The Fela

Authority: 49 U.S.C. 20103, 20107, 20501–20505; 28 U.S.C. 2461, note; and 49 CFR 1.49.

(a) Except as provided in paragraph (b) of this section, this part applies to all railroads.

(1) A railroad that operates only on track inside an installation that is not part of the general railroad system of transportation; or

(2) Rapid transit operations in an urban area that are not connected to the general railroad system of transportation.

(c) Where a passenger train is operated at a speed of 60 or more miles per hour, or a freight train is operated at a speed of 50 or more miles per hour, a block signal system complying with the provisions of this part shall be installed or a manual block system shall be placed permanently in effect which shall conform to the following conditions:

(1) A passenger train shall not be admitted to a block occupied by another train except under flag protection;

(2) No train shall be admitted to a block occupied by a passenger train except under flag protection;

(3) No train shall be admitted to a block occupied by an opposing train except under flag protection; and

(4) A freight train, including a work train, may be authorized to follow a freight train, including a work train, into a block but the following train must proceed prepared to stop within one-half the range of vision but not exceeding 20 miles per hour.

(d) Where any train is operated at a speed of 80 or more miles per hour, an automatic cab signal, automatic train stop or automatic train control system complying with the provisions of this part shall be installed.

(e) Nothing in this section authorizes the discontinuance of a block signal system, interlocking, traffic control system, automatic train stop, train control, or cab signal system without approval of the Federal Railroad Administration.

(f) Any person (an entity of any type covered under 1 U.S.C. 1, including but not limited to the following: a railroad; a manager, supervisor, official, or other employee or agent of a railroad; any owner, manufacturer, lessor, or lessee of railroad equipment, track, or facilities; any independent contractor providing goods or services to a railroad; and any employee of such owner, manufacturer, lessor, lessee, or independent contractor) who violates any requirement of this part or causes the violation of any such requirement is subject to a civil penalty of at least $550 and not more than $16,000 per violation, except that: Penalties may be assessed against individuals only for willful violations, and, where a grossly negligent violation or a pattern of repeated violations has created an imminent hazard of death or injury to persons, or has caused death or injury, a penalty not to exceed $27,000 per violation may be assessed. Each day a violation continues shall constitute a separate offense. See appendix A to this part for a statement of agency civil penalty policy.

(g) A person may also be subject to criminal penalties for knowingly and wilfully making a false entry in a record or report required to be made under this part, filing a false record or report, or violating any of the provisions of 49 U.S.C. 21311.

(h) The requirements of subpart H of this part apply to safety-critical processor-based signal and train control systems, including subsystems and components thereof, developed under the terms and conditions of that subpart.

[49 FR 3382, Jan. 26, 1984, as amended at 53 FR 52936, Dec. 29, 1988; 63 FR 11624, Mar. 10, 1998; 69 FR 30595, May 28, 2004; 70 FR 11095, Mar. 7, 2005; 72 FR 51198, Sept. 6, 2007]

As required for maintenance, plans shall be kept at all interlockings, automatic signals and controlled points. Plans shall be legible and correct.

Each circuit, the functioning of which affects the safety of train operations, shall be kept free of any ground or combination of grounds which will permit a flow of current equal to or in excess of 75 percent of the release value of any relay or other electromagnetic device in the circuit, except circuits which include any track rail and except the common return wires of single-wire, single-break, signal control circuits using a grounded common, and alternating current power distribution circuits which are grounded in the interest of safety.

The normal functioning of any device shall not be interfered with in testing or otherwise without first taking measures to provide for safety of train operation which depends on normal functioning of such device.

All control circuits the functioning of which affects safety of train operation shall be designed on the closed circuit principle, except circuits for roadway equipment of intermittent automatic train stop system.

Hand-operated switch equipped with switch circuit controller connected to the point, or with facing-point lock and circuit controller, shall be so maintained that when point is open one-fourth inch or more on facing-point switch and three-eights inch or more on trailing-point switch, track or control circuits will be opened or shunted or both, and if equipped with facing-point lock with circuit controller, switch cannot be locked. On such hand-operated switch, switch circuit controllers, facing-point locks, switch-and-lock movements, and their connections shall be securely fastened in place, and contacts maintained with an opening of not less than one-sixteenth inch when open.

Circuit controller operated by switch-and-lock movement shall be maintained so that normally open contacts will remain closed and normally closed contacts will remain open until the switch is locked.

Signal apparatus, the functioning of which affects the safety of train operation, shall be maintained in accordance with the limits within which the device is designed to operate.

Signal control and electric locking circuits shall not be selected through the contacts of instruments designed primarily for indicating or annunciating purposes in which an indicating element attached to the armature is arranged so that it can in itself cause improper operation of the armature.

Electric locks on new installations and new electric locks applied to existing installations shall be of the forced drop type.

When any component of a signal system, the proper functioning of which is essential to the safety of train operation, fails to perform its intended signaling function or is not in correspondence with known operating conditions, the cause shall be determined and the faulty component adjusted, repaired or replaced without undue delay.

Signal protection shall be provided for facing and trailing movements through spring switch within interlocking limits and through spring switch installed in automatic block signal, train stop, train control or cab signal territory where train movements over the switch are made at a speed exceeding 20 miles per hour, except that signal protection shall be required only with the current of traffic on track signaled for movement in only one direction.

Note: Does not apply to spring switch installed prior to October 1, 1950 in automatic block signal, automatic train stop, or automatic train control territory.

The control circuits of signals governing facing movements over a main track spring switch shall be selected through the contacts of a switch circuit controller, or through the contacts of relay repeating the position of such circuit controller, which, when normally closed switch point is open one-fourth inch or more, will cause such signals to display their most restrictive aspects, except that where a separate aspect is displayed for facing movements over the switch in the reverse position the signal shall display its most restrictive aspect when the switch points are open one-fourth inch or more from either the normal or reverse position.

(a) The indication of signal governing movements from siding to main track with the current of traffic on track signaled for movements in only one direction through a spring switch in automatic block signal territory shall be not less restrictive than “Proceed at Restricted Speed' when the block, into which movements are governed by the signal, is occupied, and shall be “Stop” when the main track is occupied by a train approaching the switch within at least 1,500 feet in approach of the approach signal located stopping distance from the main track signal governing trailing movements over switch, except that the indication may be caused to be less restrictive if approach or time locking is used.

(b) The indication of signal governing movements against the current of traffic from the reverse main of main tracks to a single track, or signal governing movements from a siding to a main track signaled for movements in either direction, through a spring switch, in automatic block signal territory, shall be not less restrictive than “Proceed at Restricted Speed” when the block, into which movements are governed by the signal, is occupied by a preceding train, and shall be “Stop” when the block on the single track into which the signal governs is occupied by an opposing train.

(c) The indication of signal governing movements against the current of traffic from the reverse main of main tracks to a single track or signal governing movements from a siding to a main track signaled for movements in either direction through a spring switch in automatic block signal territory shall be “Stop” when the normal direction main track of the double track or the single track signaled for movements in both directions is occupied by a train approaching the switch within at least 1,500 feet in approach of the approach signal located stopping distance from the main track signal governing trailing movements over switch, except that indication may be caused to be less restrictive if approach or time locking is used.

Automatic block, traffic control, train stop, train control and cab signal territory shall be designated in timetable instructions.

When an electric lock releasing circuit is provided on the main track to permit a train or an engine to diverge from the main track without time delay, the circuit shall be of such length to permit occupancy of the circuit to be seen by a crew member stationed at the switch. When the releasing circuit extends into the fouling circuit, a train or engine on the siding shall be prevented from occupying the releasing circuit by a derail either pipe-connected to switch point or equipped with an independently operated electric lock.

(a) Steel or wrought-iron pipe one inch or larger, or members of equal strength, shall be used for operating connections for switches, derails, movable-point frogs, facing-point locks, rail-locking devices of movable bridge protected by interlocking, and mechanically operated signals, except up-and-down rod which may be three-fourths inch pipe or solid rod. Pipe shall be fully screwed into coupling and both ends of each pipe shall be riveted to pipe plug with 2 rivets.

(b) Pipeline shall not be out of alignment sufficiently to interfere with proper operation, shall be properly compensated for temperature changes, and supported on carriers spaced not more than 8 feet apart on tangent and curve of less than 2° and not more than 7 feet apart on curve of 2° or more. With lever in any position, couplings in pipe line shall not foul carriers.

(a) Within 6 months of June 6, 2005, each railroad shall develop and adopt a software management control plan for its signal and train control systems. A railroad commencing operations after June 6, 2005, shall adopt a software management control plan for its signal and train control systems prior to commencing operations.

(b) Within 30 months of the completion of the software management control plan, each railroad shall have fully implemented such plan.

(c) For purposes of this section, “software management control plan” means a plan designed to ensure that the proper and intended software version for each specific site and location is documented (mapped) and maintained through the life-cycle of the system. The plan must further describe how the proper software configuration is to be identified and confirmed in the event of replacement, modification, or disarrangement of any part of the system.

Each roadway signal shall be positioned and aligned so that its aspects can be clearly associated with the track it governs.

At least one-half inch clearance shall be provided between semaphore signal arm, and any object that may interfere with its operation.

(a) Aspects shall be shown by the position of semaphore blades, color of lights, position of lights, flashing of lights, or any combination thereof. They may be qualified by marker plate, number plate, letter plate, marker light, shape and color of semaphore blades or any combination thereof, subject to the following conditions:

(1) Night aspects of roadway signals, except qualifying appurtenances, shall be shown by lights; day aspects by lights or semaphore arms. A single white light shall not be used.

(2) Reflector lenses or buttons or other devices which depend for visibility upon reflected light from an external source shall not be used hereafter in night aspects, except qualifying appurtenances.

(b) The aspects of cab signals shall be shown by lights or by illuminated letters or numbers.

(c) Each aspect displayed by a signal shall be identified by a name and shall indicate action to be taken. Only one name and indication shall apply to those aspects indicating the same action to be taken; the same aspect shall not be used with any other name and indication.

(d) The fundamental indications of signal aspects shall conform to the following:

(1) A red light, a series of horizontal lights or a semaphore blade in a horizontal position shall be used to indicate stop.

(2) A yellow light, a lunar light, or a series of lights or a semaphore blade in the upper or lower quadrant at an angle of approximately 45 degrees to the vertical, shall be used to indicate that speed is to be restricted and stop may be required.

(3) A green light, a series of vertical lights, or a semaphore blade in a vertical position in the upper quadrant or 60° or 90° in the lower quadrant shall be used to indicate proceed at authorized speed.

(e) The names, indications, and aspects of roadway and cab signals shall be defined in the carrier's Operating Rule Book or Special Instructions. Modifications shall be filed with the FRA within thirty days after such modifications become effective.

(f) The absence of a qualifying appurtenance, the failure of a lamp in a light signal, or a false restrictive position of an arm of a semaphore signal shall not cause the display of a less restrictive aspect than intended.

Each roadway signal shall be located with respect to the next signal or signals in advance which govern train movements in the same direction so that the indication of a signal displaying a restrictive aspect can be complied with by means of a brake application, other than an emergency application, initiated at such signal, either by stopping at the signal where a stop is required, or by a reduction in speed to the rate prescribed by the next signal in advance where reduced speed is required.

Buffing device shall be maintained so as not to cause the signal to display a less restrictive aspect than intended.

Track relay controlling home signals shall be in deenergized position, or device that functions as a track relay controlling home signals shall be in its most restrictive state, and the track circuit of an automatic train stop, train control, or cab signal system shall be deenergized in the rear of the point where any of the following conditions exist:

(a) When a rail is broken or a rail or switch-frog is removed except when a rail is broken or removed in the shunt fouling circuit of a turnout or crossover, provided, however, that shunt fouling circuit may not be used in a turnout through which permissible speed is greater than 45 miles per hour. It shall not be a violation of this requirement if a track circuit is energized:

(1) When a break occurs between the end of rail and track circuit connector; within the limits of rail-joint bond, appliance or other protective device, which provides a bypath for the electric current, or

(2) As result of leakage current or foreign current in the rear of a point where a break occurs.

(b) When a train, locomotive, or car occupies any part of a track circuit, including fouling section of turnout except turnouts of hand-operated main track crossover. It shall not be a violation of this requirement where the presence of sand, rust, dirt, grease, or other foreign matter prevents effective shunting, except that where such conditions are known to exist adequate measures to safeguard train operation must be taken.

(2) A switch is not locked where facing-point lock with circuit controller is used.

(3) An independently operated fouling-point derail equipped with switch circuit controller is not in derailing position.

Where relayed cut-section is used in territory where noncoded direct-current track circuits are in use the energy circuit to the adjoining track shall be open and the track circuit shunted when the track relay at such cut-section is in deenergized position.

At grade crossing with an electric railroad where foreign current is present, the electric energy for noncoded direct current track circuit shall feed away from the crossing.

When a track circuit shorter than maximum inner wheelbase of any locomotive or car operated over such track circuit is used for control of signaling facilities, other means shall be used to provide the equivalent of track circuit protection.

Where dead section exceeds 35 feet, a special circuit shall be installed. Where shortest outer wheelbase of a locomotive operating over such dead section is less than 35 feet, the maximum length of the dead section shall not exceed the length of the outer wheelbase of such locomotive unless special circuit is used.

Each track circuit controlling home signal or approach locking shall be so maintained that track relay is in deenergized position, or device that functions as a track relay shall be in its most restrictive state if, when track circuit is dry, a shunt of 0.06 ohm resistance is connected across the track rails of the circuit, including fouling sections of turnouts.

(a) Except as provided in paragraph (b) of this section, shunt wires and fouling wires hereafter installed or replaced shall consist of at least two discrete conductors, and each shall be of sufficient conductivity and maintained in such condition that the track relay will be in deenergized position, or device that functions as a track relay will be in its most restrictive state, when the circuit is shunted.

(b) This rule does not apply to shunt wires where track or control circuit is opened by the switch circuit controller.

Rail joints within the fouling section shall be bonded, and fouling section shall extend at least to a point where sufficient tract centers and allowance for maximum car overhang and width will prevent interference with train, locomotive, or car movement on the adjacent track.

Insulated rail joints shall be maintained in condition to prevent sufficient track circuit current from flowing between the rails separated by the insulation to cause a failure of any track circuit involved.

Switch shunting circuit shall not be hereafter installed, except where tract or control circuit is opened by the circuit controller.

Signal wire on pole line shall be securely tied in on insulator properly fastened to crossarm or bracket supported by pole or other support. Signal wire shall not interfere with, or be interfered by, other wires on the pole line. Aerial cable shall be supported by messenger.

Open-wire transmission line operating at voltage of 750 volts or more shall be placed not less than 4 feet above the nearest crossarm carrying signal or communication circuits.

Insulated wire shall be protected from mechanical injury. The insulation shall not be punctured for test purposes. Splice in underground wire shall have insulation resistance at least equal to the wire spliced.

Each wire shall be tagged or otherwise so marked that it can be identified at each terminal. Tags and other marks of identification shall be made of insulating material and so arranged that tags and wires do not interfere with moving parts of apparatus.

The following inspections and tests shall be made in accordance with specifications of the carrier, subject to approval of the FRA, to determine if the apparatus and/or equipment is maintained in condition to perform its intended function. Electronic device, relay, or other electromagnetic device which fails to meet the requirements of specified tests shall be removed from service, and shall not be restored to service until its operating characteristics are in accordance with the limits within which such device or relay is designed to operate.

(a) Semaphore signal mechanism shall be inspected at least once every six months, and tests of the operating characteristics of all parts shall be made at least once every two years.

(b) Searchlight signal mechanism shall be inspected, and the mechanical movement shall be observed while operating the mechanism to all positions, at least once every six months. Tests of the operating characteristics shall be made at least once every two years.

Switch circuit controller, circuit controller, or point detector operated by hand-operated switch or by power-operated or mechanically-operated switch-and-lock movement shall be inspected and tested at least once every three months.

Shunt fouling circuit shall be inspected and tested at least once every three months.

Electric lock, except forced-drop type, shall be tested at least once every two years.

Each relay, the functioning of which affects the safety of train operations, shall be tested at least once every four years except:

(a) Alternating current centrifugal type relay shall be tested at least once every 12 months;

(b) Alternating current vane type relay and direct current polar type relay shall be tested at least once every 2 years; and

(a) Except as provided in paragraph (b) of this section, a test for grounds on each energy bus furnishing power to circuits, the functioning of which affects the safety of train operation, shall be made when such energy bus is placed in service, and shall be made at least once every three months thereafter.

(b) The provisions of this rule shall not apply to track circuit wires, common return wires of grounded common single-break circuits, or alternating current power distribution circuits grounded in the interest of safety.

(a) Insulation resistance of wires and cables, except wires connected directly to track rails, shall be tested when wires, cables, and insulation are dry. Insulation resistance tests shall be made between all conductors and ground, and between conductors in each multiple conductor cable, and between conductors in trunking, when wires or cables are installed and at least once every ten years thereafter.

(b) Then insulation resistance of wire or cable is found to be less than 500,000 ohms, prompt action shall be taken to repair or replace the defective wire or cable and until such defective wire or cable is replaced, insulation resistance test shall be made annually.

(c) In no case shall a circuit be permitted to function on a conductor having an insulation resistance to ground or between conductors of less than 200,000 ohms during the period required for repair or replacement.

Time releases, timing relays and timing devices shall be tested at least once every twelve months. The timing shall be maintained at not less than 90 percent of the predetermined time interval, which shall be shown on the plans or marked on the time release, timing relay, or timing device.

(a) Results of tests made in compliance with §§236.102 to 236.109, inclusive; 236.376 to 236.387, inclusive; 236.576; 236.577; 236.586 to 236.589, inclusive; and 236.917(a) must be recorded on preprinted forms provided by the railroad or by electronic means, subject to approval by the FRA Associate Administrator for Safety. These records must show the name of the railroad, place and date, equipment tested, results of tests, repairs, replacements, adjustments made, and condition in which the apparatus was left. Each record must be:

(1) Signed by the employee making the test, or electronically coded or identified by number of the automated test equipment (where applicable);

(2) Unless otherwise noted, filed in the office of a supervisory official having jurisdiction; and

(3) Available for inspection and replication by FRA and FRA-certified State inspectors.

(b) Results of tests made in compliance with §236.587 must be retained for 92 days.

(1) Results of tests that pertain to installation or modification must be retained for the life-cycle of the equipment tested and may be kept in any office designated by the railroad; and

(2) Results of periodic tests required for maintenance or repair of the equipment tested must be retained until the next record is filed but in no case less than one year.

(d) Results of all other tests listed in this section must be retained until the next record is filed but in no case less than one year.

(e) Electronic or automated tracking systems used to meet the requirements contained in paragraph (a) of this section must be capable of being reviewed and monitored by FRA at any time to ensure the integrity of the system. FRA's Associate Administrator for Safety may prohibit or revoke a railroad's authority to utilize an electronic or automated tracking system in lieu of preprinted forms if FRA finds that the electronic or automated tracking system is not properly secured, is inaccessible to FRA, FRA-certified State inspectors, or railroad employees requiring access to discharge their assigned duties, or fails to adequately track and monitor the equipment. The Associate Administrator for Safety will provide the affected railroad with a written statement of the basis for his or her decision prohibiting or revoking the railroad from utilizing an electronic or automated tracking system.

The control circuits for home signal aspects with indications more favorable than “proceed at restricted speed” shall be controlled automatically by track circuits extending through the entire block.

Signal governing movements over hand-operated switch in the facing direction shall display its most restrictive aspect when the points are open one-fourth inch or more and, in the trailing direction, three-eighths inch or more, except that where a separate aspect is displayed for facing movements over the switch in the normal and in the reverse position, the signal shall display its most restrictive aspect when the switch points are open one-fourth inch or more from either the normal or reverse position.

At hand-operated crossover between main tracks, protection shall be provided by one of the following:

(a) An arrangement of one or more track circuits and switch circuit controllers,

(b) Facing point locks on both switches of the crossover, with both locks operated by a single lever, or

(c) Electric locking of the switches of the crossover. Signals governing movements over either switch shall display their most restrictive aspect when any of the following conditions exist:

(1) Where protection is provided by one or more track circuits and switch circuit controllers, and either switch is open or the crossover is occupied by a train, locomotive or car in such a manner as to foul the main track. It shall not be a violation of this requirement where the presence of sand, rust, dirt, grease or other foreign matter on the rail prevents effective shunting;

(2) Where facing point locks with a single lever are provided, and either switch is unlocked;

(3) Where the switches are electrically locked, before the electric locking releases.

On track signaled for movements in both directions, a train shall cause one or more opposing signals immediately ahead of it to display the most restrictive aspect, the indication of which shall be not more favorable than “proceed at restricted speed.” Signals shall be so arranged and controlled that if opposing trains can simultaneously pass signals displaying proceed aspects and the next signal in advance of each such signal then displays an aspect requiring a stop, or its most restrictive aspect, the distance between opposing signals displaying such aspects shall be not less than the aggregate of the stopping distances for movements in each direction. Where such opposing signals are spaced stopping distance apart for movements in one direction only, signals arranged to display restrictive aspects shall be provided in approach to at least one of the signals. Where such opposing signals are spaced less than stopping distance apart for movements in one direction, signals arranged to display restrictive aspects shall be provided in approach to both such signals. In absolute permissive block signaling, when a train passes a head block signal, it shall cause the opposing head block signal to display an aspect with an indication not more favorable than “stop.”

The circuits shall be so installed that each signal governing train movements into a block will display its most restrictive aspect when any of the following conditions obtain within the block:

(c) When an independently operated fouling point derail equipped with switch circuit controller is not in derailing position,

(d) When a track relay is in de-energized position or a device which functions as a track relay is in its most restrictive state; or when signal control circuit is deenergized.

The battery or power supply for each signal control relay circuit, where an open-wire circuit or a common return circuit is used, shall be located at the end of the circuit farthest from the relay.

Electric lock on hand-operated switch shall be controlled so that it cannot be unlocked until control circuits of signals governing movements over such switch have been opened. Approach or time locking shall be provided.

Signals shall be provided to govern train movements into and through interlocking limits, except that a signal shall not be required to govern movements over a hand-operated switch into interlocking limits if the switch is provided with an electric lock and a derail at the clearance point, either pipe-connected to the switch or independently locked, electrically. Electric locks installed under this rule must conform to the time and approach locking requirements of Rule 314 (without reference to the 20-mile exceptions), and those of either Rule 760 or Rule 768, as may be appropriate.

Track circuits and route locking shall be provided and shall be effective when the first pair of wheels of a locomotive or a car passes a point not more than 13 feet in advance of the signal governing its movement, measured from the center of the mast, or if there is no mast, from the center of the signal.

The control circuit for each aspect with indication more favorable than “proceed at restricted speed” of power operated signal governing movements over switches, movable-point frogs and derails shall be selected through circuit controller operated directly by switch points or by switch locking mechanism, or through relay controlled by such circuit controller, for each switch, movable-point frog, and derail in the routes governed by such signal. Circuits shall be arranged so that such signal can display an aspect more favorable than “proceed at restricted speed,” only when each switch, movable-point frog, and derail in the route is in proper position.

Mechanical locking, or the same protection effected by means of circuits, shall be provided.

Approach or time locking shall be provided in connection with signals displaying aspects with indications more favorable than “proceed at restricted speed.”

Facing point lock or switch-and-lock movement shall be provided for mechanically operated switch, movable-point frog, or split-point derail.

Indication locking shall be provided for operative approach signals of the semaphore type, power-operated home signals, power-operated switches, movable-point frogs and derails, and for all approach signals except light signals, all aspects of which are controlled by polar or coded track circuits or line circuits so arranged that a single fault will not permit a more favorable aspect than intented to be displayed.

Mechanical or electric locking or electric circuits shall be installed to prevent signals from displaying aspects which permit conflicting movements except that opposing signals may display an aspect indicating proceed at restricted speed at the same time on a track used for switching movements only, by one train at a time. Manual interlocking in service as of the date of this part at which opposing signals on the same track are permitted simultaneously to display aspects authorizing conflicting movements when interlocking is unattended, may be continued, provided that simultaneous train movements in opposite directions on the same track between stations on either side of the interlocking are not permitted.

Note: Relief from the requirement of this section will be granted upon an adequate showing by an individual carrier to allow opposing signals on the same track simultaneously to display aspects to proceed through an interlocking which is unattended, provided that train movements in opposite directions on the same track between stations on either site of the interlocking are not permitted at the same time.

(a) A loss of shunt of 5 seconds or less shall not permit an established route to be changed at an automatic interlocking.

(b) A loss of shunt of 5 seconds or less shall not permit the release of the route locking circuit of each power-operated switch hereafter installed.

A signal shall be provided on main track to govern the approach with the current of traffic to any home signal except where the home signal is the first signal encountered when leaving yards or stations and authorized speed approaching such signal is not higher than slow speed. When authorized speed between home signals on route governed is 20 miles per hour or less, an inoperative signal displaying an aspect indicating “approach next signal prepared to stop” may be used to govern the approach to the home signal.

(a) The control circuits for aspects with indications more favorable than “proceed at restricted speed” shall be selected through track relays, or through devices that function as track relays, for all track circuits in the route governed.

(b) At automatic interlocking, signal control circuits shall be selected (1) through track relays, or devices that function as track relays, for all track circuits in the route governed and in all conflicting routes within the interlocking; (2) through signal mechanism contacts or relay contacts closed when signals for such conflicting routes display “stop” aspects; and (3) through normal contacts of time releases, time element relays, or timing devices for such conflicting routes, or contacts of relays repeating the normal position or normal state of such time releases, time element relays, or timing devices.

When movable bridge is protected by interlocking the signal appliances shall be so interlocked with bridge devices that before a signal governing movements over the bridge can display an aspect to proceed the bridge must be locked and the track alined, with the bridge locking members within one inch of their proper positions and with the track rail on the movable span within three-eighths inch of correct surface and alinement with rail seating device on bridge abutment or fixed span. Emergency bypass switches and devices shall be locked or sealed.

Electric lock shall be provided for each hand-operated switch or derail within interlocking limits, except where train movements are made at not exceeding 20 miles per hour. At manually operated interlocking it shall be controlled by operator of the machine and shall be unlocked only after signals governing movements over such switch or derail display aspects indicating stop. Approach or time locking shall be provided.

When mechanical locking of interlocking machine is being changed or is removed from the machine, or locking becomes disarranged or broken, unless protection equivalent to mechanical locking is provided by electric locking or electric circuits, train movements through the interlocking shall not be permitted until each switch, movable-point frog or derail in the route is spiked, clamped or blocked in proper position so that it cannot be moved by its controlling lever, and then train movements shall not exceed restricted speed until the interlocking is restored to normal operation. It will not be necessary to comply with this requirement at interlockings where protection is in service in accordance with section 303, provided that the signal controls are arranged so that the signals cannot display an aspect the indication of which is less restrictive than “proceed at restricted speed.”

Switch, movable-point frog, or split-point derail equipped with lock rod shall be maintained so that it can not be locked when the point is open three-eighths inch or more.

Plunger of lever operated facing-point lock shall have at least 8-inch stroke. When lock lever is in unlocked position the end of the plunger shall clear the lock rod not more than one inch.

Bolt lock shall be so maintained that signal governing movements over switch or derail and displaying an aspect indicating stop cannot be operated to display a less restrictive aspect while derail is in derailing position, or when switch point is open one-half inch or more.

Locking dog of switch-and-lock movement shall extend through lock rod one-half inch or more in either normal or reverse position.

Point detector shall be maintained so that when switch mechanism is locked in normal or reverse position, contacts cannot be opened by manually applying force at the closed switch point. Point detector circuit controller shall be maintained so that the contacts will not assume the position corresponding to switch point closure if the switch point is prevented by an obstruction, from closing to within one-fourth inch where latch-out device is not used, and to within three-eighths inch where latch-out device is used.

Driving pieces, dogs, stops and trunnions shall be rigidly secured to locking bars. Swing dogs shall have full and free movement. Top plates shall be maintained securely in place.

The various parts of the locking bed, locking bed supports, and tappet stop rail shall be rigidly secured in place and alined to permit free operation of locking.

Locking faces shall fit squarely against each other with a minimum engagement when locked of at least one-half the designed locking face.

Mechanical locking shall be in accordance with locking sheet and dog chart currently in effect.

Locking and connections shall be maintained so that, when a lever or latch is mechanically locked the following will be prevented:

(a) Mechanical machine. (1) Latch-operated locking. Raising lever latch block so that bottom thereof is within three-eighths inch of top of quadrant.

(2) Lever-operated locking. Moving lever latch block more than three-eighths inch on top of quadrant.

(b) Electromechanical machine. (1) Lever moving in horizontal plant. Moving lever more than five-sixteenths inch when in normal position or more than nine-sixteenths inch when in reverse position.

(c) Power machine. (1) Latch-operated locking. Raising lever latch block to that bottom thereof is within seven thirty-seconds inch of top of quadrant.

(2) Lever moving in horizontal plane. Moving lever more than five-sixteenths inch when in normal position or more than nine-sixteenths inch when in reverse position.

In electro-mechanical interlocking machine, locking between electric and mechanical levers shall be maintained so that mechanical lever cannot be operated except when released by electric lever.

Latch shoes, rocker links, and quadrants of Saxby and farmer machines shall be maintained so that locking will not release if a downward force not exceeding a man's weight is exerted on the rocker while the lever is in the mid-stroke position.

Switch circuit controller connected at the point to switch, derail, or movable-point frog, shall be maintained so that its contacts will not be in position corresponding to switch point closure when switch point is open one-fourth inch or more.

Mechanical locking in interlocking machine shall be tested when new locking is installed; and thereafter when change in locking is made, or locking becomes disarranged, or tested at least once every two years, whichever shall occur first.

Approach locking shall be tested when placed in service and thereafter when modified, disarranged, or at least once every two years, whichever shall occur first.

Time locking shall be tested when placed in service and thereafter when modified, disarranged, or at least once every two years, whichever shall occur first.

Route locking or other type of switch locking shall be tested when placed in service and thereafter when modified, disarranged, or at least once every two years, whichever shall occur first.

Indication locking shall be tested when placed in service and thereafter when modified, disarranged, or at least once every two years, whichever shall occur first.

Traffic locking shall be tested when placed in service and thereafter when modified, disarranged, or at least once every two years, whichever shall occur first.

Switch obstruction test of lock rod of each power-operated switch and lock rod of each hand-operated switch equipped with switch-and-lock-movement shall be made when lock rod is placed in service or changed out, but not less than once each month.

Valve locks on valves of the non-cut-off type shall be tested at least once every three months, and valves and valve magnets shall be tested at least once every year.

Restoring feature on power switches shall be tested at least once every three months.

The standards prescribed in §§236.201, to 236.203, inclusive, §§236.205, 236.206, 236.303, 236.307 and 236.309 to 236.311, inclusive, shall apply to traffic control systems.

The control circuits for home signal aspects with indications more favorable than “proceed at restricted speed” shall be controlled by track circuits extending through entire block. Also in addition, at controlled point they may be controlled by control operator, and, at manually operated interlocking, they shall be controlled manually in cooperation with control operator.

Signals at controlled point shall be so interconnected that aspects to proceed cannot be displayed simultaneously for conflicting movements, except that opposing signals may display an aspect indicating “proceed at restricted speed” at the same time on a track used for switching movements only, by one train at a time.

Signals at adjacent controlled points shall be so interconnected that aspects to proceed on tracks signaled for movements at greater than restricted speed cannot be displayed simultaneously for conflicting movements.

On track signaled for movements in both directions, occupancy of the track between opposing signals at adjacent controlled points shall prevent changing the direction of traffic from that which obtained at the time the track became occupied, except that when a train having left one controlled point reaches a section of track immediately adjacent to the next controlled point at which switching is to be performed, an aspect permitting movement at not exceeding restricted speed may be displayed into the occupied block.

Approach or time locking shall be provided for all controlled signals where route or direction of traffic can be changed.

Route locking shall be provided where switches are power-operated. Route locking shall be effective when the first pair of wheels of a locomotive or car passes a point not more than 13 feet in advance of the signal governing its movement, measured from the center of the signal mast or, if there is no mast, from the center of the signal.

(a) Each hand-operated switch in main track shall be locked either electrically or mechanically in normal position, except:

(3) Where a signal is provided to govern train movements from the auxiliary track to the signaled track; or

(4) On a signaled siding without intermediate signals where the maximum authorized speed on the siding does not exceed 30 miles per hour.

(b) Approach or time locking shall be provided and locking may be released either automatically, or by the control operator, but only after the control circuits of signals governing movement in either direction over the switch and which display aspects with indications more favorable than “proceed at restricted speed” have been opened directly or by shunting of track circuit.

Note: Each carrier subject to this rule is hereby authorized to remove electrical or mechanical locks now installed within the purview of §236.410 when either exception (1) or (2) of the present rule is satisfied, subject to the condition that the following procedures and actions be accomplished:

(c) Where a signal is used in lieu of electric or mechanical lock to govern movements from auxiliary track to signaled track, the signal shall not display an aspect to proceed until after the control circuits of signals governing movement on main track in either direction over the switch have been opened, and either the approach locking circuits to the switch are unoccupied or a predetermined time interval has expired.

Note: Railroads shall bring all hand-operated switches that are not electrically or mechanically locked and that do not conform to the requirements of this section on the effective date of this part into conformity with this section in accordance with the following schedule:

The rules and instructions prescribed in §§236.327 and 236.328, §236.330 to §236.334, inclusive, and §236.342 shall apply to traffic control systems.

The inspections and tests prescribed in §§236.377 to 236.380, inclusive, and §§236.382, 236.383, and 236.386 shall apply to traffic control systems.

(a) An automatic train stop system may include a device by means of which the automatic application of the brakes can be forestalled.

(b) Automatic train control system shall include one or more of the following features:

(1) Low-speed restriction, requiring the train to proceed under slow speed after it has either been stopped by an automatic application of the brakes, or under control of the engineman, its speed has been reduced to slow speed, until the apparatus is automatically restored to normal because the condition which caused the restriction no longer affects the movement of the train.

(2) Medium-speed restriction, requiring the train to proceed under medium speed after passing a signal displaying an approach aspect or when approaching a signal requiring a stop, or a stop indication point, in order to prevent an automatic application of the brakes.

Note: Relief from the requirements of paragraphs (b) (1) and (2) of this section will be granted, insofar as speed limits fixed by definitions of Slow and Medium speeds are concerned, upon an adequate showing by an individual carrier where automatic train control systems now in service enforce speed restrictions higher than those required by definitions in §§236.700 to 236.838 inclusive.

(3) Maximum-speed restriction, effecting an automatic brake application whenever the predetermined maximum speed limit is exceeded.

An automatic train-stop or train-control system shall operate to initiate an automatic brake application at least stopping distance from the entrance to a block, wherein any condition described in §236.205 obtains, and at each main track signal requiring a reduction in speed.

An automatic train control system shall operate to initiate an automatic brake application when the speed of the train exceeds the predetermined rate as required by the setting of the speed control mechanism.

(a) A continuous inductive automatic train stop or train control system shall operate in connection with an automatic block signal system and shall be so interconnected with the signal system as to perform its intended function in event of failure of the engineer to acknowledge or obey a restrictive wayside signal or a more restrictive cab signal.

(b) An intermittent inductive automatic train stop system shall operate in connection with an automatic block signal system and shall be so interconnected with the signal system that the failure of the engineer to acknowledge a restrictive wayside signal will cause the intermittent inductive automatic train stop system to perform its intended function.

Proper operative relation between the parts along the roadway and the parts on the locomotive shall obtain under all conditions of speed, weather, wear, oscillation, and shock.

The automatic train stop or train control apparatus shall prevent release of the brakes after automatic application until a reset device has been operated, or the speed of the train has been reduced to a predetermined rate, or the condition that caused the brake application no longer affects the movement of the train. If reset device is used it shall be arranged so that the brakes cannot be released until the train has been stopped, or it shall be located so that it cannot be operated by engineman without leaving his accustomed position in the cab.

The automatic train stop or train control apparatus shall, when operated, cause a full service application of the brakes.

The automatic train stop, train control, or cab signal apparatus shall be so arranged as not to interfere with the application of the brakes by means of the brake valve and not to impair the efficiency of the brake system.

The automatic train stop, train control or cab signal apparatus shall be arranged so that when two or more locomotives are coupled, or a pushing or helping locomotive is used, it can be made operative only on the locomotive from which the brakes are controlled.

The automatic cab signal system shall be arranged so that cab signals will be continuously controlled in accordance with conditions described in §236.205 that obtain at least stopping distance in advance.

The automatic cab signal system shall be arranged so that when a locomotive enters or is within a block, wherein any condition described in §236.205 obtains, the cab signals shall indicate “Proceed at Restricted Speed.”

(a) The automatic cab signal system shall be so arranged that when the cab signal changes to display a more restrictive aspect, an audible indicator will sound continuously until silenced by manual operation of an acknowledging device.

(b) The audible cab indicator of automatic cab signal, automatic train stop, or automatic train control system shall have a distinctive sound and be clearly audible throughout the cab under all operating conditions.

The automatic cab signal system shall be interconnected with the roadway-signal system so that the cab signal indication will not authorize operation of the train at a speed higher than that authorized by the indication of the roadway signal that governed the movement of a train into a block except when conditions affecting movement of trains in the block change after the train passes the signal.

The cab signals shall be plainly visible to member or members of the locomotive crew from their stations in the cab.

Automatic cab signal, train stop, or train control device hereafter installed shall operate from a separate or isolated power supply.

When a roadway element except track circuit of automatic train stop, train control or cab signal system is not functioning as intended, the signal associated with such roadway element shall be caused manually to display its most restrictive aspect until such element has been restored to normal operative condition.

Insulation resistance between roadway inductor and ground shall be maintained at not less than 10,000 ohms.

When a facing point hand-operated switch is open one-fourth inch or more, a trailing point hand-operated switch three-eighths inch or more, or hand-operated switch is not locked where facing point lock with circuit controller is used, the resultant restrictive condition of an automatic train stop or train control device of the continuous type or the resultant restrictive cab signal indication of an automatic cab signal device on an approaching locomotive shall be maintained to within 300 feet of the points of the switch.

Inductor of the inert roadway element type shall be maintained with the inductor pole faces at a height above the plane of the tops of the rails, and with its inner edge at a hmrizontal distance from the gage side of the nearest running rail, in accordance with specifications of the carrier.

Trip arm of automatic train stop device when in the stop position shall be maintained at a height above the plane of the tops of the rails, and at a horizontal distance from its center line to gage side of the nearest running rail, in accordance with specifications of the carrier.

No railroad shall use strap iron inductor or other roadway element with characteristics differing from its standard type on track where speed higher than restricted speed is permitted.

Where trains are not required to stop at the entrance to equipped territory, except when leaving yards and stations and speed until entering equipped territory does not exceed restricted speed, the automatic train stop, train control, or cab signal device shall be operative at least stopping distance from the entrance to such territory except where the approach thereto is governed by automatic approach signal.

The voltage of power supply shall be maintained within 10 percent of rated voltage.

When periodic test prescribed in §236.588 is performed, insulation resistance between wiring and ground of continuous inductive automatic cab signal system, automatic train control system, or automatic train stop system shall be not less than one megohm, and that of an intermittent inductive automatic train stop system, not less than 250,000 ohms. Insulation resistance values between periodic tests shall be not less than 250,000 ohms for a continuous inductive automatic cab signal system, automatic train control system, or automatic train stop system, and 20,000 ohms for an intermittent inductive automatic train stop system.

Seal shall be maintained on any device other than brake-pipe cut-out cock (double-heading cock), by means of which the operation of the pneumatic portion of automatic train-stop or train-control apparatus can be cut out.

The equalizing-reservoir pressure or brake-pipe pressure reduction during an automatic brake application shall be at a rate not less than that which results from a manual service application.

Receiver coil which has been repaired or rewound shall have the same operating characteristics which it possessed originally or as currently specified for new equipment.

Change in adjustment of relay shall be made only in a shop equipped for that purpose except when receiver coils, electro-pneumatic valve, or other essential part of the equipment is replaced. Irregularities in power-supply voltage or other variable factors in the circuit shall not be compensated for by adjustment of the relay.

(a) Receiver of intermittent inductive automatic train stop device of the inert roadway element type shall be maintained with bottom of the receiver at a height above the plane of the tops of the rails, and with its outer edge at a horizontal distance from the gage side of the nearest rail, in accordance with specifications of the carrier.

(b) Receiver of continuous inductive automatic cab signal, train stop, or train control device of locomotive equipped with onboard test equipment, shall be maintained with the bottom of the receiver at a height above the plane of the tops of the rails, and with its outer edge at a horizontal distance from the gage side of the nearest rail, in accordance with specifications of the carrier.

Contact element of automatic train stop device of the mechanical trip type shall be maintained at a height above the plane of the tops of the rails, and at a horizontal distance from the gage side of the rail, in accordance with specifications of the carrier.

The minimum rail current required to restore the locomotive equipment of continuous inductive automatic train stop or train control device to normal condition or to obtain a proceed indication of automatic cab signal device (pick-up) shall be in accordance with specifications of the carrier.

Delay time of automatic train stop or train control system shall not exceed 8 seconds and the spacing of signals to meet the requirements of §236.24 shall take into consideration the delay time.

Acknowledging time of intermittent automatic train-stop device shall be not more than 30 seconds.

Where provision is made for preventing the operation of the pneumatic brake-applying appartus of an automatic train stop or train control device when the double-heading cock is placed in double-heading position, the automatic train stop or train control device shall not be cut out before communication is closed between the engineman's automatic brake valve and the brake pipe, when operating double-heading cock toward double-heading position.

The locomotive from which brakes are controlled, of each train operating in automatic train stop, train control, or cab signal territory shall be equipped with apparatus responsive to the roadway equipment installed on all or any part of the route traversed, and such apparatus shall be in operative condition.

Where an automatic train stop, train control, or cab signal device fails and/or is cut out enroute, train may proceed at restricted speed or if an automatic block signal system is in operation according to signal indication but not to exceed medium speed, to the next available point of communication where report must be made to a designated officer. Where no automatic block signal system is in use train shall be permitted to proceed at restricted speed or where automatic block signal system is in operation according to signal indication but not to exceed medium speed to a point where absolute block can be established. Where an absolute block is established in advance of the train on which the device is inoperative train may proceed at not to exceed 79 miles per hour.

If for any reason a cab signal authorizes a speed different from that authorized by a roadway signal, when a train enters the block governed by such roadway signal, the lower speed shall not be exceeded.

Roadway elements, except track circuits, including those for test purposes, shall be gaged monthly for height and alinement, and shall be tested at least every 6 months.

Test, acknowledgement, and cut-in circuits shall be tested at least once every twelve months.

(a) Except where tests prescribed by §236.588 are performed at intervals of not more than 2 months, each locomotive equipped with an automatic cab signal or train stop or train control device operating in equipped territory shall be inspected for damage to the equipment and tested at least once each calendar day or within 24 hours before departure upon each trip.

(b) Each equipped locomotive shall be tested to determine the locomotive equipment is responsive to the wayside equipment and shall be cycled to determine the device functions as intended.

(c) Each locomotive equipped with intermittent inductive automatic train stop or non-coded continuous inductive automatic train stop or non-coded continuous inductive automatic train control device shall be tested to determine that the pickup of the device is within specified limits.

(a) The automatic train stop, train control, or cab signal apparatus on each locomotive, except a locomotive or a multiple-unit car equipped with mechanical trip stop, shall be tested using one of the following methods:

(b) The test shall be made on departure of the locomotive from its initial terminal unless that apparatus will be cut out between the initial terminal and the equipped territory. If the apparatus is cut out between the initial terminal and the equipped territory the test shall be made prior to entering equipped territory.

(c) If a locomotive makes more than one trip in any 24-hour period, only one departure test is required in such 24-hour period.

(d)(1) Whoever performs the test shall certify in writing that such test was properly performed. The certification and the test results shall be posted in the cab of the locomotive and a copy of the certification and test results left at the test location for filing in the office of the supervisory official having jurisdiction.

(2) If it is impractical to leave a copy of the certification and test results at the location of the test, the test results shall be transmitted to either (i) the dispatcher or (ii) one other designated individual at each location, who shall keep a written record of the test results and the name of the person performing the test. These records shall be retained for at least 92 days.

Effective Date Note: At 49 FR 3387, Jan. 26, 1984, §236.587 was revised. This section contains information collection and recordkeeping requirements and will not become effective until approval has been given by the Office of Management and Budget.

Except as provided in §236.586, periodic test of the automatic train stop, train control, or cab signal apparatus shall be made at least once every 92 days, and on multiple-unit cars as specified by the carrier, subject to approval by the FRA.

(a) Each relay shall be removed from service, subjected to thorough test, necessary repairs and adjustments made, and shall not be replaced in service unless its operating characteristics are in accordance with the limits within which such relay is designed to operate, as follows:

(1) Master or primary relays of torque type depending on spring tension to return contacts to deenergized position in noncoded continuous inductive automatic train stop or train control system, at least once every two years; and

Automatic train stop, train control, or cab signal pneumatic apparatus shall be inspected, cleaned, and the results of such inspection recorded as provided by §229.29(a). When a locomotive with automatic train stop, train control, or cab signal pneumatic apparatus receives out-of-use credit pursuant to §229.33, the automatic train stop, train control, or cab signal apparatus shall be tested in accordance with §236.588 prior to the locomotive being placed in service.

Signals controlled by devices used to provide protection against unusual contingencies, such as landslides, dragging equipment, burned bridges or trestles and washouts shall be located so that stopping distance will be provided between the signal and the point where it is necessary to stop the train.

For the purpose of these rules, standards, and instructions, the following definitions will apply.

An application of the brakes resulting from a continuous or a split reduction in brake pipe pressure at a service rate until maximum brake cylinder pressure is developed. As applied to an automatic or electro-pneumatic brake with speed governor control, an application other than emergency which develops the maximum brake cylinder pressure, as determined by the design of the brake equipment for the speed at which the train is operating.

The part of a semaphore signal displaying an aspect. It consists of a blade fastened to a spectacle.

The appearance of a roadway signal conveying an indication as viewed from the direction of an approaching train; the appearance of a cab signal conveying an indication as viewed by an observer in the cab.

That part of an interlocking machine that contains or holds the tappets, locking bars, crosslocking, dogs and other apparatus used to interlock the levers.

A length of track of defined limits, the use of which by trains is governed by block signals, cab signals, or both.

A block in which no train is permitted to enter while it is occupied by another train.

The lower extremity of a latch rod which engages with a square shoulder of the segment or quadrant to hold the lever in position.

A metallic connection attached to adjoining rails to insure electrical conductivity.

A pipe running from the engineman's brake valve through the train, used for the transmission of air under pressure to charge and actuate the automatic brake equipment and charge the reservoirs of the electro-pneumatic brake equipment on each vehicle of the train.

That section of a structure bridging a navigable waterway so designed that it may be displaced to permit passage of traffic on the waterway.

The compartment of a locomotive from which the propelling power and power brakes of the train are manually controlled.

The measure of electrical values at which electrical or electronic apparatus operate (e.g., drop-away, pick-up, maximum and minimum current, and working value).

A diagrammatic representation of the mechanical locking of an interlocking machine, used as a working plan in making up, assembling and fitting the locking.

A circuit consisting of wire or other conducting material installed between the track rails at each signal in territory where an automatic train stop system or cab signal system of the continuous inductive type with 2-indication cab signals is in service, to enforce acknowledgement by the engineman at each signal displaying an aspect requiring a stop.

A term applied where one wire is used for the return of more than one electric circuit.

An electrical circuit between a source of electric energy and a device which it operates.

A roadway circuit at the entrance to automatic train stop, train control or cab signal territory by means of which locomotive equipment of the continuous inductive type is actuated so as to be in operative condition.

An electric circuit not employing a common return wire; a circuit formed by individual wires throughout.

The track circuit in the fouling section of a turnout, connected in multiple with the track circuit in the main track.

A shunting circuit which is closed through contacts of a switch circuit controller.

A term applied to a circuit used where it is desirable to provide a track circuit but where it is impracticable to maintain a track circuit.

A manually operated valve by means of which the control of brake operation is transferred to the leading locomotive.

Concentric layers of insulated wire wound around the core of a receiver of an automatic train stop, train control or cab signal device on a locomotive.

A device for opening and closing electric circuits, operated by a rod connected to a switch, derail or movable-point frog.

A term applied to stray electric currents which may affect a signaling system, but which are not a part of the system.

A stray electric current of relatively small value which flows through or across the surface of insulation when a voltage is impressed across the insulation.

A location other than a signal location where two adjoining track circuits end within a block.

A cut-section where the energy for one track circuit is supplied through front contacts or through front and polar contacts of the track relay for the adjoining track circuit.

A circuit controller which is part of the switch operating mechanism and operated by a rod connected to a switch, derail or movable point frog to indicate that the point is within a specified distance of the stock rail.

A manually operated electric switch or pneumatic valve by means of which, on a locomotive equipped with an automatic train stop or train control device, an automatic brake application can be forestalled, or by means of which, on a locomotive equipped with an automatic cab signal device, the sounding of the cab indicator can be silenced.

A device whereby the brakes may be released after an automatic train control brake application.

The maximum distance on any portion of any railroad which any train operating on such portion of railroad at its maximum authorized speed, will travel during a full service application of the brakes, between the point where such application is initiated and the point where the train comes to a stop.

A steel block attached to a locking bar or tappet of an interlocking machine, by means of which locking between levers is accomplished.

A locking dog mounted in such a manner that it is free to rotate on a trunnion which is riveted to a locking bar.

That portion of the roadway apparatus of automatic train stop, train control, or cab signal system, such as electric circuit, inductor, or trip arm to which the locomotive apparatus of such system is directly responsive.

The locking surface of a locking dog, tappet or cross locking of an interlocking machine.

An arrangement on an electro-pneumatic switch by means of which power is applied to restore the switch movement to full normal or to full reverse position, before the driving bar creeps sufficiently to unlock the switch, with control level in normal or reverse position.

As applied to an automatic train stop or train control device, to prevent an automatic brake application by operation of an acknowledging device or by manual control of the speed of the train.

An arrangement of signals, with or without other signal appliances, which functions through the exercise of inherent powers as distinguished from those whose functions are controlled manually, and which are so interconnected by means of electric circuits that their movements must succeed each other in proper sequence, train movements over all routes being governed by signal indication.

An arrangement of signals and signal appliances operated from an interlocking machine and so interconnected by means of mechanical and/or electric locking that their movements must succeed each other in proper sequence, train movements over all routes being governed by signal indication.

An overhead wire line consisting of single conductors as opposed to multiple-conductor cables.

That portion of an interlocking machine which transmits motion between the latch and the universal link.

A mechanical lock so arranged that if a switch, derail or movable-point frog is not in the proper position for a train movement, the signal governing that movement cannot display an aspect to proceed; and that will prevent a movement of the switch, derail or movable-point frog unless the signal displays its most restrictive aspect.

A device to prevent or restrict the movement of a lever, a switch or a movable bridge, unless the locking member is withdrawn by an electrical device, such as an electromagnet, solenoid or motor.

An electric lock in which the locking member is mechanically forced down to the locked position.

A mechanical lock for a switch, derail, or movable-point frog, comprising a plunger stand and a plunger which engages a lock rod attached to the switch point to lock the operated unit.

Electric locking effective while a train is approaching, within a specified distance, a signal displaying an aspect to proceed, and which prevents, until after the expiration of a predetermined time interval after such signal has been caused to display its most restrictive aspect, the movement of any interlocked or electrically locked switch, movable-point frog, or derail in the route governed by the signal, and which prevents an aspect to proceed from being displayed for any conflicting route.

The combination of one or more electric locks and controlling circuits by means of which levers of an interlocking machine, or switches or other units operated in connection with signaling and interlocking, are secured against operation under certain conditions.

Electric locking which prevents manipulation of levers that would result in an unsafe condition for a train movement if a signal, switch, or other operative unit fails to make a movement corresponding to that of its controlling lever, or which directly prevents the operation of a signal, switch, or other operative unit, in case another unit which should operate first fails to make the required movement.

The mechanical locking of an interlocking machine which is actuated by means of the lever latch.

The mechanical locking of an interlocking machine which is actuated by means of the lever.

An arrangement of locking bars, dogs, tappets, cross locking and other apparatus by means of which interlocking is effected between the levers of an interlocking machine and so interconnected that their movements must succeed each other in a predetermined order.

The rail locks, bridge locks, bolt locks, circuit controllers, and electric locks used in providing interlocking protection at a movable bridge.

Electric locking, effective when a train passes a signal displaying an aspect for it to proceed, which prevents the movement of any switch, movable-point frog, or derail in advance of the train within the route entered. It may be so arranged that as a train clears a track section of the route, the locking affecting that section is released.

A method of locking, either mechanical or electrical, which, after a signal has been caused to display an aspect to proceed, prevents, until after the expiration of a predetermined time interval after such signal has been caused to display its most restrictive aspect, the operation of any interlocked or electrically locked switch, movable-point frog, or derail in the route governed by that signal, and which prevents an aspect to proceed from being displayed for any conflicting route.

Electric locking which prevents the manipulation of levers or other devices for changing the direction of traffic on a section of track while that section is occupied or while a signal displays an aspect for a movement to proceed into that section.

An assemblage of manually operated devices for controlling the functions of a traffic control system; it may include a track diagram with indication lights.

An assemblage of manually operated levers or other devices for the control of signals, switches or other units.

The movement of a train over the points of a switch which face in a direction opposite to that in which the train is moving.

A device, the complete operation of which performs the three functions of unlocking, operating and locking a switch, movable-point frog or derail.

The movement of a train over the points of a switch which face in the direction in which the train is moving.

An employee assigned to operate the control machine of a traffic control system.

A crank secured to a locking shaft by means of which horizontal movement is imparted to a longitudinal locking bar.

A metal plate secured to a locking bracket to prevent the cross locking from being forced out of the bracket.

That part of a facing point lock which secures the lock rod to the plunger stand when the switch is locked.

A location where signals and/or other functions of a traffic control system are controlled from the control machine.

As applied to an automatic train stop or train control system without the use of roadway signals, a point where a signal displaying an aspect requiring a stop would be located.

The position assumed by the moving member of an electromagnetic device when the device is deprived of its operating current.

The principle of circuit design where a normally energized electric circuit which, on being interrupted or deenergized, will cause the controlled function to assume its most restrictive condition.

An arrangement to prevent the improper operation of a signal, switch, movable-point frog, or derail as the result of a cross in electrical circuits.

Railroad means any form of non-highway ground transportation that runs on rails or electromagnetic guideways and any entity providing such transportation, including—

(a) Commuter or other short-haul railroad passenger service in a metropolitan or suburban area and commuter railroad service that was operated by the Consolidated Rail Corporation on January 1, 1979; and

(b) High speed ground transportation systems that connect metropolitan areas, without regard to whether those systems use new technologies not associated with traditional railroads; but does not include rapid transit operations in an urban area that are not connected to the general railroad system of transportation.

A device on a locomotive, so placed that it is in position to be influenced inductively or actuated by an automatic train stop, train control or cab signal roadway element.

A relay which will not close its front contacts or open its back contacts, or both, until the expiration of a definite time intervals after the relay has been energized.

A device used to prevent the operation of an operative unit until after the expiration of a predetermined time interval after the device has been actuated.

The electrical value at which the movable member of an electromagnetic device will move to its deenergized portion.

An air reservoir connected with and adding volume to the top portion of the equalizing piston chamber of the automatic brake valve, to provide uniform service reductions in brake pipe pressure regardless of the length of the train.

A rod, attached to the front rod or lug of a switch, movable-point frog or derail, through which a locking plunger may extend when the switch points or derail are in the normal or reverse position.

A rod used for connecting the semaphore arm to the operating mechanism of a signal.

Two or more routes, opposing, converging or intersecting, over which movements cannot be made simultaneously without possibility of collision.

A section of track, either within a track circuit or between two track circuits, the rails of which are not part of a track circuit.

The section of track between the switch points and the clearance point in a turnout.

A description in tabular form of the locking operations in an interlocking machine.

The casting by means of which the latch rod and the latch block are held to a lever of a mechanical interlocking machine.

A roadway signal used to govern the approach to another signal and if operative so controlled that its indication furnishes advance information of the indication of the next signal.

A roadway signal operated either automatically or manually at the entrance to a block.

A signal located in engineman's compartment or cab, indicating a condition affecting the movement of a train and used in conjunction with interlocking signals and in conjunction with or in lieu of block signals.

A roadway signal at the entrance to a route or block to govern trains in entering and using that route or block.

Roadway signals which govern movements in opposite directions on the same track.

A mechanically operated signal with an electromagnetic device inserted in its operating connection to provide a means of controlling the signal electrically, as well as mechanically.

That part of a semaphore arm which holds the roundels and to which the blade is fastened.

A speed that will permit stopping within one-half the range of vision, but not exceeding 20 miles per hour.

The mode of an electric or electronic device that is equivalent to a track relay in its deenergized position.

As applied to mechanical locking, a device secured to a locking bar to limit its movement.

The precedence conferred upon one train over other trains by train order or by reason of its class or the direction of its movement.

A switch, the points of which face traffic approaching in the direction for which the track is signaled.

A switch within the interlocking limits the control of which is interlocked with other functions of the interlocking.

A switch operated by an electrically, hydraulically, or pneumatically driven switch-and-lock movement.

A switch equipped with a spring device which forces the points to their original position after being trailed through and holds them under spring compression.

A switch, the points of which face away from traffic approaching in the direction for which the track is signaled.

A block signal system wherein the use of each block is governed by an automatic block signal, cab signal, or both.

A system so arranged that its operation will automatically result in the following:

(a) A full service application of the brakes which will continue either until the train is brought to a stop, or, under control of the engineman, its speed is reduced to a predetermined rate.

(b) When operating under a speed restriction, an application of the brakes when the speed of the train exceeds the predetermined rate and which will continue until the speed is reduced to that rate.

A system so arranged that its operation will automatically result in the application of the brakes until the train has been brought to a stop.

A method of governing the movement of trains into or within one or more blocks by block signals or cab signals.

A block signal system under which train movements are authorized by block signals whose indications supersede the superiority of trains for both opposing and following movements on the same track.

As applied to an intermittent automatic train stop system, a predetermined time within which an automatic brake application may be forestalled by means of the acknowledging device.

As applied to an automatic train stop or train control system, the time which elapses after the onboard apparatus detects a more restrictive indication until the brakes start to apply.

A track, other than auxiliary track, extending through yards and between stations, upon which trains are operated by timetable or train orders, or both, or the use of which is governed by block signals.

A train, the movement of which is in a direction opposite to and toward another train on the same track.

A movement of a locomotive over all or any portion of automatic train stop, train control or cab signal territory between the terminals for that locomotive; a movement in one direction.

A valve electrically operated which, when operated, will permit or prevent passage of air.

(a) What is the purpose of this subpart? The purpose of this subpart is to promote the safe operation of processor-based signal and train control systems, subsystems, and components that are safety-critical products, as defined in §236.903, and to facilitate the development of those products.

(b) What topics does it cover? This subpart prescribes minimum, performance-based safety standards for safety-critical products, including requirements to ensure that the development, installation, implementation, inspection, testing, operation, maintenance, repair, and modification of those products will achieve and maintain an acceptable level of safety. This subpart also prescribes standards to ensure that personnel working with safety-critical products receive appropriate training. Each railroad may prescribe additional or more stringent rules, and other special instructions, that are not inconsistent with this subpart.

(c) What other rules apply? (1) This subpart does not exempt a railroad from compliance with the requirements of subparts A through G of this part, except to the extent a PSP explains to FRA Associate Administrator for Safety's satisfaction the following:

(ii) Why the objectives of any such requirements are not relevant to the product; or

(iii) How the requirement is satisfied using alternative means. (See §236.907(a)(14)).

(2) Products subject to this subpart are also subject to applicable requirements of parts 233, 234 and 235 of this chapter. See §234.275 of this chapter with respect to use of this subpart to qualify certain products for use within highway-rail grade crossing warning systems.

(3) Information required to be submitted by this subpart that a submitter deems to be trade secrets, or commercial or financial information that is privileged or confidential under Exemption 4 of the Freedom of Information Act, 5 U.S.C. 552(b)(4), shall be so labeled in accordance with the provisions of §209.11 of this chapter. FRA handles information so labeled in accordance with the provisions of §209.11 of this chapter.

Associate Administrator for Safety means the Associate Administrator for Safety, FRA, or that person's delegate as designated in writing.

Component means an element, device, or appliance (including those whose nature is electrical, mechanical, hardware, or software) that is part of a system or subsystem.

Configuration management control plan means a plan designed to ensure that the proper and intended product configuration, including the hardware components and software version, is documented and maintained through the life-cycle of the products in use.

Employer means a railroad, or contractor to a railroad, that directly engages or compensates individuals to perform the duties specified in §236.921 (a).

Executive software means software common to all installations of a given product. It generally is used to schedule the execution of the site-specific application programs, run timers, read inputs, drive outputs, perform self-diagnostics, access and check memory, and monitor the execution of the application software to detect unsolicited changes in outputs.

Full automatic operation means that mode of an automatic train control system capable of operating without external human influence, in which the locomotive engineer/operator may act as a passive system monitor, in addition to an active system controller.

Hazard means an existing or potential condition that can result in an accident.

High degree of confidence, as applied to the highest level of aggregation, means there exists credible safety analysis supporting the conclusion that the likelihood of the proposed condition associated with the new product being less safe than the previous condition is very small.

Human factors refers to a body of knowledge about human limitations, human abilities, and other human characteristics, such as behavior and motivation, that must be considered in product design.

Human-machine interface (HMI) means the interrelated set of controls and displays that allows humans to interact with the machine.

Initialization refers to the startup process when it is determined that a product has all required data input and the product is prepared to function as intended.

Materials handling refers to explicit instructions for handling safety-critical components established to comply with procedures specified in the PSP.

Mean Time to Hazardous Event (MTTHE) means the average or expected time that a subsystem or component will operate prior to the occurrence of an unsafe failure.

New or next-generation train control system means a train control system using technologies not in use in revenue service at the time of PSP submission or without established histories of safe practice.

Petition for approval means a petition to FRA for approval to use a product on a railroad as described in its PSP. The petition for approval is to contain information that is relevant to determining the safety of the resulting system; relevant to determining compliance with this part; and relevant to determining the safety of the product, including a complete copy of the product's PSP and supporting safety analysis.

Predefined change means any post-implementation modification to the use of a product that is provided for in the PSP (see §236.907(b)).

Previous Condition refers to the estimated risk inherent in the portion of the existing method of operation that is relevant to the change under analysis (including the elements of any existing signal or train control system relevant to the review of the product).

Processor-based, as used in this subpart, means dependent on a digital processor for its proper functioning.

Product means a processor-based signal or train control system, subsystem, or component.

Product Safety Plan (or PSP ) refers to a formal document which describes in detail all of the safety aspects of the product, including but not limited to procedures for its development, installation, implementation, operation, maintenance, repair, inspection, testing and modification, as well as analyses supporting its safety claims, as described in §236.907.

Railroad Safety Program Plan (or RSPP ) refers to a formal document which describes a railroad's strategy for addressing safety hazards associated with operation of products under this subpart and its program for execution of such strategy though the use of PSP requirements, as described in §236.905.

Revision control means a chain of custody regimen designed to positively identify safety-critical components and spare equipment availability, including repair/replacement tracking in accordance with procedures outlined in the PSP.

Risk means the expected probability of occurrence for an individual accident event (probability) multiplied by the severity of the expected consequences associated with the accident (severity).

Risk assessment means the process of determining, either quantitatively or qualitatively, the measure of risk associated with use of the product under all intended operating conditions or the previous condition.

Safety-critical, as applied to a function, a system, or any portion thereof, means the correct performance of which is essential to safety of personnel or equipment, or both; or the incorrect performance of which could cause a hazardous condition, or allow a hazardous condition which was intended to be prevented by the function or system to exist.

System refers to a signal or train control system and includes all subsystems and components thereof, as the context requires.

System Safety Precedence means the order of precedence in which methods used to eliminate or control identified hazards within a system are implemented.

Validation means the process of determining whether a product's design requirements fulfill its intended design objectives during its development and life-cycle. The goal of the validation process is to determine “whether the correct product was built.”

Verification means the process of determining whether the results of a given phase of the development cycle fulfill the validated requirements established at the start of that phase. The goal of the verification process is to determine “whether the product was built correctly.”

(a) What is the purpose of an RSPP? A railroad subject to this subpart shall develop an RSPP, subject to FRA approval, that serves as its principal safety document for all safety-critical products. The RSPP must establish the minimum PSP requirements that will govern the development and implementation of all products subject to this subpart, consistent with the provisions contained in §236.907.

(b) What subject areas must the RSPP address? The railroad's RSPP must address, at a minimum, the following subject areas:

(1) Requirements and concepts. The RSPP must require a description of the preliminary safety analysis, including:

(i) A complete description of methods used to evaluate a system's behavioral characteristics;

(2) Design for verification and validation. The RSPP must require the identification of verification and validation methods for the preliminary safety analysis, initial development process, and future incremental changes, including standards to be used in the verification and validation process, consistent with Appendix C to this part. The RSPP must require that references to any non-published standards be included in the PSP.

(3) Design for human factors. The RSPP must require a description of the process used during product development to identify human factors issues and develop design requirements which address those issues.

(4) Configuration management control plan. The RSPP must specify requirements for configuration management for all products to which this subpart applies.

(c) How are RSPP's approved? (1) Each railroad shall submit a petition for approval of an RSPP in triplicate to the Associate Administrator for Safety, FRA, 1120 Vermont Avenue, NW., Mail Stop 25, Washington, DC 20590. The petition must contain a copy of the proposed RSPP, and the name, title, address, and telephone number of the railroad's primary contact person for review of the petition.

(2) Normally within 180 days of receipt of a petition for approval of an RSPP, FRA:

(i) Grants the petition, if FRA finds that the petition complies with applicable requirements of this subpart, attaching any special conditions to the approval of the petition as necessary to carry out the requirements of this subpart;

(3) If no action is taken on the petition within 180 days, the petition remains pending for decision. The petitioner is encouraged to contact FRA for information concerning its status.

(4) FRA may reopen consideration of any previously-approved petition for cause, providing reasons for such action.

(d) How are RSPP's modified? (1) Railroads shall obtain FRA approval for any modification to their RSPP which affects a safety-critical requirement of a PSP. Other modifications do not require FRA approval.

(2) Petitions for FRA approval of RSPP modifications are subject to the same procedures as petitions for initial RSPP approval, as specified in paragraph (c) of this section. In addition, such petitions must identify the proposed modification(s) to be made, the reason for the modification(s), and the effect of the modification(s) on safety.

(1) A complete description of the product, including a list of all product components and their physical relationship in the subsystem or system;

(2) A description of the railroad operation or categories of operations on which the product is designed to be used, including train movement density, gross tonnage, passenger train movement density, hazardous materials volume, railroad operating rules, and operating speeds;

(3) An operational concepts document, including a complete description of the product functionality and information flows;

(4) A safety requirements document, including a list with complete descriptions of all functions which the product performs to enhance or preserve safety;

(5) A document describing the manner in which product architecture satisfies safety requirements;

(6) A hazard log consisting of a comprehensive description of all safety-relevant hazards to be addressed during the life cycle of the product, including maximum threshold limits for each hazard (for unidentified hazards, the threshold shall be exceeded at one occurrence);

(8) A hazard mitigation analysis, including a complete and comprehensive description of all hazards to be addressed in the system design and development, mitigation techniques used, and system safety precedence followed, as prescribed by the applicable RSPP;

(9) A complete description of the safety assessment and verification and validation processes applied to the product and the results of these processes, describing how subject areas covered in Appendix C to this part are either: addressed directly, addressed using other safety criteria, or not applicable;

(10) A complete description of the safety assurance concepts used in the product design, including an explanation of the design principles and assumptions;

(11) A human factors analysis, including a complete description of all human-machine interfaces, a complete description of all functions performed by humans in connection with the product to enhance or preserve safety, and an analysis in accordance with Appendix E to this part or in accordance with other criteria if demonstrated to the satisfaction of the Associate Administrator for Safety to be equally suitable;

(12) A complete description of the specific training of railroad and contractor employees and supervisors necessary to ensure the safe and proper installation, implementation, operation, maintenance, repair, inspection, testing, and modification of the product;

(13) A complete description of the specific procedures and test equipment necessary to ensure the safe and proper installation, implementation, operation, maintenance, repair, inspection, testing, and modification of the product. These procedures, including calibration requirements, shall be consistent with or explain deviations from the equipment manufacturer's recommendations;

(14) An analysis of the applicability of the requirements of subparts A through G of this part to the product that may no longer apply or are satisfied by the product using an alternative method, and a complete explanation of the manner in which those requirements are otherwise fulfilled (see §234.275 of this chapter and §236.901(c));

(15) A complete description of the necessary security measures for the product over its life-cycle;

(16) A complete description of each warning to be placed in the Operations and Maintenance Manual identified in §236.919, and of all warning labels required to be placed on equipment as necessary to ensure safety;

(17) A complete description of all initial implementation testing procedures necessary to establish that safety-functional requirements are met and safety-critical hazards are appropriately mitigated;

(i) All post-implementation testing (validation) and monitoring procedures, including the intervals necessary to establish that safety-functional requirements, safety-critical hazard mitigation processes, and safety-critical tolerances are not compromised over time, through use, or after maintenance (repair, replacement, adjustment) is performed; and

(ii) Each record necessary to ensure the safety of the system that is associated with periodic maintenance, inspections, tests, repairs, replacements, adjustments, and the system's resulting conditions, including records of component failures resulting in safety-relevant hazards (see §236.917(e)(3));

(19) A complete description of any safety-critical assumptions regarding availability of the product, and a complete description of all backup methods of operation; and

(20) A complete description of all incremental and predefined changes (see paragraphs (b) and (c) of this section).

(b) What requirements apply to predefined changes? (1) Predefined changes are not considered design modifications requiring an entirely new safety verification process, a revised PSP, and an informational filing or petition for approval in accordance with §236.915. However, the risk assessment for the product must demonstrate that operation of the product, as modified by any predefined change, satisfies the minimum performance standard.

(2) The PSP must identify configuration/revision control measures designed to ensure that safety-functional requirements and safety-critical hazard mitigation processes are not compromised as a result of any such change. (Software changes involving safety functional requirements or safety critical hazard mitigation processes for components in use are also addressed in paragraph (c) of this section.)

(c) What requirements apply to other product changes? (1) Incremental changes are planned product version changes described in the initial PSP where slightly different specifications are used to allow the gradual enhancement of the product's capabilities. Incremental changes shall require verification and validation to the extent the changes involve safety-critical functions.

(d) What are the responsibilities of the railroad and product supplier regarding communication of hazards? (1) The PSP shall specify all contractual arrangements with hardware and software suppliers for immediate notification of any and all safety critical software upgrades, patches, or revisions for their processor-based system, sub-system, or component, and the reasons for such changes from the suppliers, whether or not the railroad has experienced a failure of that safety-critical system, sub-system, or component.

(2) The PSP shall specify the railroad's procedures for action upon notification of a safety-critical upgrade, patch, or revision for this processor-based system, sub-system, or component, and until the upgrade, patch, or revision has been installed; and such action shall be consistent with the criterion set forth in §236.915(d) as if the failure had occurred on that railroad.

(3) The PSP must identify configuration/revision control measures designed to ensure that safety-functional requirements and safety-critical hazard mitigation processes are not compromised as a result of any such change, and that any such change can be audited.

(4) Product suppliers entering into contractual arrangements for product support described in a PSP must promptly report any safety-relevant failures and previously unidentified hazards to each railroad using the product.

(a) What is the minimum performance standard for products covered by this subpart? The safety analysis included in the railroad's PSP must establish with a high degree of confidence that introduction of the product will not result in risk that exceeds the previous condition. The railroad shall determine, prior to filing its petition for approval or informational filing, that this standard has been met and shall make available the necessary analyses and documentation as provided in this subpart.

(b) How does FRA determine whether the PSP requirements for products covered by subpart H have been met? With respect to any FRA review of a PSP, the Associate Administrator for Safety independently determines whether the railroad's safety case establishes with a high degree of confidence that introduction of the product will not result in risk that exceeds the previous condition. In evaluating the sufficiency of the railroad's case for the product, the Associate Administrator for Safety considers, as applicable, the factors pertinent to evaluation of risk assessments, listed in §236.913(g)(2).

(c) What is the scope of a full risk assessment required by this section? A full risk assessment performed under this subpart must address the safety risks affected by the introduction, modification, replacement, or enhancement of a product. This includes risks associated with the previous condition which are no longer present as a result of the change, new risks not present in the previous condition, and risks neither newly created nor eliminated whose nature (probability of occurrence or severity) is nonetheless affected by the change.

(d) What is an abbreviated risk assessment, and when may it be used? (1) An abbreviated risk assessment may be used in lieu of a full risk assessment to show compliance with the performance standard if:

(ii) Severity of each hazard associated with the previous condition does not increase from the previous condition; and

(2) An abbreviated risk assessment supports the finding required by paragraph (a) of this section if it establishes that the resulting MTTHE for the proposed product is greater than or equal to the MTTHE for the system, component or method performing the same function in the previous condition. This determination must be supported by credible safety analysis sufficient to persuade the Associate Administrator for Safety that the likelihood of the new product's MTTHE being less than the MTTHE for the system, component, or method performing the same function in the previous condition is very small.

(3) Alternatively, an abbreviated risk assessment supports the finding required by paragraph (a) of this section if:

(i) The probability of failure for each hazard of the product is equal to or less the corresponding recommended Specific Quantitative Hazard Probability Ratings classified as more favorable than “undesirable” by AREMA Manual Part 17.3.5 (Recommended Procedure for Hazard Identification and Management of Vital Electronic/Software-Based Equipment Used in Signal and Train Control Applications), or—in the case of a hazard classified as undesirable—the Associate Administrator for Safety concurs that mitigation of the hazard within the framework of the electronic system is not practical and the railroad proposes reasonable steps to undertake other mitigation. The Director of the Federal Register approves the incorporation by reference of the entire AREMA Communications and Signal Manual, Volume 4, Section 17—Quality Principles (2005) in this section in accordance with 5 U.S.C. 552(a) and 1 CFR part 51. You may obtain a copy of the incorporated standard from American Railway Engineering and Maintenance of Way Association, 8201 Corporation Drive, Suite 1125, Landover, MD 20785–2230. You may inspect a copy of the incorporated standard at the Federal Railroad Administration, Docket Clerk, 1120 Vermont Ave., NW., Suite 7000, or at the National Archives and Records Administration (NARA). For information on the availability of this material at NARA, call 202–741–6030, or go to http://www.archives.gov/federal_register/code_of_federal_regulations/ibr_locations.html ;

(A) AREMA Manual Part 17.3.1 (Communications and Signal Manual of Recommended Practices, Recommended Safety Assurance Program for Electronic/Software Based Products Used in Vital Signal Applications);

(B) AREMA Manual Part 17.3.3 (Communications and Signal Manual of Recommended Practices, Recommended Practice for Hardware Analysis for Vital Electronic/Software-Based Equipment Used in Signal and Train Control Applications);

(C) AREMA Manual Part 17.3.5 (Communications and Signal Manual of Recommended Practices, Recommended Practice for Hazard Identification and Management of Vital Electronic/Software-Based Equipment Used in Signal and Train Control Applications);

(iii) Analysis supporting the PSP suggests no credible reason for believing that the product will be less safe than the previous condition.

(e) How are safety and risk measured for the full risk assessment? Risk assessment techniques, including both qualitative and quantitative methods, are recognized as providing credible and useful results for purposes of this section if they apply the following principles:

(1) Safety levels must be measured using competent risk assessment methods and must be expressed as the total residual risk in the system over its expected life-cycle after implementation of all mitigating measures described in the PSP. Appendix B to this part provides criteria for acceptable risk assessment methods. Other methods may be acceptable if demonstrated to the satisfaction of the Associate Administrator for Safety to be equally suitable.

(2) For the previous condition and for the life-cycle of the product, risk levels must be expressed in units of consequences per unit of exposure.

(i) In all cases exposure must be expressed as total train miles traveled per year. Consequences must identify the total cost, including fatalities, injuries, property damage, and other incidental costs, such as potential consequences of hazardous materials involvement, resulting from preventable accidents associated with the function(s) performed by the system. A railroad may, as an alternative, use a risk metric in which consequences are measured strictly in terms of fatalities.

(ii) In those cases where there is passenger traffic, a second risk metric must be calculated, using passenger-miles traveled per year as the exposure, and total societal costs of passenger injuries and fatalities, resulting from preventable accidents associated with the function(s) performed by the system, as the consequences.

(3) If the description of railroad operations for the product required by §236.907(a)(2) involves changes to the physical or operating conditions on the railroad prior to or within the expected life cycle of the product subject to review under this subpart, the previous condition shall be adjusted to reflect the lower risk associated with systems needed to maintain safety and performance at higher speeds or traffic volumes. In particular, the previous condition must be adjusted for assumed implementation of systems necessary to support higher train speeds as specified in §236.0, as well as other changes required to support projected increases in train operations. The following specific requirements apply:

(i) If the current method of operation would not be adequate under §236.0 for the proposed operations, then the adjusted previous condition must include a system as required under §236.0, applied as follows:

(A) The minimum system where a passenger train is operated at a speed of 60 or more miles per hour, or a freight train is operated at a speed of 50 or more miles per hour, shall be a traffic control system;

(B) The minimum system where a train is operated at a speed of 80 or more miles per hour, but not more than 110 miles per hour, shall be an automatic cab signal system with automatic train control; and

(C) The minimum system where a train is operated at a speed of more than 110 miles per hour shall be a system determined by the Associate Administrator for Safety to provide an equivalent level of safety to systems required or authorized by FRA for comparable operations.

(ii) If the current method of operation would be adequate under §236.0 for the proposed operations, but the current system is not at least as safe as a traffic control system, then the adjusted previous condition must include a traffic control system in the event of any change that results in:

(A) An annual average daily train density of more than twelve trains per day; or

(B) An increase in the annual average daily density of passenger trains of more than four trains per day.

(iii) Paragraph (e)(3)(ii)(A) of this section shall apply in all situations where train volume will exceed more than 20 trains per day but shall not apply to situations where train volume will exceed 12 trains per day but not exceed 20 trains per day, if in its PSP the railroad makes a showing sufficient to establish, in the judgment of the Associate Administrator for Safety, that the current method of operation is adequate for a specified volume of traffic in excess of 12 trains per day, but not more than 20 trains per day, without material delay in the movement of trains over the territory and without unreasonable expenditures to expedite those movements when compared with the expense of installing and maintaining a traffic control system.

(4) In the case review of a PSP that has been consolidated with a proceeding pursuant to part 235 of this subchapter (see §236.911(b)), the base case shall be determined as follows:

(i) If FRA determines that discontinuance or modification of the system should be granted without regard to whether the product is installed on the territory, then the base case shall be the conditions that would obtain on the territory following the discontinuance or modification. Note: This is an instance in which the base case is posited as greater risk than the actual (unadjusted) previous condition because the railroad would have obtained relief from the requirement to maintain the existing signal or train control system even if no new product had been proffered.

(ii) If FRA determines that discontinuance or modification of the system should be denied without regard to whether the product is installed on the territory, then the base case shall remain the previous condition (unadjusted).

(iii) If, after consideration of the application and review of the PSP, FRA determines that neither paragraph (e)(4)(i) nor paragraph (e)(4)(ii) of this section should apply, FRA will establish a base case that is consistent with safety and in the public interest.

(a) Does this subpart apply to existing systems? The requirements of this subpart do not apply to products in service as of June 6, 2005. Railroads may continue to implement and use these products and components from these existing products.

(b) How will transition cases be handled? Products designed in accordance with subparts A through G of this part which are not in service but are developed or are in the developmental stage prior to March 7, 2005, may be excluded upon notification to FRA by June 6, 2005, if placed in service by March 7, 2008. Railroads may continue to implement and use these products and components from these existing products. A railroad may at any time elect to have products that are excluded made subject to this subpart by submitting a PSP as prescribed in §236.913 and otherwise complying with this subpart.

(c) How are office systems handled? The requirements of this subpart do not apply to existing office systems and future deployments of existing office system technology. However, a subsystem or component of an office system must comply with the requirements of this subpart if it performs safety-critical functions within, or affects the safety performance of, a new or next-generation train control system. For purposes of this section, “office system” means a centralized computer-aided train-dispatching system or centralized traffic control board.

(d) How are modifications to excluded products handled? Changes or modifications to products otherwise excluded from the requirements of this subpart by this section are not excluded from the requirements of this subpart if they result in a degradation of safety or a material increase in safety-critical functionality.

(e) What other rules apply to excluded products? Products excluded by this section from the requirements of this subpart remain subject to subparts A through G of this part as applicable.

(a) Under what circumstances must a PSP be prepared? A PSP must be prepared for each product covered by this subpart. A joint PSP must be prepared when:

(1) The territory on which a product covered by this subpart is normally subject to joint operations, or is operated upon by more than one railroad; and

(b) Under what circumstances must a railroad submit a petition for approval for a PSP or PSP amendment, and when may a railroad submit an informational filing? Depending on the nature of the proposed product or change, the railroad shall submit either an informational filing or a petition for approval. Submission of a petition for approval is required for PSPs or PSP amendments concerning installation of new or next-generation train control systems. All other actions that result in the creation of a PSP or PSP amendment require an informational filing and are handled according to the procedures outlined in paragraph (c) of this section. Applications for discontinuance and material modification of signal and train control systems remain governed by parts 235 and 211 of this chapter; and petitions subject to this section may be consolidated with any relevant application for administrative handling.

(c) What are the procedures for informational filings? The following procedures apply to PSPs and PSP amendments which do not require submission of a petition for approval, but rather require an informational filing:

(1) Not less than 180 days prior to planned use of the product in revenue service as described in the PSP or PSP amendment, the railroad shall submit an informational filing to the Associate Administrator for Safety, FRA, 1120 Vermont Avenue, NW., Mail Stop 25, Washington, DC 20590. The informational filing must provide a summary description of the PSP or PSP amendment, including the intended use of the product, and specify the location where the documentation as described in §236.917(a)(1) is maintained.

(ii) Acknowledges receipt of the informational filing and requests further information; or

(iii) Acknowledges receipt of the filing and notifies the railroad, for good cause, that the filing will be considered as a petition for approval as set forth in paragraph (d) of this section, and requests such further information as may be required to initiate action on the petition for approval. Examples of good cause, any one of which is sufficient, include: the PSP describes a product with unique architectural concepts; the PSP describes a product that uses design or safety assurance concepts considered outside existing accepted practices (see Appendix C); and the PSP describes a locomotive-borne product that commingles safety-critical train control processing functions with locomotive operational functions. In addition, good cause includes any instance where the PSP or PSP amendment does not appear to support its safety claim of satisfaction of the performance standard, after FRA has requested further information as provided in paragraph (c)(2)(ii) of this section.

(d) What procedures apply to petitions for approval? The following procedures apply to PSPs and PSP amendments which require submission of a petition for approval:

(1) Petitions for approval involving prior FRA consultation. (i) The railroad may file a Notice of Product Development with the Associate Administrator for Safety not less than 30 days prior to the end of the system design review phase of product development and 180 days prior to planned implementation, inviting FRA to participate in the design review process and receive periodic briefings and updates as needed to follow the course of product development. At a minimum, the Notice of Product Development must contain a summary description of the product to be developed and a brief description of goals for improved safety.

(ii) Within 15 days of receipt of the Notice of Product Development, the Associate Administrator for Safety either acknowledges receipt or acknowledges receipt and requests more information.

(iii) If FRA concludes that the Notice of Product Development contains sufficient information, the Associate Administrator for Safety determines the extent and nature of the assessment and review necessary for final product approval. FRA may convene a technical consultation as necessary to discuss issues related to the design and planned development of the product.

(iv) Within 60 days of receiving the Notice of Product Development, the Associate Administrator for Safety provides a letter of preliminary review with detailed findings, including whether the design concepts of the proposed product comply with the requirements of this subpart, whether design modifications are necessary to meet the requirements of this subpart, and the extent and nature of the safety analysis necessary to comply with this subpart.

(v) Not less than 60 days prior to use of the product in revenue service, the railroad shall file with the Associate Administrator for Safety a petition for final approval.

(vi) Within 30 days of receipt of the petition for final approval, the Associate Administrator for Safety either acknowledges receipt or acknowledges receipt and requests more information. Whenever possible, FRA acts on the petition for final approval within 60 days of its filing by either granting it or denying it. If FRA neither grants nor denies the petition for approval within 60 days, FRA advises the petitioner of the projected time for decision and conducts any further consultations or inquiries necessary to decide the matter.

(2) Other petitions for approval. The following procedures apply to petitions for approval of PSPs which do not involve prior FRA consultation as described in paragraph (d)(1) of this section.

(i) Not less than 180 days prior to use of a product in revenue service, the railroad shall file with the Associate Administrator for Safety a petition for approval.

(ii) Within 60 days of receipt of the petition for approval, FRA either acknowledges receipt, or acknowledges receipt and requests more information.

(iii) Whenever possible, considering the scope, complexity, and novelty of the product or change, FRA acts on the petition for approval within 180 days of its filing by either granting it or denying it. If FRA neither grants nor denies the petition for approval within 180 days, it remains pending, and FRA provides the petitioner with a statement of reasons why the petition has not yet been approved.

(e) What role do product users play in the process of safety review? (1) FRA will publish in the Federal Register periodically a topic list including docket numbers for informational filings and a petition summary including docket numbers for petitions for approval.

(2) Interested parties may submit to FRA information and views pertinent to FRA's consideration of an informational filing or petition for approval. FRA considers comments to the extent practicable within the periods set forth in this section. In a proceeding consolidated with a proceeding under part 235 of this chapter, FRA considers all comments received.

(f) Is it necessary to complete field testing prior to filing the petition for approval? A railroad may file a petition for approval prior to completion of field testing of the product. The petition for approval should additionally include information sufficient for FRA to arrange monitoring of the tests. The Associate Administrator for Safety may approve a petition for approval contingent upon successful completion of the test program contained in the PSP or hold the petition for approval pending completion of the tests.

(g) How are PSPs approved? (1) The Associate Administrator for Safety grants approval of a PSP when:

(i) The petition for approval has been properly filed and contains the information required in §236.907;

(ii) FRA has determined that the PSP complies with the railroad's approved RSPP and applicable requirements of this subpart; and

(iii) The risk assessment supporting the PSP demonstrates that the proposed product satisfies the minimum performance standard stated in §236.909.

(2) The Associate Administrator for Safety considers the following applicable factors when evaluating the risk assessment:

(i) The extent to which recognized standards have been utilized in product design and in the relevant safety analysis;

(ii) The availability of quantitative data, including calculations of statistical confidence levels using accepted methods, associated with risk estimates;

(iii) The complexity of the product and the extent to which it will incorporate or deviate from design practices associated with previously established histories of safe operation;

(iv) The degree of rigor and precision associated with the safety analyses, including the comprehensiveness of the qualitative analyses, and the extent to which any quantitative results realistically reflect appropriate sensitivity cases;

(v) The extent to which validation of the product has included experiments and tests to identify uncovered faults in the operation of the product;

(vii) Whether the risk assessment for the previous condition was conducted using the same methodology as that for operation under the proposed condition; and

(viii) If an independent third-party assessment is required or is performed at the election of the supplier or railroad, the extent to which the results of the assessment are favorable.

(3) The Associate Administrator for Safety also considers when assessing PSPs the safety requirements for the product within the context of the proposed method of operations, including:

(i) The degree to which the product is relied upon as the primary safety system for train operations; and

(ii) The degree to which the product is overlaid upon and its operation is demonstrated to be independent of safety-relevant rules, practices and systems that will remain in place following the change under review.

(4) As necessary to ensure compliance with this subpart and with the RSPP, FRA may attach special conditions to the approval of the petition.

(5) Following the approval of a petition, FRA may reopen consideration of the petition for cause. Cause for reopening a petition includes such circumstances as a credible allegation of error or fraud, assumptions determined to be invalid as a result of in-service experience, or one or more unsafe events calling into question the safety analysis underlying the approval.

(h) Under what circumstances may a third-party assessment be required, and by whom may it be conducted? (1) The PSP must be supported by an independent third party assessment of the product when FRA concludes it is necessary based upon consideration of the following factors:

(i) Those factors listed in paragraphs (g)(2)(i) through (g)(2)(vii) of this section;

(ii) The sufficiency of the assessment or audit previously conducted at the election of a supplier or railroad; and

(iii) Whether applicable requirements of subparts A through G of this part are satisfied.

(2) As used in this section, “independent third party” means a technically competent entity responsible to and compensated by the railroad (or an association on behalf of one or more railroads) that is independent of the supplier of the product. An entity that is owned or controlled by the supplier, that is under common ownership or control with the supplier, or that is otherwise involved in the development of the product is not considered “independent” within the meaning of this section. FRA may maintain a roster of recognized technically competent entities as a service to railroads selecting reviewers under this section; however, a railroad is not limited to entities currently listed on any such roster.

(3) The third-party assessment must, at a minimum, consist of the activities and result in production of documentation meeting the requirements of Appendix D to this part. However, when requiring an assessment pursuant to this section, FRA specifies any requirements in Appendix D to this part which the agency has determined are not relevant to its concerns and, therefore, need not be included in the assessment. The railroad shall make the final assessment report available to FRA upon request.

(i) How may a PSP be amended? A railroad may submit an amendment to a PSP at any time in the same manner as the initial PSP. Notwithstanding the otherwise applicable requirements found in this section and §236.915, changes affecting the safety-critical functionality of a product may be made prior to the submission and approval of the PSP amendment as necessary in order to mitigate risk.

(j) How may field testing be conducted prior to PSP approval? (1) Field testing of a product may be conducted prior to the approval of a PSP by the submission of an informational filing by a railroad. The FRA will arrange to monitor the tests based on the information provided in the filing, which must include:

(iii) A complete description of the specific test procedures, including the measures that will be taken to protect trains and on-track equipment;

(iv) An analysis of the applicability of the requirements of subparts A through G of this part to the product that will not apply during testing;

(vii) A description of any effect the testing will have on the current method of operation.

(2) FRA may impose such additional conditions on this testing as may be necessary for the safety of train operations. Exemptions from regulations other than those contained in this part must be requested through waiver procedures in part 211 of this chapter.

(a) When may a product be placed or retained in service? (1) Except as stated in paragraphs (a)(2) and (a)(3) of this section, a railroad may operate in revenue service any product 180 days after filing with FRA the informational filing for that product. The FRA filing date can be found in FRA's acknowledgment letter referred to in §236.913(c)(2).

(2) Except as stated in paragraph (a)(3) of this section, if FRA approval is required for a product, the railroad shall not operate the product in revenue service until after the Associate Administrator for Safety has approved the petition for approval for that product pursuant to §236.913.

(3) If after product implementation FRA elects, for cause, to treat the informational filing for the product as a petition for approval, the product may remain in use if otherwise consistent with the applicable law and regulations. FRA may impose special conditions for use of the product during the period of review for cause.

(b) How does the PSP relate to operation of the product? Each railroad shall comply with all provisions in the PSP for each product it uses and shall operate within the scope of initial operational assumptions and predefined changes identified by the PSP. Railroads may at any time submit an amended PSP according to the procedures outlined in §236.913.

(c) What precautions must be taken prior to interference with the normal functioning of a product? The normal functioning of any safety-critical product must not be interfered with in testing or otherwise without first taking measures to provide for safe movement of trains, locomotives, roadway workers and on-track equipment that depend on normal functioning of such product.

(d) What actions must be taken immediately upon failure of a safety-critical component? When any safety-critical product component fails to perform its intended function, the cause must be determined and the faulty component adjusted, repaired, or replaced without undue delay. Until repair of such essential components are completed, a railroad shall take appropriate action as specified in the PSP. See also §§236.907(d), 236.917(b).

(a) What life-cycle and maintenance records must be maintained? (1) The railroad shall maintain at a designated office on the railroad:

(i) For the life-cycle of the product, adequate documentation to demonstrate that the PSP meets the safety requirements of the railroad's RSPP and applicable standards in this subpart, including the risk assessment; and

(2) Results of inspections and tests specified in the PSP must be recorded as prescribed in §236.110.

(3) Contractors of the railroad shall maintain at a designated office training records pursuant to §236.923(b).

(b) What actions must the railroad take in the event of occurrence of a safety-relevant hazard? After the product is placed in service, the railroad shall maintain a database of all safety-relevant hazards as set forth in the PSP and those that had not been previously identified in the PSP. If the frequency of the safety-relevant hazards exceeds the threshold set forth in the PSP (see §236.907(a)(6)), then the railroad shall:

(1) Report the inconsistency in writing (by mail, facsimile, e-mail, or hand delivery to the Director, Office of Safety Assurance and Compliance, FRA, 1120 Vermont Ave., NW., Mail Stop 25, Washington, DC 20590, within 15 days of discovery. Documents that are hand delivered must not be enclosed in an envelope;

(2) Take prompt countermeasures to reduce the frequency of the safety-relevant hazard(s) below the threshold set forth in the PSP; and

(3) Provide a final report to the FRA Director, Office of Safety Assurance and Compliance, on the results of the analysis and countermeasures taken to reduce the frequency of the safety-relevant hazard(s) below the threshold set forth in the PSP when the problem is resolved.

(a) The railroad shall catalog and maintain all documents as specified in the PSP for the installation, maintenance, repair, modification, inspection, and testing of the product and have them in one Operations and Maintenance Manual, readily available to persons required to perform such tasks and for inspection by FRA and FRA-certified State inspectors.

(b) Plans required for proper maintenance, repair, inspection, and testing of safety-critical products must be adequate in detail and must be made available for inspection by FRA and FRA-certified State inspectors where such products are deployed or maintained. They must identify all software versions, revisions, and revision dates. Plans must be legible and correct.

(c) Hardware, software, and firmware revisions must be documented in the Operations and Maintenance Manual according to the railroad's configuration management control plan and any additional configuration/revision control measures specified in the PSP.

(d) Safety-critical components, including spare equipment, must be positively identified, handled, replaced, and repaired in accordance with the procedures specified in the PSP.

(a) When is training necessary and who must be trained? Employers shall establish and implement training and qualification programs for products subject to this subpart. These programs must meet the minimum requirements set forth in the PSP and in §§236.923 through 236.929 as appropriate, for the following personnel:

(1) Persons whose duties include installing, maintaining, repairing, modifying, inspecting, and testing safety-critical elements of the railroad's products, including central office, wayside, or onboard subsystems;

(2) Persons who dispatch train operations (issue or communicate any mandatory directive that is executed or enforced, or is intended to be executed or enforced, by a train control system subject to this subpart);

(3) Persons who operate trains or serve as a train or engine crew member subject to instruction and testing under part 217 of this chapter, on a train operating in territory where a train control system subject to this subpart is in use;

(4) Roadway workers whose duties require them to know and understand how a train control system affects their safety and how to avoid interfering with its proper functioning; and

(5) The direct supervisors of persons listed in paragraphs (a)(1) through (a)(4) of this section.

(b) What competencies are required? The employer's program must provide training for persons who perform the functions described in paragraph (a) of this section to ensure that they have the necessary knowledge and skills to effectively complete their duties related to processor-based signal and train control equipment.

(a) How must training be structured and delivered? As part of the program required by §236.921, the employer shall, at a minimum:

(1) Identify the specific goals of the training program with regard to the target population (craft, experience level, scope of work, etc.), task(s), and desired success rate;

(2) Based on a formal task analysis, identify the installation, maintenance, repair, modification, inspection, testing, and operating tasks that must be performed on a railroad's products. This includes the development of failure scenarios and the actions expected under such scenarios;

(4) Identify the additional knowledge, skills, and abilities above those required for basic job performance necessary to perform each task;

(5) Develop a training curriculum that includes classroom, simulator, computer-based, hands-on, or other formally structured training designed to impart the knowledge, skills, and abilities identified as necessary to perform each task;

(6) Prior to assignment of related tasks, require all persons mentioned in §236.921(a) to successfully complete a training curriculum and pass an examination that covers the product and appropriate rules and tasks for which they are responsible (however, such persons may perform such tasks under the direct onsite supervision of a qualified person prior to completing such training and passing the examination);

(7) Require periodic refresher training at intervals specified in the PSP that includes classroom, simulator, computer-based, hands-on, or other formally structured training and testing, except with respect to basic skills for which proficiency is known to remain high as a result of frequent repetition of the task; and

(8) Conduct regular and periodic evaluations of the effectiveness of the training program specified in §236.923(a)(1) verifying the adequacy of the training material and its validity with respect to current railroads products and operations.

(b) What training records are required? Employers shall retain records which designate persons who are qualified under this section until new designations are recorded or for at least one year after such persons leave applicable service. These records shall be kept in a designated location and be available for inspection and replication by FRA and FRA-certified State inspectors.

Any person responsible for issuing or communicating mandatory directives in territory where products are or will be in use must be trained in the following areas, as applicable:

(a) Instructions concerning the interface between the computer-aided dispatching system and the train control system, with respect to the safe movement of trains and other on-track equipment;

(b) Railroad operating rules applicable to the train control system, including provision for movement and protection of roadway workers, unequipped trains, trains with failed or cut-out train control onboard systems, and other on-track equipment; and

(c) Instructions concerning control of trains and other on-track equipment in case the train control system fails, including periodic practical exercises or simulations, and operational testing under part 217 of this chapter to ensure the continued capability of the personnel to provide for safe operations under the alternative method of operation.

(a) What elements apply to operating personnel? Training provided under this subpart for any locomotive engineer or other person who participates in the operation of a train in train control territory must be defined in the PSP and the following elements must be addressed:

(1) Familiarization with train control equipment onboard the locomotive and the functioning of that equipment as part of the system and in relation to other onboard systems under that person's control;

(2) Any actions required of the onboard personnel to enable, or enter data to, the system, such as consist data, and the role of that function in the safe operation of the train;

(3) Sequencing of interventions by the system, including pre-enforcement notification, enforcement notification, penalty application initiation and post-penalty application procedures;

(4) Railroad operating rules applicable to the train control system, including provisions for movement and protection of any unequipped trains, or trains with failed or cut-out train control onboard systems and other on-track equipment;

(5) Means to detect deviations from proper functioning of onboard train control equipment and instructions regarding the actions to be taken with respect to control of the train and notification of designated railroad personnel; and

(6) Information needed to prevent unintentional interference with the proper functioning of onboard train control equipment.

(b) How must locomotive engineer training be conducted? Training required under this subpart for a locomotive engineer, together with required records, must be integrated into the program of training required by part 240 of this chapter.

(c) What requirements apply to full automatic operation? The following special requirements apply in the event a train control system is used to effect full automatic operation of the train:

(1) The PSP must identify all safety hazards to be mitigated by the locomotive engineer.

(2) The PSP must address and describe the training required with provisions for the maintenance of skills proficiency. As a minimum, the training program must:

(i) As described in §236.923(a)(2), develop failure scenarios which incorporate the safety hazards identified in the PSP, including the return of train operations to a fully manual mode;

(ii) Provide training, consistent with §236.923(a), for safe train operations under all failure scenarios and identified safety hazards that affect train operations;

(iii) Provide training, consistent with §236.923(a), for safe train operations under manual control; and

(iv) Consistent with §236.923(a), ensure maintenance of manual train operating skills by requiring manual starting and stopping of the train for an appropriate number of trips and by one or more of the following methods:

(B) Simulated manual operation of a train for a minimum of 4 hours in a Type I simulator as required; or

(C) Other means as determined following consultation between the railroad and designated representatives of the affected employees and approved by the FRA. The PSP must designate the appropriate frequency when manual operation, starting, and stopping must be conducted, and the appropriate frequency of simulated manual operation.

(a) How is training for roadway workers to be coordinated with part 214? Training required under this subpart for a roadway worker must be integrated into the program of instruction required under part 214, subpart C of this chapter (“Roadway Worker Protection”), consistent with task analysis requirements of §236.923. This training must provide instruction for roadway workers who provide protection for themselves or roadway work groups.

(b) What subject areas must roadway worker training include? (1) Instruction for roadway workers must ensure an understanding of the role of processor-based signal and train control equipment in establishing protection for roadway workers and their equipment.

(2) Instruction for roadway workers must ensure recognition of processor-based signal and train control equipment on the wayside and an understanding of how to avoid interference with its proper functioning.

(3) Instructions concerning the recognition of system failures and the provision of alternative methods of on-track safety in case the train control system fails, including periodic practical exercises or simulations and operational testing under part 217 of this chapter to ensure the continued capability of roadway workers to be free from the danger of being struck by a moving train or other on-track equipment.

Section	Violation	Willful violation
Subpart A—Rules and Instructions—All Systems
General:
236.0 Applicability, minimum requirements	$2,500	$5,000
236.1 Plans, where kept	1,000	2,000
236.2 Grounds	1,000	2,000
236.3 Locking of signal apparatus housings:
(a) Power interlocking machine cabinet not secured against unauthorized entry	2,500	5,000
(b) other violations	1,000	2,000
236.4 Interference with normal functioning of device	5,000	7,500
236.5 Design of control circuits on closed circuit principle	1,000	2,000
236.6 Hand-operated switch equipped with switch circuit controller	1,000	2,000
236.7 Circuit controller operated by switch-and-lock movement	1,000	2,000
236.8 Operating characteristics of electro-magnetic, electronic, or electrical apparatus	1,000	2,000
236.9 Selection of circuits through indicating or annunciating instruments	1,000	2,000
236.10 Electric locks, force drop type; where required	1,000	2,000
236.11 Adjustment, repair, or replacement of component	2,500	5,000
236.12 Spring switch signal protection; where required	1,000	2,000
236.13 Spring switch; selection of signal control circuits through circuit controller	1,000	2,000
236.14 Spring switch signal protection; requirements	1,000	2,000
236.15 Timetable instructions	1,000	2,000
236.16 Electric lock, main track releasing circuit:
(a) Electric lock releasing circuit on main track extends into fouling circuit where turnout not equipped with derail at clearance point either pipe-connected to switch or independently locked, electrically	2,500	5,000
(b) other violations	1,000	2,000
236.17 Pipe for operating connections, requirements	1,000	2,000
236.18 Software management control plan:
Failure to develop and adopt a plan	$5,000	$10,000
Failure to fully implement plan	5,000	10,000
Inadequate plan	2,500	10,000
Roadway Signals and Cab Signals —
236.21 Location of roadway signals	1,000	2,000
236.22 Semaphore signal arm; clearance to other objects	1,000	2,000
236.23 Aspects and indications	1,000	2,000
236.24 Spacing of roadway signals	2,500	5,000
236.26 Buffing device, maintenance	1,000	2,000
Track Circuits —
236.51 Track circuit requirements:
(a) Shunt fouling circuit used where permissible speed through turnout greater than 45 m.p.h	2,500	5,000
(b) Track relay not in de-energized position or device that functions as track relay not in its most restrictive state when train, locomotive, or car occupies any part of track circuit, except fouling section of turnout of hand-operated main-track crossover	2,500	5,000
(c) other violations	1,000	2,000
236.52 Relayed cut-section	1,000	2,000
236.53 Track circuit feed at grade crossing	1,000	2,000
236.54 Minimum length of track circuit	1,000	2,000
236.55 Dead section; maximum length	1,000	2,000
236.56 Shunting sensitivity	2,500	5,000
236.57 Shunt and fouling wires:
(a) Shunt or fouling wires do not consist of at least two discrete conductors	2,500	5,000
(b) other violations	1,000	2,000
236.58 Turnout, fouling section:
(a) Rail joint in shunt fouling section not bonded	2,500	5,000
(b) other violations	1,000	2,000
236.59 Insulated rail joints	1,000	2,000
236.60 Switch shunting circuit; use restricted	2,500	5,000
Wires and Cables —
236.71 Signal wires on pole line and aerial cable	1,000	2,000
236.73 Open-wire transmission line; clearance to other circuits	1,000	2,000
236.74 Protection of insulated wire; splice in underground wire	1,000	2,000
236.76 Tagging of wires and interference of wires or tags with signal apparatus	1,000	2,000
Inspections and Tests; All Systems —
236.101 Purpose of inspection and tests; removal from service or relay or device failing to meet test requirements	2,500	5,000
236.102 Semaphore or search-light signal mechanism	1,000	2,000
236.103 Switch circuit controller or point detector	1,000	2,000
236.104 Shunt fouling circuit	1,000	2,000
236.105 Electric lock	1,000	2,000
236.106 Relays	1,000	2,000
236.107 Ground tests	1,000	2,000
236.108 Insulation resistance tests, wires in trunking and cables:
(a) Circuit permitted to function on a conductor having insulation resistance value less than 200,000 ohms	2,500	5,000
(b) other violations	1,000	2,000
236.109 Time releases, timing relays and timing devices	1,000	2,000
236.110 Results of tests	1,000	2,000
Subpart B—Automatic Block Signal Systems
236.201 Track circuit control of signals	1,000	2,000
236.202 Signal governing movements over hand-operated switch	1,000	2,000
236.203 Hand-operated crossover between main tracks; protection	1,000	2,000
236.204 Track signaled for movements in both directions, requirements	1,000	2,000
236.205 Signal control circuits; requirements	1,000	2,000
236.206 Battery or power supply with respect to relay; location	1,000	2,000
Subpart C—Interlocking
236.207 Electric lock on hand-operated switch; control:
(a) Approach or time locking of electric lock on hand-operated switch can be defeated by unauthorized use of emergency device which is not kept sealed in the non-release position	2,500	5,000
(b) other violations	1,000	2,000
236.301 Where signals shall be provided	1,000	2,000
236.302 Track circuits and route locking	1,000	2,000
236.303 Control circuits for signals, selection through circuit controller operated by switch points or by switch locking mechanism	1,000	2,000
236.304 Mechanical locking or same protection effected by circuits	1,000	2,000
236.305 Approach or time locking	1,000	2,000
236.306 Facing point lock or switch-and-lock movement	1,000	2,000
236.307 Indication locking:
236.308 Mechanical or electric locking or electric circuits; requisites	1,000	2,000
236.309 Loss of shunt protection; where required:
(a) Loss of shunt of five seconds or less permits release of route locking of power-operated switch, movable point frog, or derail	2,500	5,000
(b) Other violations	1,000	2,000
236.310 Signal governing approach to home signal	1,000	2,000
236.311 Signal control circuits, selection through track relays or devices functioning as track relays and through signal mechanism contacts and time releases at automatic interlocking	1,000	2,000
236.312 Movable bridge, interlocking of signal appliances with bridge devices:
(a) Emergency bypass switch or device not locked or sealed	2,500	5,000
(b) other violations	1,000	2,000
236.314 Electric lock for hand-operated switch or derail:
(a) Approach or time locking of electric lock at hand-operated switch or derail can be defeated by unauthorized use of emergency device which is not kept sealed in non-release position	2,500	5,000
(b) other violations	1,000	2,000
Rules and Instructions —
236.326 Mechanical locking removed or disarranged; requirement for permitting train movements through interlocking	1,000	2,000
236.327 Switch, movable-point frog or split-point derail	1,000	2,000
236.328 Plunger of facing-point	1,000	2,000
236.329 Bolt lock	1,000	2,000
236.330 Locking dog of switch and lock movement	1,000	2,000
236.334 Point detector	1,000	2,000
236.335 Dogs, stops and trunnions of mechanical locking	1,000	2,000
236.336 Locking bed	1,000	2,000
236.337 Locking faces of mechanical locking; fit	1,000	2,000
236.338 Mechanical locking required in accordance with locking sheet and dog chart	1,000	2,000
236.339 Mechanical locking; maintenance requirements	1,000	2,000
236.340 Electromechanical interlocking machine; locking between electrical and mechanical levers	1,000	2,000
236.341 Latch shoes, rocker links, and quadrants	1,000	2,000
236.342 Switch circuit controller	1,000	2,000
Inspection and Tests —
236.376 Mechanical locking	1,000	2,000
236.377 Approach locking	1,000	2,000
236.378 Time locking	1,000	2,000
236.379 Route locking	1,000	2,000
236.380 Indication locking	1,000	2,000
236.381 Traffic locking	1,000	2,000
236.382 Switch obstruction test	1,000	2,000
236.383 Valve locks, valves, and valve magnets	1,000	2,000
236.384 Cross protection
236.386 Restoring feature on power switches
236.387 Movable bridge locking	1,000	2,000
Subpart D—Traffic Control Systems Standards
236.401 Automatic block signal system and interlocking standards applicable to traffic control systems:
236.402 Signals controlled by track circuits and control operator	1,000	2,000
236.403 Signals at controlled point	1,000	2,000
236.404 Signals at adjacent control points	1,000	2,000
236.405 Track signaled for movements in both directions, change of direction of traffic	1,000	2,000
236.407 Approach or time locking; where required	1,000	2,000
236.408 Route locking	1,000	2,000
236.410 Locking, hand-operated switch; requirements:
(a) Hand-operated switch on main track not electrically or mechanically locked in normal position where signal not provided to govern movement to main track, movements made at speeds in excess of 20 m.p.h., and train or engine movements may clear main track	2,500	5,000
(b) Hand-operated switch on signaled siding not electrically or mechanically locked in normal position where signal not provided to govern movements to signaled siding, train movements made at speeds in excess of 30 m.p.h., and train or engine movements may clear signaled siding	2,500	5,000
(c) Approach or time locking of electric lock at hand-operated switch can be defeated by use of emergency release device of electric lock which is not kept sealed in non-release position	2,500	5,000
(d) other violations	1,000	2,000
Rules and Instructions —
236.426 Interlocking rules and instructions applicable to traffic control systems	1,000	2,000
236.476 Interlocking inspections and tests applicable to traffic control systems	1,000	2,000
Subpart E—Automatic Train Stop, Train Control and Cab Signal Systems Standards
236.501 Forestalling device and speed control	1,000	2,000
236.502 Automatic brake application, initiation by restrictive block conditions stopping distance in advance	1,000	2,000
236.503 Automatic brake application; initiation when predetermined rate of speed exceeded	1,000	2,000
236.504 Operations interconnected with automatic block-signal system	1,000	2,000
236.505 Proper operative relation between parts along roadway and parts on locomotive	1,000	2,000
236.506 Release of brakes after automatic application	1,000	2,000
236.507 Brake application; full service	1,000	2,000
236.508 Interference with application of brakes by means of brake valve	1,000	2,000
236.509 Two or more locomotives coupled	1,000	2,000
236.511 Cab signals controlled in accordance with block conditions stopping distance in advance	1,000	2,000
236.512 Cab signal indication when locomotive enters blocks	1,000	2,000
236.513 Audible indicator	1,000	2,000
236.514 Interconnection of cab signal system with roadway signal system	1,000	2,000
236.515 Visibility of cab signals	1,000	2,000
236.516 Power supply	1,000	2,000
Rules and Instructions; Roadway —
236.526 Roadway element not functioning properly	2,500	5,000
236.527 Roadway element insulation resistance	1,000	2,000
236.528 Restrictive condition resulting from open hand-operated switch; requirement	1,000	2,000
236.529 Roadway element inductor; height and distance from rail	1,000	2,000
236.531 Trip arm; height and distance from rail	1,000	2,000
236.532 Strap iron inductor; use restricted	1,000	2,000
236.534 Rate of pressure reduction; equalizing reservoir or brake pipe	1,000	2,000
236.551 Power supply voltage	1,000	2,000
236.552 Insulation resistance	1,000	2,000
236.553 Seal, where required	2,500	5,000
236.554 Rate of pressure reduction; equalizing reservoir or brake pipe	1,000	2,000
236.555 Repaired or rewound receiver coil	1,000	2,000
236.556 Adjustment of relay	1,000	2,000
236.557 Receiver; location with respect to rail	1,000	2,000
236.560 Contact element, mechanical trip type; location with respect to rail	1,000	2,000
236.562 Minimum rail current required	1,000	2,000
236.563 Delay time	1,000	2,000
236.564 Acknowledging time	1,000	2,000
236.565 Provision made for preventing operation of pneumatic brake-applying apparatus by double-heading clock; requirement	1,000	2,000
236.566 Locomotive of each train operating in train stop, train control or cab signal territory; equipped	5,000	7,500
236.567 Restrictions imposed when device fails and/or is cut out en route:
(a) Report not made to designated officer at next available point of communication after automatic train stop, train control, or cab signal device fails and/or is cut en route	5,000	7,500
(b) Train permitted to proceed at speed exceeding 79 m.p.h. where automatic train stop, train control, or cab signal device fails and/or is cut out en route when absolute block established in advance of train on which device is inoperative	5,000	7,500
(c) other violations	1,000	2,000
236.568 Difference between speeds authorized by roadway signal and cab signal; action	1,000	2,000
Inspection and Tests; Roadway —
236.576 Roadway element	1,000	2,000
236.577 Test, acknowledgement, and cut-in circuits	1,000	2,000
Inspection and Tests; Locomotive —
236.586 Daily or after trip test	2,500	5,000
236.587 Departure test:
(a) Test of automatic train stop, train control, or cab signal apparatus on locomotive not made on departure of locomotive from initial terminal if equipment on locomotive not cut out between initial terminal and equipped territory	5,000	7,500
(b) Test of automatic train stop, train control, or cab signal apparatus on locomotive not made immediately on entering equipped territory, if equipment on locomotive cut out between initial terminal and equipped territory	5,000	7,500
(c) Automatic train stop, train control, or cab signal apparatus on locomotive making more than one trip within 24-hour period not given departure test within corresponding 24-hour period	5,000	7,500
(d) other violations	2,500	5,000
236.588 Periodic test	2,500	5,000
236.589 Relays	2,500	5,000
236.590 Pneumatic apparatus:
(a) Automatic train stop, train control, or cab signal apparatus not inspected and cleaned at least once every 736 days	2,500	5,000
(b) other violations	1,000	2,000
Subpart F—Dragging Equipment and Slide Detectors and Other Similar Protective Devices; Standards
236.601 Signals controlled by devices; location	1,000	2,000
Subpart H—Standards for Processor-Based Signal and Train Control Systems
236.905 Railroad Safety Program Plan (RSPP):
Failure to develop and submit RSPP when required	5,000	7,500
Failure to obtain FRA approval for a modification to RSPP	5,000	7,500
236.907 Product Safety Plan (PSP):
Failure to develop a PSP	5,000	7,500
Failure to submit a PSP when required	5,000	7,500
236.909 Minimum Performance Standard:
Failure to make analyses or documentation available	2,500	5,000
Failure to determine that the standard has been met	5,000	7,500
236.913 Notification to FRA of PSPs:	2,500	5,000
Failure to prepare a PSP or PSP amendment as required	5,000	7,500
Failure to submit a PSP or PSP amendment as required	5,000	7,500
Field testing without authorization or approval	10,000	20,000
236.915 Implementation and operation:
(a) Operation of product without authorization or approval	10,000	20,000
(b) Failure to comply with PSP	2,500	5,000
(c) Interference with normal functioning safety-critical product	7,500	15,000
(d) Failure to determine cause and adjust, repair or replace without undue delay or take appropriate action pending repair	5,000	7,500
236.917 Retention of records:
Failure to maintain records as required	7,500	15,000
Failure to report inconsistency	10,000	20,000
Failure to take prompt countermeasures	10,000	20,000
Failure to provide final report	2,500	5,000
236.919 Operations and Maintenance Manual	3,000	6,000
236.921 Training and qualification program, general	3,000	6,000
236.923 Task analysis and basic requirements:
Failure to develop an acceptable training program	2,500	5,000
Failure to train persons as required	2,500	5,000
Failure to conduct evaluation of training program as required	2,500	5,000
Failure to maintain records as required	1,500	3,000
236.925 Training specific to control office personnel	2,500	5,000
236.927 Training specific to locomotive engineers and other operating personnel	2,500	5,000
236.929 Training specific to roadway workers	2,500	5,000

¹The Administrator reserves the right to assess a civil penalty of up to $27,000 per day for any violation where circumstances warrant. See 49 CFR part 209, appendix A.

¹A penalty may be assessed against an individual only for a willful violation. The Administrator reserves the right to assess a penalty of up to $27,000 for any violation where circumstances warrant. See 49 CFR part 209, appendix A.

[53 FR 52936, Dec. 29, 1988, as amended at 63 FR 11624, Mar. 10, 1998; 69 FR 30595, May 28, 2004; 70 FR 11104, Mar. 7, 2005]

The safety-critical performance of each product for which risk assessment is required under this part must be assessed in accordance with the following criteria or other criteria if demonstrated to the Associate Administrator for Safety to be equally suitable:

(a) How are risk metrics to be expressed? The risk metric for the proposed product must describe with a high degree of confidence the accumulated risk of a train system that operates over a life-cycle of 25 years or greater. Each risk metric for the proposed product must be expressed with an upper bound, as estimated with a sensitivity analysis, and the risk value selected must be demonstrated to have a high degree of confidence.

(b) How does the risk assessment handle interaction risks for interconnected subsystems/components? The safety-critical assessment of each product must include all of its interconnected subsystems and components and, where applicable, the interaction between such subsystems.

(c) How is the previous condition computed? Each subsystem or component of the previous condition must be analyzed with a Mean Time to Hazardous Event (MTTHE) as specified subject to a high degree of confidence.

(d) What major risk characteristics must be included when relevant to assessment? Each risk calculation must consider the total signaling and train control system and method of operation, as subjected to a list of hazards to be mitigated by the signaling and train control system. The methodology requirements must include the following major characteristics, when they are relevant to the product being considered:

(3) Train movement operational rules, as enforced by the dispatcher and train crew behaviors;

(e) What other relevant parameters must be determined for the subsystems and components? The failure modes of each subsystem or component, or both, must be determined for the integrated hardware/software (where applicable) as a function of the Mean Time to Failure (MTTF) failure restoration rates, and the integrated hardware/software coverage of all processor-based subsystems or components, or both. Train operating and movement rules, along with components that are layered in order to enhance safety-critical behavior, must also be considered.

(f) How are processor-based subsystems/components assessed? (1) An MTTHE value must be calculated for each processor-based subsystem or component, or both, indicating the safety-critical behavior of the integrated hardware/software subsystem or component, or both. The human factor impact must be included in the assessment, whenever applicable, to provide an integrated MTTHE value. The MTTHE calculation must consider the rates of failures caused by permanent, transient, and intermittent faults accounting for the fault coverage of the integrated hardware/software subsystem or component, phased-interval maintenance, and restoration of the detected failures.

(2) MTTHE compliance verification and validation must be based on the assessment of the design for verification and validation process, historical performance data, analytical methods and experimental safety-critical performance testing performed on the subsystem or component. The compliance process must be demonstrated to be compliant and consistent with the MTTHE metric and demonstrated to have a high degree of confidence.

(g) How are non-processor-based subsystems/components assessed? (1) The safety-critical behavior of all non-processor-based components, which are part of a processor-based system or subsystem, must be quantified with an MTTHE metric. The MTTHE assessment methodology must consider failures caused by permanent, transient, and intermittent faults, phase-interval maintenance and restoration of failures and the effect of fault coverage of each non-processor-based subsystem or component.

(2) MTTHE compliance verification and validation must be based on the assessment of the design for verification and validation process, historical performance data, analytical methods and experimental safety-critical performance testing performed on the subsystem or component. The non-processor-based quantification compliance must be demonstrated to have a high degree of confidence.

(h) What assumptions must be documented? (1) The railroad shall document any assumptions regarding the reliability or availability of mechanical, electric, or electronic components. Such assumptions must include MTTF projections, as well as Mean Time to Repair (MTTR) projections, unless the risk assessment specifically explains why these assumptions are not relevant to the risk assessment. The railroad shall document these assumptions in such a form as to permit later automated comparisons with in-service experience ( e.g. , a spreadsheet).

(2) The railroad shall document any assumptions regarding human performance. The documentation shall be in such a form as to facilitate later comparisons with in-service experience.

(3) The railroad shall document any assumptions regarding software defects. These assumptions shall be in a form which permits the railroad to project the likelihood of detecting an in-service software defect. These assumptions shall be documented in such a form as to permit later automated comparisons with in-service experience.

(4) The railroad shall document all of the identified safety-critical fault paths. The documentation shall be in such a form as to facilitate later comparisons with in-service faults.

(a) What is the purpose of this appendix? This appendix seeks to promote full disclosure of safety risk to facilitate minimizing or eliminating elements of risk where practicable by providing minimum criteria and processes for safety analyses conducted in support of PSPs. The analysis required by this appendix is intended to minimize the probability of failure to an acceptable level, helping to optimize the safety of the product within the limitations of the available engineering science, cost, and other constraints. FRA uses the criteria and processes set forth in this appendix to evaluate analyses, assumptions, and conclusions provided in RSPP and PSP documents. An analysis performed under this appendix must:

(1) Address each area of paragraph (b) of this appendix, explaining how such objectives are addressed or why they are not relevant, and

(2) Employ a validation and verification process pursuant to paragraph (c) of this appendix.

(b) What categories of safety elements must be addressed? The designer shall address each of the following safety considerations when designing and demonstrating the safety of products covered by subpart H of this part. In the event that any of these principles are not followed, the PSP shall state both the reason(s) for departure and the alternative(s) utilized to mitigate or eliminate the hazards associated with the design principle not followed.

(1) Normal operation . The system (including all hardware and software) must demonstrate safe operation with no hardware failures under normal anticipated operating conditions with proper inputs and within the expected range of environmental conditions. All safety-critical functions must be performed properly under these normal conditions. Absence of specific operator actions or procedures will not prevent the system from operating safely. There must be no hazards that are categorized as unacceptable or undesirable. Hazards categorized as unacceptable must be eliminated by design.

(2) Systematic failure . It must be shown how the product is designed to mitigate or eliminate unsafe systematic failures—those conditions which can be attributed to human error that could occur at various stages throughout product development. This includes unsafe errors in the software due to human error in the software specification, design or coding phases, or both; human errors that could impact hardware design; unsafe conditions that could occur because of an improperly designed human-machine interface; installation and maintenance errors; and errors associated with making modifications.

(3) Random failure . (i) The product must be shown to operate safely under conditions of random hardware failure. This includes single as well as multiple hardware failures, particularly in instances where one or more failures could occur, remain undetected (latent) and react in combination with a subsequent failure at a later time to cause an unsafe operating situation. In instances involving a latent failure, a subsequent failure is similar to there being a single failure. In the event of a transient failure, and if so designed, the system should restart itself if it is safe to do so. Frequency of attempted restarts must be considered in the hazard analysis required by §236.907(a)(8).

(ii) There shall be no single point failures in the product that can result in hazards categorized as unacceptable or undesirable. Occurrence of credible single point failures that can result in hazards must be detected and the product must achieve a known safe state before falsely activating any physical appliance.

(iii) If one non-self-revealing failure combined with a second failure can cause a hazard that is categorized as unacceptable or undesirable, then the second failure must be detected and the product must achieve a known safe state before falsely activating any physical appliance.

(4) Common Mode failure . Another concern of multiple failure involves common mode failures in which two or more subsystems or components intended to compensate one another to perform the same function all fail by the same mode and result in unsafe conditions. This is of particular concern in instances in which two or more elements (hardware or software, or both) are used in combination to ensure safety. If a common mode failure exists, then any analysis performed under this appendix cannot rely on the assumption that failures are independent. Examples include: the use of redundancy in which two or more elements perform a given function in parallel and when one (hardware or software) element checks/monitors another element (of hardware or software) to help ensure its safe operation. Common mode failure relates to independence, which must be ensured in these instances. When dealing with the effects of hardware failure, the designer shall address the effects of the failure not only on other hardware, but also on the execution of the software, since hardware failures can greatly affect how the software operates.

(5) External influences . The product must be shown to operate safely when subjected to different external influences, including:

(i) Electrical influences such as power supply anomalies/transients, abnormal/improper input conditions ( e.g. , outside of normal range inputs relative to amplitude and frequency, unusual combinations of inputs) including those related to a human operator, and others such as electromagnetic interference or electrostatic discharges, or both;

(6) Modifications . Safety must be ensured following modifications to the hardware or software, or both. All or some of the concerns identified in this paragraph may be applicable depending upon the nature and extent of the modifications.

(7) Software. Software faults must not cause hazards categorized as unacceptable or undesirable.

(8) Closed Loop Principle . The product design must require positive action to be taken in a prescribed manner to either begin product operation or continue product operation.

(9) Human Factors Engineering: The product design must sufficiently incorporate human factors engineering that is appropriate to the complexity of the product; the educational, mental, and physical capabilities of the intended operators and maintainers; the degree of required human interaction with the component; and the environment in which the product will be used.

(c) What standards are acceptable for verification and validation? (1) The standards employed for verification or validation, or both, of products subject to this subpart must be sufficient to support achievement of the applicable requirements of subpart H of this part.

(2) U.S. Department of Defense Military Standard (MIL-STD) 882C, “System Safety Program Requirements” (January 19, 1993), is recognized as providing appropriate risk analysis processes for incorporation into verification and validation standards.

(3) The following standards designed for application to processor-based signal and train control systems are recognized as acceptable with respect to applicable elements of safety analysis required by subpart H of this part. The latest versions of the standards listed below should be used unless otherwise provided.

(i) IEEE 1483–2000, Standard for the Verification of Vital Functions in Processor-Based Systems Used in Rail Transit Control.

(A) EN50126: 1999, Railway Applications: Specification and Demonstration of Reliability, Availability, Maintainability and Safety (RAMS);

(B) EN50128 (May 2001), Railway Applications: Software for Railway Control and Protection Systems;

(C) EN50129: 2003, Railway Applications: Communications, Signaling, and Processing Systems-Safety Related Electronic Systems for Signaling; and

(D) EN50155:2001/A1:2002, Railway Applications: Electronic Equipment Used in Rolling Stock.

(iii) ATCS Specification 140, Recommended Practices for Safety and Systems Assurance.

(v) AAR-AREMA 2005 Communications and Signal Manual of Recommended Practices, Part 17.

(vi) Safety of High Speed Ground Transportation Systems. Analytical Methodology for Safety Validation of Computer Controlled Subsystems. Volume II: Development of a Safety Validation Methodology. Final Report September 1995. Author: Jonathan F. Luedeke, Battelle. DOT/FRA/ORD–95/10.2.

(vii) IEC 61508 (International Electrotechnical Commission), Functional Safety of Electrical/Electronic/Programmable/Electronic Safety (E/E/P/ES) Related Systems, Parts 1–7 as follows:

(A) IEC 61508–1 (1998–12) Part 1: General requirements and IEC 61508–1 Corr. (1999–05) Corrigendum 1-Part 1:General Requirements.

(B) IEC 61508–2 (2000–05) Part 2: Requirements for electrical/electronic/programmable electronic safety-related systems.

(C) IEC 61508–3 (1998–12) Part 3: Software requirements and IEC 61508–3 Corr.1(1999–04) Corrigendum 1-Part3: Software requirements.

(D) IEC 61508–4 (1998–12) Part 4: Definitions and abbreviations and IEC 61508–4 Corr.1(1999–04) Corrigendum 1-Part 4: Definitions and abbreviations.

(E) IEC 61508–5 (1998–12) Part 5: Examples of methods for the determination of safety integrity levels and IEC 61508–5 Corr.1 (1999–04) Corrigendum 1 Part 5: Examples of methods for determination of safety integrity levels.

(F) IEC 61508–6 (2000–04) Part 6: Guidelines on the applications of IEC 61508–2 and –3.

(4) Use of unpublished standards, including proprietary standards, is authorized to the extent that such standards are shown to achieve the requirements of this part. However, any such standards shall be available for inspection and replication by FRA and for public examination in any public proceeding before the FRA to which they are relevant.

(a) What is the purpose of this appendix? This appendix provides minimum requirements for independent third-party assessment of product safety verification and validation pursuant to subpart H of this part. The goal of this assessment is to provide an independent evaluation of the product manufacturer's utilization of safety design practices during the product's development and testing phases, as required by the applicable railroad's RSPP, the product PSP, the requirements of subpart H of this part, and any other previously agreed-upon controlling documents or standards.

(b) What general requirements apply to the conduct of third party assessments? (1) The supplier may request advice and assistance of the reviewer concerning the actions identified in paragraphs (c) through (g) of this appendix. However, the reviewer should not engage in design efforts, in order to preserve the reviewer's independence and maintain the supplier's proprietary right to the product.

(2) The supplier shall provide the reviewer access to any and all documentation that the reviewer requests and attendance at any design review or walkthrough that the reviewer determines as necessary to complete and accomplish the third party assessment. The reviewer may be accompanied by representatives of FRA as necessary, in FRA's judgment, for FRA to monitor the assessment.

(c) What must be done at the preliminary level? The reviewer shall evaluate with respect to safety and comment on the adequacy of the processes which the supplier applies to the design and development of the product. At a minimum, the reviewer shall compare the supplier processes with acceptable methodology and employ any other such tests or comparisons if they have been agreed to previously with FRA. Based on these analyses, the reviewer shall identify and document any significant safety vulnerabilities which are not adequately mitigated by the supplier's (or user's) processes. Finally, the reviewer shall evaluate the adequacy of the railroad's RSPP, the PSP, and any other documents pertinent to the product being assessed.

(d) What must be done at the functional level? (1) The reviewer shall analyze the Preliminary Hazard Analysis (PHA) for comprehensiveness and compliance with the railroad's RSPP.

(2) The reviewer shall analyze all Fault Tree Analyses (FTA), Failure Mode and Effects Criticality Analysis (FMECA), and other hazard analyses for completeness, correctness, and compliance with the railroad's RSPP.

(e) What must be done at the implementation level? The reviewer shall randomly select various safety-critical software modules for audit to verify whether the requirements of the RSPP were followed. The number of modules audited must be determined as a representative number sufficient to provide confidence that all unaudited modules were developed in compliance with the RSPP.

(f) What must be done at closure? (1) The reviewer shall evaluate and comment on the plan for installation and test procedures of the product for revenue service.

(2) The reviewer shall prepare a final report of the assessment. The report shall be submitted to the railroad prior to the commencement of installation testing and contain at least the following information:

(i) Reviewer's evaluation of the adequacy of the PSP, including the supplier's MTTHE and risk estimates for the product, and the supplier's confidence interval in these estimates;

(ii) Product vulnerabilities which the reviewer felt were not adequately mitigated, including the method by which the railroad would assure product safety in the event of a hardware or software failure ( i.e. , how does the railroad assure that all potentially hazardous failure modes are identified?) and the method by which the railroad addresses comprehensiveness of the product design for the requirements of the operations it will govern ( i.e. , how does the railroad assure that all potentially hazardous operating circumstances are identified? Who records any deficiencies identified in the design process? Who tracks the correction of these deficiencies and confirms that they are corrected?);

(iii) A clear statement of position for all parties involved for each product vulnerability cited by the reviewer;

(iv) Identification of any documentation or information sought by the reviewer that was denied, incomplete, or inadequate;

(v) A listing of each RSPP procedure or process which was not properly followed;

(vi) Identification of the software verification and validation procedures for the product's safety-critical applications, and the reviewer's evaluation of the adequacy of these procedures;

(vii) Methods employed by the product manufacturer to develop safety-critical software, such as use of structured language, code checks, modularity, or other similar generally acceptable techniques; and

(viii) Method by which the supplier or railroad addresses comprehensiveness of the product design which considers the safety elements listed in paragraph (b) of appendix C to this part.

(a) What is the purpose of this appendix? The purpose of this appendix is to provide HMI design criteria which will minimize negative safety effects by causing designers to consider human factors in the development of HMIs.

(b) What is meant by “designer” and “operator”? As used in this section, “designer” means anyone who specifies requirements for—or designs a system or subsystem, or both, for—a product subject to subpart H of this part, and “operator” means any human who is intended to receive information from, provide information to, or perform repairs or maintenance on a signal or train control product subject to subpart H of this part.

(c) What kinds of human factors issues must designers consider with regard to the general function of a system? —(1) Reduced situational awareness and over-reliance. HMI design must give an operator active functions to perform, feedback on the results of the operator's actions, and information on the automatic functions of the system as well as its performance. The operator must be “in-the-loop.” Designers shall consider at minimum the following methods of maintaining an active role for human operators:

(i) The system must require an operator to initiate action to operate the train and require an operator to remain “in-the-loop” for at least 30 minutes at a time;

(ii) The system must provide timely feedback to an operator regarding the system's automated actions, the reasons for such actions, and the effects of the operator's manual actions on the system;

(iii) The system must warn operators in advance when they require an operator to take action; and

(2) Expectation of predictability and consistency in product behavior and communications. HMI design must accommodate an operator's expectation of logical and consistent relationships between actions and results. Similar objects must behave consistently when an operator performs the same action upon them.

(3) Limited memory and ability to process information. (i) HMI design must minimize an operator's information processing load. To minimize information processing load, the designer shall:

(A) Present integrated information that directly supports the variety and types of decisions that an operator makes;

(B) Provide information in a format or representation that minimizes the time required to understand and act; and

(C) Conduct utility tests of decision aids to establish clear benefits such as processing time saved or improved quality of decisions.

(A) To minimize short-term memory load, the designer shall integrate data or information from multiple sources into a single format or representation (“chunking”) and design so that three or fewer “chunks” of information need to be remembered at any one time.

(B) To minimize long-term memory load, the designer shall design to support recognition memory, design memory aids to minimize the amount of information that must be recalled from unaided memory when making critical decisions, and promote active processing of the information.

(i) Design systems that anticipate possible user errors and include capabilities to catch errors before they propagate through the system;

(ii) Conduct cognitive task analyses prior to designing the system to better understand the information processing requirements of operators when making critical decisions; and

(d) What kinds of HMI design elements must a designer incorporate in the development of on-board train displays and controls? —(1) Location of displays and controls . Designers shall:

(iii) Arrange controls to minimize the need for the operator to change position;

(vi) Design for high stimulus-response compatibility (geometric and conceptual);

(vii) Design safety-critical controls to require more than one positive action to activate ( e.g. , auto stick shift requires two movements to go into reverse); and

(iii) Design for display luminance of the foreground or background of at least 35 cd/m² (the displays should be capable of a minimum contrast 3:1 with 7:1 preferred, and controls should be provided to adjust the brightness level and contrast level);

(iv) Design the interface to display only the information necessary to the user;

(v) Where text is needed, using short, simple sentences or phrases with wording that an operator will understand;

(vi) Use complete words where possible; where abbreviations are necessary, choose a commonly accepted abbreviation or consistent method and select commonly used terms and words that the operator will understand;

(vii) Adopt a consistent format for all display screens by placing each design element in a consistent and specified location;

(viii) Display critical information in the center of the operator's field of view by placing items that need to be found quickly in the upper left hand corner and items which are not time-critical in the lower right hand corner of the field of view;

(x) Design all visual displays to meet human performance criteria under monochrome conditions and add color only if it will help the user in performing a task, and use color coding as a redundant coding technique;

(xii) Design warnings to match the level of risk or danger with the alerting nature of the signal;

(xiii) With respect to information entry, avoid full QWERTY keyboards for data entry; and

(xiv) Use digital communications for safety-critical messages between the locomotive engineer and the dispatcher.

(e) What kinds of HMI design elements must a designer consider with respect to problem management? (1) HMI design must enhance an operator's situation awareness. An operator must have access to:

PART 236—RULES, STANDARDS, AND INSTRUCTIONS GOVERNING THE INSTALLATION, INSPECTION, MAINTENANCE, AND REPAIR OF SIGNAL AND TRAIN CONTROL SYSTEMS, DEVICES, AND APPLIANCES

§ 236.0 Applicability, minimum requirements, and penalties.

Subpart A—Rules and Instructions: All Systems

General

§ 236.1 Plans, where kept.

§ 236.2 Grounds.

§ 236.3 Locking of signal apparatus housings.

§ 236.4 Interference with normal functioning of device.

§ 236.5 Design of control circuits on closed circuit principle.

§ 236.6 Hand-operated switch equipped with switch circuit controller.

§ 236.7 Circuit controller operated by switch-and-lock movement.

§ 236.8 Operating characteristics of electromagnetic, electronic, or electrical apparatus.

§ 236.9 Selection of circuits through indicating or annunciating instruments.

§ 236.10 Electric locks, force drop type; where required.

§ 236.11 Adjustment, repair, or replacement of component.

§ 236.12 Spring switch signal protection; where required.

§ 236.13 Spring switch; selection of signal control circuits through circuit controller.

§ 236.14 Spring switch signal protection; requirements.

§ 236.15 Timetable instructions.

§ 236.16 Electric lock, main track releasing circuit.

§ 236.17 Pipe for operating connections, requirements.

§ 236.18 Software management control plan.

Roadway Signals and Cab Signals

§ 236.21 Location of roadway signals.

§ 236.22 Semaphore signal arm; clearance to other objects.

§ 236.23 Aspects and indications.

§ 236.24 Spacing of roadway signals.

§ 236.25 [Reserved]

§ 236.26 Buffing device, maintenance.

Track Circuits

§ 236.51 Track circuit requirements.

§ 236.52 Relayed cut-section.

§ 236.53 Track circuit feed at grade crossing.

§ 236.54 Minimum length of track circuit.

§ 236.55 Dead section; maximum length.

§ 236.56 Shunting sensitivity.

§ 236.57 Shunt and fouling wires.

§ 236.58 Turnout, fouling section.

§ 236.59 Insulated rail joints.

§ 236.60 Switch shunting circuit; use restricted.

Wires and Cables

§ 236.71 Signal wires on pole line and aerial cable.

§ 236.72 [Reserved]

§ 236.73 Open-wire transmission line; clearance to other circuits.

§ 236.74 Protection of insulated wire; splice in underground wire.

§ 236.75 [Reserved]

§ 236.76 Tagging of wires and interference of wires or tags with signal apparatus.

Inspections and Tests; All Systems

§ 236.101 Purpose of inspection and tests; removal from service of relay or device failing to meet test requirements.

§ 236.102 Semaphore or searchlight signal mechanism.

§ 236.103 Switch circuit controller or point detector.

§ 236.104 Shunt fouling circuit.

§ 236.105 Electric lock.

§ 236.106 Relays.

§ 236.107 Ground tests.

§ 236.108 Insulation resistance tests, wires in trunking and cables.

§ 236.109 Time releases, timing relays and timing devices.

§ 236.110 Results of tests.

Subpart B—Automatic Block Signal Systems

Standards

§ 236.201 Track-circuit control of signals.

§ 236.202 Signal governing movements over hand-operated switch.

§ 236.203 Hand operated crossover between main tracks; protection.

§ 236.204 Track signaled for movements in both directions, requirements.

§ 236.205 Signal control circuits; requirements.

§ 236.206 Battery or power supply with respect to relay; location.

§ 236.207 Electric lock on hand-operated switch; control.

Subpart C—Interlocking

Standards

§ 236.301 Where signals shall be provided.

§ 236.302 Track circuits and route locking.

§ 236.303 Control circuits for signals, selection through circuit controller operated by switch points or by switch locking mechanism.

§ 236.304 Mechanical locking or same protection effected by circuits.

§ 236.305 Approach or time locking.

§ 236.306 Facing point lock or switch-and-lock movement.

§ 236.307 Indication locking.

§ 236.308 Mechanical or electric locking or electric circuits; requisites.

§ 236.309 Loss of shunt protection; where required.

§ 236.310 Signal governing approach to home signal.

§ 236.311 Signal control circuits, selection through track relays or devices functioning as track relays and through signal mechanism contacts and time releases at automatic interlocking.