2015-30469. Locomotive Alerters Resetting Without Direct Engineer Action

AGENCY:

Federal Railroad Administration (FRA), Department of Transportation (DOT)

ACTION:

Notice of Safety Advisory.

SUMMARY:

FRA is issuing Safety Advisory 2015-06 to notify freight railroads of the circumstances of a head-on collision at Hoxie, AR, and the risks automated inputs that reset alerter warning timing cycles pose. A small number of Union Pacific Railroad (UP) locomotives were equipped with alerters that the horn sequencer reset without direct engineer action, reducing the alerters' effectiveness. UP has appropriately modified its locomotives to resolve the issue and FRA is not aware of any other locomotives equipped with alerters that automatically reset without direct engineer action. However, all freight railroads should review the operation of their locomotives equipped with alerters, and modify them as necessary, to ensure no system resets the alerter warning timing cycle without direct engineer action.

FOR FURTHER INFORMATION CONTACT:

Mr. Gary Fairbanks, Staff Director, Motive Power and Equipment Division, Office of Railroad Safety, FRA, 1200 New Jersey Avenue SE., Washington, DC 20590, [phone]; or Mr. Michael Masci, Trial Attorney, Office of Chief Counsel, FRA, 1200 New Jersey Avenue SE., Washington, DC 20590, [phone].

SUPPLEMENTARY INFORMATION:

Background, Including Accident Summary and Regulatory Context

Locomotive Alerter Functioning

A locomotive alerter is a safety feature installed on a locomotive to ensure the locomotive engineer remains alert while operating the locomotive. The alerter monitors the engineer's interactions with the locomotive and initially produces an alarm in the cab when no control actions are taken to reset the alerter warning timing cycle within a certain length of time. Because over-the-road locomotive operations often do not require frequent engineer actions (control inputs), alerter systems are also equipped with a manual reset button that allows the engineer to reset the warning timing cycle directly. If no control action or manual reset occurs after the alarm sounds, the alerter system will initiate a penalty brake application and reduce locomotive power to idle to stop the locomotive.

Horn activation is a locomotive control action that will reset the alerter warning timing cycle, but when automated (using a horn sequencer) it can also interfere with the alerter's normal functionality. On many locomotives, there are two distinct ways to activate the horn: (1) During ordinary operation, the engineer holds a manual horn controller in the “on” position to activate it, and then releases the controller to silence it; and (2) when approaching a crossing, the engineer activates a separate switch (often a foot pedal) to initiate an automatic horn sequencer (sounding the long-long-short-long sequence FRA's regulations require for public highway-rail grade crossings, see Title 49 Code of Federal Regulations (CFR) 222.21(a)). The simple presence of a horn sequencer is not a safety issue. The horn sequencer is a convenient tool, because of the frequent need to sound the long-long-short-long horn sequence for public highway-rail grade crossings. However, when the horn sequencer enables the alerter warning timing cycle to reset without direct engineer action, it acts to delay the alerter's safety functionality and reduce its effectiveness, which could have serious safety consequences.

Accident Summary and Testing

The head-on collision at Hoxie highlights the importance of this issue.^[1] On August 17, 2014, at approximately 2:28 a.m. (CDT), a southbound UP freight train passed an approach and then a stop indication and collided with a northbound UP freight train while transitioning from double-main track to single-main track at Control Point Y 229 on the UP Hoxie Subdivision in Hoxie. The collision resulted in two crewmember fatalities. The event recorder on the lead southbound locomotive was destroyed, but the event recorder and a camera on a trailing locomotive enabled the National Transportation Safety Board (NTSB) to recreate certain key events leading up to the moment of impact. Four minutes and 53 seconds before impact, the engineer activated the horn sequencer, which continued to cycle for 4 minutes and 6 seconds, at which time he deactivated it after passing a grade crossing at Hickory (Milepost (MP) 227.84)). During the time the horn sequencer was operating, the engineer made one throttle change, but took no action after passing an approach signal at MP 227.4.

Given the recorded speed of the train, there were two intervals during horn sequencer operation when the alerter could have sounded, alerted the crew, and initiated a penalty brake application if no response was given. The evidence available does not rule out the possibility that the engineer was manually resetting the alerter on the lead locomotive. However, if the locomotive was set up the same as the trailing locomotive, which is likely, the alerter would not have reached its intended timing cycle limit before the actual impact, regardless whether the automatic activation of the horn sequencer reset the timing cycle. The interval from deactivation of the horn sequencer to impact was 44 seconds, or 9 seconds shorter than the alerter warning timing cycle interval of 53 seconds at the impact speed of 45 mph, so no alarm or penalty brake application could have occurred in this interval.

FRA cannot determine whether an alerter activation would have prevented the Hoxie collision. Yet, if the alerter had alarmed during the minutes leading up to the collision, it could have provided an opportunity to prevent or mitigate this accident. FRA tests of another locomotive in the same series verified that the horn sequencer installed in these locomotives reset the alerter warning timing cycle after each sounding of the horn, even though all but the first horn blast were initiated automatically. This series of 40 locomotives, which were built over 20 years ago, were factory-equipped with a stand-alone horn sequencer, wired to reset the alerter with every sounding of the horn, including the sounding of the horn by the horn sequencer.

UP has appropriately modified this series of locomotives to address this issue. FRA did not specifically regulate the manner of the alerter's interaction with the horn sequencer when the locomotives were manufactured. As discussed below, freight locomotives of this age will not fall under FRA's alerter regulations until January 1, 2017.

FRA Regulations

FRA safety regulations addressing alerters on freight locomotives are found at 49 CFR 229.140. See 77 FR 21312 (April 9, 2012). Section 229.140 requires all controlling locomotives that are placed in service for the first time on or after June 10, 2013, and operated at speeds in excess of 25 mph to be equipped with an alerter. This section also requires all controlling locomotives operated at speeds in excess of 25 mph on or after January 1, 2017, to be equipped with an alerter, regardless of when they were first placed in service.

This section prohibits automatic systems from resetting the locomotive alerter. Specifically, 49 CFR 229.140(b)(3) requires movement of the engineer's horn activation handle to reset the alerter warning timing cycle. Using a horn sequencer to reset the alerter with each sounding of the horn (one for each of the long-long-short-long sequence) does not satisfy 49 CFR 229.140(b)(3), because all but the first horn blast are initiated automatically. This section requires engineers to take direct action, either by operation of certain controls or actuation of the manual reset, to restart the alerter warning timing cycle. Further, under 49 CFR 229.140(e), the alerter must be functioning and operating as intended when the locomotive is used. FRA addresses failures to comply with these regulatory requirements through inspections and enforcement activities.

Recommended Action: In light of the discussion above, and because many older locomotives, including locomotives from smaller manufacturers and remanufacturers are still in service, FRA recommends that all freight railroads check the operation of their locomotives equipped with alerters to ensure that no system resets the alerter warning timing cycle without direct engineer action. This review should include, but not be limited to, the operation of horn sequencer circuitry, if equipped. Railroads should modify any such systems they find to ensure that no system interferes with the alerter warning timing cycle. In particular, FRA recommends that railroads that may have installed alerters prior to June 10, 2013, review the design of those systems and modify them as necessary, before January 1, 2017, to ensure safety and compliance with 49 CFR 229.140(b)(3).

Issued in Washington, DC, on November 25, 2015.

Patrick T. Warren,

Deputy Associate Administrator for Safety.

Footnotes

1.  This section provides a brief summary of the circumstances surrounding the collision, based on the NTSB and FRA preliminary findings to date. The probable cause and contributing factors, if any, have not yet been established. Therefore, nothing in this safety advisory is intended to attribute a cause to this incident, or place responsibility for this accident on the acts or omissions of any person or entity.