Skip Ribbon Commands
Skip to main content
Bookmark and Share this page


Testimony on Oversight of the Ongoing Rail, Pipeline, and Hazmat Rulemakings, Washington, DC
Christopher A. Hart
Washington, DC

Testimony of the Honorable Christopher A. Hart
National Transportation Safety Board
Before the
Subcommittee on Railroads, Pipelines, and Hazardous Materials
Committee on Transportation and Infrastructure
United States House of Representatives
Oversight of the Ongoing Rail, Pipeline, and Hazmat Rulemakings
Washington, DC
April 14, 2015

Good morning Chairman Denham, Ranking Member Capuano, and the Members of the Subcommittee. Thank you for inviting the National Transportation Safety Board (NTSB) to testify before you today.
The NTSB is an independent Federal agency charged by Congress with investigating every civil aviation accident and significant incidents in the United States and significant accidents and incidents in other modes of transportation – railroad, highway, marine and pipeline. The NTSB determines the probable cause of accidents and other transportation events and issues safety recommendations aimed at preventing future accidents. In addition, the NTSB carries out special studies concerning transportation safety and coordinates the resources of the Federal Government and other organizations to provide assistance to victims and their family members impacted by major transportation disasters.
Since its inception, the NTSB has investigated more than 140,500 aviation accidents and thousands of surface transportation accidents. In addition, the NTSB has completed 553 major investigative reports in the areas of railroad, pipeline, and hazardous materials safety. On call 24 hours a day, 365 days a year, NTSB investigators travel throughout the country and internationally to investigate significant accidents and develop factual records and safety recommendations with one aim—to ensure that such accidents never happen again. The NTSB's annual Most Wanted List highlights safety-critical actions that the US Department of Transportation (DOT), United States Coast Guard, other Federal entities, states, and organizations need to take to help prevent accidents and save lives.
To date, we have issued over 14,000 safety recommendations to nearly 2,300 recipients. Because we have no formal authority to regulate the transportation industry, our effectiveness depends on our reputation for conducting thorough, accurate, and independent investigations and for producing timely, well-considered recommendations to enhance transportation safety.
In January, the NTSB released its Most Wanted List of Transportation Safety Improvements for 2015. Each year, we develop our Most Wanted List based on safety issues we identify as a result of our accident investigations. Several of this year’s Most Wanted List areas involve rail and hazardous materials including “Improve Rail Tank Car Safety,” “Implement Positive Train Control in 2015,” and “Make Mass Transit Safer.” Today, I would like to highlight some specific issues of concern to the NTSB. 
Rail Safety: Railroad Tank Car Design
The nation’s railroad network is taking on an expanding role—one that has profound economic importance—as a major channel for the transportation of crude oil and other hazardous products. The Association of American Railroads (AAR) states that crude oil shipments have increased on Class I railroads from 4,700 carloads in 2006 to about 400,000 shipments in 2013 and this growth is expected to continue for the foreseeable future.
Furthermore, ethanol traffic transported by railroad increased 442 percent between 2005 and 2010. In 2012, ethanol was the most frequently transported hazardous material in the railroad system.[1]  In 2013, more than 290,000 tank cars transported ethanol.[2]  The evolving role of our nation’s railroad network in the transportation of flammable crude oil and ethanol requires interested parties to take a comprehensive approach to eliminate or significantly reduce the safety risks. This approach must include improvements to railroad track inspection and maintenance programs, crashworthiness of the tank cars that transport these materials, and information sharing with first responders when accidents do occur.
Indeed, as the volume of flammable liquids transported by rail grows, major accidents such as the December 2013 Casselton, North Dakota, derailment and crude oil fire   have become an increasingly commonplace story. Multiple recent serious and fatal accidents reflect substantial shortcomings in tank car design that create an unacceptable public risk. The crude oil unit train involved in the Casselton accident consisted of railroad tank cars designed and manufactured to DOT Specification 111-A100W1 (DOT-111)—a design that presents demonstrated and serious safety concerns when used to transport hazardous liquids such as crude oil and ethanol. Specifically, the NTSB has identified vulnerabilities in the DOT-111 tank car design with respect to tank heads, shells, thermal protection, and fittings that create the unnecessary and demonstrated risk that can result in the release of the tank car product in an accident.[3]  Flammable liquids such as crude oil and ethanol frequently ignite and cause catastrophic damage.[4]
The NTSB continues to find that accidents involving the rupture of DOT-111 tank cars carrying hazardous materials often have violent and destructive results. For example, on July 6, 2013, a 4,700-foot-long train that included 72 DOT-111 tank cars loaded with crude oil from the Bakken fields derailed in Lac-Mégantic, Quebec, triggering an intense fire fed by crude oil released from at least 60 cars. The fire engulfed the surrounding area and completely destroyed the town center. Forty-seven people died. The NTSB assisted the Transportation Safety Board of Canada (TSB) in its investigation of that accident, and a final report was issued on August 19, 2014.[5] Both the NTSB and the TSB issued safety recommendations asking the Federal Railroad Administration (FRA) and the Pipeline and Hazardous Materials Safety Administration (PHMSA), as appropriate, to require railroads to evaluate the safety and security risks of crude oil train routes and select routes that avoid populous and other sensitive areas; require railroads to develop comprehensive emergency response plans for worst-case releases resulting from accidents; and require shippers to sufficiently test and properly classify hazardous materials such as crude oil prior to shipment.[6] PHMSA and the FRA continue to work to implement these recommendations.
In addition, the NTSB is investigating, has investigated, or is participating in the investigation of a spate of recent similar accidents in the United States that demonstrate the destructive results when tank cars containing flammable liquids are ruptured or exposed to intense pool fires, including:
·         The February 16, 2015, CSX unit train derailment at near Mount Carbon, West Virginia, 35 miles southeast of Charleston, West Virginia, in which approximately 28 Casualty Prevention Circular-1232[7] (CPC-1232) tank cars in a 109-tank car crude oil unit train derailed and released an unknown amount of crude oil onto the ground, which immediately ignited. About 300 people were evacuated from within a one-half mile radius of the scene.
·         The April 30, 2014, crude oil until train derailment in Lynchburg, Virginia, in which three tank cars derailed into the James River and one CPC-1232 tank car breached, spilling its contents into the river. This accident is still under investigation.
·         The July 11, 2012, Norfolk Southern Railway Company train derailment in a Columbus, Ohio, industrial area in which three derailed DOT-111 tank cars released about 54,000 gallons of ethanol, with energetic rupture of one tank car in a post-accident fire.
·         The October 7, 2011, Tiskilwa, Illinois, train derailment of 10 DOT-111 tank cars resulting in fire, energetic rupture of several tank cars, and the release of more than 140,000 gallons of ethanol.
·         The June 19, 2009, Canadian National Railway unit train derailment in Cherry Valley, Illinois, in which 13 of 19 derailed DOT-111 tank cars breached, caught fire, and released more than 230,000 gallons of ethanol. The post-accident fire resulted in one death, nine injuries, and the evacuation of 600 houses within half a mile of the accident site.
·         The October 20, 2006, Norfolk Southern Railway Company unit train derailment in New Brighton, Pennsylvania, in which 23 DOT-111 tank cars derailed, fell from a bridge, caught fire, and released more than 485,000 gallons of ethanol.
Moreover, the use of unit trains increases the risk of catastrophic damage should a derailment occur. The risks are greater in unit train operations because hazardous materials are transported in high density. For example, a unit train of 75 to 100 fully loaded 30,000-gallon tank cars typically transports between 2.1 million and 2.8 million gallons of hazardous materials.[8] The Mount Carbon, Lynchburg, Casselton, Cherry Valley, and New Brighton accidents involved unit trains. Improvements in tank car safety would most effectively be targeted to those hazardous materials commodities that are transported by unit train, such as denatured fuel ethanol and crude oils, and that pose the greatest risks when released.
Federal requirements simply have not kept pace with evolving demands placed on the railroad industry and evolving technology and knowledge about hazardous materials and accidents. While CPC-1232 provides a level of protection greater than corresponding Federal requirements, the NTSB is not convinced that these modifications offer sufficient safety improvements.[9] The NTSB continues to assert that DOT-111 tank cars, or tank cars of any successor specification, that transport hazardous materials should be more puncture resistant and have effective thermal protection systems. This can be accomplished through the incorporation of additional protective features such as full head shields, jackets, thermal insulation, appropriate pressure relief devices, and thicker head and shell materials. Because the average service life of a tank car may run 20-50 years, it is imperative that industry, the FRA, and PHMSA take action now to address hazards that otherwise would exist for another half- generation or longer.
Although important decisions are clearly ahead for regulators and industry, the NTSB is pleased that at least some progress has been made. PHMSA published a notice of proposed rulemaking (NPRM) in August 2014 proposing safety improvements to DOT-111 tank cars used in trains hauling 20 or more carloads of Class 3 flammable liquids such as crude oil or ethanol.[10]  The NPRM addresses NTSB safety recommendations to require that general service tank cars authorized for transportation of denatured fuel ethanol and crude oil have enhanced tank head and shell puncture resistance systems and top fittings protection that exceed existing design requirements for DOT-111 tank cars, as well as other improvements.[11]  The NPRM also addresses the Lac-Mégantic recommendations issued in January 2014.[12]  We remain engaged in that rulemaking proceeding. PHMSA submitted a draft final rule to the Office of Management and Budget for formal review on February 5, 2015, and we will continue to carefully monitor PHMSA’s progress and will ensure that decision-makers have the full benefit of the lessons the NTSB has learned through its investigations.  
            Two weeks ago, the NTSB issued new recommendations that PHMSA require tank cars used to transport Class 3 flammable liquids be equipped with (1) thermal protection systems and (2) appropriately sized pressure relief devices that allow the release of pressure under fire conditions to ensure thermal performance that meets or exceeds the thermal performance standards outlined in Title 49 CFR § 179.18(a).[13] We also recommended that PHMSA require an aggressive, intermediate progress milestone schedule, such as a 20 percent yearly completion metric over a five-year implementation period, for the replacement or retrofitting of legacy DOT-111 and CPC-1232 tank cars to appropriate tank car performance standards, and that PHMSA establish a publicly available reporting mechanism that reports, at least annually, progress on retrofitting and replacing tank cars subject to thermal protection system performance standards.[14]
We are aware of several other accidents in which crude oil releases caused major environmental damage and fires. These accidents include:
·         The March 27, 2013, derailment of a Canadian Pacific train involving 14 tank cars of western Canadian crude oil in Parkers Prairie, Minnesota, that released 15,000 gallons of product.
·         The January 31, 2014, derailment of 11 tank cars of a Canadian National (CN) train transporting North Alberta crude oil in New Augusta, Mississippi, releasing 90,000 gallons of product.
·         The February 13, 2014, derailment of 19 tank cars of a Norfolk Southern train carrying western Canadian heavy crude oil in Vandergrift, Pennsylvania, releasing 10,000 gallons of product.
·         The January 7, 2014, derailment of five tank cars of a CN train carrying western Canadian (Manitoba/Saskatchewan) crude oil in Plaster Rock, New Brunswick, releasing 60,000 gallons of product.
·         The February 14, 2015, derailment of a CN crude oil unit train with 100 derailed tank cars 29 cars in a remote area near Gogama, Ontario, while traveling at 38 mph. Investigators found that 19 of the cars were breached and released more than 264,000 gallons of crude oil.
·         The March 5, 2015, derailment of a BNSF crude oil unit train with 103 tank cars traveling at 23 miles-per-hour (mph) derailed 21 tank cars in a rural area south of Galena, Illinois. A post-accident pool fire that began with product released from damaged valves and fittings on some tank cars resulted in five tank car thermal failures.
·         The March 7, 2015, derailment of a CN crude oil unit with 94 tank cars while traveling at 43 mph derailed 39 tank cars at the west end of a CN rail bridge that traversed the Macaming River near Gogama, Ontario, which is about 23 miles from the above-mentioned February 14, 2015, accident location. Five tank cars came to rest in the river and the remaining cars piled up on the west side of the bridge where tank cars were breached, released product, and ignited a large pool fire that destroyed the rail bridge.[15]
First Responder Notification
When accidents involving hazardous materials do occur, first responders must have the knowledge to effectively deal with the aftermath. Following the 2011 ethanol release and fire in Cherry Valley, Illinois, the NTSB reiterated its 2007 recommendation that PHMSA and the FRA require railroads to immediately provide emergency responders with accurate, real-time information on hazardous materials on a train.[16] 
More recently, following the freight train derailment in Paulsboro, New Jersey, in November 2012, the NTSB again saw the critical importance of providing immediate, accurate information to first responders about the contents of a derailed tank car and reiterated this recommendation. In August 2014, the NTSB further recommended that railroads be required to inform state and local emergency planning committees about the commodities traveling through their areas and to assist with the development of emergency response plans.[17]
Any improvement to railroad tank car safety must proceed hand-in-hand with an improved approach to ensuring first responders have adequate information to take appropriate life-saving actions. Although PHMSA indicated it is working to implement the August 2014 recommendation as part of its rulemaking proceeding to improve DOT-111 tank cars, the recommendation has been classified “Open—Unacceptable Response” because we believe emergency responders and local and state emergency planning committees should have adequate information concerning shipments of all hazardous materials, not just flammable liquids.
Rail Safety: Positive Train Control (PTC)
On December 1, 2013, four people lost their lives and 61 others were injured when a Metro-North commuter train derailed in the Bronx after entering a curve with a 30 mph speed limit at 82 mph.[18] We determined the probable cause of the derailment was the engineer’s noncompliance with the 30 mph speed restriction because he had fallen asleep due to undiagnosed severe obstructive sleep apnea. A contributing factor was the absence of a positive train control system that would have automatically applied the brakes to enforce the speed restriction. This is one of many accidents that would have been prevented by PTC.
For nearly 40 years, the NTSB has investigated numerous train collisions and over-speed derailments caused by operational errors involving human performance failures. The NTSB attributed these human performance failures to a variety of factors, including fatigue, sleep disorders, medications, loss of situation awareness, reduced visibility, and distractions in the operating cab such as the use of cell phones. Many of these accidents occurred after train crews failed to comply with train control signals, follow operating procedures in non-signaled or “dark” territories, or adhere to other specific operating rules such as returning track switches to normal position after completing their work at railroad sidings.
PTC systems help prevent derailments caused by over-speeding and train-to-train collisions caused by slowing or stopping trains that are not being operated in accordance with the signal systems and operating rules. They also help protect track workers from being struck by trains. The first NTSB-investigated accident that train control technology would have prevented occurred in 1969, when four people died and 43 were injured in the collision of two Penn Central commuter trains in Darien, Connecticut.[19] The NTSB recommended, in response to that accident, that the FRA study the feasibility of requiring railroads to install an automatic train control system, the precursor to today’s PTC systems.[20]
In 2008, more lives were lost in a PTC-preventable accident when a Metrolink commuter train and a Union Pacific freight train collided head-on in Chatsworth, California, killing 25 people and injuring 102 others. The NTSB concluded that the Metrolink engineer’s use of a cell phone to send text messages distracted him from his duties. PTC would have prevented that tragedy. In the aftermath of the Chatsworth accident, Congress enacted the Rail Safety Improvement Act (RSIA) of 2008, which requires each Class I rail carrier and each provider of regularly scheduled intercity passenger or commuter rail transportation to implement a PTC system by December 31, 2015, on each line over which intercity passenger or commuter service is operated or over which poison- or toxic-by-inhalation hazardous materials are transported.[21]  We know that several rail carriers have stated that they will not meet the 2015 deadline. This is disappointing.
Meanwhile, we continue to see accidents that could be prevented by PTC:  
·         In September 2010, near Two Harbors, Minnesota, human error and fatigue contributed to the collision of two freight trains, injuring five crew members.
·         In April 2011, near Red Oak, Iowa, fatigue contributed to the rear-end collision of a coal train with a standing maintenance-of-way equipment train, killing two crew-members.
·         In May 2011, in Mineral Springs, North Carolina, human error contributed to the rear-end collision of two freight trains, killing two crew-members and injuring two more.
·         In May 2011, in Hoboken, New Jersey, human error contributed to the collision of a train with the bumping post at the end of the track.  
·         In January 2012, near Westville, Indiana, inattentiveness contributed to the collision of three trains, injuring two crew-members.  
·         In June 2012, near Goodwell, Oklahoma, human inattentiveness contributed to the collision of two freight trains, killing three crew members.
·         In July 2012, near Barton County, Missouri, human error contributed to the collision of two freight trains, injuring two crew-members.
·         In May 2013, near Chaffee, Missouri, inattentiveness and fatigue contributed to the collision of two freight trains, injuring two crew-members and causing the collapse of a highway bridge.
·         In December 2013, near Keithville, Louisiana, human error contributed to the collision of two freight trains, injuring four crew-members.
Since 2004, in the 29 PTC-preventable freight and passenger rail accidents that the NTSB investigated, 68 people died, more than 1,100 were injured, and damages totaled millions of dollars.[22]  The NTSB files are filled with accidents that could have been prevented by PTC, and for each and every day that PTC implementation is delayed, the risk of an accident remains.
There is much debate by policymakers on extending the 2015 deadline established by the RSIA. Some railroads may meet this deadline. For those railroads that have made the difficult decisions and invested millions of dollars, they have demonstrated leadership. For those railroads that will not meet the deadline, there should be a transparent accounting for actions taken – and not taken – to meet the deadline so that regulators and policymakers can make informed decisions.[23]
Rail Safety: Inward- and Outward-Facing Audio and Video Recorders in Locomotive Cabs
The December 1, 2013, Metro-North accident in the Bronx raised questions about the actions of the engineer prior to the crash. The NTSB has repeatedly called for railroad carriers to install inward- and outward-facing audio and image recorders to answer similar questions that have arisen in other accidents. Since the 1990s, the NTSB has recommended that the FRA require audio recorders inside locomotive cabs. In its investigation of the February 16, 1996, collision between a Maryland Rail Commuter train and an Amtrak train near Silver Spring, Maryland, in which no operating crewmembers survived, the NTSB was unable to determine whether crewmember activities leading up to the accident contributed to the accident. [24]
Audio and image recorders in locomotives and cab car operating compartments are critically important because they could assist NTSB investigators and others understand what happened in a train before an accident. Significantly, these recordings would help railroad management prevent accidents by identifying safety issues before they lead to injuries and loss of life. The railroads could use the information to develop valuable training and coaching tools.
In the NTSB’s investigation of the Bryan, Ohio, railroad accident in 1999, with no surviving crewmembers, it reiterated this safety recommendation.[25] However, the FRA stated that no action would be taken to implement the recommendation. Since the FRA’s refusal to act on the recommendation of in-cab audio recorders, the NTSB has investigated additional accidents in which audio recorders, along with inward-facing video recorders, would have provided information to help determine probable cause and improve safety. 
The Chatsworth tragedy again made the case crystal-clear for understanding the activities of crewmembers in the minutes and seconds leading up to accidents. Discussing the strong safety case for a requirement for inward-facing cameras in locomotives, the NTSB noted that:
[i]n all too many accidents, the individuals directly involved are either limited in their recollection of events or, as in the case of the Chatsworth accident, are not available to be interviewed because of fatal injuries. In a number of accidents the NTSB has investigated, a better knowledge of crewmembers’ actions before an accident would have helped reveal the key causal factors and would perhaps have facilitated the development of more effective safety recommendations.[26]
Accordingly, the NTSB recommended that the FRA require the installation, in control compartments, of “crash- and fire-protected inward- and outward-facing audio and image recorders capable of providing recordings [for at least 12 hours] to verify that train crew actions are in accordance with rules and procedures that are essential to safety as well as train operating conditions.[27]  The NTSB also recommended that the FRA [r]equire that railroads regularly review and use in-cab audio and image recordings . . . to verify that train crew actions are in accordance with rules and procedures that are essential to safety.[28]
The NTSB reiterated these important recommendations in its report on the collision of a BNSF coal train with the rear end of a standing BNSF maintenance-of- way equipment train near Red Oak, Iowa, which resulted in fatal injuries to the two crewmembers of the striking train.[29]  Damage was in excess of $8.7 million. As the NTSB stated in its report, the accident again demonstrated the need for in-cab audio and image recording devices to better understand (and thereby prevent) serious railroad crashes that claim the lives of crewmembers, passengers, and the public.
In response to the December 2013 Metro-North derailment, we issued our longstanding recommendations on this subject directly to Metro-North Railroad.[30]  On May 14, 2014, Metro-North responded to the recommendations stating that it had been authorized to procure cameras with 12-hour continuous audio and image recording capability for the locomotives and operating cabs of its M-7 and M-8 equipment. Metro-North further stated that its Safety Department would work on integrating the data as part of the Metro-North System Safety Program Plan, and the recordings would be used for training, efficiency testing, hazard analysis, and accident investigations. Metro-North has since advised the NTSB that it intends to install cameras on its entire fleet.
We have been encouraged by the inclusion of these recommendations in rail safety legislation, and we hope this can be part of a rail safety legislative proposal that may be considered by this Congress. In the meantime, we will continue to address the recommendation on an individual railroad basis and with the FRA.
Pipeline Safety: Integrity Management of Natural Gas Pipelines
On March 12, 2014, in East Harlem in New York City, two multi-use, five-story tall buildings were destroyed by a natural gas explosion and subsequent fire. Eight people died, more than 48 people were injured, and more than 100 families were displaced from their homes. On December 17, 2013, natural gas from a cast iron distribution pipeline leak resulted in the explosion of a two-story apartment building in Birmingham, Alabama. One person was killed and eight people were injured. While these explosions remain under NTSB investigation, they are a grim reminder that efforts to improve pipeline integrity management practices must continue, particularly for pipelines located in high consequence areas.
There are three types of pipeline systems through which gas is transported from the source to the end users: gathering, transmission, and distribution systems. Gathering lines transport gas from a production facility to a transmission line, and transmission lines transport gas from a gathering line to a distribution facility.[31] There are approximately 298,000 miles of onshore natural gas transmission pipelines in the United States. Compared to gas distribution pipelines, transmission pipelines typically have larger diameters and significantly higher operating pressures. Therefore, the potential impact of a transmission pipeline incident on its surroundings is high. Transmission pipelines are classified as either interstate or intrastate. Interstate pipelines are subject to Federal oversight, and most states assume oversight through PHMSA for intrastate pipelines. A state must adopt the minimum Federal regulations and also provide for enforcement sanctions substantially the same as those authorized by the Federal pipeline safety regulations. Based on mileage, 64 percent of all gas transmission pipelines are interstate pipelines, while 36 percent are intrastate pipelines.
Since 2004, the operators of these pipelines have been required by PHMSA to develop and implement integrity management (IM) programs to ensure the integrity of their pipelines in populated areas (defined as high consequence areas [HCAs]) to reduce the risk of injuries and property damage from pipeline failures.[32]  An operator’s IM program is a management system designed and implemented by pipeline operators to ensure their pipeline system is safe and reliable. An IM program consists of multiple components, including procedures and processes for identifying HCAs, determining likely threats to the pipeline within the HCA, evaluating the physical integrity of the pipe within the HCA, and repairing or remediating any pipeline defects found. These procedures and processes are complex and interconnected. Effective implementation of an IM program relies on continual evaluation and data integration. The IM program is an ongoing program that is periodically inspected by PHMSA and/or state regulatory agencies to ensure compliance with regulatory requirements.
In the last six years, the NTSB completed three major gas transmission pipeline accident investigations where deficiencies with the operators’ IM programs and PHMSA oversight were identified as a concern.[33] These three accidents—located in Palm City, Florida; San Bruno, California; and Sissonville, West Virginia—resulted in eight fatalities, more than 50 injuries, and 41 homes destroyed with many more damaged. We are also evaluating IM oversight in the ongoing East Harlem and Birmingham investigations.
Earlier this year, the NTSB’s Safety Research Division conducted a safety study to build upon the results from the completed investigations and use additional research to identify weaknesses in the implementation of gas transmission pipeline integrity management programs in HCAs. The study, Integrity Management of Gas Transmission Pipelines in High Consequence Areas, found that while PHMSA’s gas IM requirements have kept the rate of corrosion failures and material failures of pipe or welds low, there is no evidence that the overall occurrence of gas transmission pipeline incidents in HCA pipelines has declined.[34] The study identified areas where improvements can be made to further enhance the safety of gas transmission pipelines in HCAs.
We recognize that IM programs are complex and require expert knowledge and integration of multiple technical disciplines including engineering, material science, geographic information systems, data management, probability and statistics, and risk management. This complexity requires pipeline operator personnel and pipeline inspectors to have a high level of knowledge to adequately perform their functions. This complexity can make IM program development, and the evaluation of operators’ compliance with IM program requirements, difficult. The study helped the NTSB determine that PHMSA resources in guiding both operators and inspectors need to be expanded and improved.
The effectiveness of an IM program depends on many factors, including how well threats are identified and risks are estimated. This information guides the selection of integrity assessment methods that discover pipeline system defects that may need remediation. The study found that aspects of the operators’ threat identification and risk assessment processes require improvement. Furthermore, the study found that of the four different integrity assessment methods (pressure test, direct assessment, in-line inspection, and other techniques), in-line inspection yields the highest per-mile discovery of pipe anomalies and the use of direct assessment as the sole integrity assessment method has numerous limitations. Compared to their interstate counterparts, intrastate pipeline operators rely more on direct assessment and less on in-line inspection.
As a result of the safety study, the NTSB issued 28 recommendations.[35] The recommendations include developing expanded and improved guidance for operators and inspectors for:
·         The development of criteria for threat identification and elimination;
·         Consideration of interactive threats; and
·         Increased knowledge of the critical components associated with risk assessment approaches.
The NTSB also recommended evaluating and improving gas transmission pipeline integrity assessment methods, including increasing the use of in-line inspection and eliminating the use of direct assessment as the sole integrity assessment method. Other recommendations include: evaluating the effectiveness of the approved risk assessment approaches for IM programs; developing minimum professional qualification criteria for all personnel involved in IM programs; and improving data collection and reporting, including geospatial data, to support the development of probabilistic risk assessment models and the evaluation of IM programs by state and Federal regulators.
The Pipeline Safety, Regulatory Certainty, and Job Creation Act of 2011[36] (the 2011 Act) requires PHMSA to conduct an evaluation on (1) whether IM should be expanded beyond current HCAs, and (2) whether doing so would mitigate the need for class location requirements for gas transmission pipelines. Consequently, PHMSA began a series of rulemaking activities to consider whether IM requirements should be changed, including adding more prescriptive language in some areas, and whether other issues related to system integrity should be addressed by strengthening or expanding non-IM requirements. Among the specific issues PHMSA is considering concerning IM requirements are whether the definition of an HCA should be revised and whether additional restrictions should be placed on the use of specific pipeline assessment methods.[37] The NTSB provided comments and will monitor these rulemakings to ensure PHMSA has the full benefit of the lessons learned through our investigations and safety study.
Pipeline Safety: Integrity Management of Hazardous Liquid Pipelines
            As we learned from the July 25, 2010 pipeline rupture in Marshall, Michigan, and the subsequent release of more than 840,000 gallons of crude oil into nearby wetlands, Talmadge Creek, and the Kalamazoo River, ensuring adequate integrity management programs for pipelines transporting hazardous liquids remains critically important. No fatalities were reported from the crude oil spill; however, local residents self-evacuated from their houses and about 320 people reported symptoms consistent with crude oil exposure.[38] The Marshall, Michigan, spill is among the largest and costliest onshore oil spills in the United States
            The NTSB determined that the probable cause of the pipeline rupture was corrosion fatigue cracks that grew and coalesced from crack and corrosion defects under disbonded polyethylene tape coating, producing a substantial crude oil release that went undetected by Enbridge’s control center for more than 17 hours. The rupture and prolonged release were made possible by pervasive organizational failures at Enbridge and PHMSA’s weak regulation for assessing and repairing crack indications. Contributing to the accident was PHMSA’s ineffective oversight of pipeline integrity management programs, control center procedures, and public awareness. The investigation also determined contributing factors to the severity of the environmental consequences were (1) Enbridge’s failure to identify and ensure the availability of well-trained emergency responders with sufficient response resources, (2) PHMSA’s lack of regulatory guidance for pipeline facility response planning, and (3) PHMSA’s limited oversight of pipeline emergency preparedness that led to the approval of a deficient facility response plan.
The NTSB is pleased that PHMSA has made progress in implementing the recommendations from this investigation, including PHMSA’s development of an NPRM titled "Pipeline Safety: Safety of On-Shore Hazardous Liquid Pipelines." Among other things, the NPRM proposes to incorporate, by reference, consensus standards governing conduct of assessments of the physical condition of in-service pipelines using inline inspection, internal corrosion direct assessment, and stress corrosion cracking direct assessment. 
PHMSA also informed us they are considering revisions to the Control Room Management regulations of the Pipeline Safety Regulations to more explicitly require team training. PHMSA indicated it plans to consider this option through the NPRM titled "Pipeline Safety: Operator Qualification, Cost Recovery, and Other Proposed Changes."
In addition, PHMSA issued two advisory bulletins. The first, Advisory Bulletin 2014-01, was issued on January 28, 2014.[39]  It notified pipeline operators (1) of the circumstances of the Marshall, Michigan, pipeline accident, and (2) of the need to identify deficiencies in facility response plans and to update these plans as necessary to conform with the nonmandatory guidance for determining and evaluating required response resources as provided in Appendix A of Title 49 Code of Federal Regulations Part 194, “Guidelines for the Preparation of Response Plans.” The second, Advisory Bulletin 2014-02, was issued on May 6, 2014.[40]  It was directed to all hazardous liquid and natural gas pipeline operators, and it described the circumstances of the accident in Marshall, Michigan—including the deficiencies observed in Enbridge Incorporated’s integrity management program—and asked them to take appropriate action to eliminate similar deficiencies. 
Hazardous Materials Safety: Air Transportation of Lithium Batteries
There are two types of lithium batteries: primary and secondary. Primary lithium batteries are non-rechargeable and are commonly used in items such as watches and pocket calculators. They contain metallic lithium that is sealed in a metal casing. The metallic lithium will burn when exposed to air if the metal casing is damaged, compromised, or exposed to sustained heating. Secondary lithium batteries, also known as lithium-ion batteries, are rechargeable and are commonly used in items such as cameras, cell phones, laptop computers, and hand power tools. Secondary lithium batteries contain electrically charged lithium ions, and a flammable liquid electrolyte. External damage or overheating of the battery can result in thermal runaway or the discharge of flammable electrolyte. Another type of secondary battery, known as lithium polymer batteries, contains a flammable polymeric material rather than a liquid, as the electrolyte. Halon suppression systems, the only fire suppression systems certified for aviation, can be used to help control flames in lithium battery fires but will not suppress thermal runaway reactions.
The demand for primary and secondary lithium batteries has skyrocketed since the mid-1990s as the popularity and use of electronic equipment of all types has grown. As the use of lithium batteries has increased, the number of incidents involving fires or overheating of lithium batteries, particularly in aviation, has likewise grown. The NTSB has investigated three such aviation accidents: Los Angeles, California; Memphis, Tennessee; and Philadelphia, Pennsylvania.
            The fires in these accidents included both primary and secondary lithium batteries, and the NTSB issued several recommendations as a result of these investigations. As a result of its investigation of the Los Angeles and Memphis incidents, the NTSB recommended that PHMSA, with the FAA, evaluate the fire hazards posed by lithium batteries in an aviation environment and require that appropriate safety measures be taken to protect the aircraft and occupants. The NTSB also recommended that packages containing lithium batteries be identified as hazardous materials, including appropriate labeling of the packages and proper identification in shipping documents when transported on aircraft. These recommendations have been closed with acceptable action by the regulators.
            Following the Philadelphia accident, the NTSB issued six safety recommendations urging PHMSA to address the problems with lithium batteries on a number of fronts, including reporting all incidents; retaining and analyzing failed batteries; researching the modes of failure; and eliminating regulatory provisions that permit limited quantities of these batteries to be transported without labeling, marking, or packaging them as hazardous materials. In January 2008, the NTSB issued additional recommendations to PHMSA and the FAA to address the NTSB’s concerns about the lack of public awareness about the overheating and ignition of lithium batteries. PHMSA issued an NPRM[41] in January 2010 to address some of these recommendations, and the final rule was issued in August 2014. The final rule is discussed in further detail below.
            In September 2010, a Boeing 747-400F, operated by UPS, crash landed on a military base in Dubai, United Arab Emirates (UAE), while the crew was trying to return to the airport for an emergency landing due to a fire in the main deck cargo compartment. Both crewmembers died as a result of injuries sustained during the crash, and the aircraft was a total loss. The UAE led this investigation,[42] and issued a final report on July 24, 2013.[43]  The report found that at least three shipments of lithium ion battery packs that meet Class 9 hazardous material designation were onboard. In addition, in July 2011, a Boeing 747-400F, operated by Asiana Cargo and transporting a large quantity of lithium batteries, crashed about 70 miles west of Jeju Island, Republic of Korea, after the flight crew declared an emergency due to a cargo fire and attempted to divert to Jeju International Airport. Again, both crewmembers died as result of injuries sustained during the crash, and the aircraft was a total loss. 
The NTSB held a public forum in April 2013 on lithium ion batteries in transportation. We learned that lithium ion batteries are becoming more prevalent in the various transportation modes, national defense, and space exploration. Panelists stated that because of their high energy density and light weight, these batteries are natural choices for energy. These benefits, however, also are the source of safety risks. We also heard about manufacturing auditing, robust testing, and monitoring and protection mechanisms to prevent a catastrophic event.
When Congress passed H.R. 658, the FAA Reauthorization bill in 2012, it contained a provision that US hazardous materials regulations (HMR) on the air transportation of lithium metal cells or batteries or lithium ion cells or batteries could not exceed the International Civil Aviation Organization (ICAO) Technical Instructions for the Safe Transport of Dangerous Goods by Air. Consequently, in January 2013, PHMSA published an NPRM stating that it was considering harmonizing requirements in the HMR on the transportation of lithium batteries with changes adopted in the 2013–2014 ICAO Technical Instructions and requested additional comments on (1) the effect of those changes, (2) whether to require compliance with the ICAO Technical Instructions for all shipments by air, both domestic and international, and (3) the impacts if PHMSA failed to adopt specific provisions in the ICAO Technical Instructions into the HMR.[44] In the NTSB’s comments on the NPRM, we noted the disparity between requirements in the HMR, which had weaker standards at the time, and the ICAO Technical Instructions. We explained that failure to require domestic shipments of lithium batteries to comply with regulations equivalent to the ICAO Technical Instructions would place the United States in an inexplicable position of having weaker safety standards at a time when it should be leading the way in response to serious safety concerns about transporting these materials. PHMSA’s final rule harmonized the HMR with the ICAO Technical Instructions as well as with applicable provisions of the United Nations Model Regulations and the International Maritime Dangerous Goods (IMDG) Code.[45]   
The NTSB notes the DOT has for some years worked to ensure that the US hazardous materials regulations are compatible with international standards and, accordingly, has been very active in the development of international standards for the transportation of hazardous materials. However, the DOT has never relinquished its rulemaking authority to an international body. The NTSB concurs with that position and firmly believes the DOT should implement more stringent standards in US regulations if deemed necessary.
Mr. Chairman, the NTSB has a long record of support for improved tank car design, PTC, inward- and outward-facing recorders in locomotive cabs, improved pipeline integrity management, and safe transportation of lithium batteries. As you know, our mission is to promote safety, and the implementation of our recommendations in these areas would help promote and improve safety. 
Thank you for the opportunity to testify before you today. I look forward to responding to your questions.

1] FRA Emerg. Order No. 28, 78 Fed. Reg. at 48221; see also NTSB, Letter to The Honorable Cynthia L. Quarterman, Administrator, Pipeline and Hazardous Materials Safety Administration, U.S. Department of Transportation (Jan. 21, 2014), at 7 n. 11-13 (and citations therein).
[2] NTSB, 2015 Most Wanted List: Improve Rail Tank Car Safety, (2015).
[3] R-12-5 through -8, R-7-4 (reiterated).
[4] See, e.g., NTSB, Derailment of CN Freight Train U70691-18 With Subsequent Hazardous Materials Release and Fire Cherry Valley, Illinois, June 19, 2009, Rpt. No. NTSB/RAR-12/01 (Feb. 14, 2012), at 88 (concluding that, in accident involving breaches of DOT-111 tank cars, “If enhanced tank head and shell puncture-resistance systems such as head shields, tank jackets, and increased shell
thicknesses had been features of the DOT-111 tank cars involved in this accident, the release of hazardous materials likely would have been significantly reduced, mitigating the severity of the accident”). The capacity of a tank car is about 30,000 gallons or 675 barrels of oil.
[5] Transportation Safety Board of Canada, Runaway and Main-Track Derailment, Montreal, Maine & Atlantic Railway Freight Train MMA-002, Mile 0.23, Sherbrooke Subdivision, Lac-Mégantic, Quebec, 06 July 2013 (2014).
[6] R-14-1, R-14-2, R-14-3, R-14-4, R-14-5, and R-14-6.
[7] In 2011, AAR issued CPC-1232, which outlines new standards for tank cars constructed after October 1, 2011, for use in ethanol and crude oil service. These standards, for example, call for DOT-111 tank cars that transport flammable liquids in packing groups I and II (the highest-risk of the three packing groups, classified according to flash and boiling points) to be built with protective “jackets” around their tanks, constructed of normalized steel at least 7/16 inch thick, and call for non-jacketed tanks to be constructed from normalized steel (steel that has been subjected to a heat-treating process that improves its material properties) at least half an inch thick. See AAR, Manual of Standards and Recommended Practices: Specifications for Tank Cars, M-1002. Corresponding Federal regulations require steel thickness of at least 7/16 inch, but they allow for the use of non-normalized steel and do not require incorporation of jackets or head shields. See 49 C.F.R. part 179, subpart D.
[8] R-12-5 through -8, R-7-4 (reiterated), at 4.
[9] NTSB, Comments on PHMSA notice of proposed rulemaking: Hazardous Materials: Enhanced Tank Car Standards and Operational Controls for High-Hazard Flammable Trains, (September 26, 2014), at 11.
[10] 79 Fed. Reg. 45016 (August 1, 2014).
[11] R-12-5 and R-12-6.
[12] R-14-1, R-14-3, R-14-4, and R-14-6.
[13] R-15-14 and R-15-15.
[14] R-15-16 and R-15-17.
[15] The NTSB is an observer to the Transportation Safety Board (TSB) of Canada’s investigation.
[16] R-07-2 and R-07-4.
[17] R-14-14.
[18] NTSB, Metro North Railroad Derailment, Accident Brief No. RAB-14/12 (October 24, 2014).
[19] NTSB, Penn Central Company, Collision of Trains N-48 and N-49 on August 20, 1969, Rpt. No. RAR-70-03 (October 14, 1970).
[20] R-70-020.
[21] Rail Safety Improvement Act of 2008, Pub. L. No. 110-432, § 104 (2008). 
[22] These accidents do not include Metro-North accidents.
[23] R-13-23 and R-13-27.
[24] NTSB, Collision and Derailment of Maryland Rail Commuter Marc Train 286 and National Railroad Passenger Corporation Amtrak Train 29 Near Silver Spring, Maryland On February 16,1996, Rpt. No. NTSB/RAR-97/02 (July 3, 1997), R-97-9. 
[25] NTSB, Collision Involving Three Consolidated Rail Corporation Freight Trains Operating in Fog on a Double Main Track Near Bryan, Ohio on January 17, 1999, Rpt. No. NTSB/RAR-01/01 (May 9, 2001). 
[26] NTSB, Collision of Metrolink Train 111 With Union Pacific Train LOF65-12 Chatsworth, California September 12, 2008, Rpt. No. NTSB/RAR-10/01 (Jan. 21, 2010), at 58.
[27] R-10-1.
[28] R-10-2.
[29] NTSB, Collision of BNSF Coal Train With the Rear End of Standing BNSF Maintenance-of-Way Equipment Train Red Oak, Iowa on April 17, 2011), Rpt. No. NTSB/RAR-12/02 (April 24, 2012). 
[30]  R-14-08, R-14-09.
[31] 49 CFR § 192.3.
[32] PHMSA’s gas transmission IM regulations may be found at 49 CFR Part 192, Subpart O.
[33] NTSB, Columbia Gas Transmission Corporation Pipeline Rupture Sissonville, West Virginia on December 11, 2012, Rpt. No. NTSB/PAR-14/01 (February 19, 2014); NTSB, Rupture of Florida Gas Transmission Pipeline and Release of Natural Gas Near Palm City, Florida, Accident Brief No. NTSB/PAB-13/01 (August 13, 2013); NTSB, Pacific Gas and Electric Company Natural Gas Transmission Pipeline Rupture and Fire San Bruno, California on September 9, 2010, Rpt. No. NTSB/PAR-11/01 (August 30, 2011). 
[34] NTSB, Integrity Management of Gas Transmission Pipelines in High Consequence Areas, No. NTSB/SS-15/01 (January 27, 2015). 
[35] P-15-1 through -28. 
[36] Pub. L. No. 112-90, § 5 (2012).
[37] The two relevant notices are: (1) Pipeline Safety: Safety of Gas Transmission Pipelines -Advanced Notice of Proposed Rulemaking, 76 Fed. Reg. 5308 (Aug. 25, 2011); and (2) Pipeline Safety: Safety of Gas Transmission Pipelines -Advance Notice of Proposed Rulemaking; Extension of Comment Period, 76 Fed. Reg. 70953 (Nov. 16, 2011).
[38] NTSB, Enbridge Incorporated Hazardous Liquid Pipeline Rupture and Release Marshall, Michigan on July 25, 2010, Rpt. No. NTSB/PAR-12/01 (July 10, 2012). 
[39] 79 Fed. Reg. 4532 (Jan. 28, 2014).
[40] 79 Fed. Reg. 25990 (May 6, 2014).
[41] 75 Fed. Reg. 1302 (January 11, 2010).
[42] Foreign investigative entities have authority equivalent to the NTSB under ICAO Annex 13. For this accident, in particular, the NTSB has been involved as the accredited representative as the State of Operator, Registration, and Manufacturer. The operator, manufacturers, and regulator (FAA) are technical advisors to the NTSB accredited representative. The NTSB plans to issue recommendations based on the findings of the UAE investigation.
[43]  General Civil Aviation Authority of the United Arab Emirates, Uncontained Cargo Fire Leading to Loss of Control Inflight and Uncontrolled Descent into Terrain, (July 24, 2013). Available at
[44] 78 Fed. Reg. 1119 (January 7, 2013).
[45] 79 Fed. Reg. 46012 (August 6, 2014).