02-1638. Notice of Safety Advisory 2002-01

AGENCY:

Federal Railroad Administration (FRA), DOT.

ACTION:

Notice of Safety Advisory 2002-01.

SUMMARY:

The FRA is issuing Safety Advisory 2002-01 addressing the importance of clear, precise, unambiguous railroad safety procedures to ensure the safety of highway-rail grade crossing warning systems or wayside signal systems that are temporarily removed from service for purposes of testing, inspection or repair.

FOR FURTHER INFORMATION CONTACT:

William Goodman, Signal and Train Control Division, Office of Safety Assurance and Compliance, FRA, 1120 Vermont Avenue, SW., Washington, DC 20590 (telephone [phone]) or Mark Tessler, Office of Chief Counsel, FRA, 1120 Vermont Avenue, SW., Washington, DC 20590 (telephone [phone]), e-mail [e-mail].

SUPPLEMENTARY INFORMATION:

Background

Highway-rail grade crossing warning devices and wayside train signals are among the most important safety systems in the railroad industry for preventing train collisions and highway-rail grade crossing accidents. Despite the high-degree of reliability of these systems, failures occasionally do occur. FRA regulations (49 CFR parts 234 and 236) require that both grade crossing warning devices and wayside signals operate on the “fail safe” principle, which causes a system to revert to its safest state in the event of a failure or malfunction of a vital component of the system. In practical terms, fail safe operations means the grade crossing warning devices will activate to stop traffic or a wayside signal will stop train movement in the event of a component failure. However, under certain circumstances, particularly where human error is involved, the fail-safe features can be deactivated or circumvented, resulting in an accident. FRA has noted that several serious highway-rail grade crossing accidents and numerous false proceed signal failures have occurred in the past three years due to human error failures. While the total number of such failures is very small given the more than 60,000 active highway-rail grade crossing warning systems and approximately 86,000 track miles of railroad signal systems currently in operation on our Nation's railroad network, even a single failure of a grade crossing warning system to activate when needed or a single false-proceed train signal has the potential to result in a serious accident or loss of life.

Grade crossing activation failures are of particular concern, because crossing signals are often the primary means of warning motorists of an approaching train. Wayside railroad signals are also critically important to the safety of train movements; however, there are often redundant safety measures in place to help prevent train collisions. For example, train movements may be remotely monitored by dispatchers at centralized dispatching centers and train crews are sometimes made aware of the presence of nearby trains by monitoring railroad radio transmissions. However, these redundant safety measures are not feasible at grade crossings. It is impossible for train dispatchers or train crews to monitor the movement of motor vehicles over a highway-railroad grade crossing. Therefore, because grade crossing warning devices play an extremely important role in preventing grade crossing collisions, it is imperative that every reasonable precaution be taken to prevent crossing activation failures.

FRA recognizes that the railroad industry has long recognized the importance of having well defined safety procedures in place to ensure the safety of highway-rail grade crossing warning systems and wayside signal systems that have been temporarily removed from service for purposes of testing, inspection or repair. Most railroads have had such safety procedures in place for many years; nevertheless, FRA has been concerned that grade crossing accidents and false proceed signals continue to occur because of the failure to properly notify approaching trains that grade crossing warning devices or wayside signal systems have been temporarily removed from service or because of the failure to properly restore these safety systems back into service. Therefore, FRA believes it is time for the railroad industry to review and re-evaluate these safety procedures. Over the past three years, at least five serious grade crossing collisions were the result of crossing warning device activation failures which were caused, in part, by the failure of railroad personnel to follow appropriate safety procedures when the crossing warning devices were removed from service for repair, or before the crossing warning devices were restored to service after repairs had been made. A brief review of these accidents may help illustrate the critical importance of railroads having clear, precise, and unambiguous railroad safety procedures in place when testing, inspecting or repairing highway-rail grade crossing warning systems or wayside signal systems.

In one incident, two teenage boys were killed when the motor vehicle they were driving was struck by an approaching train at a highway-rail grade crossing where the warning devices, which consisted of gates and flashing lights, failed to activate. An investigation of this tragic accident revealed that, several hours prior to the accident, the grade crossing warning devices had been temporarily disabled by a railroad signal maintainer for the purpose of making repairs and adjustments to the apparatus, and that the crossing warning devices were not tested to determine whether they were operating properly before the crossing was restored to service.

Another incident involved a grade crossing warning system which had been removed from service for repairs by a signal maintainer. In this instance, the signal maintainer did properly notify the railroad train dispatcher that the crossing warning devices had been temporarily deactivated and removed from service. The same dispatcher did provide proper notice to approaching trains that the grade crossing warning devices had been deactivated and that it would be necessary for the trains to provide flag protection while traversing the crossing. However, later during a change of shifts by dispatchers, the relief dispatcher was not notified that the grade crossing warning devices had been temporarily deactivated and removed from service. Consequently, the relief dispatcher did not notify a subsequent train that the grade crossing was out of service or that the train crew needed to provide flag protection before traversing the crossing. As a result, the train struck a motor vehicle at the crossing, killing the occupant.

In another grade crossing activation failure accident, railroad crossing maintenance personnel were utilizing the maintenance-of-way department's foul time and failed to follow authorized railroad safety procedures when temporarily deactivating the warning devices at a grade crossing. In this instance, a vital grade crossing warning system relay was inverted by a maintenance person and, subsequently, the maintenance-of-way department allowed a passenger train to operate through their work limits without notifying the signal personnel. Neither the train dispatcher nor the train crew were notified that the crossing warning devices had been deactivated. Consequently, a motor vehicle struck the side of a passenger train at the crossing, injuring the occupant of the motor vehicle.

Yet another example involved a railroad signal maintainer who had permission from the train dispatcher to foul the track and perform routine tests and inspections on a grade crossing warning device. During the course of inspecting the warning device, the signal maintainer applied a jumper wire to a vital warning system relay, thereby deactivating the warning device. He was subsequently called to investigate a false activation at another crossing and forgot to remove the jumper wire and restore the crossing warning device to service. He released his foul time with the train dispatcher, the warning system failed to activate for an approaching train, resulting in an accident which injured the occupant of a motor vehicle.

One last example involved a situation where a state highway department reported a false activation of a highway-rail grade crossing warning system to a railroad. The railroad's train dispatcher failed to notify train crews of the reported malfunction, which is required by Federal regulations. The railroad signal maintainer arrived at the crossing and used jumper wires to stop the warning system from falsely activating, without taking any measures to provide for the safety of highway users (i.e., notifying the dispatcher). He then proceeded to walk away from the immediate crossing area while trying to locate the cause of the false activation. A passenger train operating at 79 miles per hour traversed the crossing, hitting a motor vehicle and killing two occupants inside.

These occurrences resulted from interference with the normal functioning of the grade crossing warning systems without measures being taken to provide for the safety of highway traffic and train operations which depend on the normal functioning of such systems. FRA is very concerned about this practice and by issuing this safety advisory seeks to draw the attention of the railroad industry to this issue to reduce the likelihood of similar incidents in the future.

Failure to provide for the safety of motorists and train operations during all periods while the normal functioning of a system is interfered with is a violation of Federal rail safety regulations (See 49 CFR 234.209 and 236.4). FRA considers this requirement to be extremely significant to the safety of railroad employees, highway users, and the general public. Accordingly, when a system is completely or partially deactivated without adequate protective measures being taken, FRA will take firm enforcement action, which could include civil penalties against the companies and/or individuals responsible. However, preventing such serious failures in the first place is our primary goal, and the railroad's consistent application of proper procedures is critical in achieving that goal.

Railroads need to have clear and unambiguous procedures for temporarily removing grade crossing warning devices and wayside signal systems from service when making repairs, tests or inspections. These procedures should also help ensure that these critical safety devices are properly tested and known to be in proper working order before they are restored to service. Most railroads already have such procedures in place; however, in light of the incidents noted above, FRA believes that railroads should review existing procedures to ensure that they are adequate and should take steps to ensure that these safety procedures are followed.

FRA has reviewed some of the safety procedures for disabling grade crossing warning devices and wayside signal system that are in place on the major railroads to determine “best practices” that have been developed in the industry. We found that the most effective safety procedures include: (1) Requirements for signal employees to obtain proper authority from the train dispatcher or transportation department prior to disabling a warning or signal system; (2) documentation of the approval to disable the warning or signal system; (3) a requirement that all disabled warning systems must be properly inspected and tested to ensure proper operation before being restored to service; and (4) a procedure for the railroad maintenance personnel to verify with the train dispatcher or transportation department that the warning system has been properly tested before being restored to service.

Use of Jumper Wires

There are situations in which it may be necessary to temporarily circumvent the normal functioning of a system (i.e., crossing system or signal system maintenance, maintenance-of-way activity, defective system components not readily available for replacement, trains standing within a warning system's approach circuit for extended periods, etc.). A common method for such circumventing is by the application of jumper wires or some other means of circumventing the normal functioning of a system. This is appropriate when done in a safe manner. In such situations involving grade crossing warning systems, system credibility is maintained. For example, if maintenance-of-way work is being performed on trackage which is part of a highway-rail grade crossing warning system's train detection circuit, absent the application of jumper wires, it is highly probable that the warning system will activate, indicating to the motorist that it is not safe to cross the railroad tracks, when in fact no train is approaching the crossing. In this case, the integrity of the warning system would be compromised by the system's conveying false information to a motorist such that in the future, the motorist would not necessarily comply with the warning system indications. Appropriate use of jumper wires, or other safe means of bypassing the system, thus prevents the incorrect warning from being displayed, and safety is maintained as long as measures are taken to provide for the safety of motorists and train operations.

Although appropriately deactivating the crossing warning devices through the application of jumpers or other means is a safe practice when combined with protection measures addressed to motorists and train operations, if warning devices are allowed to remain deactivated after maintenance work is completed and workers leave the scene, the motorist may be left with a non-functioning warning system. Similarly, if this is done in a signal system, an incorrect false proceed indication may be displayed.

Because the application of jumper wires to vital control relays is the most widely accepted method for temporarily disabling a grade crossing warning device or wayside signal system, FRA found that the most effective safety procedures also mandate that only approved jumper wires may be used to bypass vital circuits. Furthermore, these procedures require documentation regarding the number of jumper wires applied to circuits, the specific location of the wires, and the circuitry designation to which the wires are applied. Also, when planned maintenance-of-way work is to be performed which could affect the operation of a warning system, the safety procedures insist that a thorough job briefing be conducted by the employee in charge of performing the work on the grade crossing warning devices or wayside signal systems. Again, in all of these cases, testing is required to ensure the proper operation of the warning system prior to returning the warning system to service and the most effective procedures require that a record be kept of the tests that were performed.

In order to mitigate the risks inherent with the circumvention of a system, FRA believes it is important that individual railroads have standard procedures in place before interfering with the normal operation of a system.

Recommended Action

In recognition of the need to assure safety, FRA strongly recommends that:

1. Each railroad having a highway-rail grade crossing warning system or wayside signal system establish specific railroad-wide instructions for the proper temporary deactivation of these systems. These instructions should address:

(a) The manner in which the deactivation is authorized;

(b) The personnel designated to authorize deactivation;

(c) The protocols for notifying designated persons, especially personnel responsible for the movement of trains, that a warning system has been deactivated;

(d) The appropriate methods of providing for the safety of train movements while the warning devices are deactivated;

(e) The requirements necessary to perform an operational test of the pertinent system components after the signal system or crossing warning device work has been completed and prior to restoring the apparatus to service; and

(f) The protocols for documenting and notifying designated persons that the warning devices have been properly tested and restored to service.

2. Each railroad should provide regular periodic training to all affected employees to ensure their understanding of instructions for the proper temporary deactivation of grade crossing warning or wayside signal system, including proper use of jumper wires.

Issued in Washington, DC on January 16, 2002.

George A. Gavalla,

Associate Administrator for Safety.