifying aggregated differentiating events, as:

Type 1. Vehicle collision followed by fire and en masse detonation of Class A explosive cargo. (Cases 1, 3 and 8)

Type 2. Single vehicle mishap with fire followed by detonation of a cargo including a Class A explosive component. (Cases 2,4 and 9)

Type 3. Single vehicle fire in which Class A explosive only burned in the fire. (Cases 5, 6, 7, and 10)

The generalization of these accident types can be used to produce models that, by necessity, involve raising the level of abstraction used for the specific events in the models created for each of the accidents. In selecting these abstractions, the actors were generalized, and their actions were also generalized. While these general models have some uses, such as comparative risk assessments, they should not used in lieu of the specific mishap models in Charts 1-10 for the analysis of specific corrective measures. A more useful way to develop corrective actions by the analysis of multiple accidents is to look for specific common events sets that could be "overlaid" or superimposed on each other, rather than redefining the events using a higher level of abstraction in the sense of Hayakawa. (5,7a)

For example, in two of the Type 1 highway accidents involving collisions, the truck carrying the explosives struck a passenger car, releasing fuel which ignited, and then brought the truck to a stop in the fire. This provides a focal point for further analysis, since in both accidents these events had to occur for the accident process to continue. If this common event could be removed from these types of accidents, the accident process would subside rather than escalate from that point on. The effect on the risk would be to diminish the severity of the accident, resulting in a reduction in the risk.

Raising the level of abstraction to prepare Charts H, I and J in Appendix 3 requires judgments to be made about the events selected, and their precise wording. Usually, this results in more differences in opinions (because judgments are involved) than the accident events charts 1-10. We fully expect more questions to be raised about Charts H, I and J than the other 10 charts.

2.5.1 Model of Type 1 accident.

The events were generalized into the model shown in Chart H, Appendix 3. The timing of the events is one problem area when generalizing accident descriptions, since the time does vary with the specific circumstances of an accident. One of the most frequent variables is the notification, arrival and subsequent action of the emergency response personnel, for example.

Despite, the problems cited, the model can be useful to indicate the accident process elements which should be documented in a mishap report worksheet, with appropriate times as illustrated on worksheets 1-10.

2.5.2 Model of Type 2 accident.

The Type 2 accident differs slightly from the Type 1 model, primarily in the beginning events, and the post-explosion events.

2.5.3 Model of Type 3 accident.

This model is substantially simpler than Types 1 and 2, because the cargo burns and the losses, including the duration of the emergency, are greatly reduced.

2.5.4 Model Use

The models contain or consolidate the elements of the accident processes analyzed in sections 2.3 and 2.4, except for the investigation aspects discussed in those sections. The primary anticipated use of the models will be for coordination of data collection in certain accidents, for training and for discussion purposes. Their use for risk assessment is discussed below.

Go to DISCUSSION, CONCLUSIONS AND RECOMMENDATIONS
Return to Section A