← back to the reports
DR-001 Freight train · Montreal, Maine & Atlantic, Canada 2013

Lac-Mégantic — A Runaway Oil Train, Seven Handbrakes, 47 Dead

runawayfreight2010s
Killed
47
Railway
Montreal, Maine & Atlantic
Service
Crude-oil unit freight
Status
Operator

Summary

Shortly before 01:15 on 6 July 2013, an unattended Montreal, Maine & Atlantic Railway (MMA) freight train carrying Bakken crude oil rolled away from where it had been parked overnight on a descending grade at Nantes, Quebec, ran roughly 7.2 miles downhill gathering speed to about 65 mph, and derailed in the centre of the town of Lac-Mégantic. Sixty-three tank cars left the rails, many were breached, and the released crude ignited in fires and explosions that killed 47 people and destroyed much of the downtown core. It remains one of the deadliest rail disasters in modern Canadian history and the deadliest involving a runaway.

The train — MMA-002 — was a unit train of 72 Class 111 tank cars carrying approximately 7.7 million litres of petroleum crude oil, plus a buffer car, hauled by five locomotives. It had been left for the night at Nantes by a single operating employee, under MMA's single-person train operation. The lead locomotive had a history of mechanical trouble; a substandard engine repair allowed oil to accumulate in the turbocharger, which overheated and caught fire after the train was parked. Firefighters shut the engine down, as their protocols required. With the lead locomotive off, the air compressor that kept the brake system charged stopped running. Over the following hour the air slowly leaked away, the brake cylinders lost their grip, and the seven handbrakes that had been set were not enough to hold the train on the grade. It began to roll.

The Transportation Safety Board of Canada (TSB) investigated under file R13D0054 and released its report on 19 August 2014. It did not reduce the catastrophe to a single mistake: it identified 18 distinct causes and contributing factors and located the failure in the operating company and its oversight — a weak safety culture at MMA, inadequate training and supervision, insufficient handbrakes never properly tested, the practice of leaving a loaded dangerous-goods train unattended on a main-line grade, the absence of any additional physical defence against a runaway, and gaps in Transport Canada's oversight. The Finding is therefore Operator — organizational and oversight failure — not the act of any one employee.

The legal reckoning ran for years and ended without a criminal conviction of the individuals charged. Three former MMA employees were tried on 47 counts each of criminal negligence causing death and acquitted by a jury in January 2018. Separately, MMA and several former employees pleaded guilty to federal regulatory offences; the engineer received a conditional sentence served in the community, and fines were imposed against the bankrupt company. The disaster reshaped North American rules for crude-by-rail, train securement, and tank-car design.

Timeline

5 July 2013, evening
The train is parked
MMA-002 — 72 loaded crude-oil tank cars and a buffer car behind five locomotives — is left for the night at Nantes, on the main line on a descending grade, by a single operating employee who then goes off duty.
5 July, evening
Handbrakes and a running engine
The employee applies seven handbrakes in total and leaves the lead locomotive running to keep the air brakes charged.
5 July, ~23:30
The locomotive catches fire
Oil accumulated in the lead locomotive's turbocharger, from a substandard earlier repair, overheats and ignites; smoke and flame draw the local fire brigade.
5–6 July, ~23:50–00:13
Firefighters shut it down
Responders shut off the burning lead locomotive to fight the fire. With the engine off, the air compressor stops recharging the brake system.
6 July, after midnight
The air bleeds off
Air slowly leaks from the brake system; brake-cylinder pressure falls below the level needed to hold the train, and the seven handbrakes alone cannot restrain the load on the grade.
6 July, ~01:14
It starts to roll
The unattended train begins to move down the grade toward Lac-Mégantic, accelerating with no one aboard.
6 July, ~01:15
Derailment and fire
At about 65 mph the train derails on the curve in the town centre; 63 tank cars leave the rails, many are breached, roughly 6 million litres of crude are released and ignite.
6 July, hours after
The town burns
Explosions and a sustained fire destroy more than 30 buildings; 47 people are killed, most in the bars and businesses of the downtown core.
19 August 2014
The TSB report
Investigation R13D0054 is released, naming 18 causes and contributing factors and faulting MMA's weak safety culture, training and securement practices, and gaps in Transport Canada oversight.
19 January 2018
Three acquitted
A Quebec jury acquits the engineer, the rail-traffic controller, and the manager of train operations of 47 counts each of criminal negligence causing death.
Early 2018
Federal guilty pleas
MMA and several former employees plead guilty to federal regulatory offences; fines totalling about CAD 1.25 million are imposed and the engineer receives a conditional sentence served in the community.

The Train and the Grade

The line between Nantes and Lac-Mégantic descends one of the steepest sustained grades in the Quebec rail network. A loaded unit train of crude oil left standing on such a grade is held in place only by its brakes; gravity works against it continuously. MMA's practice was to park trains at Nantes overnight with the air brakes kept charged by a running locomotive and a modest number of handbrakes set, then hand over to a relief crew in the morning. On most nights it worked, because the running locomotive maintained the air pressure that did most of the holding.

That arrangement depended on two assumptions that failed together. The first was that the lead locomotive would keep running — but it had a known defect, an engine repair using inappropriate material that let oil collect and burn, and it caught fire. The second was that the handbrakes alone could hold the train if the air was lost. They could not. MMA's own instructions called for a number of handbrakes scaled to the train's weight; the employee applied seven, and a proper handbrake effectiveness test — releasing the air and confirming the handbrakes alone hold the train — had not been done. The train was left relying on the locomotive that then failed.

The operation was conducted by a single person. The Board could not establish that a second crew member would have prevented the accident, but the single-person model removed the redundancy — a second set of eyes to confirm that enough handbrakes were set and tested — that a conventional crew provides. The decision to leave the train, the number of handbrakes, the omitted test, and the reliance on a troubled locomotive were all products of how the company operated, not a single momentary lapse.

The Runaway and the Fire

When firefighters arrived at Nantes to fight the locomotive fire, they did what fire procedures called for: they shut the burning engine down. Neither they nor the railway employees on the scene appreciated that shutting off the lead locomotive would stop the air compressor and begin a slow, silent failure of the brakes. There was no warning, no alarm, and no one aboard. The air pressure decayed over roughly an hour. As it fell, the air brakes released their grip car by car until the seven handbrakes could no longer restrain the weight of a fully loaded oil train on a descending grade. Around 01:14 the train began to move.

It ran the 7.2 miles into Lac-Mégantic with no one aboard, accelerating to about 65 mph — far above the limit for the curve at the bottom, in the heart of the town. The train derailed on that curve, and 63 tank cars left the track. They were Class 111 (DOT-111) tank cars, widely used for crude but known to be vulnerable to puncture in a derailment; many were breached, and roughly 6 million litres of volatile Bakken crude spilled and ignited almost at once. The fire and explosions tore through the downtown. Forty-seven people died, many in establishments open late on a summer night; more than 30 buildings were destroyed, and ground, lake, and river were contaminated by crude.

The TSB's reconstruction made the mechanism plain: a securement failure became a runaway, the runaway a high-speed derailment, and the derailment of a long string of volatile crude in fragile tank cars a town-centre conflagration. Each link was foreseeable, and several were addressed in rules only after the fact.

The Board's Verdict

The TSB declined to frame Lac-Mégantic as the failure of one man on one night. Its report identified 18 causes and contributing factors, and the picture was organizational. MMA, the Board found, had a weak safety culture: persistent gaps between the company's written instructions and its actual practices, not caught and closed by management. Training and supervision were inadequate; equipment maintenance — the locomotive repair that caused the fire — was deficient; handbrake application and testing did not follow the company's own rules. Leaving a loaded dangerous-goods train unattended on a main-line grade, secured in a way that depended on a running locomotive, was a standing hazard, and no engineered defence — no derail, no second safeguard — stood ready to catch a runaway if the brakes failed.

The Board also faulted the regulator. Transport Canada, it concluded, had not audited MMA's safety management system often or thoroughly enough to detect and correct the weaknesses the disaster exposed, and follow-up was insufficient. The Finding word the case file carries — Operator — captures this: the cause lay in how the company operated and was overseen, not in a discrete mechanical defect, and not solely in the conduct of the employee who parked the train.

That distinction matters for accountability as well as analysis. When three former MMA employees stood trial for criminal negligence, the jury — which did not hear all of the TSB's organizational findings — acquitted them. The systemic failings the Board described were not the kind a criminal court could readily pin on individuals, which is part of why the regulatory route, not the criminal one, produced the guilty findings.

The Five Factors

01
Securement that depended on a running machine
The train was held on a steep grade chiefly by air brakes kept charged by a locomotive, with only seven handbrakes as backup. A securement scheme that relies on a powered system to stay safe is not secured at all once that system stops; parked dangerous-goods trains must be held by enough mechanical handbrakes, tested with the air released, to hold the grade unaided.
02
The omitted handbrake test
No one confirmed the handbrakes alone could hold the train by releasing the air and checking that it stayed still — the very test designed to catch the situation that occurred. A safety check skipped because the train "always holds" removes the one step that reveals when it will not.
03
Single-person operation removed the second check
One employee parked, secured, and left a loaded crude train with no one to verify the work. Single-point human operation eliminates the redundancy that catches an under-applied or untested brake; high-consequence tasks need an independent confirmation, not the assumption that one person got it right.
04
A maintenance defect lit the fuse
A substandard locomotive repair let oil collect and burn, and the fire led to the shutdown that started the runaway. Deferred or improper maintenance on the equipment a safety scheme relies on converts a known weakness into a system-wide failure; the holding locomotive was a safety-critical item, not a routine one.
05
The cargo and the cars made it catastrophic
Volatile Bakken crude in puncture-prone Class 111 tank cars turned a derailment into a town-centre fire. Matching tank-car robustness, routing, and speed to the actual flammability of the lading is part of operating safely; treating volatile crude as ordinary freight understates the consequence of any single failure upstream.

Aftermath

Lac-Mégantic forced a wholesale reconsideration of how crude oil moves by rail in North America. Regulators in Canada and the United States tightened the rules on securing unattended trains, prohibited leaving certain loaded dangerous-goods trains unattended on main tracks without specified safeguards, accelerated the phase-out and retrofit of the vulnerable DOT-111 tank cars for flammable service, imposed new requirements on the classification of crude, and advanced lower speed limits and route-risk assessments for key trains. MMA did not survive; it went bankrupt, and its assets and the line passed to a successor operator.

The accountability outcomes were mixed and, for many in the town, unsatisfying. The criminal trial of the engineer, the rail-traffic controller, and the operations manager ended in acquittals in January 2018. On the regulatory track, MMA and several former employees pleaded guilty to federal offences related to the failure to properly test the handbrakes; the bankrupt company and individuals were fined, and the engineer received a conditional sentence served in the community. The TSB's central message endured: the disaster was built into the way the operation was run and overseen, and the defences that would have stopped it had to be imposed by rule, because the company's own culture had not provided them.

Lessons

  1. Secure parked dangerous-goods trains with enough handbrakes to hold them on the grade with the air released, and prove it with a handbrake effectiveness test — never let securement depend on a running locomotive.
  2. Treat the equipment a safety scheme relies on as safety-critical; a deferred or substandard repair on a holding locomotive can start the very failure the brakes were meant to prevent.
  3. Build in an independent check for high-consequence tasks; single-person operation removes the redundancy that catches an under-applied or untested brake.
  4. Regulators must audit a railway's safety-management system often enough and deeply enough to find the gap between written rules and daily practice before it kills.
  5. Match tank-car strength, routing, and speed to the real flammability of the cargo; volatile crude in fragile cars turns any upstream failure into a mass-casualty fire.

References