A Review of the Department of Transportation Plan for Analyzing and Testing Electronically Controlled Pneumatic Brakes (2017)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

A Review of the Department of Transportation Plan for Analyzing and Testing Electronically Controlled Pneumatic Brakes Letter Report A Report of

i National Academies of Sciences, Engineering, and Medicine Transportation Research Board 500 Fifth Street, NW Washington, DC 20001 February 17, 2017 The Honorable Elaine Chao Secretary U.S. Department of Transportation 1200 New Jersey Ave, SE Washington, DC 20590 Dear Secretary Chao: In response to a congressional request, the National Academies of Sciences, Engineering, and Medicine (NASEM) formed a committee to review the planning, execution, and results of the physical tests and related analysis that the U.S. Department of Transportation (DOT) will use to inform the department’s reconsidera- tion of the electronically controlled pneumatic (ECP) braking system requirements in the Hazardous Materi- als: Enhanced Tank Car Standards and Operational Controls for High-Hazard Flammable Trains (HHFT) Final Rule (May 8, 2015). The committee’s membership is shown in Appendix A, and its statement of task is shown in Appendix B. This report responds to the first part of the committee’s task: to review the test and analysis plan pre- pared by DOT and comment on whether it will lead to objective, accurate, and reliable results to evaluate the parameters and other factors that DOT has identified in its comparison of the emergency braking perfor- mance of railroad tank car ECP brakes with that of other braking systems. In carrying out its task, the committee held a public session on October 14, 2016, to hear presentations from representatives of the Federal Railroad Administration and various stakeholder organizations on issues concerning the testing and analysis plan. The committee reviewed various written materials and held five meetings in closed session to deliberate and develop this letter report. In addition, committee members went to the Transportation Technology Center in Pueblo, Colorado, on September 28, 2016, to observe a full-scale shell impact test of a tank car that was part of implementing the overall test plan. (See Appendix C for addi- tional details on the committee’s information-gathering activities.) A group of independent experts has reviewed this letter report in draft form according to the policies and procedures approved by the NASEM Report Review Committee (see Appendix D for a list of the re- viewers). The committee’s overall findings and recommendations start on page 24 of this report and are summarized here. DOT’s Analysis and Test Plan The committee found that DOT’s plan for analysis and physical testing of the effectiveness of ECP brakes relative to other braking systems did not explain why the parameters and other factors identified in the plan are the significant ones to be considered. Before the plan is implemented, it is important that DOT ensure that the plan is focused on the significant factors worthy of testing or additional measurements. The report explains how DOT can do this by developing a multivariate regression model on the basis of two available databases on train derailment accidents to examine how tank car spillage relates to specific circumstances of the accidents.

ii ECP Brake Force Propagation in Emergency Applications The DOT modeling approach for the HHFT final rule includes no delay in the emergency application of ECP brakes in response to a derailment. All train cars are assumed to initiate emergency braking at the be- ginning of the simulation; a latency time for detecting loss of brake pipe pressure and for signals to be re- ceived at all cars to initiate emergency braking was not included in the modeling. However, some test data provided to the committee from train brake manufacturers suggest that during the first few seconds of emer- gency brake application in response to an in-train derailment, the initial cars approaching the point of derail- ment in a train with ECP brakes might experience less braking force than would cars in a train with other types of brakes. The brief delay observed in the test results is within the allowable industry standard. Alt- hough the committee does not consider the test rack results it received to be definitive with respect to emer- gency brake performance, the results point to key aspects in need of further testing. To ensure that appropriate data on the propagation of emergency ECP braking are included in compara- tive analyses of braking systems, the report discusses the need for evaluation of the performance of ECP sys- tems relative to other braking systems through simulations of derailments at multiple car positions that use one or more test racks certified by the Association of American Railroads. In addition, the report discusses the need for DOT to measure the time required for the emergency-mode application of ECP braking systems and other braking systems from initial train separation to the point at which all of the brakes on the train are fully applied by testing full-scale locomotive and revenue cars that are in service. It is important for the test to be conducted on standing trains and on ones that are moving slowly, with emergency braking conditions initiated by disrupting the brake pipe and electric line connections simultaneously. Validation of Modeling and Simulation Approach DOT’s analysis and testing plan includes validation of the modeling and simulation approach used for the HHFT final rule. The committee recommends steps that DOT should take in conducting that validation to demonstrate the model’s ability to simulate actual derailment events. Accurate prediction of specific aspects of derailments with known outcomes would increase confidence in use of the model to predict the outcome of those accidents had ECP brakes been present. The committee is pleased to provide this letter report and looks forward to further consideration of the issues discussed as it carries out the remainder of its study. Sincerely, Louis J. Lanzerotti Committee Chair cc: Kevin Kesler, DOT/FRA

iii Contents ABBREVIATIONS.................................................................................................................................................. v DEFINITION OF KEY TERMS........................................................................................................................... vi INTRODUCTION ................................................................................................................................................... 1 HOW TRAIN BRAKING SYSTEMS WORK ..................................................................................................... 4 EMERGENCY PERFORMANCE SIMULATION OF TRAIN BRAKING SYSTEMS ............................... 10 OVERVIEW OF MODELING AND SIMULATION APPROACHES ........................................................... 11 DOT ANALYSIS AND TEST PLAN ................................................................................................................... 20 IDENTIFYING KEY CONSIDERATIONS FOR DOT PLAN ........................................................................ 20 USING ACCIDENT DATA FOR MODEL VALIDATION .............................................................................. 23 FINDINGS AND RECOMMENDATIONS ........................................................................................................ 24 APPENDIXES A BIOGRAPHICAL INFORMATION: COMMITTEE ON THE REVIEW OF DEPARTMENT OF TRANSPORTATION TESTING OF ELECTRONICALLY CONTROLLED PNEUMATIC BRAKES ................................................................................................... 27 B STATEMENT OF TASK ............................................................................................................................... 30 C INFORMATION-GATHERING ACTIVITIES OF THE COMMITTEE ............................................... 31 D ACKNOWLEDGMENT OF REVIEWERS ................................................................................................ 32 E ANALYSIS AND TEST PLAN TO ASSESS THE EFFECTIVENESS OF ECP BRAKES IN REDUCING THE RISKS ASSOCIATED WITH HIGH-HAZARD FLAMMABLE TRAINS (VERSION 0.9 WITH NOTES ON STATUS, AS OF OCTOBER 11, 2016) ............................ 33 F TEST-RACK RESULTS ................................................................................................................................ 36

v Abbreviations AAR Association of American Railroads ABDX Current air brake valve manufactured by Wabtec ADF average derailment/collision blockage force BC brake cylinder BCP brake cylinder pressure BP brake pipe or train line BPP brake pipe pressure CAWG Collision Analysis Working Group CCD car control device DB-60 Current air brake valve manufactured by New York Air Brake DOT U.S. Department of Transportation DP distributed power ECP electronically controlled pneumatic EOT end-of-train device FAST Act Fixing America’s Surface Transportation Act fps feet per second FRA Federal Railroad Administration GAO U.S. Government Accountability Office HEU head-end unit HHFT high-hazard flammable train HHFUT high-hazard flammable unit train HOT head-of-train device MHz megahertz mph miles per hour MSRP Manual of Standards and Recommended Practices NAS National Academy of Sciences NASEM National Academies of Sciences, Engineering, and Medicine NBR net braking ratio NPRM notice of proposed rulemaking NTSB National Transportation Safety Board NYAB New York Air Brake Corporation OL overlay PHMSA Pipeline and Hazardous Materials Safety Administration PLC programmable logic controller POD point of derailment psig pounds per square inch gauge RAIRS Rail Accident/Incident Reporting System RIA regulatory impact analysis RSI Railway Supply Institute TEDS Train Energy and Dynamics Simulator TOES Train Operation and Energy Simulator TRB Transportation Research Board

vi TTCI Transportation Technology Center, Inc. UMLER Universal Machine Language Equipment Register Wabtec Westinghouse Air Brake Technologies Corporation WDP wired distributed power DEFINITION OF KEY TERMS Emergency braking Application of maximum braking force to stop a train as quickly as possible. Emer- gency braking can be initiated by the locomotive engineer by moving the brake han- dle or it can be initiated by a break-in-two, in which the train separates between cars and the brake pipe hoses separate. Test rack A laboratory setup that physically simulates the operation of and documents the re- sponse of the piping, valves, and pneumatic brake equipment, and any ECP compo- nents of a train consist. Train consist The coupled cars making up a train.

1 LETTER REPORT ON A REVIEW OF THE DEPARTMENT OF TRANSPORTATION PLAN FOR ANALYZING AND TESTING ELECTRONICALLY CONTROLLED PNEUMATIC BRAKES INTRODUCTION In May 2015, the U.S. Department of Transportation’s (DOT’s) Pipeline and Hazardous Materials Safety Administration (PHMSA) and the Federal Railroad Administration (FRA) issued the final rule enti- tled Enhanced Tank Car Standards and Operational Controls for High-Hazard Flammable Trains [HHFT].1,2 The rule includes requirements designed to reduce the consequences and, in some cases, the probability of accidents involving trains transporting large quantities of flammable liquids, including crude oil and ethanol. It regulates HHFT operation in terms of speed restrictions, braking systems, and routing, and it sets forth re- quirements concerning safety improvements in tank car design standards, a sampling and classification pro- gram for unrefined petroleum-based products, and notification. Consideration of Emergency Braking Applications in the Rulemaking Process During development of the rule, DOT’s PHMSA and FRA considered the potential effectiveness of pneumatic (air) brakes and three enhanced braking systems in reducing the number of tank cars derailed or punctured in the event of a train accident. Pneumatic brakes involve the use of air compressors on locomo- tives to charge the train car brakes on each of the coupled cars making up a train, which is also referred to as a consist. When the train’s engineer applies the brakes, a brake pipe pressure (BPP) reduction is initiated at the locomotive, which creates a pressure wave in the brake pipe (BP or train line) that propagates down the length of the train. When the pressure reduction wave reaches a car, a control valve on that car activates the brake cylinder (BC), which causes the brake shoes to apply to the wheels. The BP air pressure reduction also brings about the activation of brakes in the next car. The process is repeated sequentially until the air pres- sure reduction reaches the end of the train. The rulemaking considered the potential performance of three braking systems for emergency applica- tions. The systems involved the use of pneumatic brakes with two-way end-of-train (EOT) devices, pneumat- ic brakes with a distributed power (DP) configurations, and electronically controlled pneumatic (ECP) brakes. EOT devices and DP configurations are frequently used by railroads in the United States in conjunc- tion with pneumatic brakes. All single commodity trains (usually referred to as “unit trains”) in the United States carrying crude oil or ethanol use either EOT devices or DP configurations to enhance their pneumatic brake systems, and the HHFT final rule requires that either system be used on HHFTs. During an engineer-initiated emergency braking involving EOT systems, a device at the front unit lo- cated in the controlling (lead) locomotive sends a radio signal to a device at the rear of the train to activate an emergency air valve for brake application. The rear unit sends an acknowledgment signal to the front unit on receipt of the command. An emergency brake signal can be initiated simultaneously from both the front and the rear of the train. DP systems use locomotives positioned at strategic locations within the train consist (usually at the rear of the train, but sometimes also in the middle) to provide additional power and train control in certain opera- tions (such as climbing steep inclines). DP has the benefit of lowering longitudinal in-train forces [also re- ferred to as buff (compressive force) and draft (stretching force)], which allows longer trains to be run. DP locomotives are controlled by command signals sent via radio from the lead locomotive to adjust power and dynamic braking or pneumatic brake settings. With a DP consist at the rear of the train, an engineer-initiated emergency brake signal can be set off simultaneously from the front and the rear of the train, similar to an EOT braking system. 1The final rule is at 80 Federal Register 26644–26750 (May 8, 2015). 2The rule defines an HHFT as “a train comprised of 20 or more loaded tank cars of a Class 3 flammable liquid in a continuous block or 35 or more loaded tank cars of a Class 3 flammable liquid across the entire train.”

2 ECP brake systems simultaneously send an electronic braking command to all equipped cars in the train. All cars and controlling locomotives in the train must be ECP equipped for the ECP brake system to work. ECP brakes can be installed as an overlay (OL) such that a train so equipped can be operated in ECP mode or pneumatic mode. Alternatively, ECP brakes can be installed in an ECP-only configuration, such that the brakes on a car so equipped will respond only to ECP signals or an emergency loss of BPP. According to a 2006 report by Booz Allen Hamilton, the simultaneous application of ECP brakes in response to an engi- neer setting the brakes on all cars in a train improves train handling during normal operations by substantial- ly reducing stopping distances as well as by reducing longitudinal in-train forces acting along the train length as the train speeds up, slows down, or reacts to changes in grade and track curvature.3 According to DOT, ECP brake systems reduce the time before a unit train’s pneumatic brakes are fully engaged and therefore are more effective than other pneumatic brake systems. The modeling and simulations of derailment scenarios performed by a private contractor (Sharma & Associates) for DOT suggested that trains equipped with ECP brake systems that experience an in-train separation have decreased brake applica- tion time and that the kinetic energy of tank cars leaving the tracks in a train derailment is less than that of trains equipped with pneumatic brakes alone or augmented with EOT devices or DP configurations.4 After consideration of those results and its own analysis, DOT concluded that the use of ECP brakes can substan- tially reduce the number of cars that might derail, become punctured, and release their contents during a train accident.5 ECP Brake System Requirement The HHFT rule, citing the estimated effectiveness of ECP brakes in reducing the consequences of de- railment events by reducing the kinetic energy of a train during a derailment, requires the use of ECP brakes on unit trains designated as high-hazard flammable unit trains (HHFUTs). According to the rule, an HHFUT is a train comprising 70 or more loaded tank cars transporting flammable liquids at speeds in excess of 30 mph. HHFUTs are required to use ECP brakes in the transport of one or more tank cars loaded with flamma- ble liquids with specified characteristics and traveling at speeds greater than 30 mph by January 2021. Railroad Industry Opposition In comments on the proposed HHFT regulation, various organizations associated with the railroad in- dustry questioned whether the expected benefits of equipping trains with ECP brakes justify the costs of the technology. The organizations expressed concern that the use of ECP brakes would impose unreasonably high costs related to brake system reliability and maintenance issues. (U.S. railroads operating unit trains equipped with ECP brakes in limited applications indicated that they have been phasing out use of ECP brakes because of lack of reliability and extra maintenance costs.6) Several railroad companies have reported 3Federal Railroad Administration ECP Brake System for Freight Service. Booz Allen Hamilton, 2006. The report (page II-7) indicates the following: “Stopping distances for long trains with ECP brakes can be cut to about 40 to 60 percent of the conventional brake stop distances.” See https://www.fra.dot.gov/eLib/Details/L02964. 4Letter Report: Objective Evaluation of Risk Reduction from Tank Car Design & Operations Improvements— Extended Study. Sharma & Associates, March 2015. The final rule relies on the updated modeling. 5In the HHFT rule, DOT indicated that the effective use of braking on a freight train can result in some accident avoidance and that the benefit is amplified when a train operates in ECP brake mode. DOT examined records of train derailments over 20 years and used professional judgment to identify those that might have been avoidable if a train had been operating with ECP brakes. The department then estimated expected monetary benefits that might be gained from accidents avoided because of the HHFT final rule. (Final Regulatory Impact Analysis. Hazardous Materials: Enhanced Tank Car Standards and Operational Controls for High-Hazard Flammable Trains; Final Rule, May 2015, pages 249– 251). 6The Government Accountability Office report responding to the congressional request was issued in October 2016. Train Braking: DOT’s Rulemaking on Electronically Controlled Pneumatic Brakes Could Benefit from Additional Data and Transparency. GAO-17-122. http://www.gao.gov/products/GAO-17-122.

3 an increase in the average number of service interruptions per trip for trains with ECP braking systems as opposed to other braking systems. ECP communication issues, such as intercar connector reliability, were among the factors mentioned.7 As a result, whether the safety evidence was sufficient to justify the ECP brakes requirement was questioned. Furthermore, a modeling evaluation conducted by the Association of American Railroads (AAR) that used an approach different from the one used by DOT estimated a much smaller reduction in the severity of derailments after comparison of ECP brakes with other brake systems. (See discussion later in this report.) AAR indicated that upgrading tank integrity would provide a more effec- tive approach to improving safety than would the ECP brakes requirement.8 Congressional Mandate to Reconsider the ECP Brake System Requirement In the Fixing America’s Surface Transportation (FAST) Act,9 which was enacted in December 2015, Congress required the Secretary of Transportation to reconsider the ECP braking system requirements and determine, by the end of 2017, whether those requirements are justified. The act requires DOT to incorporate the results of the physical testing of ECP brake effectiveness and an evaluation by the Government Account- ability Office (GAO) of the costs and benefits of ECP brakes included in the regulatory impact analysis (RIA) that supported the final rule.10 If DOT does not find that the ECP brake requirements are justified, the Secretary is expected to repeal them. National Academies Committee’s Study In response to a congressional request, the National Academies of Sciences, Engineering, and Medicine (NASEM) agreed to form a committee to review the planning, execution, and results of the physical tests and related analysis that DOT will use to inform the Secretary’s decision. The committee’s membership is shown in Appendix A, and its statement of task is shown in Appendix B. In the first phase of its task, the committee is to review DOT’s testing and analysis plan and comment on whether it will provide objective, accurate, and reliable evaluations of the factors that DOT has identified in its comparison of the emergency braking performance of ECP brakes with other braking systems. The key question is whether ECP brakes would reduce the incidence and severity of spills of crude oil or ethanol from derailments compared with the alternative braking systems. In the second phase of this project, the committee will review the conduct of DOT’s tests and reports of test results and provide its findings and conclusions addressing the performance of ECP brakes relative to other braking technologies or systems tested by DOT. Key Issue Considered by Committee This letter report responds to the first phase of the committee’s task. To inform its deliberations, the committee obtained information from a variety of sources, including brake manufacturers. It heard presenta- tions from representatives of DOT and other organizations, made a site visit, and considered written infor- mation (see Appendix C). During its information-gathering activities, the committee learned about several approaches for estimat- ing the likely effect of the application of emergency train brakes initiated at the point of derailment (POD) and acting only on the trailing cars in the train. As discussed later in this report, the Sharma & Associates approach that was relied on by DOT for its rulemaking estimated a 30 percent reduction in the most likely number of cars punctured for trains equipped with ECP brakes for all three speeds considered in the derail- 7Williams, J., and B. Price. NS/BNSF ECP Brake Overview, Including 5000-Mile ECP Waiver. Oct. 4, 2016. 8Comments of AAR, Docket No. PHMSA-2012-0082 (HM-251), Sept. 30, 2014. 9Public Law No. 114-94. 10GAO. Train Braking: DOT’s Rulemaking on Electronically Controlled Pneumatic Brakes Could Benefit from Ad- ditional Data and Transparency. GAO-17-122, Oct. 2016. http://www.gao.gov/products/GAO-17-122.

4 ment scenarios examined. The approach used in the study conducted by AAR estimated the total energy dis- sipated in the derailment and the number of cars reaching the POD instead of the number of cars punctured. The National Transportation Safety Board (NTSB) study estimated the number of cars that would stop short of the POD and the energy state of each car that is unable to come to a complete stop before reaching the POD. For trains having the same net braking ratio (NBR)11 and speed, the AAR and NTSB studies concluded that potentially an additional car or two would derail without the use of ECP brakes. As part of carrying out the first phase of its task, the committee considered reasons why the results of the DOT–Sharma approach might have been different from those of the AAR and NTSB approaches and how those reasons might inform the development of DOT’s analysis and test plan. This report is not intended to be a comprehensive consideration of the performance of ECP brakes rela- tive to that of other braking systems, nor is it intended to analyze the maximum capabilities of a brake sys- tem in dissipating energy during an emergency braking event and reducing the incidence and severity of spills from derailments. That would include considerations of design specifications for the mechanical as- pects of brake operations. The report is limited to certain aspects of emergency braking performance during in-train derailments. The committee’s statement of task requires it to focus on assessing the effectiveness of brake control systems that are initiated after a first car, or one of its wheels, derails. Therefore, the committee did not consider the potential for accident avoidance through engineer-initiated emergency braking. Also, the committee was not tasked with considering potential costs associated with ECP brakes or other braking sys- tems. Costs were considered by GAO, as mentioned above. Organization of This Report The next section of this report discusses the operation of train braking systems in normal and emergen- cy applications to provide substantive context and a base of knowledge for all readers. It is followed by a discussion of braking systems in emergency application in terms of the propagation of brake pressures as a function of time. The modeling approaches used by DOT, AAR, and NTSB in evaluating brake effectiveness in train derailment scenarios are then discussed and compared. As described later, DOT’s analysis and test plan does not include any full-scale testing of unit train braking performance. In open session on October 14, 2016, DOT representatives indicated to the committee their belief that the department could rely on simula- tions rather than physical tests of unit trains in comparing braking system performance. For that reason, this report examines the simulations used by DOT and others to assess whether the restricted physical tests planned by the department would be appropriate. The report considers DOT’s analysis and test plan and dis- cusses how existing databases can help identify important knowledge gaps in evaluating braking system ef- fectiveness. The report also discusses how the modeling approach relied on by DOT can be validated more broadly. The committee’s findings and recommendations are provided at the end of the report. HOW TRAIN BRAKING SYSTEMS WORK Train brakes are used for train speed control, safe stopping, and emergency braking. In this section the operation of pneumatic brakes and three braking systems—ECP and pneumatic brakes augmented with EOT devices or DP configurations—are discussed. Unit trains carrying crude oil or ethanol in the United States do not rely on pneumatic brakes alone; instead, the brakes are augmented with either EOT devices or DP con- figurations, as required by regulations. Braking during normal operating conditions and emergency applica- tion in response to a derailment are considered next. 11NBR is a fundamental performance parameter for all types of brakes. AAR defines NBR in the Manual of Stand- ards and Recommended Practices, Section E-II, Electronically Controlled Brake Systems, Appendix A, effective Au- gust 2014, as follows: “Net braking ratio; the sum of the actual normal (perpendicular) brake shoe forces on all of the wheels on a car divided by the actual weight of the car on the rail; the term is used specifically in tread braking applica- tions. In this standard, NBR refers to the loaded net brake ratio resulting from a full-service (100%) brake application from a 90-psig brake pipe pressure.”

5 Pneumatic Brakes Components of the modern pneumatic brake system on each car include a reservoir for compressed air, a brake valve, and a BC (see Figure 1). The brake valve comprises many valves whose purposes are to detect changes in air pressure and route the flow of air. The reservoir has an auxiliary compartment and an emer- gency compartment, which is to be engaged in emergency brake application to provide increased brake cyl- inder pressure (BCP). The brake system for each car is connected by the BP, which is a pressurized pipe be- neath the car that is connected by flexible couplers at the ends of the car. The BP is pressurized by an air compressor on the locomotive. In a rail car pneumatic brake system, brakes are applied when air pressure in the BP is reduced below that of the reservoir. The brake valve detects this pressure change in the BP and admits pressurized air to flow from the auxiliary reservoir to the BC. The pressurized air acts on the brake piston and, through the brake rigging, applies the braking force to the wheels of the car. Conversely, when the air pressure in the BP equals or exceeds the pressure in the reservoir, the brake valve directs the air in the BC to be vented to the atmosphere, and the brakes are released. When the brakes are released, air in the BP is used to recharge the reservoir. If the BP is interrupted, for example by a derailment, or if the engineer at the head end of the train initiates an emergency application, the BPP will fall drastically. The brake valve will divert the auxiliary and reservoir air to the BC, and full emergency braking power will be applied on each car. The BP is never used to pressurize the BC directly; it is used to control brake operation and to pressurize the auxiliary and emer- gency reservoirs. Once air is admitted to the BC, the piston begins to actuate a system of rods and levers, which initially takes some seconds to move the brake shoes fully against the wheels. The rate of brake force increase is con- trolled by the brake valve to apply the brake force in a controlled manner during an emergency application.12 After the slack is taken up, the force of the brake shoe against the wheel is proportional to the pressure in the BC, with the system designed such that even with the brakes in full emergency application, the wheels can still rotate. To maximize the effectiveness of the brakes, the wheels are allowed to rotate and not slide against the rails. The schematics in Figures 2 and 3 shows the foundation brake rigging on a railroad car in released and applied conditions, respectively. FIGURE 1 Automatic brake system. 12AAR Manual of Standards and Recommended Practices, Section E, S-469, Paragraph 6.3.

6 Symbol definitions: FIGURE 2 Brakes released. Piston in BC is fully retracted due to the contained spring. (This perspective is viewed from above and shows the wheels at each end of a car.) Symbol definitions: FIGURE 3 Brakes applied. Piston in BC is fully extended due to air pressure from reservoir. For the current version of air brake valves13 (ABDX or DB-60),14 BPPs are sustained at 90 pounds per square inch gauge (psig), which results in a BCP equalization of 65 psig for a full service application and 75 psig for an emergency brake application. The speed of the transmission pressure wave through the train in an ABDX system is about 980 feet per second (fps). However, as will be described later, unit trains operate with either EOT devices or DP configurations, which, via radio transmission, broadcast an emergency brake sig- nal and initiate braking in both directions from the front and rear of the train. 13Air brake valves must comply with AAR Standard S-462, Control Valve Approval Procedures, 2002 version, which contains references to performance standards, test rack and on-car tests, and service trial requirements (including number of valves required to be applied to cars, mileage to be accumulated, and posttest teardown inspection) for a valve to receive AAR approval for unrestricted use. 14ABDX is the current air brake valve manufactured by Wabtec. DB-60 is the current air brake valve manufactured by New York Air Brake.

7 ECP Brakes ECP brakes are set or released by a signal sent through an electric line connecting all the cars in a train to the locomotives instead of relying on a pneumatic signal through the BP (see Figure 4). The signals are received by each car in the train essentially simultaneously. AAR has written and enacted standards for ECP brakes.15 The brake system on each car contains the same components and foundation brake rigging as for pneumatic brakes, but the brake valve is replaced by a car control device (CCD), basically a brake valve in- tegrating a programmable logic controller (PLC). The PLC obeys the signal sent from the locomotive to send air to the BC or discharge air from the BC to the atmosphere. This sets or releases the brakes. The BP is used to charge the reservoirs on the individual cars. When a brake application is requested, each ECP CCD allows air from the reservoir to flow into the BCs as part of the brake propagation sequence.16 ECP brakes can be installed on cars as an overlay (OL) to a pneumatic brake system or as a replace- ment of the conventional pneumatic system (that is, as an ECP-only system). A car with an ECP-OL system can be operated in a train for ECP or for pneumatically controlled operation. A car with an ECP-only system can only be operated in a train set up for ECP operation. For a train to be configured for ECP operation, all cars in the train must be equipped with an ECP system, either ECP-OL or ECP-only. Two-Way EOT Device with Pneumatic Brakes Until the mid-1980s, all trains operated with a caboose that was occupied by at least one person on the rear end. When cabooses were eliminated, a device was developed to mark the end of the train. Trains with EOT devices now involve two-way communications between the head-of-train (HOT) device on the lead, controlling locomotive and the EOT device by means of radio signals at frequencies such as 457.9375 and 452.9375 megahertz. For the purpose of this report, the two-component system is referred to as an EOT braking system. Trains configured for ECP operation require an EOT device that can communicate with the HOT device, and vice versa, by means of the electric line rather than by radio. In this case, the HOT is inte- gral to the ECP locomotive system and not a separate device with a radio. FIGURE 4 ECP brakes diagram. 15AAR, Safety and Operations. Manual of Standards and Recommended Practices, Section E-II, Electronically Con- trolled Brake Systems. The latest version was issued in 2014. 16The reservoir volume, at 90 psig, is connected to the cylinder volume (initially retracted and at 0 psig) such that the pressure equalizes at 65 psig throughout the total volume (reservoir + expanded cylinder). During emergency applica- tion, an additional auxiliary reservoir volume at 90 psig is added to the total volume (reservoir + expanded cylinder + auxiliary reservoir) such that the equalization pressure is approximately 75 psig.

8 The EOT device at the rear of the train communicates with the HOT component to indicate the status of the BPP and that the device is in motion. If the EOT device at the rear detects a drop in the BPP, the EOT device sends a signal to the HOT device. Pneumatic Brakes with DP Configurations Braking systems involving DP use one or more locomotives placed in the train consist after the lead lo- comotive consist. The DP consists can be placed nearly anywhere in the train consist but are most frequently at the rear. One or two DP consists might be within the train, and there might or might not be a DP consist at the rear. Railroad companies have rules for placement of a DP consist within a train that are dependent on tonnage rating for the route, distance between DP consists, and coupler strength limits. One way that the DP system enhances braking performance is by charging the BP from several locations along the length of the train. The lead locomotive communicates by radio with the other DP locomotives in the consist. The engineer can operate the locomotive consist in one of two modes, synchronous or asynchronous. In the synchronous mode, all DP locomotives mimic the controlling locomotive at the head as to throttle setting or brake appli- cation. In the asynchronous mode, the engineer sets a fence or boundary. Locomotives on one side of the fence operate one way, and those on the other side of the fence operate in a different way. For example, on a train that has just crested a grade, the engineer might want to set up the head locomotive to begin dynamic braking while keeping the DP locomotive in the rear end in power to shove the rear of the train over the grade. All trains experience air leakage from BPs, regardless of the braking system. Supplying air from more than one location (as in the DP system) has the benefit of overcoming air pressure loss more readily, espe- cially in cold weather, because of the many rubber gaskets in articulated air hose connections and the amount of piping and joints in the train. DP partially overcomes BP leakage. This results in greater braking force ca- pacity since the auxiliary and emergency reservoir pressures that are used to equalize with the BC are main- tained at a higher pressure. Trains configured for ECP operation can integrate DP into the locomotive head-end equipment, and all communications between DP locomotive consists occur over the ECP electric line. The controlling unit of the DP locomotive is required to have a functioning ECP module on the electronic brake system. According to AAR Standard 4250, wire distributed power (WDP) can be used in ECP trains, in which the lead locomo- tive communicates with the other WDP locomotives by using the ECP electric line. Radio distributed power is not used in trains operating under ECP control. Emergency Braking Various aspects of the functioning of different braking systems when a derailment causes a BP separa- tion are summarized below. Pneumatic Emergency Braking with an EOT Device • Braking is triggered by BPP reduction, and the transmission rate of the pressure change is 980 fps in both directions from the initial BP separation. • As each car senses the loss of BPP, it begins setting its brakes in emergency application. • If the separation is in the front half of the train, after the lead locomotive system senses the emergency drop in BPP, it commands the HOT to send a radio signal to the rear EOT device to vent BPP from the rear of the train, which will start the propagation of pneumatic emergency applications from the last car forward. • If the initiation of an emergency braking application occurs because of a BP separation in the rear half of the train, the EOT device at the rear radios the air pressure drop to the HOT device. The system can be programmed to signal the head-end locomotive to apply the brakes automatically from the front of

9 the train in emergency mode, or it can be programmed to notify the engineer, who decides whether to initiate emergency braking. • The closer the POD is to the head of the train, the more effective the brake application will be on the portion of the train trailing the POD, relative to pneumatic braking alone. A derailment closer to the head accentuates the EOT benefit since EOT brake applications start from the rear of the train before a pneumatic signal of brakes without EOT devices would reach the rear. Pneumatic Emergency Braking with DP Configurations • Braking is triggered by BPP reduction, and the transmission rate of the pressure change is 980 fps in both directions from the initial BP separation. • As each car senses the loss of BPP, it begins setting its brakes in emergency application. • If the separation is in the front half of the train, the lead locomotive’s DP system senses the emergen- cy drop in BPP and sends a radio signal to all DP locomotives in the consist to set brakes in emergen- cy application in both directions from each DP locomotive. • If the separation is closer to a rear or midtrain DP locomotive than to the head locomotive consist, the DP locomotive consist, on sensing the BP-initiated emergency braking, radios the other locomotives to set brakes in emergency application, propagating rearward and forward from each of the locomo- tive consists. • As with EOT braking systems, the closer the POD is to the head of the train, the more effective the brake application will be on the portion of the train trailing the POD, relative to pneumatic braking without EOT devices. On detection of a pressure loss, the lead locomotive signals all controlling DP locomotives to set an emergency brake application on both ends. If the trailing DP locomotive is in power mode, it will reduce power after it senses an emergency drop in BPP or receives a signal from the lead locomotive. If the trailing locomotive is in dynamic braking mode, it will maintain a dynamic brake setting. ECP Emergency Braking • When any CCD detects that the BPP has locally decreased to 50 psig or less for a 90 psig set point, it broadcasts a loss of BPP message onto the ECP electric line.17 • If ECP car-to-car electrical connectors become separated without a loss of BPP, the CCD sets the brakes in emergency application due to a communication loss after 6 seconds.18 • When any car or locomotive receives a signal from two separate sources along the ECP electric line indicating a loss of BPP, that car or locomotive will apply its ECP brakes to an emergency level. The car or locomotive itself might be one of the two sources that are reporting the condition, or the reports might be received from two other devices. When BPP is vented at an emergency rate, multiple CCDs will detect the critical loss of BPP and send a critical loss message. All broadcast messages are on the 17AAR Standard S-4200, 2014 revision, Paragraph 4.4.3.2: “If the EOT detects BPP less than (0.56 × BPP setpoint), it shall broadcast a Critical Loss exception.” Paragraph 4.4.3.3: “Except when in a ‘no air’ condition, if a CCD or trail- ing HEU [head end unit] detects a loss of BPP, it shall broadcast a Critical Loss exception message. Loss of BPP shall be defined as BPP less than (0.56 × BPP setpoint). A ‘no air’ condition shall be defined as brake pipe pressure, reservoir pressure, and brake cylinder pressure all less than 5 psi, which is normally associated with manual venting of reservoir and brake cylinder pressure.” 18AAR Standard S-4200, 2014 revision, Paragraph 4.4.2.2.1: “If any CCD, trailing HEU, or EOT fails to receive the HEU beacon for 6 seconds, then the CCD or trailing HEU shall maintain the current brake application and the CCD, trailing HEU, or EOT shall broadcast a Critical Loss exception message.”

10 common ECP communication system and are received by all cars and locomotives on the ECP net- work at the same time.19 • For an emergency brake application caused by an air hose separation, an ECP-only system initiates an emergency brake application when two or more CCDs detect the drop in BPP below 50 psig. A mes- sage from the CCDs is automatically sent down the ECP electric line setting brakes in emergency ap- plication simultaneously on the other cars. • An ECP-OL system starts setting a pneumatic emergency brake application with the conventional emergency portion at the BP separation point. At the same time, once two or more OL CCDs detect the drop in BPP below 50 psig, a message from the OL CCDs is automatically sent to all other cars via the ECP electric line, setting brakes in emergency application on all cars simultaneously before the BPP drop has propagated to their positions. • The emergency performance of the ECP system is not sensitive to the location of the POD along the train and is not dependent on radio communication from the front to the back of the train. EMERGENCY PERFORMANCE SIMULATION OF TRAIN BRAKING SYSTEMS Braking force is one of several kinds of forces involved in a train derailment that are discussed in the context of modeling and simulation later in this report. This section focuses on braking forces by discussing how freight train brake systems respond in the event of a train derailment. The graphs shown in Appendix F, which compare BPP and BCP as a function of time, were provided to the committee at its request by New York Air Brake (NYAB) and Westinghouse Air Brake Technologies Corporation (Wabtec). They were de- veloped from tests that the companies had conducted on their AAR standardized 150–rail car test racks.20 The NYAB test rack simulated ECP-only braking and the Wabtec test rack simulated ECP-OL braking. While there are some differences between the graphs from NYAB and Wabtec for ECP-initiated emergency brake applications 75 cars from the rear, both tests exhibit some delay before all the brakes begin applying. (See Figures F-3, F-10, and F-12 in Appendix F.) The results from the two test racks were consistent with regard to pneumatic brakes. See, for example, the graphs of the emergency application of pneumatic brakes 75 cars from the rear of the train from the two companies (Figures F-6 and F-11 in Appendix F). Conventional pneumatic control valves reacted to a drop in BPP and began to build BCP almost immediately after the separation of the air hoses at the POD. These preliminary data sets examined only the timing of the propagation of brake component response as a result of a separation in the air hoses or electrical intercar connectors, or both, at the POD. The test racks were not set up to test for any latency attributable to radio response times between devices of a train with pneumatic brakes and a DP configuration or EOT devices. While there was variability in the test rack results, some results suggest that during the first few sec- onds of emergency brake application in response to an air hose separation, the initial cars approaching the POD in a train with ECP brakes might experience less braking force than would cars in a train with pneumat- ic brakes. However, the results indicated that pneumatic brakes took longer than ECP brakes to set fully all of the brake cylinders on the test rack after a BP hose separation. Consider the relationship between the time history of the development of the average BCP (braking ca- pacity) of the trailing cars and the number of cars derailed during the initial few seconds. For a specific test 19AAR Standard S-4200, 2014 revision, Paragraph 4.4.4.1: “If a CCD or trailing HEU receives a Critical Loss excep- tion within 5 seconds of experiencing a critical loss, or experiences a critical loss within 5 seconds of receiving a Criti- cal Loss exception message, or receives Critical Loss exception messages from two other devices (CCDs or EOT or trailing HEU) within 5 seconds, then that CCD or trailing HEU, if applicable (see paragraph 4.3.1.5), shall make an electronic emergency brake application.” 20An AAR standardized train car test rack is a laboratory setup that physically simulates the operation of and docu- ments the response of the piping, valves, pneumatic brake equipment, and any ECP components of a train consist. The construction and use of 150-car train test racks are covered by AAR’s Manual of Standards and Recommended Practic- es, Section E, S-463 and S-464.

11 comparing ECP and pneumatic brakes, Figure F-6 (Appendix F) indicates that for pneumatic brakes, the BCP began to develop within the first second. Figure F-3 indicates that for ECP brakes, Cars 1, 35, and 75 all responded together but did not begin to develop BCP until approximately the third second. The data in Table 1 can be used in combination with the velocity of the cars at the time they reach the POD to estimate that 1 to 2½ cars might be added to the derailment pile before the cylinders under ECP control begin to de- velop pressure. The total number of cars derailed will depend on various factors, including the speed of oper- ation of these trains (see Table 1), the amount of train energy dissipated by the extent of brake application, and the blocking force in an actual derailment. Note that the Figure F-6 data for “Car_35-BC” provides an approximation for the average BCP for pneumatic brakes throughout the 75 trailing cars. This can be compared with the BC data in Figure F-3 (with ECP, Cars 1, 35, and 75 respond together, so the graph is the average of the trailing cars). For approximately the first 10 seconds, the average BCP for pneumatic brakes exceeded the average BCP for the ECP test run. Between 10 seconds and 16 seconds, the average BCP for the ECP test exceeded that of the pneumatic brakes. After 16 seconds, the average BCPs were the same. While the test rack used in this discussion was set up to model cars that are 50 feet long, 58 feet is a more typical length of a tank car (DOT-117J100W1). That difference in length would add a maximum of 0.89 second to the time needed for full actuation of all brakes in the portion of the train after the POD for a derailment occurring 115 cars from the rear of the train as shown in Figure F-8 in Appendix F. OVERVIEW OF MODELING AND SIMULATION APPROACHES Sharma & Associates Approach Used by DOT The first of the three modeling approaches presented in this report is the Sharma & Associates approach used by DOT as the primary tool for comparing the effectiveness of ECP brakes with that of other braking systems. The modeling process, key assumptions made, and conclusions are summarized below for the mod- el detailed in the March 2015 Sharma & Associates report presented to DOT and to the committee.21 The DOT–Sharma approach involves a mathematical simulation of the entire derailment event using commercially available software (LS-DYNA) and numerical analysis.22 The outcome of the DOT–Sharma approach is the probability of tank car puncture after a derailment and has been extended to the quantity of product spilled. The DOT–Sharma approach has three components. The first models various operating condi- tions, including train length and speed, brake type, in-train forces, and track conditions, up to the POD. In the second, the resulting speed of the train at the POD is fed into LS-DYNA3D to simulate a derailment event induced by a lateral force, and the retarding forces due to emergency brake application for cars on the tracks and ground reaction forces for derailed cars are incorporated to determine the speed of each car as it collides with other cars after derailment. The third component calculates the probability of tank car puncture for the simulated derailment. It uses the LS-DYNA output, probability distributions for impactor size and impactor forces, and tank car puncture-resistance information. TABLE 1 Train Speed and Number of Cars Passing a Reference Point in 1 Second Train Speed Number of Cars per Second Passing a Reference Point (mph) (fps) 50-Foot Cars 58-Foot Cars 30 44.0 0.88 0.76 40 58.7 1.2 1.0 50 73.3 1.5 1.3 21Letter Report: Objective Evaluation of Risk Reduction from Tank Car Design & Operations Improvements— Extended Study. Sharma & Associates, March 2015. 22LS-DYNA Keyword User’s Manual. Livermore Software Technology Corporation, Version 971, May 2007. http:// lstc.com/pdf/ls-dyna_971_manual_k.pdf.

12 Several simplifying assumptions were made when the LS-DYNA model was developed. The track was not explicitly modeled but was simulated as level and tangent. The cars on the track were constrained lateral- ly by an artificial stiffness. The lateral forces generated by this stiffness were assigned an upper limit, above which a car was considered to have derailed. The cars were modeled in three dimensions, but their motion was restricted to two dimensions and constrained to prevent rollover. To initiate the derailment, a lateral force was applied to the leading car at the POD. Once a car derailed, the ground reaction force was modeled by a constant coefficient of friction between the car and the ground. The simulations run with the Sharma model varied the coefficient of friction between the tank car and the ground (three values), the lateral derailment force (three values), and the lateral track stiffness (two val- ues) to develop 18 derailment condition combinations. These conditions were then modeled for three train speeds and three brake system scenarios. With regard to the retarding forces caused by braking, the Sharma model compared trains equipped with ECP brakes and those equipped with pneumatic brakes alone or with either EOT devices or DP configu- rations. DOT assumed that the effect of EOT and DP systems would be similar. Thus, they were treated as one system in the Sharma model (for example, the BPP was the same at both ends of the train for the two systems). For EOT and DP systems, the signal for emergency brake activation was initiated at both ends; the signal was received by all cars simultaneously for ECP systems. DOT23 confirmed the following for the Sharma model: • Data for emergency ECP brake force input to the LS-DYNA model were taken from AAR Standard S-4200: “Emergency Application: BCP shall reach target pressure from a full release, within ±3 psi, in no more than 12.0 seconds nor less than 7.0 seconds.”24 A midrange value of 9.6 seconds was chosen, and the assumption was made that brake force built up linearly. • For ECP brake systems, the braking force on every car in the train begins to build at the moment of derailment initiation (start of simulation), and all forces build uniformly to the maximum value. • For pneumatic brake systems, the brake force at each car increases linearly from zero to maximum value in 12 seconds. The initiation of the force buildup at any particular car depends on its distance from the emergency venting location and the propagation rate. The linear application of forces is not representative of the test rack data presented in Appendix F or the simulation of emergency brake application in the Train Energy and Dynamics Simulator (TEDS)25 or the Train Operations and Energy Simulator (TOES), both of which have been validated against actual braking events. DOT confirmed that delays before transmission of the emergency brake signal were not modeled.26 Why linear approximations were used when actual functions are available is unclear. For all of the simulations summarized in the Sharma report, the train consisted of 100 cars and derail- ment occurred near the head of the train. In acknowledgment that derailments can be initiated at any point in a train, additional simulations were conducted after the completion of the Sharma report for trains of 80, 50, and 20 cars trailing the POD, the results of which were submitted to DOT for review. On the basis of the ad- ditional simulations, DOT concluded that the benefits of enhanced braking systems are lower for shorter total train lengths, and those results were built into the risk evaluations.27 The Sharma report describes the preliminary effort to validate the approach, which relied heavily on comparison with actual derailment events filtered from FRA’s Rail Accident/Incident Reporting System 23FRA follow-up clarifications in response to request from NASEM ECP Committee, dated November 17 and 29, 2016. 24AAR Standard S-4200, 2014 revision, Paragraph 4.3.11. 25Final Rule: Hazardous Materials: Enhanced Tank Car Standards and Operational Controls for High-Hazard Flam- mable Trains, Department of Transportation, Federal Register, Vol. 80, No. 89, May 8, 2015, p. 26695. 26FRA follow-up clarification in response to request from NASEM ECP Committee, dated November 17, 2016. 27FRA presentation to NASEM ECP Committee, Effectiveness of ECP Brakes in Reducing the Risks Associated with HHFT Trains, October 14, 2016.

13 (RAIRS) database. DOT qualitatively compared the output of 18 simulations of tank car derailment accidents run at three initial train speeds with three images of actual tank car derailment pileups. The simulations’ out- put of the expected number of cars derailed was portrayed graphically against a background of data points from the RAIRS database (1992–2013) that had been filtered for scenarios similar to the simulations.28 The parameters used to filter the data included type of consist = freight train, type of incident = derailment, and number of cars behind POD = at least 50.29 The data used to compare the simulations with actual events in- cluded train speed at derailment, total number of cars derailed, and total number of punctures. The probabil- ity distributions used in the calculations are not clearly validated. In its final regulatory impact analysis for the HHFT final rule,30 DOT indicates: FRA derailment database was intentionally filtered for incidents similar to the specific type of derail- ment simulated in Dyna. For the purpose of validating the Dyna model, only derailments within the in- tended domain of the simulation were included, such as derailments (not collisions) of freight trains, of a minimum length, on a mainline track, etc. (specific parameter values used for this filtering can be supplied). The Dyna model was intended to simulate the type of tank car unit train derailment leading to hazmat release with the potential for significant damage, not the full range of incidents reported in the FRA database (page 72). However, the model’s ability to simulate specific derailment events given a set of parameters was not ad- equately validated. For example, the model results were not matched to the recorded speed of a trailing locomo- tive from an actual derailment, as was the case in the AAR and NTSB studies. The validation process, rather than examining train behavior during specific events, primarily compared simulated results for number of cars derailed and number of punctures against a large data scatter from historical derailment events and indicated that the modeled data fell within the data set. (See below for discussion of model validation.) The Sharma model concluded that ECP brakes would result in a 30 percent improvement in the likely number of punctures compared with pneumatic brakes and estimated the comparable benefit of pneumatic brakes with EOT devices or DP configurations to be 16 percent. DOT conducted additional analysis on the basis of the results of the Sharma model and concluded that ECP brakes were nearly 20 percent more effec- tive than EOT or DP in terms of quantity of product spilled. While the details of the additional analysis were not provided in the final rule or in the Sharma report, DOT indicates that this final conclusion averages the modeled benefit over various train lengths (80, 50, and 20 cars)31 and weights the evaluation in terms of quantity of product spilled rather than number of punctures. AAR Approach In response to the Notice of Proposed Rulemaking (NPRM) HM-251,32 AAR used the well-established TOES model in simulations of the effectiveness of pneumatic brakes and ECP brakes to determine the num- ber of cars involved in an in-train derailment.33 TOES was used to model the emergency braking perfor- mance of the train on the tracks before derailment, not to simulate the entire derailment event. A correction factor was used to account for the reaction forces that occur when derailed cars pile up to estimate the total 28Letter Report: Objective Evaluation of Risk Reduction from Tank Car Design & Operations Improvements— Extended Study. Sharma & Associates, March 2015. 29DOT response to committee information request, October 26, 2016. 30DOT Final Regulatory Impact Analysis. Hazardous Materials: Enhanced Tank Car Standards and Operational Con- trols for High-Hazard Flammable Trains: Final Rule. May 2015. [Docket No. PHMSA-2012-0082 (HM-251).] 31FRA follow-up clarification in response to request from NASEM ECP Committee, October 26, 2016. 32NPRM HM-251, Hazardous Materials Enhanced Tank Car Standard and Operational Controls for High Hazard Flammable Trains (Docket No. PHMSA-2012-0082). 33Analysis and Modeling of Benefits of Alternative Braking Systems in Tank Car Derailments. Research Report R-1007. AAR, Sept. 2014 (revised March 16, 2015).

14 energy dissipated in the derailment. These reaction forces or blockage forces are propagated through all the cars on the track, from car to car through the draft gear and couplers. The derailment blockage force can be an important factor in the slowing of trailing cars in a derailment. It results from the resistance to movement of train cars already in the derailment pileup (see Figure 5). This force is significant only in a pileup-type derailment. Derailed cars that have plowed into the terrain and suc- cessive cars that have piled up adjacent to each other in a way that blocks the uninhibited travel of oncoming cars as they roll toward the POD all contribute to this resistance to movement. The increased resistance to movement as more cars are added to the pile can cause the blockage force to grow. The TOES portion of the AAR approach is well validated against actual data with regard to the on-track behavior of trains under various operating conditions, and the AAR approach as a whole was validated by using event recorder data from actual derailment events, as described in the AAR report: Event recorder data from remote DP locomotives involved in derailments (such as the Aliceville, AL, derailment cited in the NPRM) provided accurate rear-of-train speed profiles to determine the magni- tude of the blockage force. The speed profiles and stopping distances modeled compare well to the data from these actual derailments. With the derailment blockage collision force included in the analysis, simulations of the derailments were conducted with ECP brakes as well as conventional braking sys- tems (page 2). Events used in the validation (Aliceville, Alabama; Brainerd, Minnesota; and Wagner, Montana) in- cluded derailments that initiated at the front, middle, and rear of a train and for which deceleration data were available from an event recorder located on a rear DP unit. The validation process compared the stopping distance calculated by the model with the actual time to stop for each event. With the addition of a blockage force, which ranged from 500,000 to 650,000 pounds, the calculated stopping time and actual time were in good agreement. In addition, the modeled deceleration rate agreed closely with the speed decay from the event recorder.34 The validated model was then applied to three derailment events listed in the NPRM (Aliceville, Ala- bama; Cherry Valley, Illinois; and Vandergrift, Pennsylvania) to determine the simulated benefits of alterna- tive braking systems. The effects of pneumatic brakes alone, pneumatic brakes augmented with a rear-of- train DP unit, and ECP brakes were studied. Results indicated that an average of 1.3 fewer cars were in- volved in the modeled derailment when ECP brakes were used as opposed to DP or pneumatic brakes alone or augmented with DP configurations. The AAR report noted that the Vandergrift derailment may have been a special case; most of the cars ended up in-line on their sides and rolled down an embankment, rather than piled up after having run into one another. Although ECP brakes might have shortened the stopping distance, their predicted contribution to the outcome in this event is hard to calculate with a model based on blockage force. FIGURE 5 Blocking force development. The first car is the first one derailed. 34See Analysis and Modeling of Benefits of Alternative Braking Systems in Tank Car Derailments. Research Report R-1007. AAR, Sept. 2014 (revised March 16, 2015).

15 Finally, a parametric study was conducted to evaluate the effect of a range of values for train speed, de- railment points within a train, track grade, and brake systems (including placement of the DP within the train) on stopping time and distance for each scenario. The following conclusions were drawn from that study:35 • The average reduction in the number of cars reaching the POD based on ECP usage was less than two. • The AAR study calculated the maximum reduction in energy dissipated in a derailment that is at- tributable to the use of ECP instead of conventional brakes to be 25.3 percent, with an average reduc- tion of 13.3 percent. • Parametric analysis indicated that the benefit of ECP over conventional brakes is greatest for derail- ments occurring at the head end. • The severity of a derailment might depend in part on a number of random factors unrelated to braking: o The probability of a pileup-type derailment is independent of the braking system on the train. o The energy dissipated when a car is derailed and interacting with the ground and with the pile of derailed cars is greater than the energy dissipated due to braking force. o In some derailment scenarios (e.g., Vandergrift, Pennsylvania), brake systems have little influence on the severity of the outcome. NTSB Approach The NTSB approach is similar to the AAR approach, although it uses a different mathematical model (conservation of energy) and different software (TEDS) in combination with a blockage force correction fac- tor to predict the number of cars stopping short of the POD.36 The NTSB study was originally initiated as an independent effort to evaluate AAR’s research report, but the goals of the study evolved to include quantification of (a) “the number of trailing consist cars ex- pected to stop short of the point of derailment (POD) as a result of energy dissipated by a given brake system configuration” and (b) “the energy state of each car in the trailing consist calculated to reach the POD based on available empirical data from actual train derailment events.”37 The study is presented in two parts: • Analysis of four derailments to determine the average derailment/collision blockage force (ADF), and • A comprehensive parametric study varying the train speed, track grade, and derailment position in the train along with the ADF. The NTSB study used a simplified conservation-of-energy method to model the energy dissipation for a train and the TEDS tool to validate the results of the simplified model. Four derailments were modeled, for each of which event recorder data from a rear-train DP were available. The derailments included three that had been modeled during the AAR study and one that occurred in Castleton, North Dakota. As did the AAR method, the NTSB approach used onboard data to determine an ADF that modeled the speed profile of the actual event. The NTSB method38 resulted in an average blockage force of 507,600 pounds compared with AAR’s assumed value of 500,000 pounds for the analysis of derailments for which event recorder data were not available.39 When the derailment blocking force is accounted for in addition to the braking force, the difference in the number of cars derailed on account of the difference in time required for full application of an emergency 35AAR’s observations and conclusions on DOT’s NPRM are not listed here. 36Train Trailing Consist Energy Dissipation Study. NTSB, Sept. 22, 2016. http://dms.ntsb.gov/pubdms/search/ document.cfm?docID=445207&docketID=59162&mkey=94138. 37Train Trailing Consist Energy Dissipation Study. NTSB, Sept. 22, 2016. 38Train Trailing Consist Energy Dissipation Study. NTSB, Sept. 22, 2016. 39Analysis and Modeling of Benefits of Alternative Braking Systems in Tank Car Derailments. Research Report R- 1007. AAR, Sept. 2014, revised March 2015.

16 brake for the ECP system versus the pneumatic system is reduced to one to two cars. In subsequent analyses, NTSB varied the NBR in addition to the parameters that were evaluated in the AAR study. The AAR study is based on an assumed NBR of 10 percent. The DOT–Sharma study is based on an assumed NBR of 12 per- cent. The NTSB study evaluates NBR values of 10, 12.8, and 14 percent, the range that is consistent with AAR standards.40 The NTSB study concludes that an average of 1.7 fewer cars would derail if ECP were used as opposed to DP and that two or three fewer cars would derail with a reduction of each car’s kinetic energy of 30 per- cent or more. The NTSB study directly attributes the reduction in the number of cars derailed (1.7) and the 30 percent reduction in energy of two or three cars that entered the pileup to the use of ECP brakes. There- fore, four or five cars would likely have a lower risk of tank puncture. Comparison of Sharma, AAR, and NTSB Approaches The DOT–Sharma approach simulates the derailment event as a multibody dynamics process by using LS-DYNA3D software and additional analysis to perform the tank car impact modeling. The simulation starts when all the cars are on the track, progresses to the time when they derail, and is modeled in a continu- ous manner. The model does not include details such as individual wheels or bogies (wheel assemblies) but groups these elements into the overall car body model. The cars are kept on the path of the rails by lateral forces applied at the bolster center plate, which are removed when a car is deemed to have “derailed.” The car bodies on the track are initially linked by couplers, which can fail and separate once a car has derailed. The model simulates the cars as they slide on the ground and as they contact and collide with each other. Ef- forts to validate the DOT–Sharma approach involved comparisons of the output with data on derailment events obtained from FRA’s RAIRS database. Two primary modeling approaches have been used as alternatives to the Sharma approach in assessing the benefits of ECP brakes. Neither model considered the probability of puncture of derailed cars. AAR’s assess- ment of the benefits of ECP brakes was based on estimating the total energy dissipated in the derailment and the number of cars reaching the POD instead of the number of cars punctured. The NTSB study estimated the number of cars that would stop short of the POD and the energy state of each car that is unable to come to a complete stop before reaching the POD. An adjustment, represented as an external constant force acting to de- celerate the train, was applied to these results to account for the blockage forces that occur when derailed rail cars pile up. The adjustment was applied as a correction to the results to estimate the total energy dissipated in the derailment and the number of cars reaching the POD. Both methods were validated against specific derail- ment events before the model was extended to evaluation of various derailment scenarios. Effective analysis of a derailment entails accounting for the major forces involved in the event, includ- ing (a) braking forces, (b) coupler forces, (c) ground reaction forces, and (d) car-to-car contact forces. In some cases, as discussed below and summarized in Table 2, those forces are handled in fundamentally dif- ferent ways by the different approaches. Braking Forces The LS-DYNA3D simulation uses longitudinal braking force functions applied to each car on the track for each braking system evaluated. The applied braking forces were increased linearly to a constant value, which is not representative of actual emergency braking events, and they included no programmed delay in braking signal transmission in the ECP system. Furthermore, the DOT–Sharma approach simulated EOT and DP braking systems identically for modeling purposes. The AAR and NTSB models both used a longitudinal train dynamics simulation to estimate the brake forces applied to each car on the train during the emergency 40Although a higher NBR might be beneficial with respect to stopping distance, the NBR is determined by the design of the mechanical portion of the brake system. The task of this committee is focused on the relative performance of a number of control systems that act to operate the mechanical portion of the brakes. Because of that focus, a nonvariable mechanical design is assumed. For this reason, variation of the NBR is outside the scope of the committee’s task, and the NBR was not addressed in detail in this report.

17 braking event up to the POD. The AAR analysis determined these forces by using TOES; the NTSB analysis used TEDS. TOES and TEDS are both well validated and able to simulate the operation of a train, including the lo- comotive traction and braking forces. Both programs have highly detailed BPP, brake valve, and BCP mod- els, which result in the brake forces applied to each car being well modeled.41 The AAR method modeled EOT and DP systems separately. The NTSB method simulated a variety of braking systems by placing the DP in the head-end and trailing DP positions. No midtrain or other in-train DP positions were evaluated. Ultimately, the influence of the braking force at a given speed depends on the total braking time, in- cluding the time to detect the break in the BP or ECP electric line, the time to transmit the emergency brak- ing signal, and the time for full actuation of brakes on the cars after the first car derails. In view of the speeds at which the trains operate, several cars could derail before full brake actuation regardless of the braking sys- tem used. Failure to model the emergency braking profile accurately could result in errors in the predicted number of derailed cars, which could overstate the effectiveness of one brake system in comparison with others. Coupler Forces As the cars derail, the couplers are strained and will deform and fail. The Sharma model includes a model of the coupler and can account for the failure of the coupler mechanism. The details of the allowable limits to the swing and rotation angles of the couplers are described in the Sharma report and appear to be consistent with values defined in the AAR manual.42 The DOT–Sharma approach models each car as it de- rails. The summation of the forces that are transmitted through couplers and body contact reflects the block- age force. Neither the AAR approach nor the NTSB approach specifically accounted for the failure of couplers, since these approaches do not model the actual derailment event. However, the reaction forces of the cou- plers are bundled into the overall blockage force that is used to represent the total force of the postderailment pileup of cars in these analyses. Ground Reaction Forces In the DOT–Sharma approach, the ground reaction forces for each derailing car were simulated as a simple sliding friction model,43 with a constant coefficient of friction applied, nominally 0.3. From the first POD until a car stops moving, the ground reaction force applied to it is continuous and is a fixed fraction of the car’s weight. The DOT–Sharma approach assumed that 0.27, 0.3, and 0.33 made up an acceptable range of friction values, although no justification was provided in the documentation as to why those values were selected, other than to state that “this range is consistent with nominal values for friction between steel and soil, which generally range from 0.2 to 0.4.” In an attachment to comments on the NPRM from AAR, Kirkpatrick44 commented on the selection of the ground friction value of 0.3 as being low in comparison with values used by other researchers in derail- ment simulation models. In response, FRA indicated the following: The friction factors used in Sharma’s analysis are consistent with the friction levels that may be ex- pected between soil and steel. For example, the friction factor between steel and “clean sand, silty sand- 41Validation of the Train Energy and Dynamics Simulator (TEDS). DOT/FRA/ORD-15/01. Office of Railroad Policy and Development, FRA, U.S. Department of Transportation, Jan. 2015. 42Section C-II, Design, Fabrication, and Construction of Freight Cars, Chapter II. Manual of Standards and Recom- mended Practices, AAR, Washington D.C., 2011. 43In this type of model, the reaction force is assumed to be a fraction of the overall weight of the object, with the co- efficient of friction used as the multiplier. 44Kirkpatrick, S. A Review of Analyses Supporting the Pipeline and Hazardous Materials Safety Administration HM-251 Notice of Proposed Rulemaking, Attachment A. Applied Research Associates, Inc., Sept. 29, 2014.

18 gravel mixture, single size hard rock fill” is reported as 0.30 with other factors varying between 0.2 and 0.4 (page 68 of Final RIA, May 2015). That argument does not justify the use of 0.3 as a suitable proxy for estimating the ground reaction force during a derailment, since the value of 0.3 for steel on soil is generally understood to be representative of a flat smooth steel plate sliding on flat, clean, dry soil. The conditions that occur during a train derailment are different from that. The wheels, truck components, and tank car structures all disrupt the rail bed ties, the ballast, and the surrounding soils during the derailment process. FRA also wrote the following: Further, the suggestion of using a friction factor of 1.0 does not seem realistic. This value is close to the value of friction between rubber and concrete/asphalt, not soil and steel. As an example, modern high- performance sport cars are able to generate such high friction levels when equipped with specialized performance tires. One does not expect a tank car rolling down an embankment to have the same levels of friction or grip as a Corvette going around a racetrack. Data and information are available that can enable an evidence-based resolution of the question of what val- ues of the coefficient of friction are the appropriate choices for derailed cars sliding on or plowing through terrain adjacent to tracks. FRA did not present evidence that the literature on soil mechanics or vehicle– ground interaction was reviewed or referenced in its work. A study of the literature would likely indicate whether agricultural equipment frequently requires a drawbar pull of more than its weight (that is, whether such equipment effectively has a “friction” coefficient greater than 1.0). Another example is that of heavy tracked vehicles. Steel links interacting with soil can achieve a drawbar pull of 0.5 to 0.8 times the vehicle mass, again analogous to a friction coefficient of roughly 0.5 to 0.8.45 Taking such data and information into account in assessing the values of coefficients of friction that are suitable for a car sliding on or plowing through terrain would be appropriate. FRA did not report investigating the possibility of a rail car interacting with the ground during a derailment having an effective coefficient of friction greater than 0.3 and as high as or greater than 1.0. Finally, FRA wrote the following: A friction level of 1.0 would result in a car traveling at 50 mph to decelerate to a stop in 84 feet or about 1.5 car lengths. There is very little evidence of 50-mph derailments coming to a stop within 1.5 car lengths. However, a derailed car is being pushed by the cars on the rails behind it. That is why the car would typically not stop within 1.5 car lengths, not because of the coefficient of friction acting alone. In summary, the use of 0.3 as a nominal ground friction coefficient is not well justified in the FRA work. FRA could have justified the use of an estimated ground friction value, even a constant value as was used, simply by performing a validation study against known, well-documented derailments, as was done by Kirkpatrick and in studies cited by Kirkpatrick (Paetsch et al.46 and Toma47). For a validated model, the overall ground reaction of the pileup of cars is, essentially, representative of the blockage force that was used by AAR and NTSB in their respective studies. In the AAR and NTSB approaches, the ground reaction forces were bundled into the overall blockage force that is used to represent the total force of the postderailment pileup of cars. As described above, the blockage force represents the summation of the ground reaction forces occurring during the derailment. 45Bekker, M. G. Introduction to Terrain–Vehicle Systems. University of Michigan Press, 1969. Wong, J. Y. Theory of Ground Vehicles, 4th ed. Wiley and Sons, 2008. 46Paetsch, C. R., A. B. Perlman, and D. Y. Jeong. Dynamic Simulation of Train Derailments. Proceedings of ASME International Mechanical Engineering Congress and Exposition, Paper No. IMECE2006-14607, 2006. 47Toma, E. E. A Computer Model of a Train Derailment. PhD dissertation. Queen’s University, Kingston, Ontario, Canada, Oct. 1998.

19 TABLE 2 Comparison of Modeling Methods and Results Modeling Aspect DOT–Sharma AAR NTSB On-track modeling Sharma model TOES TEDS Discrete model for each car on the track Yes Yes Yes Discrete model for each derailed car off the track Yes No No Braking forces included Yes Yes Yes Evaluated EOT and DP separately No Yes No Forces for individual derailed cars included Yes No No Car-to-car collision forces included Yes No No Forces for aggregate of derailed cars included Yesa Yes Yes Use of parametric study to evaluate additional parameters No Yes Yes Puncture probability calculated Yes No No a Through a complete simulation of the pileup dynamics, the blockage force is fully accounted for. Car-to-Car Contact Forces In the DOT–Sharma approach the motion of all the cars is modeled by using LS-DYNA3D, as stated in the Sharma report: “The cars were individually modeled in three dimensions (3-D),48 with appropriate repre- sentation for the tank shells, tank heads, and stub sills. Shell elements with a Belytscko–Tsay formulation were used with a nominal element length of 12", with finer mesh densities where appropriate.” In the AAR and the NTSB approaches, the car-to-car impact forces were bundled into the overall blockage force that is used to represent the total force of the postderailment pileup of cars. Although they used different mathematical models and software to predict blockage force caused by a derailment, the val- ues determined by the two methods were in close agreement. Summary The simulation methods described and reviewed in this report were developed to determine and evalu- ate the effects of ECP brakes on the outcome of a train derailment. They use different methods and draw ap- parently different conclusions. The different modeling approaches were based in part on different assumptions for evaluating how and to what extent ECP brakes can mitigate derailments and their subsequent effects, relative to pneumatic brakes augmented with EOT devices or a DP configuration. As cited in the HHFT final rule, DOT concluded that trains with ECP brakes are expected to reduce the number of cars punctured by up to 30 percent com- pared with pneumatic brake systems. In addition, an EOT device or DP locomotive at the rear of the train is expected to reduce the number of cars punctured by up to 16 percent. DOT also concluded that the trains us- ing ECP brakes are expected to be nearly 20 percent more effective than trains using EOT or DP systems on the basis of quantity of product spilled in a derailment. In analyses conducted in response to the final rule, AAR and NTSB concluded that the number of cars that would reach the POD would average 1.3 to 1.7 fewer in derailments involving 100-car trainsets equipped with ECP brakes as opposed to pneumatic brakes alone or with DP configurations.49 The discrepancies in the results of the modeling approaches raise important questions. Derailments are complex, chaotic events that are challenging to model. Differences in results be- 48“Modeled in 3D” refers to the tank structures, not to the derailment event. The derailment event is constrained to planar motion. The tank car structures are modeled as 3D structures that are able to bend and deform in a manner simi- lar to actual tank structures. 49The number of cars calculated to reach the POD can vary as a result of input modeling parameters, including NBR values, speed, grade, and derailment position.