For two decades, one of the most commonly used type of rail tanker has been allowed to haul hazardous liquids from coast to coast, even though transportation officials were aware of a dangerous design flaw that almost guarantees the car will tear open in an accident, potentially spilling cargo that could catch fire, explode or contaminate the environment.
The rail and chemical industries have committed to a safer design for new tankers but are pressing regulators not to require modifications to tens of thousands of existing cars, despite a spike in the number of accidents as more tankers are put into service to accommodate soaring demand for ethanol, the highly flammable corn-based fuel usually transported by rail.
Derailments have triggered chemical spills and massive blasts like one in July in Columbus, Ohio, that blew up with such intensity that one witness said it "looked like the sun exploded." Some communities with busy railways are beginning to regard the tankers as a serious threat to public safety.
"There's a law of averages that gives me great concern," said Jim Arie, fire chief in Barrington, a wealthy Chicago suburb where ethanol tankers snake through a bustling downtown. "Sometimes I don't sleep well at night."
He's not the only one. The town's mayor is trying to build a national coalition to push for safety reforms.
The tanker, known as the DOT-111, is a workhorse of the American rail fleet, with a soda-can shape that makes it one of the most easily recognizable cars on freight routes.
The tanker itself is not suspected of causing derailments, but its steel shell is too thin to resist puncture in accidents. The ends are especially vulnerable to tears from couplers that can rip off between cars. Unloading valves and other exposed fittings on the tops of tankers can also break during rollovers.
The flaws were noted as far back as a 1991 safety study.
An Associated Press analysis of 20 years' worth of federal rail accident data found that ethanol tankers have been breached in at least 40 serious accidents since 2000. In the previous decade, there were just two breaches.
The number of severe crashes is small considering the total mileage covered by the many tankers in service. But the accident reports show at least two people have been killed by balls of flame, with dozens more hurt. And the risk of greater losses looms large.
The rail and chemical industries and tanker manufacturers have acknowledged the design flaws and voluntarily committed to safety changes for cars built after October 2011 to transport ethanol and crude oil. The improvements include thicker tank shells and shields on the ends of tanks to prevent punctures.
But under their proposal to regulators, the 30,000 to 45,000 existing ethanol tankers would remain unchanged, including many cars that have only recently begun their decades-long service lives.
The National Transportation Safety Board asked in March for the higher standards to be applied to all tankers, meaning existing cars would have to be retrofitted or phased out.
The industry's proposal "ignores the safety risks posed by the current fleet," the NTSB said, adding that those cars "can almost always be expected to breach in derailments that involve pileups or multiple car-to-car impacts."
The federal Pipeline and Hazardous Materials Safety Administration, part of the U.S. Department of Transportation, is considering both arguments, but the regulatory process is slow and could take several years, experts said.
Industry representatives say a retrofit isn't feasible because of engineering challenges and costs. They insist the threat of serious accidents is overstated.
"How many millions of miles have the 111 cars run without problems?" said Lawrence Bierlein, an attorney for the Association of Hazmat Shippers Inc. "It's more likely you're going to be hit by lightning."
But worries about the tankers' weaknesses persist, especially since the volume of dangerous cargo on American rails is only expected to grow.
Ethanol production has soared from 900 million gallons in 1990 to nearly 14 billion gallons last year. Seeking to lessen America's dependence on foreign oil, federal mandates will quadruple the amount of ethanol and other renewable fuel that's blended into the nation's gasoline and diesel by 2022.
Nearly all of it moves by rail. In 2010, that meant 325,000 carloads of ethanol, according to the Association of American Railroads. Ethanol is now the highest-volume hazardous material shipped by rail. In 2000, it wasn't even in the top 10.
"That may account for the increasing frequency of accidents involving the DOT-111s and the current attention that's being drawn to them," said Paul Stancil, a senior hazardous materials accident investigator with the NTSB.
Since 2005, ethanol has increasingly been shipped in higher densities using "virtual pipelines" trains in which every car carries the same product. The NTSB says that practice increases the potential severity of accidents like one in 2009 in the northern Illinois city of Rockford.
On the way home from her nursing job, Chris Carter stopped at a rail crossing near Rockford as a Canadian National freight train barreled past carrying more than 2 million gallons of ethanol to Chicago.
Unknown to the train's two crew members and the small number of waiting motorists, a section of track had washed out in a rainstorm earlier that evening.
"I notice to my right side there's sparks like fireworks, like a sparkler," Carter said. "So that catches my eye. In my head I'm going, 'Oh my God, this is going to derail.' I could feel it, I could tell."
The train began to come apart, its cars bouncing and colliding like toys thrown by a child. One exploded as it tumbled through the air.
"I stood there just frozen, watching these unbelievable explosions," Carter recalled. "The concussion from the energy just blew your hair back."
More than 20 miles away, Carter's husband and son saw the fire from their farmhouse. It looked to them like a sunrise.
As Carter and the others ran, an older woman who injured her knee couldn't move. She cast a tiny silhouette against an enormous wall of flame. A man ran back and rescued her.
On the other side of the tracks, one of the explosions washed over the van of Jose Tellez and his family. His wife, Zoila, was killed.
Witness Matthew Koch told a local newspaper he saw Zoila Tellez run from the vehicle in flames and fall to her knees with her arms outstretched as if she were reaching out for help.
Jose Tellez suffered burns, and his adult daughter, Addriana, who was five months' pregnant, lost her baby.
In addition to the fatality, 11 people were injured, making it the nation's single worst ethanol tanker accident. Nineteen of the 114 cars derailed. Thirteen released ethanol and caught fire.
In its final report in February, the NTSB cited the "inadequate design" of the tanker cars as a factor contributing to the severity of the accident.
The other accident in which a release of ethanol claimed a life was a 1996 derailment at Cajon Junction in southern California. The train's brakeman, who was thrown or jumped from the locomotive, burned to death after apparently trying to crawl to safety in a creek bed.
The Ohio derailment forced a mile-wide evacuation just north of downtown Columbus. Three tankers, each carrying 30,000 gallons of ethanol, caught fire and filled the night sky with flames.
"The heat was so excruciating that I had to ball up and cover my body," said Nicholas Goodrich, a grocery store employee who happened to be nearby and ran to the scene.
The cost of retrofitting existing tankers is estimated conservatively at $1 billion and would be shouldered mostly by the ethanol-makers who own and lease the cars. The rail industry points to its improving safety record, but that's little comfort to communities like Barrington, said Village President Karen Darch.
"There's a risk every day of affecting lots of people in one incident," Darch said, "lots of property, but obviously most importantly, lots of people's lives."