E9-17184. Positive Train Control Systems

AGENCY:

Federal Railroad Administration (FRA), Department of Transportation (DOT).

ACTION:

Notice of proposed rulemaking.

SUMMARY:

FRA proposes regulations implementing a requirement of the Rail Safety Improvement Act of 2008 that certain passenger and freight railroads install positive train control systems. The proposal includes required functionalities of the technology and the means by which it would be certified. The proposal also describes the contents of the positive train control implementation plans required by the statute and contains the proposed process for submission of those plans for review and approval by FRA. These proposed regulations could also be voluntarily complied with by entities not mandated to install positive train control systems.

DATES:

(1) Written comments must be received by August 20, 2009. Comments received after that date will be considered to the extent possible without incurring additional expenses or delays.

(2) FRA will hold an oral public hearing on a date to be announced in a forthcoming notice.

ADDRESSES:

Comments: Comments related to Docket No. FRA-2008-0132, may be submitted by any of the following methods:

• Web Site: Comments should be filed at the Federal eRulemaking Portal, http://www.regulations.gov. Follow the online instructions for submitting comments.
• Fax: [phone].
• Mail: Docket Management Facility, U.S. Department of Transportation, 1200 New Jersey Avenue, SE., W12-140, Washington, DC 20590.
• Hand Delivery: Room W12-140 on the Ground level of the West Building, 1200 New Jersey Avenue, SE., Washington, DC between 9 a.m. and 5 p.m. Monday through Friday, except Federal holidays.

Instructions: All submissions must include the agency name and docket number or Regulatory Identification Number (RIN) for this rulemaking. Note that all comments received will be posted without change to http://www.regulations.gov including any personal information. Please see the Privacy Act heading in the SUPPLEMENTARY INFORMATION section of this document for Privacy Act information related to any submitted comments or materials.

Docket: For access to the docket to read background documents or comments received, go to http://www.regulations.gov at any time or to Room W12-140 on the Ground level of the West Building, 1200 New Jersey Avenue, SE., Washington, DC between 9 a.m. and 5 p.m. Monday through Friday, except Federal Holidays.

FOR FURTHER INFORMATION CONTACT:

Thomas McFarlin, Office of Safety Assurance and Compliance, Staff Director, Signal & Train Control Division, Federal Railroad Administration, Mail Stop 25, West Building 3rd Floor West, Room W35-332, 1200 New Jersey Avenue, SE., Washington, DC 20590 (telephone: [phone]); or Jason Schlosberg, Trial Attorney, Office of Chief Counsel, RCC-10, Mail Stop 10, West Building 3rd Floor, Room W31-217, 1200 New Jersey Avenue, SE., Washington, DC 20590 (telephone: [phone]).

SUPPLEMENTARY INFORMATION:

FRA is issuing this proposed rule to provide regulatory guidance and performance standards for the development, testing, implementation, and use of Positive Train Control (PTC) systems for railroads mandated by the Railroad Safety Improvement Act of 2008 section 104, Public Law 110-432, 122 Stat. 4854 (Oct. 16, 2008) (codified at 9 U.S.C. 20157) (hereinafter “RSIA08”) to install PTC systems. These regulations may also be voluntarily complied with by entities not mandated to install PTC in lieu of the requirements contained in subpart H of part 236. The proposed rule establishes requirements for PTC system standard design and functionality, the associated submissions for FRA PTC system approval and certification, requirements for training, and required risk-based criteria. The RSIA08 mandates that widespread implementation of PTC across a major portion of the U.S. rail industry be accomplished by December 31, 2015. This proposed rule is intended to provide the necessary Federal oversight, guidance, and assistance toward successful completion of that congressional requirement. This proposed rule also necessitates or results in some minimal revision or amendment to parts 229, 234 and 235, as well as previously existing subparts A through H of part 236.

Table of Contents for Supplementary Information

I. Introduction

II. Background

A. The Need for Positive Train Control Technology

B. Earlier Efforts to Encourage Voluntary PTC Implementation

C. Technology Advances Under Subpart H

III. The Rail Safety Improvement Act of 2008

IV. RSAC

V. Use of Performance Standards

VI. Section-by-Section Analysis

VII. Regulatory Impact and Notices

A. Executive Order 12866 and DOT Regulatory Policies and Procedures

B. Regulatory Flexibility Act and Executive Order 13272

C. Paperwork Reduction Act

D. Federalism Implications

E. Environmental Impact

F. Unfunded Mandates Reform Act of 1995

G. Energy Impact

H. Privacy Act

VIII. The Rule

I. Introduction

This proposed rule provides new performance standards for the implementation and operation of PTC systems as mandated by RSIA08 and as otherwise voluntarily adopted. The proposed rule also details the process and identifies the documents that railroads and operators of passenger trains are to utilize and incorporate in their PTC implementation plans required by the Railroad Safety Improvement Act of 2008 section 104, Public Law 110-432, 122 Stat. 4854, (Oct. 16, 2008) (codified at 9 U.S.C. 20157) (hereinafter “RSIA08”). The proposal also details the process and procedure for obtaining FRA approval of such plans.

FRA began the process of developing a proposed rule after RSIA08 was signed into law. While developing the proposed rule, FRA applied the performance-based principles embodied in existing subpart H of part 236 to identify and remedy any weaknesses discovered in the subpart H regulatory approach, while exploiting lessons learned from products developed under subpart H. FRA has continued to make performance-based safety decisions while supporting railroads in their development and implementation of PTC system technologies.

Development of the proposed rule was enhanced with the participation of the Railroad Safety Advisory Committee (RSAC), which tasked a PTC Working Group to provide advice regarding development of implementing regulations for PTC systems and their deployment that are required under RSIA08. The PTC Working Group made a number of consensus recommendations, which have been identified and included in this proposed rule. The preamble discusses the statutory background, the regulatory background, the RSAC proceedings, the alternatives considered and the rationale for the option selected, the proceedings to date, as well as the comments and conclusions on general issues. Other comments and resolutions are discussed within the corresponding section-by-section analysis.

II. Background

A. The Need for Positive Train Control Technology

Since the early 1920s, systems have been in use that can intervene in train operations by warning crews or causing trains to stop if they are not being operated safely because of inattention, misinterpretation of wayside signal indications, or incapacitation of the crew. Pursuant to orders of the Interstate Commerce Commission (ICC)—whose safety regulatory activities were later transferred to FRA when it was established in 1967—cab signal systems, automatic train control, and automatic train stop systems were deployed on a significant portion of the national rail system to supplement and enforce the indications of wayside signals and operating speed limitations. However, these systems were expensive to install and maintain, and with the decline of intercity passenger service following the Second World War, the ICC and the industry allowed many of these systems to be discontinued. During this period, railroads were heavily regulated with respect to rates and service responsibilities. The development of the Interstate Highway System and other factors led to reductions in the railroads' revenues without regulatory relief, leading to bankruptcies, railroad mergers, and eventual abandonment of many rail lines. Consequently, railroads focused on fiscal survival, and investments in expensive relay-based train control technology were economically out of reach. The removal of these train control systems, which had never been pervasively installed, permitted train collisions to continue, notwithstanding enforcement of railroad operating rules designed to prevent them.

As early as 1970, following its investigation of the August 20, 1969, head-on collision of two Penn Central Commuter trains near Darien, Connecticut, in which 4 people were killed and 45 people were injured, the National Transportation Safety Board (NTSB) asked FRA to study the feasibility of requiring a form of automatic train control system to protect against operator error and prevent train collisions. Following the Darien accident, the NTSB continued to investigate one railroad accident after another caused by human error. During the next two decades, the NTSB issued a number of safety recommendations asking for train control measures. Following its investigation of the May 7, 1986, rear-end collision involving a Boston and Maine Corporation commuter train and a Consolidated Rail Incorporated (Conrail) freight train in which 153 people were injured, the NTSB recommend that FRA promulgate standards to require the installation and operation of a train control system that would provide for positive train separation. NTSB Recommendation R-87-16 (May 19, 1987), available at http://www.ntsb.gov/​Recs/​letters/​1987/​R87_​16.pdf. When the NTSB first established its Most Wanted List of Transportation Safety Improvements in 1990, the issue of Positive Train Separation was among the improvements listed, and it remained on the list until just after enactment of RSIA08. Original “Most Wanted” list of Transportation Safety Improvements, as adopted September 1990, available at http://www.ntsb.gov/​Recs/​mostwanted/​original_​list.htm. The NTSB continues to follow the progress of the technology's implementation closely and participated through staff in the most recent PTC Working Group deliberations.

Meanwhile, enactment of the Staggers Rail Act of 1980 signaled a shift in public policy that permitted the railroads to shed unprofitable lines, largely replace published “tariffs” with appropriately priced contract rates, and generally respond to marketplace realities, which increasingly demanded flexible service options responsive to customer needs. The advent of microprocessor-based electronic control systems and digital data radio technology during the mid-1980s led the freight railroad industry, through the Association of American Railroads (AAR) and the Railway Association of Canada, to explore the development of Advanced Train Control Systems (ATCS). With broad participation by suppliers, railroads, and FRA, detailed specifications were developed for a multi-level “open” architecture that would permit participation by many suppliers while ensuring that systems deployed on various railroads would work in harmony as trains crossed corporate boundaries. ATCS was intended to serve a variety of business purposes, in addition to enhancing the safety of train operations. Pilot versions of ATCS and a similar system known as Advanced Railroad Electronic Systems (ARES) were tested relatively successfully, but the systems were never deployed on a wide scale primarily due to cost. However, sub-elements of these systems were employed for various purposes, particularly for replacement of pole lines associated with signal systems.

Collisions, derailments, and incursions into work zones used by roadway workers continued as a result of the absence of effective enforcement systems designed to compensate for the effects of fatigue and other human factors. Renewed emphasis on rules compliance and Federal regulatory initiatives, including rules for the control of alcohol and drug use in railroad operations, operational testing and inspection programs designed to verify railroad rules compliance, requirements for qualification and certification of locomotive engineers, and negotiated rules for roadway worker protection led to some reduction in risk. However, the lack of an effective collision avoidance system allowed the continued occurrence of accidents, some involving tragic losses of life and significant property damage.

B. Earlier Efforts To Encourage Voluntary PTC Implementation

As the NTSB continued to highlight the opportunities for accident prevention associated with emerging train control technology through its investigations and findings, Congress showed increasing interest, mandating three separate reports over the period of a decade. In 1994, FRA reported to Congress on this problem, calling for implementation of an action plan to deploy PTC systems (Railroad Communications and Train Control, July 1994 (hereinafter “1994 Report”)). The 1994 Report forecasted substantial benefits of advanced train control technology in supporting a variety of business and safety purposes, but noted that an immediate regulatory mandate for PTC could not be justified based upon normal cost-benefit principals relying on direct safety benefits. The report outlined an aggressive Action Plan implementing a public-private sector partnership to explore technology potential, deploy systems for demonstration, and structure a regulatory framework to support emerging PTC initiatives.

Following through on the 1994 Report, FRA committed approximately $40 million through the Next Generation High Speed Rail Program and the Research and Development Program to support development, testing, and deployment of PTC prototype systems in the Pacific Northwest, Michigan, Illinois, Alaska, and some Eastern railroads. FRA also initiated a comprehensive effort to structure an appropriate regulatory framework for facilitating voluntary implementation of PTC and for evaluating future safety needs and opportunities.

In September of 1997, FRA asked the RSAC to address the issue of PTC. The RSAC accepted three tasks: Standards for New Train Control Systems (Task 1997-06), Positive Train Control Systems—Implementation Issues (Task 1997-05), and Positive Train Control Systems—Technologies, Definitions, and Capabilities (Task 1997-04). The PTC Working Group was established, comprised of representatives of labor organizations, suppliers, passenger and freight railroads, other Federal agencies, and interested state departments of transportation. The PTC Working Group was supported by FRA counsel and staff, analysts from the Volpe National Transportation Systems Center, and advisors from the NTSB staff.

In 1999, the PTC Working Group provided to the Federal Railroad Administrator a consensus report (“1999 Report”) with an indication that it would be continuing its efforts. The report defined the PTC core functions to include: Prevention of train-to-train collisions (positive train separation); enforcement of speed restrictions, including civil engineering restrictions (curves, bridges, etc.) and temporary slow orders; and protection for roadway workers and their equipment operating under specific authorities. The PTC Working Group identified additional safety functions that might be included in some PTC architectures: Provide warning of on-track equipment operating outside the limits of authority; receive and act upon hazard information, when available, in a more timely or more secure manner (e.g., compromised bridge integrity, wayside detector data); and provide for future capability by generating data for transfer to highway users to enhance warning at highway-rail grade crossings. The PTC Working Group stressed that efforts to enhance highway-rail grade crossing safety must recognize the train's necessary right of way at grade crossings and that it is important that warning systems employed at highway-rail grade crossings be highly reliable and “fail-safe” in their design.

As the PTC Working Group's work continued, other collaborative efforts, including development of Passenger Equipment Safety Standards (including private standards through the American Public Transit Association), Passenger Train Emergency Preparedness rules, and proposals for improving locomotive crashworthiness (including improved fuel tank standards) have targeted reduction in collision and derailment consequences.

In 2003, in light of technological advances and potential increased cost and system savings related to prioritized deployment of PTC systems, the Appropriations Committees of Congress requested that FRA update the costs and benefits for the deployment of PTC and related systems. As requested, FRA carried out a detailed analysis that was filed in August of 2004 (“2004 Report”), which indicated that under one set of highly controversial assumptions, substantial public benefits would likely flow from the installation of PTC systems on the railroad system. Further, the total amount of these benefits was subject to considerable controversy. While many of the other findings of the 2004 Report were disputed, there were no data submitted to challenge the 2004 Report finding that reaffirmed earlier conclusions that the safety benefits of PTC systems were relatively small in comparison to the large capital and maintenance costs. Accordingly, FRA continued to believe that an immediate regulatory mandate for widespread PTC implementation could not be justified based upon traditional cost-benefit principles relying on direct railroad safety benefits. Benefits and Costs of Positive Train Control (Report in Response to Committees on Appropriations, August 2004).

Despite the economic infeasibility of PTC based on safety benefits alone, as outlined in the 1994, 1999, and 2004 Reports, FRA continued with regulatory and other efforts to facilitate and encourage the voluntary installation of PTC systems. As part of the High Speed Rail Initiative, and in conjunction with the National Railroad Passenger Corporation (Amtrak), the AAR, the State of Illinois, and the Union Pacific Railroad Company (UP), FRA created the North American Joint Positive Train Control (NAJPTC) Program, which set out to describe a single standardized open source PTC architecture and system. UP's line between Springfield and Mazonia, Illinois was selected for initial installation of a train control system to support Amtrak operations up to 110 mph, and the system was installed and tested on portions of that line. Although the system did not prove viable as then conceived, the project hastened the development of PTC technology that was subsequently employed in other projects. Promised standards for interoperability of PTC systems also proved elusive.

In addition to financially supporting the NAJPTC Program, FRA continued to work with the rail carriers, rail labor, and suppliers on regulatory reforms to facilitate voluntary PTC implementation. The regulatory reform effort culminated when FRA issued a final rule on March 7, 2005, establishing a technology neutral safety-based performance standard for processor-based signal and train control systems. This new regulation, codified as subpart H to part 236, was carefully crafted to encourage the voluntary implementation and operation of processor-based signal and train control systems without impairing technological development. 70 FR 11052 (Mar. 7, 2005).

FRA intended that final rule—developed in close cooperation with rail management, rail labor, and suppliers—to further facilitate individual railroad efforts to voluntarily develop and deploy cost effective PTC technologies that would make system-wide deployment more economically viable. It also appeared very possible that major railroads would elect to make voluntary investments in PTC to enhance safety, improve service quality, and foster efficiency (e.g., better asset utilization, reduced fuel use through train pacing).

C. Technology Advances Under Subpart H

While FRA and RSAC worked to develop consensus on the regulations that would become subpart H, the railroads continued with PTC prototype development. The technology neutral, performance-based regulatory process established by subpart H proved to be very successful in facilitating the development of other PTC implementation approaches. Although the railroads prototype development efforts were generally technically successful and offered significant improvements in safety, costs of nationwide deployment continued to be untenable. Information gained from prototype efforts did little to reduce the estimated costs for widespread implementation of the core PTC safety functions on the nation's railroads.

Working under subpart H, the BNSF Railway Company (BNSF), CSX Transportation, Inc. (CSXT), the Norfolk Southern Corporation (NS), and UP undertook more aggressive design and implementation work. The new subpart H regulatory approach also made it feasible for smaller railroads such as the Alaska Railroad and the Ohio Central Railroad to begin voluntary design and implementation work on PTC systems that best suited their needs. FRA provided, and continues to provide, technical assistance and guidance regarding regulatory compliance to enable the railroads to more effectively design, install, and test their respective systems.

In December 2006, FRA approved the initial version of the Electronic Train Management System (ETMS) product for deployment on 35 of BNSF's subdivisions (“ETMS I Configuration”) comprising single track territory that was either non-signaled or equipped with traffic control systems. In a separate proceeding, FRA agreed that ETMS could be installed in lieu of restoring a block signal system on a line for which discontinuance had been authorized followed by a significant increase in traffic. During the same period, BNSF successfully demonstrated a Switch Point Monitoring System (SPMS)—a system that contains devices attached to switches that electronically report the position of the switches to the railroad's central dispatching office or the crew of an approaching train—and a Track Integrity Warning System (TIWS)—a system that electronically reports to the railroad's central dispatching office or the crew of an approaching train if there are any breaks in the rail that might lead to derailments. FRA believes both of these technologies help to reduce risk in non-signaled territory and are forward-compatible for use with existing and new PTC systems. To be forward-compatible, not to be confused with the similar concept of extensibility, a system must be able to gracefully provide input intended for use in later system versions. The introduction of a forward-compatible technology implies that older devices can partly understand and provide data generated or used by new devices or systems. The concept can be applied to electrical interfaces, telecommunication signals, data communication protocols, file formats, and computer programming languages. A standard supports forward-compatibility if older product versions can receive, read, view, play, execute, or transmit data to the new standard. In the case of wayside devices, they are said to be forward compatible if they can appropriately communicate and interact with a PTC system when later installed. A wayside device might serve the function of providing only information or providing information and accepting commands from a new system.

In addition to scheduling the installation of the ETMS I configuration as capital funding became available, BNSF voluntarily undertook the design and testing of complementary versions of ETMS that would support BNSF operations on more complex track configurations, at higher allowable train speeds, and with additional types of rail traffic. Meanwhile, CSXT was in the process of redesigning and relocating the test bed for its Communications Based Train Management (CBTM) system, which it has tested for several years, and UP and NS were working on similar systems using vital onboard processing.

As congressional consideration of legislation that resulted in the RSIA08 commenced, all four major railroads had settled on the core technology developed for them by Wabtec Railway Electronics (“Wabtec”). As the legislation progressed, the railroads and Wabtec worked toward greater commonality in the basic functioning of the onboard system with a view toward interoperability. Accordingly, ETMS is now a generic architectural description of one type of PTC system. Examples of ETMS include the non-vital PTC systems of BNSF's ETMS I and ETMS II, CSXT's CBTM, UP's Vital Train Management System (VTMS), and NS's Optimized Train Control (OTC). Further work is being undertaken by BNSF to advance the capability of ETMS by integrating Amtrak operations (ETMS III). For a description of system enhancements planned by BNSF as per the Product Safety Plan filed in accordance with subpart H, see FRA Docket No. 2006-23687, Document 0017, at pp. 40-43.

While the freight railroads' efforts for developing and installing PTC systems progressed over a relatively long period of time, starting with demonstrations of ATCS and ARES in the late 1980s and culminating in the initial ETMS Product Safety Plan approval in December of 2006, Amtrak demonstrated its ability to turn on revenue-quality PTC systems on its own railroad in support of high speed rail. Beginning in the early 1990s, Amtrak developed plans for enhanced high speed service on the Northeast Corridor (NEC), which included electrification and other improvements between New Haven and Boston and introduction of the Acela trainsets as the premium service from Washington to New York and New York to Boston. In connection with these improvements, which support train speeds up to 150 mph, Amtrak undertook to install the Advanced Civil Speed Enforcement System (ACSES) as a supplement to existing cab signals and automatic train control (speed control). Together, these systems deliver PTC core functionalities. In support of this effort, FRA issued an order for the installation of the system, which required all passenger and freight operators in the New Haven-Boston segment to equip their locomotives with ACSES. See 63 FR 39343 (July 22, 1998). ACSES was installed between 2000 and 2002, and has functioned successfully between New Haven and Boston, and on selected high speed segments between Washington and New York for a number of years.

Amtrak voluntarily began development of an architecturally different PTC system, the Incremental Train Control System (ITCS), for installation on its Michigan Line. Amtrak developed and installed ITCS under waivers from specific sections of 49 CFR part 236, subparts A through G, granted by FRA. ITCS was applied to tenant NS locomotives as well as Amtrak locomotives traversing the route. Highway-rail grade crossings on the route were fitted with ITCS units to pre-start the warning systems for high-speed trains and to monitor crossing warning system health in real time. The ITCS was tested extensively in the field for safety and reliability, and it was placed in revenue service in 2001. As experience was gained, FRA authorized increases in speed to 95 mph; and FRA is presently awaiting final results of an independent assessment of verification and validation for the system with a view toward authorizing operations at the design speed of 110 mph.

Despite these successes, the widespread deployment of these various train control systems, particularly on the general freight system, remained very much constrained by prohibitive capital costs. While the railroads were committed to installing these new systems to enhance the safety afforded to the public and their employees, the railroad's actual widespread implementation remained forestalled due to an inability to generate sufficient funding for these new projects in excess of the capital expenditures necessary to cover the ongoing operating and maintenance costs. Accordingly, the railroads continued to plan very slow deployments of PTC system technologies.

III. The Rail Safety Improvement Act of 2008

On May 1, 2007, the House of Representatives introduced H.R. 2095, which would, among other things, mandate the implementation and use of PTC systems. The bill passed the House on October 17, 2007. The bill was then amended and passed by the Senate on August 1, 2008. While the bill was awaiting final passage, the FRA Administrator testified before Congress that “FRA is a strong supporter of PTC technology and is an active advocate for its continued development and deployment.” Senate Commerce Committee Briefing on Metrolink Accident, 110th Cong. (Sept. 23, 2008) (written statement of Federal Railroad Administrator Joseph H. Boardman), available at http://www.fra.dot.gov/​downloads/​PubAffairs/​09-23-08FinalStatementFRAAdministratorPTC_​Sen_​Boxer_​Meeting.pdf.

On September 24, 2008, the House concurred with the Senate amendment and added another amendment pursuant to H. Res. 1492. When considering the House's amendment, various Senators made statements referencing certain train accidents that were believed to be PTC-preventable. For instance, Senator Lautenberg (NJ) took notice of the collision at Graniteville, South Carolina in 2005, and Senators Lautenberg, Hutchinson (TX), Boxer (CA), Levin (MI), and Carper (DE) took notice of an accident at Chatsworth, California, on September 12, 2008. According to Senator Levin, Federal investigators have said that a collision warning system could have prevented that crash and the subject legislation would require that new technology to prevent crashes be installed in high risk tracks. Senators Carper and Boxer made similar statements, indicating that PTC systems are designed to prevent train derailments and collisions, like the one in Chatsworth. 154 Cong. Rec. S10283-S10290 (2008). Ultimately, on October 1, 2008, the Senate concurred with the House amendment.

The Graniteville accident referenced by Senator Lautenberg was an early morning collision between two NS trains in non-signaled (dark) territory near the Avondale Mills Textile plant. One of the trains—which was transporting chlorine gas, sodium hydroxide, and cresol on the main track—approached an improperly lined hand-operated switch. As the train diverged through the switch, it ran onto the siding track where it collided with a parked train. Various tank cars ruptured, releasing at least 90 tons of chlorine gas. Nine people died due to chlorine inhalation and at least 250 people were treated for chlorine exposure. In addition, 5,400 residents within a mile of the crash site were forced to evacuate for nearly two weeks while hazardous materials (hazmat) teams and cleanup crews decontaminated the area.

The Chatsworth train collision occurred on the afternoon of September 12, 2008, when a Union Pacific freight train and a Metrolink commuter train collided head-on on a single main track equipped with a Traffic Control System (TCS) in the Chatsworth district of Los Angeles, California. Although NTSB has not yet released its final report, evidence summarized at the NTSB's public hearing suggested that the Metrolink passenger train was operated past a signal displaying a stop indication and entered a section of single track where the opposing UP freight train was operating on a signal indication permitting it to proceed over a switch and into a siding (after which the switch would have been lined for the Metrolink train to proceed). As a consequence of the accident, 25 people died and over 130 more were seriously injured.

Prior to the accidents in Graniteville and Chatsworth, the railroads' slow incremental deployment of PTC technologies—while not uniformly agreed upon by the railroads, FRA, and NTSB—was generally deemed acceptable by them in view of the tremendous costs involved. Partially as a consequence and severity of these very public accidents, coupled with a series of other less publicized accidents, Congress passed the Rail Safety Improvement Act of 2008 into law on October 16, 2008, marking a public policy decision that, despite the implementation costs, railroad employee and general public safety warranted mandatory and accelerated installation and operation of PTC systems.

As immediately relevant to this rulemaking, RSIA08 requires the installation and operation of PTC systems on all main lines, meaning all intercity and commuter lines—with limited exceptions entrusted to FRA—and on freight-only lines when they are part of a Class I railroad system, carrying at least 5 million gross tons of freight annually, and carrying any amount of poison- or toxic-by-inhalation (PIH or TIH) materials. While the statute vests certain responsibilities with the Secretary of the U.S. Department of Transportation, the Secretary has since delegated those responsibilities to the FRA Administrator. See 49 CFR 1.49(oo); 74 FR 26,981 (June 5, 2009); see also 49 U.S.C. 103(g).

In RSIA08, Congress established very aggressive dates for PTC system build-out completion. Each subject railroad is required to submit to FRA by April 16, 2010, an implementation plan indicating where and how it intends to install PTC systems by December 31, 2015. As a result of this accelerated PTC system deployment schedule, railroads must immediately engage in a massive reprogramming of capital funds.

In light of the timetable instituted by Congress, and to better support railroads with their installation while maintaining safety, FRA decided that it is appropriate for mandatory PTC systems to be reviewed by FRA differently than the regulatory approval process provided under subpart H. FRA believes that it is important to develop a process more suited specifically for PTC systems that would better facilitate railroad reuse of safety documentation and simplify the process of showing that the installation of the PTC system did not degrade safety. FRA also believes that subpart H does not clearly address the statutory mandates and that such lack of clarity would complicate railroad efforts to comply with the new statutory requirements. Accordingly, FRA is hereby proposing to amend part 236 by modifying existing subpart H and adding a new subpart I. FRA requests comments on whether this proposed regulation exercises the appropriate level of discretion and flexibility to comply with RSIA08 in the most cost effective and beneficial manner.

IV. RSAC

In March 1996, FRA established the RSAC, which provides a forum for collaborative rulemaking and program development. The RSAC includes representatives from all of the agency's major stakeholder groups, including railroads, labor organizations, suppliers and manufacturers, and other interested parties. When appropriate, FRA assigns a task to RSAC, and after consideration and debate, RSAC may accept or reject the task. If accepted, RSAC establishes a working group that possesses the appropriate expertise and representation of interests to develop recommendation to FRA for action on the task. These recommendations are developed by consensus. The working group may establish one or more task forces or other subgroups to develop facts and options on a particular aspect of a given task. The task force, or other subgroup, reports to the working group. If a working group comes to consensus on recommendations for action, the package is presented to the RSAC for a vote. If the proposal is accepted by a simple majority of the RSAC, the proposal is formally recommended to FRA. FRA then determines what action to take on the recommendation. Because FRA staff has played an active role at the working group and subgroup levels in discussing the issues and options and in drafting the language of the consensus proposal, and because the RSAC recommendation constitutes the consensus of some of the industry's leading experts on a given subject, FRA is generally favorably inclined toward the RSAC recommendation. However, FRA is in no way bound to follow the recommendation and the agency exercises its independent judgment on whether the recommended rule achieves the agency's regulatory goals, is soundly supported, and was developed in accordance with the applicable policy and legal requirements. Often, FRA varies in some respects from the RSAC recommendation in developing the actual regulatory proposal.

In developing this proposal, FRA adopted the RSAC PTC Working Group approach. As part of this effort, FRA is working with the major stakeholders affected by this subpart in as much a collaborative manner as possible. FRA believes establishing a collaborative relationship early in the product development and regulatory development cycles can help bridge the divide between the railroad carrier's management, railroad labor organizations, the suppliers, and FRA by ensuring that all stakeholders are working with the same set of data and have a common understanding of product characteristics or their related processes production methods, including the regulatory provisions, with which compliance is mandatory. However, where the group failed to reach consensus on an issue, FRA used its authority to resolve the issue, attempting to reconcile as many of the divergent positions as possible through traditional rulemaking proceedings.

On December 10, 2008, the RSAC accepted a task (No. 08-04) entitled “Implementation of Positive Train Control Systems.” The purpose of this task was defined as follows: “To provide advice regarding development of implementing regulations for Positive Train Control (PTC) systems and their deployment under the Rail Safety Improvement Act of 2008.” The task called for the RSAC PTC Working Group to perform the following:

• Review the mandates and objectives of the Act related to deployment of PTC systems;
• Help to describe the specific functional attributes of systems meeting the statutory purposes in light of available technology;
• Review impacts on small entities and ascertain how best to address them in harmony with the statutory requirements;
• Help to describe the details that should be included in the implementation plans that railroads must file within 18 months of enactment of the Act;
• Offer recommendations on the specific content of implementing regulations; and The task also required the PTC Working Group to:
• Report on the functionalities of PTC systems;
• Describe the essential elements bearing on interoperability and the requirements for consultation with other railroads in joint operations; and
• Determine how PTC systems will work with the operation of non-equipped trains.

The PTC Working Group was formed from interested organizations that are members of the RSAC. The following organizations contributed members:

American Association of State Highway & Transportation Officials (AAHSTO)

American Chemistry Council (ACC)

American Public Transportation Association (APTA)

American Short Line and Regional Railroad Association (ASLRRA)

Association of American Railroads (AAR)

Association of State Rail Safety Managers (ASRSM)

Brotherhood of Maintenance of Way Employees Division (BMWED)

Brotherhood of Locomotive Engineers and Trainmen Division (BLETD)

Brotherhood of Railroad Signalmen

Federal Transit Administration*

International Brotherhood of Electrical Workers

National Railroad Construction and Maintenance Association

National Railroad Passenger Corporation (Amtrak)

National Transportation Safety Board (NTSB)*

Railway Supply Institute (RSI)

Transport Canada*

Tourist Railway Association Inc.

United Transportation Union (UTU)

*Indicates associate (non-voting) member.

From January to April 2009, FRA met with the entire PTC Working Group five times over the course of twelve days. During those meetings, in order to efficiently accomplish the tasks assigned to it, the PTC Working Group empowered three task forces to work concurrently. These task forces were the passenger, short line and regional railroad, and the radio and communications task forces. Each discussed issues specific to their particular interests and needs and produced proposed rule language for the PTC Working Group's consideration. The majority of the proposals were adopted into the rule as agreed upon by the working group, with rule language related to a remaining few issues being further discussed and enhanced for inclusion into the rule by the PTC Working Group.

The passenger task force discussed testing issues relating to parts 236 and 238 and the definition of “main line” under the statute, including possible passenger terminal and limited operations exceptions to PTC implementation. Recommendations of the task force were presented to the PTC Working Group, which adopted or refined each suggestion.

The short line and regional railroad task group was formed to address the questions pertaining to Class II and Class III railroads. Specifically, the group discussed issues regarding the trackage rights of Class II and III railroads using trains not equipped with PTC technology over a Class I railroad's PTC territory, passenger service over track owned by a Class II or Class III railroads where PTC would not otherwise be required, and railroad crossings-at-grade involving a Class I railroad's PTC-equipped train and a Class II or III railroad's PTC unequipped train. After much discussion, there were no resolutions reached to any of the main issues raised. However, the discussion yielded insights utilized by FRA in preparing this proposed rule.

The radio and communications task force addressed wireless communications issues, particularly as it relates to communications security, and recommended language for proposed § 236.1033.

FRA staff worked with the PTC Working Group and its task forces in developing many facets of this proposal. FRA gratefully acknowledges the participation and leadership of representatives who served on the PTC Working Group and its task forces. These points are discussed to show the origin of certain issues and the course of discussion on these issues at the task force and working group levels. We believe this helps illuminate the factors FRA weighed in making its regulatory decisions regarding this proposed rule and the logic behind those decisions.

In general, the PTC Working Group agreed on the process for implementing PTC under the statute, including decisional criteria to be applied by FRA in evaluating safety plans, adaptation of subpart H principles to support this mandatory implementation, and refinements to subpart H and the part 236 appendices necessary to dovetail the two regulatory regimes and take lessons from early implementation of subpart H, including most aspects of the training requirements. Notable accords were reached, as well, on major functionalities of PTC and on exceptions applicable to passenger service (terminal areas and main line exceptions). Major areas of disagreement included whether to allow non-equipped trains on PTC lines, extension of PTC to lines not within the statutory mandate, and whether to provide for additional onboard displays when two or more persons are regularly assigned duties in the cab. Some additional areas of concern were discussed but could not be resolved in the time available. It was understood that where discussion did not yield agreement, FRA would make proposals and receive public comment.

V. Use of Performance Standards

Given the statutory mandate for the implementation of PTC systems, FRA intends the proposed rule to accelerate the promotion of, and not hinder, cost effective technological innovation by encouraging an efficient utilization of resources, an increased level of competition, and more innovative user applications and technological developments. FRA believes that, wherever possible, regulation must allow technologies the full freedom to exploit market opportunities, must support the challenges and opportunities resulting from the combination of emerging and varying technologies within an evolving marketplace, and should not discriminate between PTC systems vendors due to the technology or services provided.

Accordingly, wherever possible, FRA has attempted to refrain as much as possible from developing technical or design standards, or even requiring implementation of particular PTC technologies that may prevent technological innovation or the development of alternative means to achieve the statutorily defined PTC functions. If FRA were to implement specific technical standards, emerging technologies may render those standards obsolete. Thus, implementation of systems by the railroads using new technologies that are not addressed by the specific standards would require railroads and FRA to manage the deployment of alternative technologies using a cumbersome and time consuming waiver process. Consequently, for the same reasons FRA expressed in the final rule implementing subpart H (70 FR 11052, 11055-11059 (Mar. 7, 2005)), FRA continues to believe that it is best to pursue a performance-based standard while providing sufficient basic parameters within which the PTC system's architectures and functionalities must be developed, implemented, and maintained.

Like subpart H of part 236, proposed subpart I provides for the same level of product confidence and versatility in determining what PTC technology a railroad may elect to implement and operate, even if the railroad chooses to modify its PTC system over time. Unlike subpart H, however, proposed subpart I requires specific deployment of PTC while simplifying the application process, potentially reducing the size of the regulatory filings through facilitation of safety documentation reuse, and more narrowly defining the required performance targets based on railroad operations and in terms of more specific functional PTC behaviors. The approach under subpart I also reduces the likelihood of continually changing safety targets, which may vary based on each railroad's safety culture, and provides for incremental improvements in safety in coordination with FRA.

To ensure sufficient confidence in each PTC system implemented under subpart I, FRA expects that all safety- and risk-related data be supported by credible evidence or information. Such credible evidence or information may be developed through laboratory or field testing, augmented by appropriate analysis and inspection, which may be monitored or reviewed by FRA. FRA expects that, as a practical matter, lab testing would be performed in the majority of cases. FRA does not believe it is necessary to require any railroad to lab test. However, field testing may be required in certain instances to test certain points of the PTC system in various conditions.

If the railroad or FRA determines that the complexity of the technology or the supporting safety case warrants, credibility of this information may also be evaluated through an assessment of Verification and Validation performed by an acceptable independent third party selected and paid for by the railroad, subject to FRA approval. Ultimately, however, it is FRA's responsibility to determine whether each PTC system's performance results in an acceptable level of safety to railroad employees and the general public and whether any such system shall receive PTC System Certification, as required by statute. In order to provide meaningful flexibility, FRA is prepared to consider use of alternative risk analysis methods and proposals regarding the extent to which a product exhibits fail-safe behavior. FRA still emphasizes that higher speed and higher risk rail service should be supported by more highly competent train control technology and analysis.

FRA recognizes that there may potentially be various PTC system configurations and a variety of operational scopes involved. FRA believes that the information requested under subpart I should be sufficient to permit FRA to predict whether a PTC system is fully adequate from a safety perspective. Subparts H and I require submission of similar technical data. Given the degree of uncertainty associated with the underlying analysis of a complex PTC system and its environs, subpart I—much like subpart H—requires application of FRA's judgment and expertise. Given the complexity of the underlying analysis—and FRA's need to ensure an acceptable level of safety and analytical uniformity between functionally equivalent but architecturally different systems—it is incumbent upon the subject railroad, possibly in concert with the vendor, supplier, or manufacturer of its PTC system, to make a persuasive case in its filings that the applicable performance standards are met. Primarily, the risk assessments required by the proposed rule should provide an objective measure of the safety risk levels involved, which will be reviewed by FRA for comparison purposes. As such, FRA believes that each risk assessment should determine relative risk levels, rather than absolute risk levels, but against a clearly delineated base case acceptable to FRA under the proposed regulation.

Thus, this proposed rule attempts to emphasize the determination of relative risk. FRA believes that the guidelines captured in Appendix B adequately state the objectives and major considerations of any risk assessment it would expect to see submitted under proposed subpart I. FRA also believes that these guidelines allow sufficient flexibility in the conduct of risk assessments, yet provide sufficient uniformity by helping to ensure that final results are presented in familiar units of measurement.

One of the major characteristics of a risk assessment is whether it is performed using qualitative or quantitative methods. FRA continues to believe that both quantitative and qualitative risk assessment methods may be used, as well as combinations of the two. FRA expects that qualitative methods should be used only where appropriate, and only when accompanied by an explanation as to why the particular risk cannot be fairly quantified. FRA also continues to believe that railroads and suppliers should not be limited in the type of risk assessments they should be allowed to perform to demonstrate compliance with the minimum performance standard. The state of the art of risk assessment methods could potentially change more quickly than the regulatory process will allow, and not taking advantage of these innovations could slow the progress of implementation of safer signal and train control systems. Thus, as in subpart H, FRA is allowing risk assessment methods not meeting the guidelines of this rule, so long as it can be demonstrated to the satisfaction of the FRA Associate Administrator for Railroad Safety/Chief Safety Officer (hereinafter Associate Administrator) that the risk assessment method used is suitable in the context of the particular PTC system. FRA believes this determination is best left to the Associate Administrator because the FRA retains authority to ultimately prevent implementation of a system whose plans do not adequately demonstrate compliance with the performance standard under the proposed rule.

FRA is aware that some types of risk are more amenable to measurement by using certain methods rather than others because of the type and amount of data available. If a railroad does elect to use different risk assessment methods, FRA will consider this as a factor for PTC System Certification (see § 236.1015). Also, in such cases, when the margin of uncertainty has been inadequately described, FRA will be more likely to require FRA monitored field or laboratory testing (see § 236.1035) or an independent third-party assessment (see § 236.1017).

When FRA issued the final rule establishing subpart H, FRA considered the criteria of simplicity, relevancy, reliability, cost, and objectivity. FRA believes that these criteria remain applicable. FRA has attempted to make the requirements under subpart I simpler than the requirements of subpart H, so that railroads will be provided with a greater amount of flexibility to more easily demonstrate that its PTC system is certifiable by FRA. Like subpart H, subpart I focuses on the safety-relevant characteristics of systems and emphasizes all relevant aspects of product performance. FRA also drafted performance standards that can be applied reliably and precisely in a manner which should yield similar results each time it is applied to the same subject. Although RSIA08 appears to make cost a consideration secondary to safety, FRA believes that demonstrating compliance under subpart I should minimize those costs while not degrading the primary objective of public safety. FRA also believes that subpart I includes an objective performance standard where compliance can be determined through sound engineering analysis, testing, or investigation.

VI. Section-by-Section Analysis

Unless otherwise noted, all section references below refer to sections in title 49 of the Code of Federal Regulations (CFR). FRA seeks comments on all proposals made in this NPRM.

Proposed Amendments to 49 CFR Part 229

Section 229.135 Event Recorders

Advances in electronics and software technology have not only enabled the development of PTC systems, but have also resulted in changes to the implementation of locomotive control systems. These technological changes have provided for the introduction of new functional capabilities and the integration of different functions in ways that advance the building, operation, and maintenance of locomotive control systems. FRA also recognizes that advances in technology may further eliminate the traditional distinctions between locomotive control and train control functionalities. Indeed, technological advances may provide opportunities for increased or improved functionalities in train control systems that run concurrently with locomotive control.

Train control and locomotive control, however, remain two fundamentally different operations with different objectives. FRA does not want to restrict the adoption of new locomotive control functions and technologies by imposing regulations on locomotive control systems intended to address safety issues associated with train control. Accordingly FRA is reviewing and enhancing the Locomotive Safety Standards (49 CFR part 229) to address the use of advanced electronics and software technologies to improve safe, efficient, and economical locomotive operations when a new or proposed locomotive control system function does not interface or commingle with a safety-critical train control system. In the meantime, FRA proposes to amend § 229.135 to ensure its applicability to subpart I.

Proposed Amendments to 49 CFR Part 234

Section 234.275 Processor-Based Systems

Section 234.275 of title 49 presently requires that each processor-based system, subsystem, or component used for active warning at highway-rail grade crossings that is new or novel technology, or that provides safety-critical data to a railroad signal or train control system which is qualified using the subpart H process, shall also be governed by those requirements, including approval of a Product Safety Plan. Particularly with respect to high speed rail, FRA anticipates that PTC systems will in some cases incorporate new or novel technology to provide for crossing pre-starts (reducing the length of approach circuits for high speed trains), verify crossing system health as between the wayside and approaching trains, or slow trains approaching locations where storage has been detected on a crossing, among other options. Indeed, each of these functions is presently incorporated in at least one train control system, and others may one day be feasible (including in-vehicle warning). There would appear to be no reason why such a functionality intended for inclusion in a PTC system mandated by subpart I could not be qualified with the rest of the PTC system under subpart I. On the other hand, care should be taken to set an appropriate safety standard taking into consideration highway users, occupants of the high speed trains, and others potentially affected.

In fact, with new emphasis on high speed rail, FRA needs to consider the ability of PTC systems to integrate this type of new technology and thereby reduce risk associated with high speed rail service. Risk includes derailment of a high speed train with catastrophic consequences after encountering an obstacle at a highway-rail grade crossing. To avoid such consequences, as many crossings as possible should be eliminated. To that end, 49 CFR 213.347 requires a warning and barrier plan to be approved for Class 7 track (speeds above 110 mph) and prohibits grade crossings on Class 8 and 9 track (above 125 mph). That leaves significant exposure on Class 5 and 6 track that is currently not addressed by regulation. Comment is requested on how best to approach this issue, ensuring that various FRA regulations, including subpart I, address this safety need effectively and in harmony with one another.

Proposed Amendments to 49 CFR Part 235

Section 235.7 Changes Not Requiring Filing of Application

FRA proposes to amend this section of the regulation which allows specified changes within existing signal or train control systems be made without the necessity of filing an application. The amendment consists of adding allowance for a railroad to remove an intermittent automatic train stop system in conjunction with the implementation of a PTC system approved under subpart I of part 236.

The changes allowable under this section, without filing of an application, are those identified on the basis that the resultant condition will be at least no less safe than the previous condition. The required functions of PTC within subpart I provide a considerably higher level of functionality related to both alerting and enforcing necessary operating limitations than an intermediate automatic train stop system does. Additionally, in the event of the loss of PTC functionality (i.e., a failure en route), the operating restrictions required will provide the needed level of safety in lieu of the railroad being expected to keep and maintain an underlying system such as intermittent automatic train stop for only in such cases. FRA therefore believes that with the implementation of PTC under the requirements of subpart I, the safety value of any previously existing intermittent automatic train stop system is entirely obviated. There were no objections in the PTC Working Group to this amendment.

Proposed Amendments to 49 CFR Part 236

Section 236.0 Applicability, Minimum Requirements, and Penalties

FRA proposes to amend this existing section of the regulation to remove manual block from the methods of operation permitting speeds of 50 miles per hour or greater for freight trains and 60 miles per hour or greater for passenger trains. Manual block rules do create a reasonably secure means of preventing train collisions. However, where the attributes of block signal systems are not present, misaligned switches, broken rails, or fouling equipment may cause a train accident. FRA believes that contemporary expectations for safe operations require this adjustment, which also provides a more orderly foundation for the application of PTC to the subject territories. There were no objections in the PTC Working Group to this change.

Section 236.909 Minimum Performance Standard

FRA is proposing to modify existing § 236.909 to make the risk metric sensitivity analysis an integral part of the full risk assessment required to be submitted with a product safety plan in accordance with § 236.907(a)(7). The proposed amendment of this section would also eliminate an alternative option for a railroad to use a risk metric in which consequences of potential accidents are measured strictly in terms of fatalities.

Currently, § 236.909(e)(1) indicates how safety and risk should be measured for the full risk assessment, but does not accentuate the need for running a sensitivity analysis on chosen risk metrics to assure that the worst case scenarios for the proposed system failures or malfunctions are accounted for in the risk assessment. On the other hand, Appendix B to this part mandates that each risk metric for the proposed product must be expressed with an upper bound, as estimated with a sensitivity analysis. The FRA's experience gained while reviewing product safety plans submitted to FRA in accordance with subpart H, revealed that the railroad's did not understand a sensitivity analysis for the chosen risk metrics to be a mandatory requirement. Accordingly, to ensure clarity regarding FRA's expectations, FRA proposes to amend paragraph (e)(1) to explicitly require the performance of a sensitivity analysis for the chosen risk metrics. The language proposed in this rule explains the need for the sensitivity analysis and describes the key input parameters that must be analyzed.

The proposed modification to paragraph (e)(2) is intended to clarify how the exposure and its consequences, as main components of the risk computation formula, must be measured. Under the proposed rule text, the exposure must be measured in train miles per year over the relevant railroad infrastructure where a proposed system is to be implemented. When determining the consequences of potential accidents, the railroad must identify the total costs involved, including those relating to fatalities, injuries, property damage, and other incidentals. FRA proposes to eliminate the option of using an alternative risk metric, which would allow the measurement of consequences strictly in terms of fatalities. It is FRA's experience that measuring consequences of accidents strictly in terms of fatalities did not serve as an adequate alternative to metrics of total cost of accidents for two main reasons. First, the statistical data on railroad accidents shows that accidents involving fatalities also cause injuries and significant damage to railroad property and infrastructure for both freight and especially passenger operations. Even though the cost of human life is often the highest component of monetary estimates of accident consequences, the dollar estimates of injuries, property losses, and damage to the environment associated with accidents involving fatalities cannot and should not be discounted in the risk analysis. Second, allowing fatalities to serve as the only risk metrics of accident consequences confused the industry and the risk assessment analysts attempting to determine the overall risk associated with the use of certain types of train control systems. As a result, some risk analysts inappropriately converted injuries and property damages for observed accidents into relative estimates of fatalities. This method cannot be considered acceptable because, while distorting the overall picture of accident consequences, it also raises questions on appropriateness of conversion coefficients. Therefore, FRA considers it appropriate to eliminate from the rule the alternative option for consequences to be measured in fatalities only.

Subpart I—Positive Train Control Systems

Section 236.1001 Purpose and Scope

This section describes both the purpose and the scope of subpart I. Subpart I provides performance-based regulations for the development, test, installation, and maintenance of Positive Train Control (PTC) Systems, and the associated personnel training requirements, that are mandated for installation by FRA. This subpart also details the process and identifies the documents that railroads and operators of passenger trains are to utilize and incorporate in their PTC implementation plans. This subpart also details the process and procedure for obtaining FRA approval of such plans.

Section 236.1003 Definitions

Given that a natural language such as English contains, at any given time, a finite number of words, any comprehensive list of definitions must either be circular or leave some terms undefined. In some cases, it is not possible and indeed not necessary to state a definition. Where possible and practicable, FRA prefers to provide explicit definitions for terms and concepts rather than rely solely on a shared understanding of a term through use.

Paragraph (a) reinforces the applicability of existing definitions of subparts A through H. The definitions of subparts A through H are applicable to subpart I, unless otherwise modified by this part.

Paragraph (b) introduces definitions for a number of terms that have specific meanings within the context of subpart I. In lieu of analyzing each definition here, however, some of the delineated terms will be discussed as appropriate while analyzing other sections below.

As a general matter, however, FRA believes it is important to explain certain organizational changes required pursuant to RSIA08. The statute establishes the position of a Chief Safety Officer. The Chief Safety Officer has been designated as the Associate Administrator for Railroad Safety. Thus, the use of the term Associate Administrator in this subpart refers to the Associate Administrator for Railroad Safety and Chief Safety Officer.

Section 236.1005 Requirements for Positive Train Control Systems

RSIA08 specifically requires that each PTC system be designed to prevent train-to-train collisions, overspeed derailments, incursions into established work zone limits, and the movement of a train through a switch left in the wrong position. Section 236.1005 includes the minimum statutory requirements and provides amplifying information defining the necessary PTC functions and the situations under which PTC systems must be installed. Each PTC system must be reliable and perform the functions specified in RSIA08. FRA requests comments on whether the definitions and amplifying information within § 236.1005 are appropriate interpretations of RSIA08 and whether FRA is exercising the appropriate level of discretion and flexibility to comply with RSIA08 in the most cost effective and efficient manner.

Train-to-train collisions. Paragraph (a)(1)(i) proposes to apply the statutory requirement that a mandatory PTC system must be designed to prevent train-to-train collisions. FRA understands this to mean head-to-head, rear-end, and side and raking collisions between trains on the same, converging, or intersecting tracks. PTC technology now available can meet these needs through guidance to the locomotive engineer that is current and continuous and through enforcement using predictive braking to stop short of known targets. FRA notes that the technology associated with currently available PTC systems may not completely eliminate all collisions risks. For instance, a PTC system mandated by this subpart is not required to prevent a collision caused by a train that derails and moves over an area not covered by track and onto a neighboring or adjacent track (known in common parlance as a “secondary collision”).

During discussions regarding available PTC technology, it has been noted that this technology also has inherent limitations with respect to prevention of certain collisions that might occur at restricted speed. In signaled territory, there are circumstances under which trains may pass red signals, other than absolute signals except with verbal authority, either at restricted speed or after stopping and then proceeding at restricted speed. Available PTC technology does not track the rear end of each train as a target that another train must be stopped short of but instead relies on the signal system to indicate the appropriate action. In this example, the PTC system would display “restricted speed” to the locomotive engineer as the action required and would enforce the upper limit of restricted speed (i.e., 15 or 20 miles per hour, depending on the railroad). This means that more serious rear end collisions will be prevented, because the upper limit of restricted speed is enforced, and it also means that fewer low speed rear-end collisions will occur because a continuous reminder of the required action will be displayed to the locomotive engineer (rather than the engineer relying on the aspect displayed by the last signal, which may have been passed some time ago). However, some potential for a low-speed rear-end collision will remain in these cases, and the rule is clear that this limitation has been accepted. Similar exposure may occur in non-signaled territory where trains are conducting switching operations or other activities under joint authorities. The PTC system can enforce the limits of the authority and the upper limit of restricted speed, but it cannot guarantee that the trains sharing the authority will not collide. Again, however, the likelihood and average severity of any potential collisions would be greatly reduced. FRA may address this issue in a later modification to subpart I if necessary as technology becomes available.

The proposed rule text does, however, provide an example of a potential train-to-train collision that a PTC system should be designed to prevent. Rail-to-rail crossings-at-grade—otherwise known as diamond crossings—present a risk of side collisions. FRA recognizes that such intersecting lines may or may not require PTC system implementation and operation. Since a train operating with a PTC system cannot necessarily recognize a train not operating with a PTC system or moving on an intersecting track without a PTC system, the PTC system—no matter how intelligent—may not be able to prevent a train-to-train collision in such circumstances.

Accordingly, paragraph (a)(1)(i) proposes to require certain protections for such rail-to-rail crossings-at-grade. While these locations are specifically referenced in paragraph (a)(1)(i), their inclusion is merely illustrative and does not necessarily preclude any other type of potential train-to-train collision. Moreover, a host railroad may have alternative arrangements to the specific protections referenced in the associated table under paragraph (a)(1)(i), which it must submit in its PTC Safety Plan (PTCSP)—discussed in detail below—and receive a PTC System Certification associated with that PTCSP.

Rail-to-rail crossings-at-grade that have one or more PTC routes intersecting with one or more routes without a PTC system must have an interlocking signal arrangement in place developed in accordance with subparts A through G of part 236 and a PTC enforced stop on all PTC routes. FRA has also determined that the level of risk varies based upon the speeds at which the trains operate through such crossings, as well as the presence, or lack, of PTC equipped lines leading into the crossing. Accordingly, under a compromise accepted by the PTC Working Group, if the maximum speed on at least one of the intersecting tracks is more than 40 miles per hour, then the routes without a PTC system must also have either some type of positive stop enforcement or a split-point derail on each approach to the crossing and incorporated into the signal system, and a permanent maximum speed limit of 20 miles per hour. FRA expects that these protections be instituted as far in advance of the crossing as is necessary to stop the encroaching train from entering the crossing. The 40 miles per hour threshold appears to be appropriate given three factors. First, the frequency of collisions at these rail intersections is low, because typically one of the routes is favored on a regular basis and train crews expect delays until signals clear for their movement. Second, the special track structure used at these intersections, known as crossing diamonds, experiences heavy wear; and railroads tend to limit speeds over these locations to no more than 40 miles per hour. Finally, FRA recognizes that for a train on either intersecting route, elevated speed will translate into higher kinetic energy available to do damage in a collision-induced derailment. Thus, for the relatively small number of rail crossings with one or more routes having an authorized train speed above 40 miles per hour, including higher speed passenger routes, it is particularly important that any collision be prevented. FRA appreciates that a more protective approach could be considered and welcomes any data or commentary that might bear on this issue.

FRA believes that these more aggressive measures are required to ensure train safety in the event the engineer does not stop a train before reaching the crossing when the engineer does not have a cleared route displayed by the interlocking signal system and higher speed operations are possible on the route intersected. The split-point derail would prevent a collision in such a case by derailing the offending train onto the ground before it reaches the crossing. Should the train encounter a split-point derail as a result of the crew's failure to observe the signal indication, the slower speed at which the unequipped train is required to travel would minimize the damage to the unequipped train and the potential affect on the surrounding area. As an alternative to split-point derails, the non-PTC line may be outfitted with some other mechanism that ensures a positive stop of the unequipped crossing train. If a PTC system or systems are installed and operated on all crossing lines, there are no speed restrictions other than those that might be enforced as part of a civil or temporary speed restriction. However, the crossing must be interlocked and the PTC system or systems must ensure that each of the crossing trains can be brought safely to a stop before reaching the crossing in the event that another train is already cleared through or occupying the crossing.

Overspeed derailments. Paragraph (a)(1)(ii) proposes that PTC systems mandated under subpart I be designed to prevent overspeed derailments and addresses specialized requirements for doing so. FRA notes that a number of passenger train accidents with significant numbers of injuries have been caused by trains exceeding the maximum allowable speed at turnouts and crossovers and upon entering stations. Accordingly, FRA emphasizes the importance of enforcement of turnout and crossover speed restrictions, as well as civil speed restrictions.

For instance, in the Chicago region, two serious train accidents occurred on the same Metra commuter line when locomotive engineers operated trains at more than 60 miles per hour while traversing between tracks using crossovers, which were designed to be safely traversed at 10 miles per hour. For illustrative purposes, the rule text makes clear that such derailments may be related to railroad civil engineering speed restrictions, slow orders, and excessive speeds over switches and through turnouts and these types of speed restrictions are to be enforced by the system.

Roadway work zones. Paragraph (a)(1)(iii) proposes that PTC systems mandated under subpart I be designed to prevent incursions into established work zone limits. Work zone limits are defined by time and space. The length of time a work zone limit is applicable is determined by human elements. Working limits are obtained by contacting the train dispatcher, who will confirm an authority only after it has been transmitted to the PTC server. Paragraph (a)(1)(iii) emphasizes the importance of the PTC systems to provide positive protection for roadway workers working within the limits of their work zone. Accordingly, once a work zone limit has been established, the PTC system must be notified. The PTC system must continue to obey that limit until it is notified from the dispatcher or roadway worker in charge, with verification from the other, either that the limit is released and the train is authorized to enter or the roadway worker in charge authorizes movement of the train through the work zone.

As a way to achieve this technological functionality, FRA's Office of Railroad Development has funded the development of a Roadway Worker Employee in Charge (EIC) Portable Terminal that allows the EIC to control the entry of trains into the work zone. While no rule includes the commonly used term EIC, FRA recognizes that it is the equivalent to the “Roadway Worker In Charge” as used in part 214. With the portable terminal, the EIC can directly control the entry of trains into the work zone and restrict the speed of the train through the work zone. If the EIC does not grant authority for the train to enter the work zone, the train is forced to a stop prior to violating the work zone authority limits. If the EIC authorizes entry of the train into the work zone, the EIC may establish a maximum operating speed for the train consistent with the safety of the roadway work employees. This speed is then enforced on the train authorized to enter and pass through the work zone. The technology is significantly less complex than the technology associated with dispatching systems and the PTC onboard system. In view of this, FRA strongly encourages deployment of such portable terminals as opposed to current approaches which only require the locomotive engineer to in some manner “acknowledge” his or her authority to operate into or through the limits of the work zone (e.g., by pressing a soft key on the onboard display, even if in error).

Pending the adoption of more secure technology such as the EIC Portable Terminal, FRA will scrutinize PTC Safety Plans to determine whether they leave no opportunity for single point human failure in the enforcement of work zone limits. FRA again notes that some approaches in the past have provided that the locomotive engineer could simply acknowledge a work zone warning, even if inappropriately, after which the train could proceed into the work zone. FRA proposes that more secure procedures be included in safety plans under the new proposed subpart.

Movement over main line switches. Paragraph (a)(1)(iv) proposes to require that PTC systems mandated under subpart I be designed to prevent the movement of a train through a main line switch in the improper position. Given the complicated nature of switches—especially when operating in concert with wayside, cab, or other similar signal systems—the proposed rule provides more specific requirements in paragraph (e) as discussed further below.

In numerous paragraphs, the proposed rules require various operating requirements based primarily on signal indications. Generally, these indications are communicated to the engineer, who would then be expected to operate the train in accordance with the indications and authorities provided. However, a technology that receives the same information does not necessarily have the wherewithal to respond unless it is programmed to do so. Thus, paragraph (a)(2) requires PTC systems implemented under subpart I to obey and enforce all such indications and authorities provided by these safety-critical underlying systems. The integration of the delivery of the indication or authority with the PTC system's response to those communications must be described and justified in the PTC Development Plan (PTCDP)—further described below—and the PTCSP, as applicable, and then must comply with those descriptions and justifications.

The PTC Working Group had extensive discussions concerning the monitoring of main line switches and came to the following general conclusions:

First, signal systems do a good job of monitoring switch position, and enforcement of restrictions imposed in accordance with the signal system is the best approach within signaled territory (main track and controlled sidings). As a general rule, the enforcement required for crossovers, junctions, and entry into and departure from controlled sidings will be a positive stop, and the enforcement provided for other switches (providing access to industry tracks and non-signaled sidings and auxiliary tracks) will be display and enforcement of the upper limit of restricted speed. National Transportation Safety Board representatives were asked to evaluate whether this strategy meets the needs of safety from their perspective. They returned with a list of accidents caused by misaligned switches that the Board had investigated in recent years, none of which was in signaled territory. Based on that data, the NTSB staff decided that it was not necessary to monitor individual switches in signaled territory.

Second, switch monitoring functions of contemporary PTC systems provide an excellent approach to addressing this requirement in dark territory. However, it is important to ensure that switch position is determined with the same degree of integrity that one would expect within a signaling system (e.g., fail safe point detection, proper verification of adjustment). The PTC Working Group puzzled over sidings in dark territory and how to handle the requirement for switch monitoring in connection with those situations. (While these are not “controlled” sidings, as such, they will often be mapped so that train movements into and out of the sidings are appropriately constrained.) At the final PTC Working Group meeting, a proposal was accepted that would treat a siding as part of the main line track structure requiring monitoring of each switch off of the siding if the siding is non-signaled and the authorized train speed within the siding exceeds 20 miles per hour.

This issue is more fully discussed below.

Other functions. While FRA has included the core PTC system requirements in § 236.1005, there is the possibility that other functions may be explicitly or implicitly required elsewhere in subpart I. Accordingly, under paragraph (a)(3), each PTC system required by subpart I must also perform any other functions specified in subpart I. According to 49 U.S.C. 20157(g), FRA must prescribe regulations specifying in appropriate technical detail the essential functionalities of positive train control systems and the means by which those systems will be qualified.

In addition to the general performance standards required under paragraphs (a)(1)-(3), paragraph (a)(4) proposes more prescriptive performance standards relating to the situations paragraphs (a)(1)-(3) intend to prevent. Paragraph (a)(4) defines specific situations where FRA has determined that specific warning and enforcement measures are necessary to provide for the safety of train operations, their crews, and the public and to accomplish the goals of the PTC system's essential core functions. Under paragraph (a)(4)(i), FRA proposes to prevent unintended movements onto PTC main lines and possible collisions at switches by ensuring proper integration and enforcement of the PTC system as it relates to derails and switches protecting access to the main line. Paragraph (a)(4)(ii) intends to account for operating restrictions associated with a highway-rail grade crossing active warning system that is in a reduced or non-operative state and unable to provide the required warning for the motoring public. In this situation, the PTC system must provide positive protection and enforcement related to the operational restrictions of alternative warning that are issued to the crew of any train operating over such crossing in accordance with part 234. Paragraph (a)(4)(iii) concerns the movement of a PTC operated train in conjunction with the issuance of an after arrival mandatory directive. While FRA recognizes that the use of after arrival mandatory directives poses a risk that the train crew will misidentify one or more trains and proceed prematurely, PTC provides a means to intervene should that occur. Further, such directives may sometimes be considered operationally useful. Accordingly, FRA fully expects that the PTC system will prevent collisions between the receiving trains and the approaching train or trains.

FRA recognizes that movable bridges, including draw bridges, present an operational issue for PTC systems. Under subpart C, § 236.312 already governs the interlocking of signal appliances with movable bridge devices and FRA believes that this section should equally apply to PTC systems governing movement over such bridges. While subparts A through H apply to PTC systems—as stated in § 236.1001—paragraph (a)(4)(iv) proposes to make this abundantly clear. Accordingly, in paragraph (a)(4)(iv) and consistent with § 236.312, movable bridges within a PTC route are to be equipped with an interlocked signal arrangement which is also to be integrated into the PTC system. A train shall be forced to stop prior to the bridge in the event that the bridge locking mechanism is not locked, the locking device is out of position, or the bridge rails of the movable span are out of position vertically or horizontally from the rails of the fixed span. Effective locking of the bridge is necessary to assure that the bridge is properly seated and thereby capable to support both the weight of the bridge and that of a passing train(s) and preventing possible derailment or other potential unsafe conditions. Proper track rail alignment is also necessary to prevent derailments, either of which again could result in damage to the bridge or a train derailing off the bridge.

Paragraph (a)(4)(v) proposes that hazard detectors integrated into the PTC system—as required by paragraph (c) of this section or the FRA approved PTCSP—must provide an appropriate warning and associated applicable enforcement through the PTC system. There are many types of hazard detection systems and devices. Each type has varying operational requirements, limitations, and warnings based on the types and levels of hazard indications and severities. FRA expects this enforcement to include a positive stop where necessary to protect the train (e.g., areas with high water, flood, rock slide, or track structure flaws) or to provide an appropriate warning with possible movement restriction be acknowledged (i.e., hot journal or flat wheel detection). The details of these warnings and associated required enforcements are to be specifically addressed within a PTCDP and PTCSP subject to FRA approval, and the PTC system functions are to be maintained in accordance with the system specifications. FRA does not expect that all hazard detectors be integrated into the PTC systems, but where they are, they must interact properly with the PTC system to protect the train from the hazard that the detector is monitoring.

Paragraph (a)(5) addresses the issue of broken rails, which is the leading cause of train derailments. FRA proposes to strictly limit the speed of passenger and freight operations in those areas where broken rail detection is not provided. Under § 236.0(c), as amended in this rule, 24 months after the effective date of a final rule, freight trains operating at or above 50 miles per hour, and passenger trains operating at or above 60 miles per hour are required to have a block signal system unless a PTC system meeting the requirements of this part is installed. Since current technology for block signal systems relies on track circuits—which also provide for broken rail detection—FRA proposes limiting speeds where broken rail detection is not available to the maximums allowed under § 236.0 when a block signal system is not installed.

Deployment requirements. Paragraph (b) contains proposed requirements for where and when PTC systems must be installed. Under RSIA08, each applicable railroad carrier must implement a PTC system in accordance with its PTC Implementation Plan (PTCIP), as further discussed below. The PTCIP is statutorily required to be submitted by April 16, 2010, and must explain how the railroad or railroads intend to implement an operating PTC system by December 31, 2015. Essentially, a PTC system must be installed on certain tracks. In addition, except as provided under § 236.1006, onboard components required for and responsive to the PTC system must be installed on each lead locomotive that operates over those tracks.

The lead locomotive means the first locomotive proceeding in the direction of movement. In addition to the lead locomotive that controls the train while moving in a forward direction, a PTC system must be installed on any rear end unit control cab locomotive that is capable of controlling the train when it moves in the reverse direction. These proposed requirements assume that locomotives controlling the train may be placed only at each end. At this time, FRA is unaware of any locomotives not placed at either end of the train that may independently control the train. FRA seeks comments and information regarding these assumptions and understandings.

As a threshold matter, RSIA08 requires that a PTC system be installed on certain main lines of each entity required to file a PTCIP. According to the statute, a main line is, with certain exceptions, a Class I railroad track over which 5 million or more gross tons of railroad traffic is transported annually. Pursuant to the statute, FRA may also designate additional tracks as main line and may provide exceptions for intercity rail or commuter passenger transportation over track where limited or no freight railroad operations occur. The statutory language does not indicate whether the phrase “main line” refers to the route used or actual trackage owned by the subject railroad. It is clear, however, that Congress intended to focus implementation and operation of PTC systems on freight lines owned or used by Class I railroads for operations specifically identified in the statute.

For instance, by referencing Class I railroads—and not referencing any other type of freight railroad—FRA believes that Congress did not intend, as a general matter, to have smaller freight railroads incur the tremendous costs involved in PTC system implementation and operation unless they own track over which is provided regularly schedule intercity or commuter rail passenger transportation. Congress gives the Secretary discretion in 49 U.S.C. 20157(f) to require the installation of PTC systems on railroads other than Class I railroads and intercity or commuter passenger systems.

The Surface Transportation Board (STB) has established a statutory definition for Class I, II, and III railroads based on the reported revenues in 1992. A reference to Class I railroads in this subpart refers to those railroads that have been designated as such by the Surface Transportation Board (STB). According to STB, a Class I railroad has revenues greater than $250 million (adjusted annually for inflation); a Class II railroad has revenues ranging from $20 million to $250 million (adjusted annually for inflation); and a Class III railroad has revenues that are less than $20 million (adjusted annually for inflation). All switching and terminal railroads, regardless of revenue size, are Class III railroads. The STB railroad classification determines the amount of reporting which a carrier must file with the STB. Class I railroads are required to file an annual R-1 Report, a detailed income, expense, and operating data report, quarterly and annual freight carload commodity reports, and reports on types of employees and employee compensation (Wage Form A and B).

From time to time, as some Class II railroads approached the Class I railroad revenue threshold, these carriers petitioned the STB to remain as Class II railroads, so that these carriers would not be burdened with the additional reporting requirements. Generally the STB allowed this exemption. Accordingly, there may be some large railroads—including Montana Rail Link and Florida East Coast—that are Class II railroads “by waiver,” thereby freeing them from having to file Class I railroad reports with the STB.

In drafts of this proposed rule provided to the RSAC PTC Working Group, it was suggested that a Class I railroad's main line be defined as track owned and controlled by the Class I railroad. By also including track “controlled” by the Class I railroad, FRA intended to include tracks not owned by Class I railroads, but used in a manner as if the Class I railroad did own that track. For instance, under the term “controlled,” FRA intended that a track owned by a Class II or III railroad would be considered a main line if a Class I railroad had effective control over the Class II or III railroad or that specific track. Without the “control” requirement, Class I railroads could divest themselves of track ownership while maintaining effective control for the purposes of avoiding PTC system implementation.

The American Short Line and Regional Railroad Association (ASLRRA), however, expressed concern with this provision, instead suggesting that a Class I railroad's main line include only those lines owned and “operated” by the Class I railroad. FRA believes that the underlying ASLRRA concern is that many of its member railroads may go out of business if they are mandated to install PTC systems and incur the associated untenable financial costs. FRA agrees that, from the point of view of the congressional mandate, a narrower concept is appropriate at this time. However, in light of future circumstances relating to railroad revenue, safety opportunities, traffic patterns, and other variables, FRA also recognizes that it may later require PTC system implementation and operation on certain Class II and III railroad tracks.

To avoid confusion, FRA proposes to define main line by standards applicable to a single element. In its effort to define a Class I railroad's main line as track owned and controlled by the Class I railroad, FRA focuses the proposed definition on the status of the track. To also focus on the issue of operations could raise confusion and irreconcilable understandings. Thus, FRA is not comfortable with ASLRRA's suggestion. To accomplish FRA's goal and respond to ASLRRA's concerns, however, FRA has limited a Class I railroad's main lines to tracks and segments documented in the timetables last filed before October 16, 2008, by the Class I railroads with FRA under § 217.7 of this title over which 5 million or more gross tons of railroad traffic is transported annually. For most of its territory, each railroad is already required to track tonnage in order to satisfy the requirements for joint bar and internal rail flaw inspections. See 213.119 (table), 213.237. Thus, FRA does not expect this determination to be difficult for railroads. For railroads that are required to submit a PTCIP by April 16, 2010, the gross tonnage will be based on 2008 year traffic. To the extent rail traffic exceeds 5 million gross tons in any year after 2008, the tonnage shall be calculated for the preceding two calendar years in determining whether a PTCIP or its amendment is required. FRA seeks comments on whether any tracks intended to be covered would be missed under this approach and on whether there is a better approach.

The RSIA08 requires certain tracks to be considered main line where a certain amount of railroad traffic is transported. However, in certain yard or terminal locations, trains are prepared for transportation, but railroad traffic is not “transported.” Moreover, FRA recognizes that in such locations, PTC system operation would be especially cumbersome and onerous and possibly resulting in a reduction of safety due to inappropriate interventions by the PTC system that could lead to “train handling” derailments or hazards to personnel riding the sides of rolling stock. Accordingly, in such locations, FRA may not consider the subject tracks as main line. For such locations that only include freight operations, FRA proposes to consider these tracks other than main line by definition if all trains in the location are limited to restricted speed.

However, for any tracks used by passenger trains, FRA proposes that any designation of track as other than main line should be performed on a case-by-case basis in accordance with § 236.1019. FRA seeks comments on this issue. FRA also seeks comments on whether this explanation comports with the railroads' understanding of the rule text.

Once a Class I railroad's main lines are determined, a PTC system must be installed and operated on those main line tracks over which passenger trains are operated or any PIH materials are is transported. As a corollary, PTC systems are not required on a Class I railroad's lines over which no PIH materials are transported and no passenger trains are operated. In addition to an applicable Class I railroad's main lines, a PTC system must be implemented and operated on all railroads' main lines over which regularly scheduled intercity rail passenger transportation or commuter rail passenger transportation, as defined by 49 U.S.C. 24102, is provided. However, FRA does not intend to apply this requirement to tracks operated by tourist railroads, as described in 49 U.S.C. 20103(f), because, inter alia, they are not Class I railroads and they do not provide regularly scheduled intercity or commuter passenger service.

According to 49 U.S.C. 24102, “intercity rail passenger transportation” means rail passenger transportation, except commuter rail passenger transportation. 49 U.S.C. 24102 defines commuter rail passenger transportation as “short-haul rail passenger transportation in metropolitan and suburban areas usually having reduced fare, multiple-ride, and commuter tickets and morning and evening peak period operations.”

49 CFR 238.5 provides further guidance, defining a long-distance intercity passenger train as “a passenger train that provides service between large cities more than 125 miles apart and is not operated exclusively in the National Railroad Passenger Corporation's Northeast Corridor” and a commuter train as “a passenger train providing commuter service within an urban, suburban, or metropolitan area. The term includes a passenger train provided by an instrumentality of a State or a political subdivision of a State.” Section 238.5 also defines passenger service as “a train or passenger equipment that is carrying, or available to carry, passengers. Passengers need not have paid a fare in order for the equipment to be considered in passenger or in revenue service.” According to § 238.5, a passenger train is “a train that transports or is available to transport members of the general public. If a train is composed of a mixture of passenger and freight equipment, that train is a passenger train for purposes of this part.”

While the statute generally limits mandatory PTC system implementation and operation to certain main lines—defined for freight purposes as track over which 5 million or more gross tons of railroad traffic is transported annually—FRA is required to define passenger main line by regulation. See 49 U.S.C. 20157(i)(2)(B). In that regard, FRA has determined that freight density, as such, is not a relevant factor. FRA intends to cover the same intercity and commuter passenger services as 49 CFR part 238 (Passenger Equipment Safety Standards), which excludes tourist railroads (49 CFR 238.3). See also, 49 CFR part 209, Appendix A.

As a corollary, after December 31, 2015, no intercity or commuter passenger operations may operate on any track that does not have a PTC system installed, except as described in the proposed rule. A PTC system must be installed on any track—regardless of its ownership or the weight of annual traffic—before any intercity or commuter rail passenger operation may operate. Thus, any passenger or freight track over which such passenger trains operate must be PTC-equipped.

The RSIA08 requires each intercity and commuter passenger railroad to implement PTC on “its main line over which intercity rail passenger transportation or commuter rail passenger transportation, as defined in section 24102, is regularly provided.” Section 24102 uses the terms “intercity” and “commuter” in essentially the same way FRA has used the terms for safety regulatory purposes. The single question that has been puzzling in considering this mandate has been the meaning of the possessive article, “its,” before “main line.” It appears clear from the course of congressional consideration that the expression was intended to apply to the passenger railroad's entire route system, regardless of ownership. Amtrak's route system includes predominately trackage owned or controlled by others. Many commuter railroads operate partially or even exclusively over lines owned by freight railroads. On the other hand, FRA is persuaded that the same intention does not apply as to Class I freight railroads. A Class I freight railroad might operate a train under trackage rights over a Class II or III railroad, but it does not appear that was intended to burden the smaller railroad with the responsibility to install PTC.

Accordingly, FRA is proposing to consider as passenger train main lines all tracks across the nation over which intercity or commuter passenger trains are transported. For the purposes of passenger trains, a main line is determined regardless of the amount (i.e., 5 million or more gross tons annually), except where temporary rerouting may occur in accordance with §§ 236.1005(g)-(k) as further discussed below. Thus, if an intercity or commuter passenger train is transported over a track, the track requires PTC implementation and operation, regardless of whether the track is owned by a passenger railroad entity, a Class I railroad, or any smaller freight railroads, including Class II and short line railroads.

This approach, permissible under 49 U.S.C. 20157(a)(1)(C), is consistent with both FRA's understanding of congressional intent and FRA's historical safety sensitivity to regulating passenger transportation. For example, in the relatively recent final rule governing continuous welded rail, different schedules were developed for track inspection intervals associated with freight and passenger train operations. See 71 FR 59,677, 59,681 (Oct. 11, 2006). According to FRA, the different schedules for track inspection were developed to consider the potentially greater severity, especially in terms of loss of life, from possible future track-related passenger train accidents.

If FRA were to otherwise restrict PTC systems to passenger train main lines that are only owned by the passenger railroads, then PTC systems would only be required on 11 percent of all track used by the passenger railroads across the nation, which would mostly include the Northeast Corridor (NEC) and some passenger lines in Michigan. Considering Congress' concern with accidents involving multiple passenger fatalities, which appears to be a significant impetus for Congress' final passage of RSIA08, FRA believes that Congress did not intend in 49 U.S.C. 20157 to limit PTC system operation to this narrow passenger territory.

Nevertheless, while all passenger routes, including those over track owned by freight railroads, are automatically deemed main lines under the proposed rule, the proposed rule also provides an exception for those main lines that would not be main lines but for the existence of passenger trains and are not deemed by FRA main lines due to limited or no freight railroad operations. This exception is permissible pursuant to 49 U.S.C. 20157(i)(2)(B). The proposed procedure for such exceptions can be found under §§ 236.1011 and 236.1019, as further discussed below.

In addition to determining which tracks require PTC system implementation and operation, paragraph (b) requires such installation be performed by the “host railroad.” Subpart I makes a distinction between the railroad that has effective operating control over a segment of track, and a railroad that is simply passing its trains across the same segment of track. While the concept of actual ownership of the track segment plays a significant role in determining the host railroad, a PTC system may be required on a track segment that is not owned by a PTC railroad. To avoid confusion, FRA designates the host railroad as the railroad that exercises operational control of the movement of trains on the segment, irrespective of the actual ownership of the segment. This is in contrast to a tenant railroad, which is any railroad that uses a segment of track but does not exercise operational control of the movements of its trains. The terms “host railroad” and “tenant railroad” are defined as such in the definitions listed under § 235.1003.

The requirements for PTC contained in RSIA08 pertaining to freight lines define the intended route structure by reference to the presence or absence of PIH traffic and the annual gross tonnage. The law requires installation and operation of a PTC system where it (1) is part of a Class I railroad system, (2) carries at least 5 million gross tons of rail traffic, and (3) carries at least some PIH traffic. Based upon information available to FRA, and assuming a level of rail operations consistent with normal economic conditions, these requirements describe approximately 45,000 miles of freight-only territory plus almost 18,000 miles where both PIH and passengers are carried. There are another 6,000 miles of track owned by a Class I railroad and used for passenger service that would not otherwise be required to be equipped, for a total build-out of about 69,000 route miles. These lines basically describe the heart or “core” of the Class I freight network, albeit with some gaps.

However, the railroads carry only about 100,000 carloads of PIH products annually (approximately 0.3% of all rail traffic). Facing an extraordinary potential for tort liability associated with this traffic, the railroads have sought through various means to reduce the potential for release of these commodities through safety improvements; but they have also sought to be relieved of their common carrier obligation to carry them. The RSIA08 mandate, which entails an expenditure of billions of dollars, most of it nominally because the lines in question carry PIH, presents an additional enormous incentive for the Class I railroads to shed PIH traffic and, further, to concentrate the remaining PIH traffic on the fewest possible lines of railroad.

FRA is concerned that PIH traffic could be diverted from the rail mode. Although the risks of transporting these commodities can be reduced by product substitution, by coordination of transportation that reduces length of haul, and by other means, and although the U.S. DOT continues to support these means where feasible, for the present there are still realistic and supportable demands for transportation of these PIH commodities that implicate the national interest in a very strong way. Hazardous materials are vital to maintaining the health of the economy of the United States and are essential to the well-being of its people. These materials are used in water purification, farming, manufacturing, and other industrial applications. The need for hazardous materials to support essential services means that transportation of hazardous materials is unavoidable. There are over 20 hazardous materials considered to be PIH that are shipped by rail in tank car quantities. In 2003, over 77,000 tank car loads of PIH materials were shipped by rail.

Examples of PIH materials include anhydrous ammonia and chlorine. Anhydrous ammonia is an important source of nitrogen fertilizer for crops and is used in the continuous cycle cooling units found in various appliances and vehicles and in the production of explosives and manufacturing of nitric acid and certain alkalies, pharmaceuticals, synthetic textile fibers, plastics, and latex stabilizers. Chlorine is used as an elemental disinfectant for over 84 percent of large drinking water systems (those serving more than 10,000 people), according to the American Water Works Association. For pharmaceuticals, chlorine chemistry is essential to manufacturing 85 percent of their products. Chlorine chemistry is also used in 25 percent of all medical plastics, and 70 percent of all disposable medical applications. The single largest use of chlorine is for the production of polyvinyl chloride (PVC), which is used for building and construction materials such as siding, windows, pipes, decks and fences.

The only effective modal alternative for transporting PIH materials is by road, and for the present insufficient capacity exists in the form of suitable packages (tank trucks, intermodal tanks). Further, diversion to highways would entail significantly higher societal costs, including adverse safety trade-offs from more trucks on the highways—even before the potential for accidental release of product or further security vulnerabilities are considered.

FRA is also concerned that PIH traffic could be retained on the railroads but concentrated in such a way as to result in circuitous routings with greater exposure to derailment hazards and security threats. Although security concerns may be addressed to some extent by rerouting during periods of high alert in specified urban areas, these detour routes would inevitably be over lines not equipped with PTC systems. These are the kinds of unfavorable trade-offs that the recent amendments to PHMSA's rail security rule—based on a separate statutory mandate and developed in concert with FRA—were intended to prevent. See, e.g., 73 FR 20752 (April 16, 2008); 73 FR 72182 (Nov. 26, 2008).); 49 CFR 172.820.

Finally, FRA believes that, while the presence of PIH traffic on the rail network was viewed by the Congress as a good proxy for risk sufficient to warrant PTC system installation and operation, FRA is not persuaded that it was the intent of Congress that PIH traffic be driven from the railroads or concentrated on a smaller number of lines with more circuitous routings. The final legislation constituting the RSIA08 emerged following the Chatsworth collision of September 12, 2008, which claimed 25 lives (one rail employee and 24 passengers). However, neither H.R. 2095, as initially passed by the House of Representatives on October 17, 2007, nor the Senate version of the bill passed on August 1, 2008, was limited to PIH routes. All versions of the bill, including that finally enacted, preserved FRA's ability to apply the technology to additional routes.

Although FRA recognizes that the congressional trade-offs in September 2008 were driven by the impending end of the 110th Congress, the Chatsworth accident, and the desire on the part of some senators to see a rapid deployment of PTC technology (more rapid, in fact, than provided in either the Senate- or House-enacted versions), FRA does not believe that the Congress intended an implementation that would create substantial incentives to drive PIH traffic off of the railroads or concentrate it in such a way that large urban areas would see an increase in volume above that expected using normal, direct routing of the shipments. Accordingly, FRA proposes to use its discretion in crafting implementing regulations to preserve the presumed congressional intent. FRA does this by proposing in paragraph (b) that implementation plans required to be filed by April 16, 2010, be based on 2008 traffic levels. Although rail traffic, including PIH traffic, declined in the second half of the year, 2008 constitutes a much more “normal” base year than 2009 is expected to be due to the current economic conditions. It was also the year during which the Congress enacted the subject mandate.

In taking this action, FRA departs from the PTC Working Group's consensus that 2009 be used as the base year. Since the RSAC initially took up this subject, rail traffic levels have continued to plummet, and that decision now appears to be inappropriate. FRA did advise the PTC Working Group that it reserved the right to “lock in” the PTC route structure as of passage of RSIA08 to prevent unintended consequences. From a technical standpoint, § 236.1005(b) attempts to do just that, but with ample room for adjustment in light of normal changes in market conditions.

Paragraph (b)(2) would require that the determination of Class I freight railroad main lines required to be equipped be initially established and reported as follows using a 2008 traffic base for gross tonnage and determine the presence of PIH traffic based on 2008 shipments and routings. If increases in traffic occur that require a line to be equipped and the PTCIP has already been filed, an amendment would be required. As suggested by the RSAC, gross tonnage would be measured over two years to avoid unusual spikes in traffic driving investments inappropriately. However, if the 5 million gross tons threshold was met based on the prior two years of traffic, and PIH was added to the route, the railroad would be required to promptly file a PTCIP amendment and thereafter equip the line by the end of December 31, 2015 or within two years, whichever is later.

Once a PTC system is installed, it cannot be removed or treated as inoperative unless such discontinuance or modification is approved by FRA in accordance with § 236.1021, as discussed below. This is the case even if the track segment ceases to be defined as a main line in accordance with subpart I due to traffic pattern or consist changes, such as annual traffic levels possibly dipping below the 5 million gross ton threshold referenced in the statute and in §§ 236.1003 and 236.1005 or the rerouting of PIH traffic. This result is consistent with longstanding practice under 49 U.S.C. 20502 (see 49 CFR part 235). To the extent traffic levels decline or PIH traffic ceases prior to April 16, 2010, or during the implementation period, a railroad could ask FRA to except a line segment from the requirement that it be equipped. The railroad would need to provide estimated traffic projections for the next 5 years (e.g., as a result of planned rerouting, coordinations, location of new business on the line). Where the request involves prior or planned rerouting of PIH traffic, the railroad would be required to provide a supporting analysis that takes into consideration the rail security provisions of the PHMSA rail routing rule, including any railroad-specific and interline routing impacts. See 49 CFR 172.820. For example, the request should include information where multiple railroad carriers may coordinate traffic, especially where there are parallel lines directing traffic in opposite directions. FRA could approve an exception if FRA finds that it would be consistent with safety and in the public interest.

Once a PTC system is required to be installed, it cannot be removed or treated as inoperative unless such discontinuance or modification is approved by FRA in accordance with § 236.1021, as discussed below. This is the case even if the track segment ceases to be defined as a main line in accordance with subpart I due to traffic pattern or consist changes, such as annual traffic levels possibly dipping below the 5 million gross ton threshold referenced in the statute and in §§ 236.1003 and 236.1005 or the rerouting of PIH traffic.

There was discussion in the PTC Working Group regarding how to handle new passenger service. Amtrak in particular suggested that FRA might consider some leeway for new intercity service that could be instituted within a short period if the sponsor (most likely a state government) requested. FRA considered this contingency but concluded that new passenger service should be adequately planned and deliberately executed with safety as its first priority. The proposal in paragraph (b) states that, after December 31, 2015, no intercity or commuter rail passenger service could continue or commence until a PTC system has been installed and made operative. FRA requests comment on this proposal and on whether a new rail passenger service commenced after April 10, 2010, but before December 31, 2015, should be permitted any leeway for installation of PTC after 2015 and, if so, what special circumstances would warrant that treatment.

Paragraph (c) provides amplifying information regarding the installation and integration of hazard detectors into PTC systems. Paragraph (c)(1) reiterates FRA's position that any hazard detectors that are currently integrated into an existing signal and train control system must be integrated into mandatory PTC systems and that the PTC system will enforce as appropriate on receipt of a warning from the detector. Paragraph (c)(2) proposes to require each PTCSP submitted by a railroad to also identify any additional hazard detector to provide warnings to the crew that a railroad may elect to install. The PTCSP must also clearly define the actions required by the crew upon receipt of the alarm or other warning or alert. FRA does not expect a railroad to install hazard detectors at every location where a hazard might possibly exist.

Paragraph (c)(3) proposes, in the case of high speed service (as described in § 236.1007 as any service operating at speeds greater than 90 mph) that FRA will require the hazard analysis to address any hazards on the route, along with a reason why additional hazard detectors are not required to provide warning and enforcement for hazards not already protected by an existing hazard detector. The hazard analysis must clearly identify the risk associated with the hazard, and the mitigations taken if a hazard detector is not installed and interfacing with a PTC system. For instance, in the past, large motor vehicles have left parallel or overhead structures and have fouled active passenger rail lines. Depending upon the circumstances, such events can cause catastrophic train accidents. Although not every such event can be prevented, detection of obstacles such as this may make it more likely that the accident could be prevented.

Under paragraph (d), FRA proposes that each lead locomotive operating with a PTC system be equipped with an operative event recorder that captures safety-critical data routed to the engineer's display that the engineer must obey, as well as the text of mandatory directives and authorized speeds. FRA intends that this information be available in the event of an accident with a PTC-equipped system to determine root causes and the necessary actions that must be taken to prevent reoccurrence. Although FRA expects implemented PTC systems will prevent PTC-preventable accidents, in the event of system failure FRA believes it is necessary to capture available data relating to the event. Further, FRA sees value in capturing information regarding any accident that may occur outside of the control of a PTC system as it is currently designed—including the prevention of collisions with trains not equipped with PTC systems—and accidents that could otherwise have been prevented by PTC technology, but were unanticipated by the system developers, the employing railroad, or FRA.

The data may be captured in the locomotive event recorder, or a separate memory module. If the locomotive is placed in service on or after October 1, 2009, the event recorder and memory module, if used, shall be crashworthy, otherwise known as crash-hardened, in accordance with § 229.135. For locomotives built prior to that period, the data shall be protected to the maximum extent possible within the limits of the technology being used in the event recorder and memory module.

As required by the RSIA08 and by paragraph (a)(1)(iv), as noted above, a PTC system required by subpart I must be designed to prevent the movement of a train through a main line switch in the wrong position. Paragraph (e) provides amplifying information on switch point monitoring, indication, warning of misalignment, and associated enforcement. According to the statute, each PTC system must be designed to prevent “the movement of a train through a switch left in the wrong position.” FRA understands “wrong position” to mean not in the position for the intended movement of the train. FRA believes that Congress' use of the phrase “left in the wrong position” was primarily directed at switches in non-signaled (dark) territory such as the switch involved in the aforementioned accident at Graniteville, South Carolina. FRA also believes that, in order to prevent potential derailment or divergence to an unintended route, it is critical that all switches be monitored by a PTC system in some manner to detect whether they are in their proper position for train movements. If a switch is misaligned, the PTC system shall provide an acceptable safe state of train operations.

Prior to the statute, PTC provided for positive train separation, speed enforcement, and work zone protection. The addition of switch point monitoring and run through prevention would have eliminated the Graniteville, South Carolina accident where a misaligned switch resulted in the unintended divergence of a train operating on the main track onto a siding track and the collision of that train with another parked train on the siding. The resulting release of chlorines gas caused nine deaths and required the evacuation of the entire town for two weeks while remediation efforts were in progress.

As discussed above, FRA considered requiring PTC systems to be interconnected with each main line switch and to individually monitor each switch's point position in such a manner as to provide for a positive stop short of any misalignment condition. However, after further consideration and discussion with the PTC Working Group, FRA believes that such an approach may be overly aggressive and terribly expensive in signaled territory.

Under paragraph (e), FRA instead proposes to treat switches differently, depending upon whether they are within a wayside or cab signal system—or are provided other similar safeguards (i.e., distant switch indicators and associated locking circuitry) required to meet the applicable switch position standards and requirements of subparts A-G—or are within non-signaled (dark) territory.

While a PTC system in dark territory would be required to enforce a positive stop—as discussed in more detail below—a PTC system in signaled territory would require a train to operate at no more than the upper limit of restricted speed between the associated signal, over any switch in the block governed by the signal, and until reaching the next subsequent signal that is displaying a signal indication more permissive than proceed at restricted speed.

Signaled territory includes various types of switches, including power-operated switches, hand-operated switches, spring switches, electrically-locked switches, electro-pneumatic switches, and hydra switches, to name the majority. Each type of switch poses different issues as it relates to PTC system enforcement. We look at power- and hand-operated switches as examples.

On a territory without a PTC system, if a power-operated switch at an interlocking or control point were in a condition resulting in the signal system displaying a stop indication, an approaching train would have to stop generally only a few feet from the switch, and in the large majority of cases no more than several hundred feet away from it. In contrast, in PTC territory adhering to the aforementioned overly aggressive requirement, a train would have to stop at the signal, which may be in close proximity to its associated switch, and operate at no more than the upper limit of restricted speed to that switch, where it would have to stop again. FRA believes that, since the train would be required to stop at the signal, and must operate at no more than the upper limit of restricted speed until it completely passes the switch (with the crew by rule watching for and prepared to stop short of, among other concerns, an improperly lined switch), another enforced stop at the switch would be unnecessarily redundant.

Operations using hand-operated switches would provide different, and arguably greater, difficulties and potential risks. Generally, in between each successive interlocking and control point, signal spacing along the right of way can approximately be 1 to 3 miles or more apart, determined by the usual length of track circuits and the sufficient number of indications that would provide optimal use for train operations. Each signal governs the movement through the entire associated block up to the next signal. Thus, a train approaching a hand-operated switch may encounter further difficulties since its governing signal may be much further away than one would be for a power-operated switch. If within signaled territory a hand-operated switch outside of an interlocking or control point were in a condition resulting in the signal system displaying a restricted speed signal indication, an approaching train may be required to stop before entering the block governed by the signal and proceed at restricted speed, or to otherwise reduce its speed to restricted speed as it enters the block governed by the signal, and be operated at restricted speed until the train reaches the next signal displaying an indication more permissive than proceed at restricted speed, including while passing over any switch within the block. The governing signal, however, may be anywhere from a few feet to more than a mile from the hand-operated switch. For instance, if a signal governs a 3 mile long block, and there is a switch at 1.8 miles after passing the governing signal (stated in advance of the signal), and that switch is misaligned, the train would have to travel that 1.8 miles at restricted speed. Even if the train crew members were able to normal the misaligned switch, they would need to remain at restricted speed at least until the next signal (absent an upgrade of a cab signal indication).

In signaled territory, to require a PTC system to enforce a positive stop of an approaching train at each individual switch that is misaligned would be an unnecessary burden on the industry, particularly since movement beyond the governing signal would be enforced by the PTC system to a speed no more than the upper limit of restricted speed. Accordingly, in signaled territory, FRA proposes in paragraph (e)(1) to require a PTC system to enforce the upper limit of restricted speed through the block. By definition, at restricted speed, the locomotive engineer must be prepared to stop within one-half the range of vision short of any misaligned switch or broken rail, etc., not to exceed 15 or 20 miles per hour depending on the operating rule of the railroad. Accordingly, if a PTC system is integrated with the signal system, and a train is enforced by the PTC system to move at restricted speed past a signal displaying a restricted speed indication, FRA feels comfortable that the PTC system will meet the statutory mandate of preventing the movement of the train through the switch left in the wrong position by continuously displaying the speed to be maintained (i.e., restricted speed) and by enforcing the upper limit of the railroads' restricted speed rule (but not to exceed 20 mph). While this solution would not completely eliminate human factors associated with movement through a misaligned switch, it would significantly mitigate the risk of a train moving through such a switch and would be much more cost effective.

Moreover, it would be cost prohibitive to require the industry to individually equip each of the many thousands of hand-operated switches with a wayside interface unit (WIU) necessary to interconnect with a PTC system in order to provide a positive stop short of any such switch that may be misaligned. Currently each switch in signaled territory has its position monitored by a switch circuit controller (SCC). When a switch is not in its normal position, the SCC opens a signal control circuit to cause the signal governing movement over the switch location to display its most restrictive aspect (usually red). A train encountering a red signal at the entrance to a block will be required to operate at restricted speed through the entire block, which can be several miles in length depending on signal spacing. The signal system is not capable of informing the train crew which switch, if any, in the block may be in an improper position since none of switches are equipped with an independent WIU. There could be many switches within the same block in a city or other congested area. Thus, there is a possibility that one or more switches may be not in its proper position and the signal system is unable to transmit which switch or switches are not in normal position. The governing signal could also be displaying a red aspect on account of a broken rail, broken bond wire, broken or wrapped line wire, bad insulated joint, bad insulated switch or gage rods, or other defective condition.

FRA believes that requiring a PTC system to enforce the upper limit of restricted speed in the aforementioned situations is statutorily acceptable. The statute requires each PTC system to prevent “the movement of a train through a switch left in the wrong position.” Under this statutory language, the railroad's intended route must factor into the question of whether a switch is in the “wrong” position. In other words, in order to determine whether a switch is in the “wrong position,” we must know the switch's “right position.” The “right position” is determined by the intended route of the railroad. Thus, when determining whether a switch is in the wrong position, it is necessary to know the railroad's intended route and whether the switch is properly positioned to provide for the train to move through the switch to continue on that route. The intended route is normally determined by the dispatcher.

Under the proposed rules, when a switch is in the wrong position, the PTC system must have knowledge of that information, must communicate that information to the railroad (e.g., the locomotive engineer or dispatcher), and must control the train accordingly. Once the PTC system or railroad has knowledge of the switch's position, FRA expects the position to be corrected in accordance with part 218 before the train operates through the switch. See, e.g., §§ 218.93, 218.103, 218.105, 218.107.

If the PTC system forces the train to move at no more than the upper limit of restricted speed, the railroad has knowledge that a misaligned switch may be within the subject block, and the railroad by rule or dispatcher permission then makes the decision to move through the switch (i.e., the railroad's intent has changed as indicated by rule or dispatcher instructions), the switch is no longer in the “wrong position.” The RSAC PTC Working Group was unanimous in concluding that these arrangements satisfy the safety objectives of RSIA08. Utilization of the signal system to detect misaligned switches and facilitate safe movements also provides an incentive to retain existing signal systems, with substantial additional benefits in the form of broken rail detection and detection of equipment fouling the main line.

Paragraph (e)(2) addresses movements over switches in dark territory and under conditions of excessive risk, even if in block signal territory. In dark territory, by definition, there are no signals available to provide any signal indication or to interconnect with the switches or PTC system. Without the benefit of a wayside or cab signal system, or other similar system of equivalent safety, the PTC system will have no signals to obey. In such a case, the PTC system may be designed to allow for virtual signals, which are waypoints in the track database that would correspond to the physical location of the signals had they existed without a switch point monitoring system. Accordingly, paragraph (e)(2)(i) proposes to require that in dark territory where PTC systems are implemented and governed by this subpart, the PTC system must enforce a positive stop for each misaligned switch whereas the lead locomotive must be stopped short of the switch to preclude any fouling of the switch. Once the train stops, the railroad will have an opportunity to correct the switch's positioning and then continue its route as intended.

Unlike in signaled territory, FRA expects that on lines requiring PTC in dark territory, each switch will be equipped with a WIU to monitor the switch's position. A WIU is a device that aggregates control and status information from one or more trackside devices for transmission to a central office and/or an approaching train's onboard PTC equipment, as well as disaggregating received requests for information, and promulgates that request to the appropriate wayside device. Most of the switches in dark territory are hand-operated with a much smaller amount of them being spring and hydra switches. In dark territory, usually none of the switches have their position monitored by a SCC and railroads have relied on the proper handling of these switches by railroad personnel. When it is necessary to throw a main line switch from normal to reverse, an obligation arises under the railroad's rules to restore the switch upon completion of the authorized activity. Switch targets or banners are intended to provide minimal visual indication of the switch's position, but in the typical case trains are not required to operate at a speed permitting them to stop short of open switches. As evidenced by the issuance of Emergency Order No. 24 and the subsequent Railroad Operating Rules Final Rule (73 FR 8442 (Feb. 13, 2008)), proper handling of main line switches cannot be guaranteed in every case. However, now with the implementation and operation of PTC technology, if a switch is not in the normal position, that information will be transmitted to the locomotive. The PTC system will then know which switch is not in the normal position and require a positive stop at that switch location only.

In the event that movement through a misaligned switch would result in an unacceptable risk, whether in dark or signaled territory, paragraph (e)(2)(ii) proposes to require the PTC system to enforce a positive stop on each train before it crosses the switch in the same manner as described above for trains operating in dark, PTC territory. FRA acknowledges that regardless of a switch's position, and regardless of whether the switch is in dark or signaled territory, movement through certain misaligned switches—even at low speeds—may still create an unacceptable risk of collision with another train.

FRA understands the term “unacceptable risk” to mean risk that cannot be tolerated by the managing activity. It is a type of identified risk that must be eliminated or controlled. For instance, such an unacceptable risk may exist with a hand-operated crossover between two main tracks, between a main track and a siding or auxiliary track, or with a hand-operated switch providing access to another subdivision or branch line. The switches mentioned in (e)(2)(ii) are in locations where, if the switch is left lined in the wrong position, a train would be allowed to traverse through the crossover or turnout and potentially into the path of another train operating on an adjoining main track, siding, or other route. Even if such switches were located within a signaled territory, the signal governing movements over the switch locations, for both tracks as may be applicable, would be displaying their most restrictive aspect (usually red). This restrictive signal indication would in turn allow both trains to approach the location at restricted speed where one or both of the crossover switches are lined in the reverse position. Since the PTC system is not capable of actually enforcing restricted speed other than its upper limits, the PTC system would enforce a 15 or 20 mile per hour speed limit dependent upon the operating rules of the railroad. However, there is normally up to as much as a 5 mile per hour tolerance allowed for each speed limit before the PTC system will actually enforce the applicable required speed. Thus, in reality, the PTC system would not enforce the restricted speed condition until each train obtained a speed of up to 25 miles per hour. In this scenario, it is conceivable that two trains both operating at a speed of up to 25 miles per hour could collide with each other at a combined impact speed (closing speed) of up to 50 miles per hour. While these examples are provided in the rule text, they are merely illustrative and do not limit the universe of what FRA may consider an unacceptable risk for the purpose of paragraph (e). FRA emphasizes that FRA maintains the final determination as to what constitutes acceptable or unacceptable risk in accordance with paragraph (e)(2)(ii).

The PTC system must also enforce a positive stop short of any misaligned switch on a PTC controlled siding in dark territory where the allowable track speed is in excess of 20 miles per hour. Sidings are used for meeting and passing trains and where those siding movements are governed by the PTC system, safety necessitates the position of the switches located on them to be monitored in order to protect train movements operating on the siding. Conversely, on signaled sidings, train movements are governed and protected by the associated signal indications, track circuits, and monitored switches, none of which are present in dark territory.

Paragraph (e)(3) provides that the PTCSP may include a safety analysis for PTC system enforcement associated with switch position and an identification and justification of any alternate means of protection other than that provided in this section shall be identified and justified. FRA recognizes that in certain circumstances this flexibility may allow the reasonable use of a track circuit in lieu of individually monitored switches.

Paragraph (e)(4) provides amplifying information regarding existing standards of subparts A through G related to switches, movable-point frogs, and derails in the route governed that are equally applicable to PTC systems unless otherwise provided in a PTCSP approved under this subpart. This paragraph explains that the FRA required and accepted railroad industry standard types of components used to monitor switch point position and how those devices are required to function. This paragraph allows for some alternative method to be used to accomplish the same level of protection if it is identified and justified in a PTCSP approved under this subpart.

Paragraph (f) provides amplifying information for determining whether a PTC system is considered to be configured to prevent train-to-train collisions, as required under paragraph (a). FRA will consider the PTC system as providing the required protection if the PTC system enforces the upper limits of restricted speed. These criteria will allow following trains to pass intermediate signals displaying a restricting aspect and will allow for the issuance of joint mandatory directives.

Where a wayside signal displays a “Stop,” “Stop and Proceed,” or “Restricted Proceed” indication, paragraph (f)(1)(i) requires the PTC system to enforce the signal indication accordingly. In the case of a “Stop” or “Stop and Proceed” indication, the train will be brought to a stop prior to passing the signal displaying the indication. The train may then proceed at 15 or 20 miles per hour, as applicable according to the host railroad's operating rule(s) for restricted speed. In the case of a “Restricted Proceed” indication, the train would be allowed to pass the signal at 15 or 20 miles per hour. In either event, the speed restriction would be enforced until the train passes a more favorable signal indication. In dark territory where trains operate by mandatory directive, the PTC system would be expected to enforce the upper limit of restricted speed on a train when the train was allowed into a block already occupied by another preceding train traveling in the same direction. FRA would expect each PTC system to function in this way and that each railroad will test each system to ensure such proper functioning.

Paragraphs (g) through (k) all concern situations where temporary rerouting may be necessary and would affect application of the operational rules under subpart I. While the proposed rule attempts to reduce the opportunity for PTC and non-PTC trains to co-exist on the same track, FRA recognizes that this may not always be possible, especially when a track segment is out of service and a train must be rerouted in order to continue to destination. Accordingly, paragraph (g) allows for temporary rerouting of traffic between PTC equipped lines and lines not equipped with PTC systems. FRA anticipates two situations—emergencies and planned maintenance—that would justify such rerouting.

Paragraph (g) provides the preconditions and procedural rules to allow or otherwise effectuate a temporary rerouting in the event of an emergency or planned maintenance that would prevent usage of the regularly used track. Historically, FRA has dealt with temporary rerouting on an ad hoc basis. For instance, on November 12, 1996, FRA granted UP, under its application RS&I-AP-No. 1099, conditional approval for relief from the requirements of § 236.566, which required equipping controlling locomotives with an operative apparatus responsive to all automatic train stop, train control, or cab signal territory equipment. The conditional approval provided for “detour train movements necessitated by catastrophic occurrence such as derailment, flood, fire, or hurricane” on certain listed UP territories configured with automatic cab signals (ACS) or automatic train stop (ATS). Ultimately, the relief would allow trains not equipped with the apparatus required under § 236.566 to enter those ACS and ATS territories. However, the relief was conditional upon establishing an absolute block in advance of each train movement—as prescribed by General Code of Operating Rules (GCOR) 11.1 and 11.2—and notifying the applicable FRA Regional Headquarters. The detour would only be permissible for up to seven days and FRA could modify or rescind the relief for railroad non-compliance.

On February 7, 2006, that relief was temporarily extended to include defined territory where approximately two months of extensive track improvements were necessary. Additional conditions for this relief included a maximum train speed of 65 miles per hour and notification to the FRA Region 8 Headquarters within 24 hours of the beginning of the non-equipped detour train movements and immediately upon any accident or incident. On February 27, 2007, FRA provided similar temporary relief for another three months on the same territory.

While the aforementioned conditional relief was provided on an ad hoc basis, FRA feels that codifying rules regulating temporary rerouting involving PTC system track or locomotive equipment is necessary due to the potential dangers of allowing mixed PTC and non-PTC traffic on the same track and the inevitable increased presence of PTC and PTC-like technologies. Moreover, FRA believes that the subject railroads and FRA would benefit from more regulatory flexibility to work more quickly and efficiently to provide for temporary rerouting to mitigate the problems associated with emergency situations and infrastructure maintenance.

Under the proposed rule, FRA is providing for temporary rerouting of non-PTC trains onto PTC track and PTC trains onto non-PTC track. A train will not be considered rerouted for purposes of the conditions set forth in this section if it operates on a PTC line that is other than its “normal route,” which is equipped and functionally responsive to the PTC system over which it is subsequently operated, or if it is a non-PTC train (not a passenger train or a freight train having any PIH materials) operating on a non-PTC line that is other than its “normal route.”

Paragraph (g) effectively provides temporary civil penalty immunity from various applicable requirements of this subpart, including provisions under subpart I relating to lead locomotives, similar to how waivers from FRA have provided certain railroads immunity from § 236.566. FRA seeks comments on what other requirements under part 236 should also be included.

FRA expects that emergency rerouting will require some flexibility in order to respond to circumstances outside of the railroad's control—most notably changes in the weather, vandalism, and other unexpected occurrences—that would result in potential loss of life or property or prevent the train from continuing on its normal route. While paragraph (g) lists a number of possible emergency circumstances, they are primarily included for illustrative purposes and are not a limiting factor in determining whether an event rises to an emergency. For instance, FRA would also consider allowing rerouting in the event use of the track is prevented by vandalism or terrorism. While these events are not the primary reasons FRA proposes paragraph (g) to allow rerouting, FRA recognizes that they may fall outside of the railroad's control.

In the event of an emergency that would prevent usage of the track, temporary rerouting may occur instantly by the railroad without immediate FRA notice or approval. By contrast, the vast majority of maintenance activities can be predicted by railroad operators. While the proposed rule provides for temporary rerouting for such activities, the lack of exigent circumstances does not require the allowance of instantaneous rerouting without an appropriate request and, in cases where the request is for rerouting to exceed 30 days, FRA approval. Accordingly, under paragraph (g), procedurally speaking, temporary rerouting for emergency circumstances will be treated differently than temporary rerouting for planned maintenance. While FRA continues to have an interest in monitoring all temporary rerouting to ensure that it is occurring as contemplated by FRA and within the confines of the rule, the timing of FRA notification, and the approval procedures, reflect the aforementioned differences.

When an emergency circumstance occurs that would prevent usage of the regularly used track, and would require temporary rerouting, the subject railroad must notify FRA within one business day after the rerouting commences. To provide for communicative flexibility in emergency situations, the proposed rule provides for such notification to be made in writing or by telephone. FRA proposes that written notification may be accomplished via overnight mail, e-mail, or facsimile. In any event, the railroad should take the steps necessary for the method of notification selected to include confirmation that an appropriate person actually on duty with FRA receives the notification and FRA is duly aware of the situation. FRA is considering whether to employ the National Response Center (NRC) for such communications, whereas notification may be made to the NRC clearly describing the actions taken and providing the railroad's point of contact so that FRA may follow up for additional information if necessary. While the NRC provides full time telephonic services, 24 hours a day, 7 days a week, 365 days a year, the light volume of calls FRA expects for rerouting purposes under this section may make the option cost prohibitive. FRA is currently reviewing this option and seeks comments on this issue.

While telephone notification may provide for easy communications by the railroad, a mere phone call would not provide for documentation of information required under paragraph (g). Moreover, if for some reason the phone call is made at a time when the designated telephone operator is not on duty or if the caller is only able to leave a message with the FRA voice mail system, the possibility exists that the applicable FRA personnel would not be timely notified of the communication and its contents. Thus, while not in the proposed rules, FRA is considering requiring any telephonic notification performed in accordance with paragraph (g) to be followed up with written notification within 48 hours. FRA seeks comments on this issue.

FRA is also considering using particular contact mail and e-mail addresses and telephone and facsimile numbers to be used exclusively for the notifications required by paragraph (g) as they relate to emergency rerouting. Otherwise, if a railroad would notify a particular member of the FRA staff in writing, and that staff member is unavailable (e.g., on annual or sick leave, working in the field, or otherwise indisposed), FRA would not be timely notified of the emergency situation and the rerouting actions that are occurring. If there is a singular contact address for each form of written notification, FRA could attempt to provide continuous personnel assignment to monitor incoming notifications. FRA seeks comments on this issue. FRA also seeks comments on the possible need to include requirements relating to confirmation of receipt of notifications required under paragraph (g).

Emergency rerouting can only occur without FRA approval for fourteen (14) consecutive calendar days. If the railroad requires more time, it must make a request to the Associate Administrator. The request must be made directly to the Associate Administrator and separately from the initial notification sometime before the 14-day emergency rerouting period expires. Unless the Associate Administrator notifies the railroad of his or her approval before the end of the allowable emergency rerouting timeframe, the relief provided by paragraph (g) will expire at the end of that timeframe.

While a mere notification is necessary to commence emergency rerouting, a request must be made, with subsequent FRA approval, to perform planned maintenance rerouting. The relative predictability of planned maintenance activities allows railroads to provide FRA with much more advance request of any necessary rerouting and allows FRA to review that request. FRA proposes that the request must be made at least 10 calendar days before the planned maintenance rerouting commences.

To ensure a retrievable record, the request must be made in writing. It may be submitted to FRA by fax, e-mail, or courier. Because of security protocols placed in effect after 9/11, regular mail undergoes irradiation to ensure that any pathogens have been destroyed prior to delivery. The irradiation process adds significant delay to FRA's receipt of the document, and the submitted document may be damaged due to the irradiation process. The lack of emergency circumstances makes telephonic communication less necessary and less preferable. Like notifications for emergency rerouting, the request for planned rerouting must include the number of days that the rerouting should occur. If the planned maintenance will require rerouting up to 30 days, then the request must be made with the Regional Administrator. If it will require rerouting for more than 30 days, then the request must be made with the Associate Administrator. These longer time periods reflects FRA's opportunity to review and approve the request. In other words, since FRA expects that the review and approval process will provide more confidence that a higher level of safety will be maintained, the rerouting period for planned maintenance activities may be more than the 14 days allotted for emergency rerouting.

Regardless of whether the temporary rerouting is the result of an emergency situation or planned maintenance, the communication to FRA required under paragraph (g) must include the information listed under paragraph (i). This information is necessary to provide FRA with context and details of the rerouting. To attempt to provide railroads with the flexibility intended under paragraph (g), and to attempt to prevent enforcement of the rules from which the railroad should be receiving relief, FRA must be able to coordinate with its inspectors and other personnel. This information may also eventually be important to FRA in developing statistical analyses and models, reevaluating its rules, and determining the actual level of danger inherent in mixing PTC and non-PTC traffic on the same tracks.

For emergency rerouting purposes, the information is also necessary for FRA to determine whether it should order the railroad or railroads to cease rerouting or provide additional conditions that differ from the standard conditions specified in paragraph (i). FRA recognizes the importance of allowing temporary rerouting to occur automatically in emergency circumstances. However, FRA must also maintain its responsibility of ensuring that such rerouting occurs lawfully and as intended by the rules. Accordingly, the proposed rules provide for the opportunity for FRA to review the information required by paragraph (g) to be submitted in accordance with paragraph (i) and order the railroad or railroads to cease rerouting if FRA finds that such rerouting is not appropriate or permissible in accordance with the requirements of paragraphs (g) through (i), and as may be so directed in accordance with paragraph (k), as discussed further below.

For rerouting due to planned maintenance, the information required under paragraph (i) is equally applicable and will be used to determine whether the railroad should not reroute at all. If the request for planned maintenance is for a period of up to 30 days, then the request and information must be sent in writing to the Regional Administrator of the region in which the temporary rerouting will occur. While such a request is self-executing—meaning that it will automatically be considered permissible if not otherwise responded to—the Regional Administrator may prevent the temporary rerouting from starting by simply notifying the railroad or railroads that its request is not approved. The Regional Administrator may otherwise provide conditional approval, request that further information be supplied to the Regional Administrator or Associate Administrator, or disapprove the request altogether. If the railroad still seeks to reroute due to planned maintenance activities, it must provide the Regional Administrator or Associate Administrator, as applicable, the requested information. If the Regional Administrator requests further information, no planned maintenance rerouting may occur until the information is received and reviewed and the Regional Administrator provides his or her approval. Likewise, no planned maintenance rerouting may occur if the Regional Administrator disapproves of the request. If the Regional Administrator does not provide notice preventing the temporary rerouting, then the planned maintenance rerouting may begin and occur as requested. However, once the planned maintenance rerouting begins, the Regional Administrator may at any time order the railroad or railroads to cease the rerouting in accordance with paragraph (k).

Requests for planned maintenance rerouting exceeding 30 days, however, must be made to the Associate Administrator and are not self-executing. No such rerouting may occur without Associate Administrator approval, even if the date passes on which the planned maintenance was scheduled to commence. Under paragraph (h)(3), like the Regional Administrator, the Associate Administrator may provide conditional approval, request further information, or disapprove of the request to reroute. Once approved rerouting commences, the Associate Administrator may also order the rerouting to cease in accordance with paragraph (k).

Paragraph (j) requires that, once temporary rerouting commences, regardless of whether it is for emergency or planned maintenance purposes, the track segments upon which the train will be rerouted must have an absolute block established in advance of each rerouted train movement and that each rerouted train movement shall not exceed 59 miles per hour for passenger and 49 miles per hour for freight. FRA requests comment on whether these speed restrictions should be limited to trains actually transporting PIH materials or intercity or commuter passengers and whether a higher limit should be provided on cab signal territory where the detoured train is led by a locomotive equipped with operative cab signals. FRA also requests comment on whether the more stringent requirements of § 236.1029 (trains failed en route on PTC lines) should apply. Finally, FRA requests comment on the extent to which the host railroad's PTCSP might provide for alternative safety measures.

Moreover, as referenced in paragraph (g) as it applies to both emergency and planned maintenance circumstances, the track upon which FRA expects the rerouting to occur would require certain mitigating protections listed under paragraph (j) in light of the mixed PTC and non-PTC traffic. While FRA purposefully intends paragraph (j) to apply similarly to § 236.567, FRA recognizes that § 236.567 does not account for the statutory mandates of interoperability and the core PTC safety functions. Accordingly, paragraph (j) must be more restrictive.

Section 236.567, which applies to territories where “an automatic train stop, train control, or cab signal device fails and/or is cut out en route,” requires trains to proceed at either restricted speed or, if an automatic block signal system is in operation according to signal indication, at no more than 40 miles per hour to the next available point of communication where report must be made to a designated officer. Where no automatic block signal system is in use, the train shall be permitted to proceed at restricted speed or where an automatic block signal system is in operation according to signal indication but not to exceed medium speed to a point where absolute block can be established. Where an absolute block is established in advance of the train on which the device is inoperative, the train may proceed at not to exceed 79 miles per hour. Paragraph (j) utilizes that absolute block condition, which more actively engages the train dispatcher in managing movement of the train over the territory (in both signaled and non-signaled territory). Recognizing that re-routes under this section will occur in non-signaled territory, the maximum authorized speeds associated with such territory are used as limitations on the speed of re-routed trains. FRA agrees with the comments of labor representatives in the PTC Working Group who contend that the statutory mandate alters to some extent what would otherwise be considered reasonable for these circumstances. FRA welcomes comments on whether restrictions associated with re-routing should vary depending on whether the actual train in question is a passenger train or includes cars containing PIH materials.

It should be noted that this paragraph (j) was added by FRA after further consideration of this issue and was not part of the PTC Working Group consensus. FRA believes that special precautions may be appropriate given the heightened safety expectations suggested by the statutory mandate. Comment is requested on the appropriateness of these restrictions, including any impact on other rail traffic.

Paragraph (k), as previously noted, provides the Regional Administrator with the ability to order the railroad or railroads to cease rerouting operations that were requested for up to 30 days. The Associate Administrator may order a railroad or railroads to cease rerouting operations regardless of the length of planned maintenance rerouting requested. FRA believes this is an important measure necessary to prevent rerouting performed not in accordance with the rules and FRA's expectations based on the railroad's communications and to ensure the protection of train crews and the public. However, FRA is confident that in the vast majority of cases railroads will utilize the afforded latitude reasonably and only under necessary circumstances.

FRA expects each host railroad to develop a plan to govern operations in the event temporary rerouting is performed in accordance with this section. Thus, as noted further below in § 236.1015, FRA proposes each PTCSP to include a plan accounting for such rerouted operations.

Section 236.1006 Equipping Locomotives Operating in PTC Territory

The PTC Working Group discussed at great length the issues related to operation of PTC-equipped locomotives, and locomotives not equipped with PTC onboard apparatus, over lines equipped with PTC. The PTC Working Group recognized that the typical rule with respect to train control territory is that all controlling locomotives must be equipped and operative (see § 236.566). It was also noted in the discussion that the Interstate Commerce Commission (FRA's predecessor agency in the regulation of this subject matter) and FRA have provided some relief from this requirement in discrete circumstances where safety exposure was considered relatively low and the hardship associated with equipping additional locomotives was considered substantial.

The ASLRRA noted that its member railroads conduct limited operations over Class I railroad lines that will be required to be equipped with PTC systems in a substantial number of locations. These operations are principally related to the receipt and delivery of carload traffic in interchange. The small railroad service extends onto the Class I railroad track in order to hold down costs and permit both the small railroad and the Class I railroad to retain traffic that might be priced off the railroad if the Class I had to dispatch a crew to pick up or place the cars. This, in turn, supports competitive transportation options for small businesses, including marginal small businesses in rural areas.

The ASLRRA advocated an exception that would permit the trains of its members and other small railroads to continue use of existing trackage rights and agreements without the necessity for equipping their locomotives with PTC. They suggested that any incremental risk be mitigated by requiring that such trains proceed subject to the requirement for an absolute block in advance (similar to operating rules consistent with § 236.567 applicable to trains with failed onboard train control systems). This position was consistently opposed both by the rail labor organizations and the Class I railroads. These organizations took the position that all trains should be equipped with PTC in order to gain the benefits sought by the congressional mandate and to provide the host railroad the full benefit of its investment in safety. Informal discussions suggested that Class I railroads might offer technical or financial assistance to certain small railroads in equipping their locomotives, but that this would, of course, be done based on the corporate interest of the Class I railroad.

In the PTC Working Group and in informal discussions around its activities, Class I railroads indicated that they intended to take a strong position against non-equipped trains operating on their PTC lines, and that in order to enforce this restriction fairly they understood that they would need to equip their own locomotives, including older road switchers that might venture onto PTC-equipped lines only occasionally. However, during these discussions, FRA was not able to develop a clear understanding regarding, outside the scope of FRA regulations, the extent to which the Class I railroads under previously executed private agreements enjoy the effective ability to enforce a requirement that all trains be equipped. FRA presumes for purposes of this proposal that there will be circumstances rooted in previously executed private agreements under which the Class I railroad would be entitled to require the small railroad to use a controlling locomotive equipped with PTC as a condition of operating onto the property. FRA wishes to emphasize that, in making this regulatory proposal, FRA does not intend to influence the exercise of private rights or to suggest that public policy would disfavor an otherwise legitimate restriction on the use of unequipped locomotives on PTC lines. Rather, this proposal is intended to explore limited exceptions that might be acceptable from the point of view of safety, and helpful from the point of view of the public interest in rail service, where it might be compatible with prior rights of the railroads involved. FRA also notes that, in the absence of clear guidance on this issue, a substantial number of waiver requests could be expected that would have to be resolved without the benefit of decisional criteria previously examined and refined through the rulemaking process.

Paragraph (a) proposes that, as general rule, all trains operating over PTC territory must be PTC-equipped. In other words, paragraph (a) would require that each lead locomotive to be operated with a PTC onboard apparatus if it is controlling a train operating on a track equipped with a PTC system in accordance subpart I. The PTC onboard apparatus should operate and function in accordance with the PTCSP governing the particular territory. Accordingly, it must successfully and sufficiently interoperate with the host railroad's PTC system.

Generally, the four parts of each PTC system are office, wayside, communications, and onboard components. FRA recognizes that a PTC onboard apparatus for a lead locomotive owned and operated by one railroad may not be part of the PTC system upon which the locomotive operates. For example, a Class II railroad lead locomotive equipped with a PTC onboard apparatus may operate on a Class I railroad's PTC line. Throughout this rule, the use of the term “PTC system,” depending upon its context, usually refers to the host railroad's PTC system, and not the tenant railroad's lead locomotive. When using the term, PTC onboard apparatus, however, FRA intends to cover all such mobile equipment, regardless of whether it on a locomotive owned or controlled by a host or tenant railroad.

Under proposed § 236.1006, FRA may enforce paragraph (a). Proposed paragraphs (b) and (c), however, contains a series of proposed qualifications and exceptions to paragraph (a).

First, it is understood that during the time PTC technology is being deployed to meet the statutory deadline of December 31, 2015, there will be movements over PTC lines by trains with lead locomotives not equipped with a PTC onboard apparatus. In general, Class I railroad locomotives are used throughout the owning railroad's system and, under shared power agreements, on other railroads nationally. FRA anticipates that the gradual equipping of locomotives—which will occur at a relatively small number of specialized facilities and which will require a day or two out of service as well as time in transit—will extend well into the implementation period that ends on December 31, 2015. It will not be feasible to tie locomotives down to PTC lines, and the RSAC stakeholders fully understood that point. Labor organizations did urge that railroads make every effort to use equipped locomotives as controlling units, and FRA believes that in general, railroads will do so in order to obtain the benefits of their investment.

Second, FRA has included a transitional provision, related to PTC apparatus that fails upon attempted initialization, specifically intended to encourage placement of PTC-equipped locomotives on the point during the period when reliability may be an issue. This provision would allow a stated, declining percentage of locomotives equipped with PTC to be dispatched even if the onboard apparatus fails. Although FRA agrees with the objective of rail labor's suggestion for “consist management” that puts equipped locomotives on the point, FRA also recognizes that a number of factors related to the age and condition of locomotives may influence this decision. Further, in the early stages of implementation, requiring that power be switched if initialization fails could result in significant train delays and contribute to congestion in yards and terminals. Some “slack” in the system will be required to implement PTC intelligently and successfully. Of course, if FRA determines during implementation that good faith efforts are not being made to take advantage of PTC-equipped locomotives, FRA could step in with more prescriptive requirements after providing notice and an opportunity for comment.

Recognizing that matching PTC lines with PTC-equipped controlling locomotives will be a key factor in obtaining the benefits of this technology in the period up to December 31, 2015, FRA requests comments on whether PTC Implementation Plans should be required to include power management elements describing how this will be accomplished to the degree feasible.

Third, the section provides a cross-reference to § 236.1029 pertaining to PTC onboard apparatus failing en route.

Fourth, this provision proposes exceptions for trains operated by Class II and III railroads, including tourist or excursion railroads. The exceptions are limited to lines not carrying intercity or commuter passenger service, except where the Class I freight railroad and the passenger railroad have requested an exception in the PTC Implementation Plan's main line track exception addendum (MTEA) in accordance with § 236.1019, as further discussed below, and FRA has approved that element of the plan.

FRA has considered whether to provide an exception to requiring each Class II and III railroad locomotive to be equipped with a PTC onboard apparatus when operating over passenger routes to be equipped with a PTC system, but FRA has not been able to define conditions that would apparently be suitable in every case. FRA is open to consideration of exceptions within the context of a PTC Implementation Plan. To the extent that the host Class I or passenger railroad would need to be supportive of the exception, FRA recognizes that options may be foreclosed prior to FRA consideration. However, railroads have historically exercised substantial control of operations over track that they own or dispatch, and in this case those interests significantly parallel the apparent intent of the Congress to achieve a high level of safety in mixed freight and passenger operations. If FRA were to handle exceptions through PTC Implementation Plans, FRA seeks comments on how that should be accomplished. FRA also seeks comments on whether there should be an assumption that the lead locomotives not equipped with PTC onboard apparatus' on four unequipped Class II or III railroad trains will be permitted daily on a segment of PTC-equipped track and that variances from that are permitted in a PTC Implementation Plan. If so, FRA questions whether that should be subject to the agreement of both railroads. If agreement by the Class II or III railroad is not required, FRA seeks comments on what assurance there would be that the Class I railroad would not effectively shut out the Class II or III railroad's operation.

FRA recognizes that most of the justifications stated for these proposed exceptions pertain to short movements for interchange that would constitute a small portion of the movements over the PTC-equipped line. The accident/incident data show that the risk attendant upon these movements is small. A review of the last seven years of accident data covering 3,312 accidents that were potentially preventable by PTC showed that there were only two of those accidents which involved a Class I railroad's train and a Class II or III railroad's train. FRA believes that the low level of risk revealed by these statistics justifies an exception for Class II and III railroad trains traversing a PTC-equipped line for a relatively short distance. FRA notes that the cost of equipping those trains would be high when viewed in the context of the financial strength of the Class II or III railroad and the marginal safety benefits would be relatively low in those cases where a small volume of traffic is moved over the PTC-equipped line.

FRA also believes that it is clearly desirable to eventually have each train using a PTC-equipped line to have a lead locomotive equipped with a PTC onboard apparatus. However, FRA seeks comments on the length of time the exception should last and a justification of that length of time. Other considerations aside, FRA seeks comments on whether FRA should not require a Class II or III railroad locomotive used on a PTC-equipped line to be equipped with PTC when it is rebuilt or replaced (i.e., when the cost of equipping a locomotive is lowest). In other cases, the Class II or III railroad has dedicated locomotives serving the line to be equipped with PTC. From the facts presently available to FRA, it appears to be appropriate for those locomotives to be equipped with PTC. Moreover, FRA is aware of other cases where Class II and III railroads have rather more extensive operations over Class I railroad lines; and, in these cases, the risks incurred could be more substantial. Further, in some of these cases the smaller railroads are aligned with the Class I railroads over which they operate or may even be under common ownership and control. For purposes of prompting a more complete public dialogue on this issue, FRA is proposing to limit unequipped movements by any single Class II or III railroad to not more than 4 trains per day over any given track segment on a PTC-equipped line. A train moving from the small railroad to the point of interchange and back within the same calendar day would count as two trains.

To the extent the movements in question do not exceed 20 miles, this exception would be available at least until FRA next considered the issue of PTC deployment. Information available to FRA indicates that this would accommodate a substantial majority of the affected operations. FRA questions and seeks comments as to whether this latitude should be available if one or more locomotives subsequently acquired by the small railroad were equipped for PTC.

To the extent the movements in question exceed 20 miles, the exception would be available only until December 31, 2020. In some cases, small railroads operate over Class I railroad tracks for over one hundred miles, and these operations may be integral to their service plans (e.g., permitting the small railroad to reach lines branching off from the Class I railroad's route structure for which the smaller railroad provides local service). FRA recognizes that in these circumstances the smaller railroads would face overwhelming competition for supplier attention and significant challenges related to pricing that will attend the initial period of implementation. Accordingly, FRA proposes to provide for these railroads to equip the necessary locomotives with additional time beyond the statutory deadline that applies to Class I railroads. In conjunction with this latitude, FRA would ask for progress reports to focus the attention of the railroads' management teams and to ensure that the agency could not be presented with unreasonable demands for further extensions at the end of the extended implementation period.

FRA recognizes that small railroads carry a wide variety of commodities, including PIH traffic. FRA invites comments on whether the small railroad exceptions for freight operations that FRA is proposing should be altered if the small railroad is transporting PIH traffic on PTC equipped track through a densely populated area. Commenters are requested to detail any alternative standards they believe should be adopted to address such a situation.

Section 236.1007 Additional Requirements for High Speed Service

Since the early 1990s, there has been an interest centered around designated high speed corridors for the introduction of high speed rail, and a number of States have made progress in preparing rail corridors through safety improvements at highway-rail grade crossings, investments in track structure, and other areas. FRA has administered limited programs of assistance using appropriated funds. With the passage of the American Recovery and Reinvestment Act of 2009, Public Law 111-5, 123 Stat. 115 (2009), which provides $8 billion in capital assistance for high speed rail corridors and intercity passenger rail service, and the President's announcement in April 2009 of a Vision for High Speed Rail in America, FRA expects those efforts to increase considerably. FRA believes that railroads conducting high speed operations in the United States can provide a world class service as safe as, or better than, any high speed operations conducted elsewhere. In anticipation of such service, and to ensure public safety, FRA proposes three tiers of requirements for PTC systems operating in high speed service. The proposed performance thresholds are intended to increase safety performance targets as the maximum speed limits increase to compensate for increased risks, including the potential frequency and adverse consequences of a collision or derailment.

Section 236.1007 proposes setting the intervals for the high speed safety performance targets for operations with: maximum speeds at or greater than 60 and 50 miles per hour for passenger service and freight operations, respectively, under paragraph (a); maximum speeds greater than 90 miles per hour under paragraph (b); maximum speeds greater than 125 miles per hour under paragraph (c); and maximum speeds greater than 150 mph under paragraph (d). The reader should note that the requirements increase as speed rises. Thus, for instance, operations with trains moving above 125 miles per hour must, in addition to the requirements under paragraph (c), adhere to the requirements under paragraphs (a) and (b).

Paragraph (a) addresses the PTC system requirements for territories where speeds are greater than 59 miles per hour for passenger service and 49 miles per hour for freight service. Under existing regulations (49 CFR 236.0), block signal systems are required at these speeds (unless a manual block system is in place, an option that this proposal would phase out). The proposed rule expects covered operations moving at these speeds to have implemented a PTC system that provides, either directly or with another technology, all of the statutory PTC system functions along with the safety-critical functions of a block signal system as defined in the existing standards of subparts A-F of part 236. The safety-critical functions of a block signal system include track circuits, which assist in broken rail detection and unintended track occupancies (equipment rolling out), and fouling circuits, which can identify equipment that is intruding on the clearance envelope and may prevent raking collisions.

FRA recognizes that advances in technology may render current block signal, fouling, and broken rail detection systems obsolete and FRA does not want to preclude the introduction of suitable and appropriate advanced technologies. Accordingly, FRA believes that alternative mechanisms providing the same functionality are entirely acceptable and FRA encourages their development and use to the extent they do not have an adverse impact on the level of safety.

Paragraph (b) addresses system requirements for territories where operating speeds are greater than 90 miles per hour, which is currently the maximum allowable operating speed for passenger trains on Class 5 track. At these higher speeds, the implemented PTC system must not only comply with paragraph (a), but also be shown to be fail-safe (as defined in Appendix C) and at all times prevent unauthorized intrusion of rail traffic onto the higher speed line operating with a PTC system. FRA intends this concept of fail-safe application to be understood in its commonplace meaning, i.e., that insofar as feasible the system is designed to fail to a safe state, which normally means that trains will be brought to a stop. Further, FRA understands that there are aspects of current system design and operation that may create a remote opportunity for a “wrong-side” or unsafe failure and that these issues would be described in the PTCSP and mitigations would be provided. FRA recognizes that, as applied in the general freight system, this proposal could create a significant challenge related to interoperability of freight equipment operating over the same territory. Accordingly, FRA requests comment on whether, where operations do not exceed 125 miles per hour or some other value, the requirement for compliance with Appendix C safety assurance principles might be limited to the passenger trains involved, with “non-vital” onboard processing permitted for the intermingled freight trains.

As speed increases, it also becomes more important that inadvertent incursions on the PTC-equipped track be prevented at switch locations. FRA proposes that this be done by effective means that might include use of split-point derails properly placed, equipping of tracks providing entry with PTC, or arrangement of tracks and switches in such a way as to divert an approaching movement which is not authorized to enter onto the PTC line. The protection mechanism on the slower speed line must be integrated with the PTC system on the higher speed line in a manner to provide appropriate control of trains operating on the higher speed line if a violation is not prevented for whatever reason.

Paragraph (c) addresses high speed rail operations exceeding 125 miles per hour, which is the maximum speed for Class 7 track under § 213.307. At these higher speeds, the consequences of a derailment or collision are significantly greater than at lower speeds due to the involved vehicle's increased kinetic energy. In such circumstances, in addition to meeting the requirements under paragraphs (a) and (b), including having a fail-safe PTC system, the entity operating above 125 miles per hour must provide an additional safety analysis (the HSR-125) providing suitable evidence to the Associate Administrator that the PTC system can support a level of safety equivalent to, or better than, the best level of safety of comparable rail service in either the United States or a foreign country over the 5-year period preceding the submission of the PTCSP. Additionally, PTC systems on these high speed lines must provide the capability, as appropriate, to detect incursion from outside the right of way and provide warnings to trains. Each subject railroad is free to suggest in its HSR-125 any method to the Associate Administrator that ensures that the subject high speed lines are corridors effectively sealed and protected from such incursions (see § 213.347 of this title), including such hazards as large motor vehicles falling on the track structure from highway bridges.

Paragraph (d) addresses the highest speeds existing or currently contemplated for rail operations exceeding 150 miles per hour. FRA expects these operations to be governed by a Rule of Particular Applicability and the HSR-125 required by paragraph (c) shall be developed as part of an overall system safety plan approved by the Associate Administrator. The quantitative risk showing required for operations above 125 miles per hour is not required to include consideration of acts of deliberate violence. The reason for this exclusion is simply to remove speculative or extraordinary considerations from the analysis. FRA and the Department of Homeland Security will of course expect that security considerations are taken into account in system planning.

Section 236.1009 Procedural Requirements

RSIA08 and the proposed rule requires that by April 16, 2010, each Class I railroad carrier and each entity providing regularly scheduled intercity or commuter rail passenger transportation develop and submit to FRA a plan for implementing a PTC system by December 31, 2015, and that FRA shall not permit the installation of any PTC system or component in revenue service unless the Administrator has certified them through the approval process contained in this part. FRA understands implementation to include design, testing, potential Verification and Validation, installation, and operation over the PTC system's life cycle.

Current subpart H of part 236 provides a technically sound procedure for obtaining FRA approval of various processor-based signal and train control systems. However, as based on experience gained during BNSF's ETMS 1 project, FRA believes that its process does not support rapid FRA review and decision making and requires redundant submission of information common to multiple railroads. FRA also believes that although the risk analysis required by subpart H fully reflects operational parameters associated with the different type of operations, it is excessively cumbersome and overly time consuming for the purposes of deploying PTC system technologies at the rate required under RSIA08. Moreover, subpart H does not require an implementation plan and does not provide for “certification.” Arguably FRA could simply amend subpart H to include requirements relating to implementation plans and to modify the language to equate “approval” under subpart H with “certification” under the statute. However, FRA believes that such a resultant amended subpart H would remain unsuitable for a PTC system certification process in light of the congressional mandates. Those potential amendments alone would not remedy subpart H's inability to provide quick and efficient FRA review.

Accordingly, for PTC system implementation, certification, and build-out completion to occur within the very aggressive dates set by Congress, FRA is proposing a new subpart I, with some minor modifications to subpart H. Under subpart I, § 236.1007 proposes and explains the process by which each railroad may ultimately receive PTC System Certification for its PTC system. Under § 236.1007, FRA intends to avoid procedural redundancy, provide sufficient procedural flexibility to accompany the varying needs of those seeking certification, mitigate the financial risk associated with technological investment necessary to comply with the regulatory requirements, and otherwise develop a streamlined process to provide for quick review and resolution of the issues leading to certification.

Generally speaking, there are three major elements of the proposed PTC System Certification process: PTC Implementation Plan (PTCIP) submission and approval, receipt or use of a Type Approval number—which may be provided with approval of a PTC Development Plan (PTCDP)—and PTC Safety Plan (PTCSP) submission to receive PTC System Certification. While § 236.1009 provides for the procedural requirements for this process, the contents for the applicable filings are provided for under §§ 236.1011, 236.1013, and 236.1015. The PTCIP is the written plan that defines the specific details of how and when the railroad will implement the PTC system. The PTCDP provides a detailed discussion of specific elements of the proposed technology and product that will be used to implement PTC as required by RSIA08. Approval of the PTCDP comes in the form of a Type Approval number that applies to the subject PTC system. The PTCSP provides the railroad-specific elements demonstrating that the system, as installed, meets the required safety performance objectives. Approval of the PTCSP comes in the form of a PTC System Certification.

Under paragraph (a), the PTCIP submission deadline of April 16, 2010, applies to all host railroads—as defined in § 236.1003—that exist at that time and are required to install a PTC system on one or more main lines in accordance with § 236.1005(b). Intercity and commuter railroads that are tenants on Class I, II, or III freight lines must also join with their host railroad in filing these plans. FRA believes that the railroad that maintains operational control over a particular track segment is generally in the best position to develop and submit the PTCIP, since that railroad is more knowledgeable of the conditions of and operations over its track. FRA recognizes that in cases where a tenant passenger railroad operates over a Class II or III railroad, the passenger railroad may be required to take a more active role in planning the PTC system deployment by working with the host railroad.

Paragraph (a), proposes to require that a PTCIP will be filed by railroads that are host railroads upon which passenger trains traverse and thus require PTC installation and operation. FRA recognizes that the statute requires timely submission of a PTCIP by each Class I railroad and each entity providing regularly scheduled intercity or commuter rail passenger transportation. Class II and III railroads that host intercity or commuter rail service will need to file implementation plans, whether or not they directly procure or manage installation of the PTC system.

The tenant passenger railroad will need to file jointly with the Class I, II or III railroad. This is consistent with RSIA08, which requires each subject passenger railroad to file an implementation plan. In the case of an intercity or commuter railroad providing service over a Class I railroad, it may be sufficient for the passenger railroad to file a letter associating itself with the Class I's plan to the extent it impacts the passenger service. FRA does not propose any requirement for joint filing in the more common case where another railroad has freight trackage rights over a Class I railroad's PTC line. However, the Class I railroad will, of course, address these joint operations and discuss the issue of interoperability in its plan as required by law.

If a host freight railroad and tenant passenger railroad cannot come to an agreement on a PTCIP to jointly file by April 16, 2010, they must instead each file a PTCIP separately with a notification separate from the PTCIP to the Associate Administrator indicating that a joint filing was not possible and an explanation of why the subject railroads could not agree upon a final PTCIP draft for joint filing. Under such a circumstance, each freight or passenger railroad may still be subject to a civil penalty assessed for each day past the deadline that a PTCIP is not jointly filed. FRA believes that these measures are necessary to ensure timely PTC system implementation and operation under the statute and are in the interest of public safety. FRA believes that when subject railroads have an obligation to submit a joint filing, they also carry the obligation to seek dispute resolution by private means if needed.

If a PTCIP or request for amendment (RFA), as provided in § 236.1021, must be submitted in accordance with the rule after April 16, 2010, paragraph (a) does not propose to provide the subject railroads with an opportunity to file separately. If a railroad intends to use track that would require the installation of a PTC system in accordance with paragraph (a)(3), and the parties have difficulty reaching agreement, then such usage would merely be delayed until the parties come to a mutually acceptable PTCIP for joint filing.

FRA notes that new passenger railroads are likely to begin operations during the period between issuance of the final rule in this proceeding and the end of the implementation period for PTC (December 15, 2015). Railroads beginning operations after April 16, 2010, but before December 31, 2015, that must install PTC would be expected to file a PTCIP that meets the requirements of paragraph (a) as soon as possible after the decision to proceed. It is FRA's position for purposes of this proposal that any railroad commencing operations after December 31, 2015, that require PTC will not be authorized to commence revenue operations until the PTC installation is complete. FRA requests comment on whether there are any legitimate exceptions to this approach, which appears to be the only approach consistent with the RSIA08.

Paragraph (b) contains the proposed process for receiving a Type Approval number for a particular PTC system. Under the proposed rule, each PTC system must receive a Type Approval number. The Type Approval is a number assigned to a particular off-the-shelf PTC system product—described in a PTCDP in accordance with § 236.1013—indicating FRA's belief that the product could fulfill the requirements of subpart I. FRA's issuance of a Type Approval does not mean that the product will meet the requirements of subpart I. The Type Approval applies to the technology designed and developed, but not yet implemented, and does not bestow any ownership or other similar interests or rights to any railroad. Each Type Approval number remains under the control of the FRA, and can be issued or revoked in accordance with this subpart.

FRA expects the proposed Type Approval process to provide a variety of benefits to FRA and the industry. If a railroad submits a PTCDP describing a PTC system, and the PTC system receives a Type Approval, then other railroads intending to use the same PTC system without variances may, in accordance with proposed paragraph (b)(1), simply rely on the Type Approval number without having to file a separate PTCDP. While the railroad filing the PTCDP must expend resources to develop and submit the PTCDP, all other railroads using the same PTC system would not. This would not only provide significant cost and time savings for a number of railroads, but will remove a significant level of redundancy from the approval process that is currently inherent in subpart H.

If, however, a railroad intends to use a modified version of a PTC system that has already received a Type Approval number, and the variances between the two systems are of a safety-critical nature, the railroad must submit a new PTCDP. The new PTCDP can either fully comply with the content requirements under § 236.1013 or supply a Type Approval number for the other PTC system upon which the modified PTC system will rely and a document fulfilling the content requirements under § 236.1013 as it applies to the safety-critical variances.

In any event, to receive a new Type Approval number, the railroad must submit to FRA a PTCDP, drafted in accordance with § 236.1013, no later than when it submits its PTCIP. While the PTCDP may be drafted by the PTC system vendor, FRA believes it is the railroads' regulatory responsibility and duty to submit its PTCIP to FRA. FRA believes that requiring the submission of the PTCDP with the PTCIP will facilitate a reduction in regulatory activities, thus maximizing the time available for the railroads to carry out the necessary activities to complete PTC implementation within the 65 months available between April 2010, and December 2015. During that time, the each railroad is expected to carry out all of the required actions necessary to complete design, manufacture, test, and installation of the PTC office, onboard, and wayside subsystems. FRA believes that the process proposed in paragraph (b) provides the railroads considerable flexibility. By requiring that a railroad's PTCDP be submitted no later than its PTCIP, FRA intends to ensure that FRA has the opportunity early in the regulatory approval process to review and determine whether the proposed technical solution in the PTCDP has the potential to satisfy the statutory requirements. If a PTCDP is submitted at a later time, the length of time available to the railroad to perform a complete PTC implementation will be decreased even further.

Many issues relating to FRA's review of the railroad's PTCDP may also cause further delays, thus reducing the time between the receipt of a Type Approval and the statutory deadline of December 15, 2015, upon which the PTC system must be installed and operating. For instance, FRA may find that the PTCDP does not adequately conform to this subpart or otherwise has insufficient information to justify approval. FRA may also determine that there are issues raised by the PTCDP that would adversely affect the ability of FRA to eventually certify the system. If such a situation were to arise, the railroad and its vendor would need to address the issues, and resubmit the PTCDP for FRA approval.

Given the magnitude of the tasks faced by the railroads, any additional delays beyond April 16, 2010, will increase the risk of the railroad failing to meet the December 31, 2015, completion date required by RSIA08. Such delays will increase the length of time that the risk to the public and railroad employees remains unmitigated by PTC technologies. More specifically, FRA recognizes that any loss of time would make it more difficult for a railroad to perform the installation, testing, and analyses necessary to submit its PTCSP for PTC System Certification. Such installation, testing, and analyses cannot occur until the railroad knows the PTC system that it may use, as identified by a Type Approval number. Accordingly, paragraph (b) proposes that each PTCDP be filed no later than when its associated PTCIP is submitted in order to preserve as much time as possible to ensure that each railroad meets the statutory deadline and that Congress' intent is not otherwise frustrated.

FRA believes that the existence of certain overlapping issues in each PTCDP and PTCIP also requires their contemporaneous submission and review. FRA strongly believes that a meaningful implementation plan cannot be created if the railroad has not identified and understands the technology they propose to implement. Without an understanding of the technology, and the issues associated with its design, test, and implementation, any schedules developed by the railroad may be meaningless. Unless there is an understanding of the PTC system it hopes to use, and how it expects to implement that system, evaluation of a deployment schedule can not be undertaken.

Moreover, the PTCIP requires that the railroad address the issue of interoperability with other PTC systems. Any meaningful discussion regarding interoperability requires that the railroad have a clear understanding of the technical capabilities of the system that it proposes to implement before it can make an informed judgment of how the system will interoperate with other systems. The information required in the PTCDP provides the implementing railroad, other railroads with which the implementing railroad interfaces, and FRA with an understanding of the technical requirements necessary for interoperability. FRA believes that early identification of technical capabilities of the proposed PTC systems will allow the concerned parties to make more timely design adjustments to facilitate interoperability, reducing any delays that may increase the level of risk of the railroad meeting its statutory deadline.

FRA also believes that the process proposed by paragraph (b) will also reduce each railroad's financial risk related to implementing a technological system requiring governmental approval. Members of the PTC Working Group expressed concern about having to expend significant resources to implement and test a PTC system prior to submitting a PTCSP reflecting its findings in order to receive PTC System Certification. FRA believes that proposed paragraphs (b) and (e) address this concern. By requiring submission of a PTCDP earlier in the process, FRA intends to be involved in the design and implementation process from the beginning. After contemporaneously reviewing a railroad's PTCIP and PTCDP, FRA may be able to predetermine, and share with the railroad, an appropriate course of action to adequately address the various issues specific to the railroad and related to drafting a successful PTCSP. Moreover, in accordance with paragraph (e)—as discussed further below—each subject railroad may have the benefit of FRA monitoring its progress in implementing its PTC system. With FRA's involvement in the process, each subject railroad's financial risk associated with implementing a PTC system prior to PTCSP approval will be mitigated.

While FRA expects each subject railroad to submit its PTCDP with its PTCIP, the proposed rule does not preclude a railroad from submitting its PTCDP before its PTCIP for FRA review and approval. FRA encourages an earlier submission of the PTCDP to further reduce the required regulatory effort necessary to review the PTCIP and PTCDP if submitted together. More importantly, it would present an opportunity for FRA to issue a Type Approval for the proposed PTC system before April 16, 2010, thus providing other railroads intending to use the same or similar PTC system the opportunity to leverage off of the work already accomplished by simply submitting the Type Approval—and a much less burdensome PTCDP in the event of variances. FRA also believes that the proposed regulatory procedure may incentivize railroads using the same or similar PTC system to jointly develop and submit a PTCDP, thus further reducing the paperwork burden on FRA and the industry as a whole and increasing confidence in the interoperability between systems.

Paragraph (c) proposes to require that each subject railroad must either file a Request for Expedited Certification (REC) or submit an approved PTCIP, a Type Approval, and a PTCSP developed in accordance with § 236.1015 in order to receive PTC System Certification. A REC applies only to PTC systems that have already been in revenue service and meet the criteria of § 236.1031(a), as further discussed below. If a PTC system is not eligible for expedited certification, the railroad must submit a PTCSP. As required under proposed § 236.1015, the PTCSP must include information relating to the operation and safety of the PTC system as defined in the PTCDP and as applied to the railroad's actual territory. To determine the sufficiency of the PTC system's applicability on the railroad's territory, the railroad may be required, as referenced in paragraph (e), to perform laboratory or field testing or have an independent assessment performed. Ultimately, PTC System Certification—issued by FRA based on a review and approval of the PTCSP—is FRA's formal recognition that the PTC system, as described and implemented, meets the statutory requirements and the provisions of subpart I. It does not imply FRA endorsement or approval of the PTC system itself.

To be clear, paragraph (d) requires that each PTCIP, PTCDP, and PTCSP must comply with the content requirements proposed in §§ 236.1011, 236.1013, and 236.1015, respectively. If the submissions do not comply with their respective regulatory requirements, then they may not be approved. Without approval, a PTC system may not receive a Type Approval or PTC System Certification.

Paragraph (d) also proposes that the contents of the submitted plans be understood by FRA personnel. In the interest of an open market, FRA does not want to preclude the ability of PTC system suppliers outside of the United States from manufacturing PTC systems or selling them to the subject railroads. However, in order to ensure the safety and reliability of those systems, FRA needs to adequately review the submitted plans. Accordingly, FRA proposes to require that all materials submitted in accordance with this subpart be in the English language, or be translated into the English language and attested as true and correct. FRA seeks comments on this proposal and whether any additional requirements are necessary to ensure FRA's adequate understanding of the submissions.

Under subpart H of part 236, a railroad may seek confidential treatment for certain information required to be submitted under that subpart. According to § 236.901(c), a railroad may label that information as confidential—if it deems it to be trade secrets, or commercial or financial information that is privileged or confidential under Exemption 4 of the Freedom of Information Act, 5 U.S.C. 552(b)(4)—and submit the information in accordance with § 209.11. FRA believes that the same concept should be applied to materials submitted in accordance with proposed subpart I. FRA continues to believe that the referenced information should receive the protections under the Freedom of Information Act (FOIA) (5 U.S.C. 552) and the Trade Secrets Act (18 U.S.C. 1905). FRA also continues to believe that it cannot make any flat pronouncements about the confidentiality of information it has not yet received. Should a FOIA request be made for information submitted under this rule that the submitting party has claimed should be withheld, the submitting company will be notified of the request in accordance with the submitter consultation provisions of the Department's FOIA regulations (§ 7.17) and will be afforded the opportunity to submit detailed written objections to the release of information protected by exemption 4 as provided for in § 7.17(a). Since FRA proposes to place the redacted versions of the submitted plans in a docket for public comment, FRA strongly encourages submitting parties to request protection from withholding only for those portions of documents that truly justify such treatment (i.e., trade secrets and security sensitive information).

While FRA continues to believe that there is no need at this time to substantially revise § 209.11, FRA proposes in subpart I to require an additional document to assist FRA in efficiently and correctly reviewing confidential information. Under § 209.11, a redacted and an unredacted copy of the same document must be submitted. When FRA review is required to determine whether confidentiality should be afforded, FRA personnel must painstakingly compare side-by-side the two versions to determine what information has been redacted. To reduce this burden, FRA proposes that any material submitted for confidential treatment under subpart I and § 209.11 must include a third version that would indicate, without fully obscuring, the redacted portions. For instance, to indicate, without obscuring, the plan's redacted portions, the railroad may use the color or light gray highlighting, underlining, or strikethrough functions of its word processing program. This document will also be treated as confidential under § 209.11. While FRA could instead amend § 209.11 to include this requirement, FRA does not believe it to be necessary at this time. If more regulatory procedures in other subparts or parts provide for confidential treatment under § 209.11, FRA will then consider whether amendment of § 209.11 would be appropriate at that time.

As discussed more specifically below, FRA is considering requiring the submission of an adequate GIS shapefile to fulfill some of the PTCIP content requirements under § 236.1011. Redacting word processing documents includes the simple task of blocking the text wished to be deemed confidential. However, in a GIS shapefile, which includes primarily map data, visually blocking out the information would defeat the purpose. For instance, a black dot over a particular map location, or a black line over a particular route, would actually reveal the location. FRA expects that a railroad seeking confidentiality for portions of a GIS shapefile will submit three versions of the shapefile to comply with paragraph (d). FRA expects that the version for public consumption would merely not include the confidential information. FRA seeks comments on this proposal. FRA also seeks comments on how a third version of the GIS shapefile would indicate, without fully obscuring, the confidential portions.

As previously noted, FRA expects that FRA-monitored laboratory or field testing or an independent third party assessment may be necessary to support conclusions made and included in a railroad's submitted PTCDP or PTCSP. This issue is initially addressed in paragraph (e). The procedural requirements to effectuate either of those requirements can be found in §§ 236.1035 and § 236.1017, respectively.

Proposed paragraph (f) makes clear that FRA approval of a plan submitted under subpart I may be contingent upon any number of factors and that once the plan is approved, FRA maintains the authority to modify or revoke the resulting Type Approval or PTC System Certification. Under paragraph (f)(1), FRAs would reserve the right to attach additional requirements as a condition for approval of a PTCIP, PTCDP, or PTCSP. A risk-informed and performance-based approach is one in which the risk insights, and engineering analysis and performance history, are used to: (1) Focus attention on the most important activities; (2) establish objective criteria based upon risk insights for evaluating performance; (3) develop measurable or calculable parameters for monitoring systems performance; and (4) focus on the results as the primary basis of regulatory decision-making. To accomplish these tasks, it is necessary to identify, analyze, assess, and control hazards and risks within all components of a system—including people, cultures and attitudes, procedures, materials, tools, equipment, facilities and software. In the preparation of any of these plans, railroads may have inadvertently failed to fully address hazards and risks associated with all of these components.

FRA believes that proposed paragraph (f)(1) will make the regulatory process more efficient and stable. Rather than reject a railroad's plan completely, and consequently delay the railroad's implementation of its PTC system, FRA would prefer to add additional conditions during the approval process to address these oversights. When determining whether to attach conditions to plan approval, FRA will consider whether: (1) The plan includes a well-defined and discrete technical or security issue that affects system safety; (2) the risk or safety significance of an issue can be adequately determined; (3) the issue affects public health and safety; (4) the issue is not already being processed under an existing program or process; and (5) the issue cannot be readily addressed through other regulatory programs and processes, existing regulations, policies, guidance, or voluntary industry initiatives.

Proposed paragraph (f)(2) provides FRA the right to withdraw a Type Approval or a PTC System Certification as a consequence of the discovery of new information regarding system safety that was not previously identified. FRA issuance of each Type Approval or PTC System Certification under performance-based regulations assumes that the model of the train control system and its associated probabilistic data adequately accounts for the behavior of all design features of the system that could contribute to system risk. Different system design approaches may result in different levels of detail introducing different approximations/errors associated with the safety performance. There are some characteristics for which modeling methods may not fully capture the behavior of the system, or there may be elements of the system for which historical performance data may not be currently available. These potential inconsistencies in the failure analysis could introduce significant variations in the predicted performance from the actual performance. Because of the design complexity associated with train control systems, FRA recognizes that these inconsistencies are not the results of deliberate acts by any individuals or organizations, but simply reflects the level of detail of the analysis, the availability of comprehensive information as well as the qualification and experience of the team of analysts, and the resource limitations of both the railroad and FRA.

In proposed paragraph (f)(3), FRA indicates that the railroad may be allowed to continue operations using the system, although such continued operations may have special conditions attached to mitigate any adverse consequences. It is FRA's intent, to the maximum extent possible and when consistent with safety, to assist railroads in keeping the systems in operation. FRA expects that if it places a condition on PTC system operations, each railroad will have a predefined process and procedure in place that would allow continued railroad operations, albeit under reduced capability, until appropriate mitigations are in place, and the system can be restored to full operation. In certain dire situations, FRA may actually order the suspension or discontinuation of operations until the root cause of the situation is understood and adequate mitigations are in place. FRA believes that suspending a Type Approval or a PTC System Certification pending a more detailed analysis of the situation may be appropriate, and that any such suspension must be done without prejudice. FRA expects to take such an action only in the most extreme circumstances and after consultation with the affected parties.

After reconsidering its issuance of a Type Approval or PTC System Certification, under paragraph (f)(4), FRA may either dismiss its reconsideration, continue to recognize the existing FRA approved Type Approval or PTC System Certification, allow continued operations with certain conditions attached, or order the railroad to cease applicable operations by revoking its Type Approval or PTC System Certification. If FRA dismisses its reconsideration or continues to recognize the Type Approval, any conditions required during the reconsideration period would no longer be applicable. If FRA will allow continued operations, FRA may order that the same or other conditions apply. FRA expects that revocation of a Type Approval or PTC System Certification may occur in very narrow circumstances, where the risks to safety appear insurmountable. Regrettably, there may be a few situations in which the inconsistencies are the result of deliberate fraudulent representations. In such situations, FRA may also seek criminal or civil penalties against the entities involved.

Proposed paragraph (g) enables FRA to engage in the proper inspection to ensure that a railroad is in compliance with subpart I. FRA inspections may be required to determine whether a particular railroad has not implemented a PTC system where necessary. For instance, FRA may need to confirm whether a track segment has traversing over it 5 million gross tons or more of annual railroad traffic, PIH materials, or passenger traffic. FRA may also need to inspect locomotives to determine whether they are equipped with a PTC onboard apparatus or to review locomotive logs to determine whether it has entered PTC territory. Paragraph (g) makes clear FRA's statutorily provided power to inspect the railroads and gather information necessary to enforce subpart I.

As noted above, in order to maintain an open marketplace, the proposed rule has been drafted to allow domestic railroads to purchase PTC systems from outside of the United States. FRA recognizes that PTC systems have been used in revenue service across the globe and that acceptable products may be available in other countries. FRA also recognizes that such use may come under a regulatory entity much like FRA. Accordingly, under paragraph (h), in the event information relating to a particular PTC system has been certified under the auspices of a regulatory entity in a foreign government, FRA is willing to consider that information as independently Verified and Validated in accordance with the proposed rule to support the railroad's PTCSP development. The phrase “under the auspices” intends to reflect the possibility of certification contractually performed by a private entity on behalf of a foreign government agency. However, the foreign regulatory entity must be one recognized by the Associate Administrator. A railroad seeking to enjoy the benefits of paragraph (h) must communicate that interest in its PTCSP.

Section 236.1011 PTC Implementation Plan Content Requirements

This proposed section describes the minimum required contents of a PTC Implementation Plan. A PTCIP is a railroad's plan for complying with the installation of mandatory PTC systems required by RSIA08. The PTCIP consists of implementation schedules, narratives, rules, technical documentation, and relevant excerpts of agreements that an individual railroad will use to complete mandatory PTC implementation. FRA will measure the railroad's progress in meeting the required implementation date based on the schedule and other information in the PTCIP. While the proposed rule does not specify or mandate any format for the PTCIP, it must at least clearly indicate which portions intend to address compliance with the various plan requirements under § 236.1011. The PTCIP must also clearly identify each referenced document and either include a copy of each document (or its applicable excerpt) or indicate where FRA and the public may view that document. Should FRA not be able to readily determine adequate response to the required information, FRA will assume that the information has not been submitted, and will handle the document accordingly. The lack of the required information may result in FRA's disapproval of a PTCIP. To facilitate timely and successful submittals, FRA, through assistance from a PTCIP Task Force drawn from the PTC Working Group, is developing a template that could be used to format the documents that must be submitted. FRA, however, wishes to emphasize that the use of such a template is strictly voluntary, and encourages railroads to prepare and submit the documents in whatever structure is most economical for the railroad. FRA does believe it is necessary to require that the railroads expend their limited resources in reformatting of documents when such an activity adds no real value. However, while the template may be a useful tool, and in light of the various forms a PTCIP may be required to take due to the system the railroad intends to implement, complete adherence to the template will not guarantee FRA approval of the submitted PTCIP.

FRA expects each PTCIP to include various highly specific and descriptive elements relating to each railroad's infrastructure and operations. FRA recognizes that to manually assemble each piece of data into a PTCIP may be exceptionally onerous and time consuming and may make the PTCIP prone to errors. In light of the foregoing and due to the statutory requirement that Congress be apprised of the progress of the railroad carriers in implementing their PTC systems, FRA believes that electronic submission of much of this information may be warranted and preferred. To facilitate collection of this data, FRA proposes to require submission of this data in electronic format. Such electronic submission would fulfill the requirements under § 236.1011 to which they apply.

FRA believes that the preferred, least costly, and least error-prone method to comply with § 236.1011 is for railroads to submit an electronic geographic digital system map containing the aforementioned segment attribute information in shapefile format, which is a data format structure compatible with most Geographic Information System (GIS) software packages. Using a GIS provides an efficient means for organizing basic transportation-related geographic data to facilitate the input, analysis, and display of transport networks. Railways around the world rely on GIS to manage key information for rail operations, maintenance, asset management, and decision support systems. FRA believes that the railroads may have already identified track segments, and their physical and operational characteristics, in shapefile format. For instance, FRA believes that it may be preferable that for each track segment, a shapefile should provide the following identifiable information: Owning railroad(s); distance; signal system; track class; subdivision; number and location of sidings; maximum allowable speed; number and location of mainline tracks; annual volume of gross tonnage; annual number of cars carrying hazmat; annual number of cars carrying PIH; passenger traffic volume; average daily through trains; WIUs; switches; and at-grade rail-to-rail crossings. The requirements under paragraph (a) may be changed to accommodate any of these informational elements. FRA seeks comments on this proposal.

Paragraph (a)(1) proposes that the railroad describe the technology that will be employed in its PTC system. Here, FRA intends to use the term “technology” broadly to include all applicable tools, machines, methods, and techniques.

In proposed paragraph (a)(2), FRA addresses the statutory requirements that the PTCIP shall describe how the PTC system will provide interoperability with movements of trains of other railroad carriers over its lines. Practically speaking, this means that each locomotive operating within PTC territory must be able to communicate with and respond to the PTC systems installed on each PTC territory's track and signal system, except in limited situations established elsewhere in this proposed rule. For similar reasons, paragraph (a)(3) proposes that the PTCIP should describe how the PTC system will provide for interoperability of the system between the host and all tenant railroads on the lines required to be equipped with PTC systems under this subpart.

Interoperability means the ability of diverse systems and organizations to work together (inter-operate), taking into account the technical, operational, and organizational factors that may impact system-to-system performance. FRA expects each PTC system required by subpart I to exhibit syntactic interoperability—so that it may successfully communicate and exchange data with other PTC systems—and semantic interoperability—so that it may automatically, accurately, and meaningfully interpret the exchanged information to prove useful to the end user of each communicating PTC system. To achieve semantic interoperability, both sides must defer to a common information exchange reference model. In other words, the content of the information sent must be the same as what is received and understood. Taking syntactic and semantic interoperability together, FRA expects each PTC system to provide services to, and accept services from, other PTC systems and to use those services exchanged to enable the PTC systems to operate effectively together and to provide the intended results. The degree of interoperability should be defined in the PTCIP when referring to specific cases.

Interoperability is achieved through four interrelated means: Product testing, industry and community partnership, common technology and intellectual property, and standard implementation.

Product testing includes conformance testing and product comparison. Conformance testing ensures that the product complies with an appropriate standard. FRA recognizes that certain standards attempt to create a framework that would result in the development of the same end product. However, many standards apply only to core elements and allow developers to enhance or otherwise modify products as long as they adhere to those core elements. Thus, if an end product is developed in different ways to conform to the same standard, there may still be discrepancies between each instantiation of the end product due to the existence of those variables. Accordingly, FRA believes that comparison testing must also occur to ensure that each instantiation of the same product, regardless of the means upon which it is created to meet the same standard, is ultimately identical. In regards to PTC systems, such comparison testing must occur on all portions that relate to each system's interoperability with other systems. Thus, it is also important that the PTC system be formally tested in a production scenario—as they will be finally implemented—to ensure that it will actually intercommunicate and interoperate with other PTC systems as advertised and intended.

To reach interoperability between the various applicable PTC systems, each PTCDP must also show that the systems share common product engineering. Product engineering refers to the common standard, or a sub-profile thereof, as defined by the industry and community partnerships, specifically intended to achieve interoperability. Without common product engineering, the systems will be unable to intercommunicate or otherwise interact as necessary to comply with the proposed rule.

FRA expects that each interoperability standard for PTC systems will be developed by a partnership between various industry participants. Industry and community partnerships, either domestic or international, usually sponsor standard workgroups to define a common standard to provide system intercommunications for a specific purpose. At times, an industry or community will sub-profile an existing standard produced by another organization to reduce options and thus making interoperability more achievable. Thus, in each PTCDP, the railroad must discuss how it developed or adopted a standard commonly accepted by that partnership.

Means of achieving interoperability include having the various entities involved using the same PTC system product or obtaining its components from the same developer. While FRA does not necessarily require this approach—since the agency seeks to maintain an open and competitive marketplace—FRA believes that this is a suitable means to achieve interoperability. This technique may provide similar technical results when using PTC system products from different vendors relying on the same intellectual property. FRA recognizes that certain developers with an intellectual property interest in a particular technology may provide a non-exclusive license of its intellectual property to another entity so that the licensee may introduce into the marketplace a substantially similar product reliant on that intellectual property. In such a case, FRA foresees that the use of a common PTC system technology—even if it is proprietary to a single or multiple entities and licensed to railroads—could reduce the variability between components, thus providing for a more efficient means to achieve interoperability.

In order for interoperability to actually occur between multiple entities' PTC systems, there must be some standard to which they all adhere. Thus, FRA also expects that each PTCDP will provide assurances of a common interoperability standard agreed to between all entities using PTC systems that must interoperate.

Since each of these interrelated means has an important role in reducing variability in intercommunication, each railroad's PTCIP must clearly describe the elements required under paragraph (a)(1)-(3).

Much of the remaining information required in a PTCIP under the proposed rule relies on the location, length, and characteristics of each track segment. Therefore, a common understanding of a track segment is necessary. A track is the main designation for describing a physical linear portion of the network. Each line of railroad has a station location referencing system, which serves to locate inventory features and defects along the length of the track. Because some tracks can be very long, track segments are established to divide the track into smaller “management units.” Typically, segment's boundaries are established at point of switch (POS) locations, but may also be located at mile markers, grade crossings, or other readily identifiable locations. Inspection, condition assessment, and maintenance planning is performed individually on each segment. After the track network hierarchy is established, the attribute information associated with each track is defined. This attribute information describes the track layout (e.g., curves and grades), the track structure (e.g., rail weights and tie specifications), track clearance issues, and other track related items such as turnouts, rail-to-rail at-grade crossings, highway-rail grade crossings, drainage culverts, and bridges. Inventory information about these track attributes can be quite detailed. The benefits of a complete and accurate track inventory provides a record of the track network's properties and information about the existing track materials at the specific locations when maintenance or repair is necessary.

Proposed paragraphs (a)(4) and (a)(5) require the railroad to put its entire implementation plan into an understandable context, primarily as it relates to the sequence and schedule of line segment implementation events. Under RSIA08, § 20157(a)(2), Congress requires each subject railroad, in its PTCIP, to describe how it shall, to the extent practical, implement the PTC system in a manner that addresses areas of greater risk before areas of lesser risk. Accordingly, under paragraph (a)(4), the PTCIP must discuss the railroad's areas of risk and the criteria by which these risks were evaluated and prioritized for PTC system implementation. To this end, the railroad must clearly identify all track segments that must be equipped, the basis for that decision for each segment (which might be done by categories of segments), and, as provided in paragraph (a)(5), the dates that implementation of each segment will be completed, taking into account the time necessary to fulfill the procedural requirements related to PTCSP submission, review, and approval. At a minimum, the deployment decisions must be based on segment traffic characteristics such as passenger and freight traffic volumes, the quantity of PIH and other hazardous materials, current methods of operations, existence of block signals and other traditional train control technologies, the number and class of tracks, authorized and allowable speeds for each segment, and other unusual characteristics that may adversely impact safety, such as unusual ruling grades and other track geometries. In cases where deployment of the PTC system cannot be accomplished in order of areas with the greatest risk to areas with the least risk, paragraph (a)(9) proposes that the railroad must explain why such a deployment was not practical and the steps that will be taken to minimize adverse consequences to the public until the line segment can be equipped.

Proposed paragraphs (a)(6) and (a)(7) require the PTCIP to include information regarding the rolling stock and wayside devices that will be equipped with the appropriate PTC technology. For a PTC system to work as intended, PTC system components must be installed and operated in all applicable offices and on all applicable onboard and wayside subsystems. Accordingly, the PTCIP must identify which technologies will be installed on each subsystem and when they are scheduled to be installed.

Under paragraph (a)(6), each host railroad filing the PTCIP must include a comprehensive list of all rolling stock upon which a PTC onboard apparatus must be operative. FRA understands that in most situations, the rolling stock referenced in paragraph (a)(6) may only apply to lead locomotives. However, in the interest of not hindering creative technological innovations, FRA presumes the possibility that PTC system technology may also be attached to additional rolling stock to provide other functions, including determining train capacity and length or providing certain acceptable and novel train controls. To be kept apprised of these possibilities, FRA is proposing in paragraph (a)(6) that each PTCIP include a list of all rolling stock equipped with PTC technology. FRA believes that the PTCIP should also identify any risks associated with trains operated by tenant railroads and not equipped with PTC system technology and the efforts that the host railroad has made to establish the extent of that risk. Although FRA believes that this is inherent to reviewing the risk in the system, FRA asks for comment as to whether a requirement should be specifically called out in the rule text.

FRA understands that a host railroad may not receive cooperation from a tenant railroad in collecting the necessary rolling stock information. Nevertheless, FRA expects each host railroad to make a good faith effort. Identification of those tenant railroads that the host railroad attempted to obtain the requisite and applicable information from and that failed to address a host railroad's written request may establish a good faith effort by the host railroad.

Proposed paragraph (a)(7) requires the PTCIP to provide a detailed schedule of and the railroad to subsequently report WIU installation. The selection and identification of a technology selected as part of the PTCIP will also, to a great extent, determine the distribution of the functional behaviors of each of the PTC subsystems (e.g., office, wayside, communications, and back office). The WIU is a type of remote terminal unit (RTU) that is part of a larger PTC system, which is a type of Supervisory Control and Data Acquisition System (SCADA). As a whole, the safe and efficient operation of a SCADA—a centralized system that covers large areas, monitors and control systems, and passes status information from, and operational commands to, RTUs—is largely dependent on the ability of each of its RTUs to accurately receive and distribute the required information. As such, a PTC system cannot properly operate without properly functioning WIUs to provide and receive status information and react appropriately to control information.

It is commonly understood that a WIU device is capable of communicating directly to the office, train, or other wayside unit. FRA recognizes that there may not be the same amount of WIUs and devices that they monitor. Depending on the architecture and technology used, a single WIU may communicate the necessarily information as it relates to multiple devices. FRA is comfortable with this type of consolidation provided that, in the event of a failure of any one of the devices being monitored, the most restrictive condition will be transmitted to the train or office, except where the system may uniquely identify the failed device in a manner that will provide safe movement of the train when it reaches the subject location.

Because of the critical role that WIU's play in the proper and safe operation of PTC systems, paragraph (a)(7) proposes that the railroad identify the number of WIU's required to be installed on any given track segment and the schedule for installing the WIU's associated with that segment. This information is necessary to fully and meaningfully fulfill the RSIA08 requirement that by December 31, 2012, Congress shall receive a report on the progress of the railroad carriers in implementing PTC systems. See 49 U.S.C. 20157(d). To comply with this statutory requirement, each railroad must determine the number of WIUs it will need to procure and the location—as defined by the applicable subdivision—that each WIU will be installed. FRA believes that if a railroad does not perform these traditional engineering tasks, it will risk exceeding the statutory implementation deadline of December 31, 2015. FRA considers this information an integral part of the PTCIP that must be submitted to FRA for approval.

FRA recognizes the potential for technological improvements that may modify the number and types of WIU's required. FRA also recognizes that during testing and installation, it may be discovered that additional WIU installation may be necessary. In either case, the railroad will be required to submit an RFA in accordance with § 236.1021 indicating how the railroad intends to appropriately revise its schedule to reflect the resulting necessary changes. Nevertheless, regardless of whether FRA approves or disapproves of the RFA, if a railroad is required to submit its PTCIP by April 16, 2010, implementation must still be completed by the statutory deadline December 31, 2015.

Under proposed paragraph (a)(8), each railroad must also identify in its PTCIP which of its track segments are either main line or not main line. This list must be made based solely on the statutory and regulatory definitions regardless of whether FRA may later deem a track segment as other than main line. If a railroad has a main line that it believes should be considered not main line, it may file with the PTCIP a main line track exception addendum (MTEA) in accordance with § 236.1019, as further discussed below. Each track segment included in the MTEA should be indicated as much on the list required under paragraph (a)(8) so that the PTCIP accounts for each track segment with an appropriate cross-reference to the subject MTEA.

Paragraph (a)(9) requires that the plan call out the basis for this determination to the extent the railroad determines that risk-based prioritization required by paragraph (a)(4) of this section is not practical. FRA recognizes that there may be situations where risk is somewhat evenly distributed and where other factors related to practical considerations—such as the need to establish reliable operation of the system in less complex environments before installing it in more complex environments—may be the prudent course. However, the burden of establishing the reasonableness of this approach would be on the railroad, starting with a showing that risk does not vary substantially among the line segments in question.

As previously mentioned, § 236.1005(a) requires each applicable PTC system to be designed to prevent train-to-train collisions. Under that section, FRA has proposed various requirements that would apply to at-grade rail-to-rail crossings, also known as diamond crossings. While the proposed rule text includes certain specific technical requirements, it also provides the opportunity for each subject railroad to submit an alternative arrangement providing an equivalent level of safety as specified in an FRA approved PTCSP. Accordingly, under proposed paragraph (a)(10), if the railroad intends to utilize alternative arrangements providing an equivalent level of safety to that of the table provided under § 236.1005(a)(1)(i), each PTCSP must identify those alternative arrangements and methods, with any associated risk reduction measures, in its PTCSP.

Paragraph (b) contains proposed provisions related to further deployment of PTC. As noted elsewhere in this preamble, the specific characteristics of the PTC route structure, with the focus on PIH traffic as an indicator of risk, was a late addition to the bill that would become RSIA08, not having appeared in either the House or Senate bills until the final package was assembled using consultations between the committee staffs in lieu of a formal committee of conference. Although the statutory construct (Class I rail line with 5 million gross tons and some PIH materials) adequately defines most of the core of the national freight rail system, it is a construct that will introduce distortions at both ends of the spectrum of risk.

On one hand, a line with a maximum speed limit of 25 miles per hour ending at a grain elevator that receives a few cars of anhydrous ammonia per year is a “main line” if it has at least 5 million gross tons of traffic (a very low threshold for a Class I railroad). This is not a line without risk, particularly if it lacks wayside signals, but FRA analysis shows that the potential for a catastrophic release from a pressure tank car is very low at an operating speed of 25 miles per hour, and the low tonnage is likely associated with relatively infrequent train movements—limiting the chance of a collision. As FRA understands the congressional mandate, the law gives FRA little choice but to require PTC under these circumstances.

On the other end of the spectrum, lines with greater risk may go unaddressed. For instance, a line carrying perhaps a much higher level of train traffic and significant volumes of other hazardous materials at higher speeds, without any PIH or passenger traffic, would not be equipped. This example is not likely to be present to any significant extent under current conditions. However, should the Class I railroads raise freight rates sufficiently to eliminate PIH traffic by making rail transportation prohibitively expensive, the issue would be presented as a substantial one. Most of the transportation risk—including hazards to train crews and roadway workers and exposure to other hazardous materials if released—would remain, but not the few carloads of PIH. FRA believes that the intent of Congress with respect to deployment of PTC might be defeated, even though the literal language of the legislation would be satisfied. Other lines carrying very heavy volumes of bulk commodities such as coal and intermodal traffic may or may not include PIH traffic. Putting aside the risk associated with PIH materials, significant risk exists to train crews and persons in the immediate vicinity of the right-of-way if a collision or other PTC-preventable accident occurs. Any place on the national rail system is a potential roadway work zone, but special challenges are presented in providing for on-track safety where train movements are very frequent.

Risk on the larger Class II and III railroads' lines is also a matter of concern, and the presence of significant numbers of Class I railroad trains on some of those properties presents the opportunity for further risk reduction, since over the coming years virtually all Class I railroad locomotives will be equipped with PTC onboard apparatus'. Examples include trackage and haulage rights retained over Class II and III railroads following asset sales in which the Class I railroads divested the subject lines. Other prominent examples involve switching and terminal railroads, the largest of which are owned and controlled by two or more Class I railroads and function, in effect, as extensions of their systems. Conrail Shared Assets, a large regional switching railroad that is owned by NS and CSXT and is comprised of major segments of the former Conrail, then a Class I railroad, is perhaps the classic example.

FRA notes that there has also been a trend, only recently and temporarily abated by the downturn in the economy, toward higher train counts on some non-signaled lines of the Class I railroads. On a train-mile basis, these operations present about twice the risk as similar operations on signalized lines. These safety gaps need to be filled; and, while most will be filled due to the presence of PIH traffic, FRA cannot verify that this is the case in every instance.

FRA concludes that the mandated deployment of PTC will leave some substantial gaps in the Class I route structure, including gaps in some major urban areas. FRA believes that these gaps will, over time, be “filled in” by voluntary actions of the Class I railroads as they establish the reliability of their PTC systems, verify effective interoperability, and begin to enjoy the safety and other business benefits from use of these systems. FRA fully understands both the desire of the labor stakeholders in the PTC Working Group to see a broader build-out of PTC systems than that “minimally” required by RSIA08 and the concerns of the Class I railroads' representatives who noted the extreme challenge associated with equipping tens of thousands of wayside units, some 20,000 locomotives, and their dispatching centers' back offices within the statutory implementation period.

The Congress recognized that all of these issues are legitimate concerns and so mandated the establishment of Risk Reduction Programs under the same legislation. Section 103 of RSIA08 codifies language that includes, within the Risk Reduction Program, a Technology Implementation Plan that is specifically required to address technology alternatives, including PTC. Accordingly, the PTC and Risk Reduction provisions in RSIA08 are clearly aligned in purpose; and there are also references in the technology plan elements of the Risk Reduction language that address installation of PTC by other railroads. Further, FRA has been charged with a separate rulemaking under section 406 of RSIA08 regarding risk in non-signaled (dark) territory that significantly overlaps the issue set in this rulemaking and the Risk Reduction section. Use of technologies that are integral to PTC systems constitute the best response to hazards associated with non-signaled lines. Switch position monitoring systems, track integrity circuits, digital data links and other technology used to address dark territory issues should be and, as presently conceived, are forward-compatible with PTC. FRA proposes in paragraph (b) to dovetail these requirements by requiring that each Class I railroad include in its PTCIP deployment strategies indicating how it will approach the further build-out of full PTC, or partial implementation of PTC (e.g., using PTC technology to prevent train-to-train collisions but perhaps not monitoring all switches in the territory; or using PTC to protect movements of the Class I over a switching or terminal railroad without initially requiring all controlling locomotives of the switching or terminal railroad to be equipped). These railroads would then be required to include in the technology elements of their initial Risk Reduction plans a specification of which lines will be equipped and with what PTC system elements. Proposed paragraph (b) makes clear that there would be no expectation regarding additional lines being equipped until those mandated by subpart I have been addressed. FRA shares the view of the Class I railroads and the passenger railroads that the December 31, 2015, deadline already presents a substantial challenge for railroads, suppliers and the employees affected.

Paragraph (c) proposes to codify in regulation the statutory mandate that FRA review the PTCIP and determine, within 90 days upon receipt of the plan, whether to provide its approval or disapproval. FRA believes it is also important to provide procedural rules to communicate approval or disapproval. Thus, under paragraph (c), FRA proposes that any approval or disapproval of a PTCIP requires FRA to provide written notice. In the event that FRA disapproves of the PTCIP, the notice will also include a narrative explaining the reasons for disapproval. Once the railroad receives notification that its PTCIP has been disapproved by FRA, it will have 30 days to resubmit its PTCIP for review and approval. While FRA may provide assistance to remedy a faulty PTCIP, it is ultimately the railroad's responsibility and burden to develop and submit a PTCIP worthy of FRA approval. A railroad may be subject to civil penalties if it fails to timely file its PTCIP under this section. As noted previously, subpart I applies to each railroad that Congress and FRA has mandated to install a PTC system. A railroad that is not required to install a PTC system may still do so under its own volition. In such a case, it may either seek approval of its system under either subpart H or I. Paragraph (d) intends to make this choice clear.

Paragraph (e) responds to comments by labor organizations in the PTC Working Group. These employee representatives sought the opportunity to comment on major PTC filings. The paragraph provides that, upon receipt of a PTCIP, PTCDP, or PTCSP, FRA posts on its public Web site notice of receipt and reference to the public docket in which a copy of the filing has been placed. FRA may consider any public comment on each document to the extent practicable within the time allowed by law and without delaying implementation of PTC systems. The version of any filing initially placed in the public docket would be the redacted copy as filed by the railroad. If FRA later determined that additional material was not deserving of protection as confidential, that material would be added to the docket.

Section 236.1013 PTCDP Content Requirements and Type Approval

As noted in the discussion above regarding § 236.1009, each PTCSP must be submitted with a Type Approval number identifying a PTC system that FRA believes could fulfill the requirements of subpart I. Under § 236.1009, a railroad may submit an existing Type Approval number in lieu of a PTC Development Plan (PTCDP) if the PTC system it intends to implement and operate is identical to the one described in that Type Approval's associated PTCDP. In the event, however, that a railroad intends to install a system for which a Type Approval number has not yet been assigned, or to use a system with an assigned Type Approval number that may have certain variances to its safety-critical functions, then the railroad must submit a PTCDP to obtain a new Type Approval number.

The PTCDP is the core document that provides the Associate Administrator sufficient information to determine whether the PTC system proposed for installation by the railroad could meet the statutory requirements for PTC systems specified by RSIA08 and the regulatory requirements under subpart I. Issuance of a product Type Approval number is contingent upon the approval of the PTCDP by the Associate Administrator. While filing of a PTCDP is optional in the sense that the railroad may proceed directly to submission of the PTCSP by the April 16, 2010 deadline (see § 236.1009), FRA encourages railroads engaged in joint operations to do so. Approval of the PTCDP, and issuance of a Type Approval, presents the opportunity for other railroads to reduce the effort required to obtain a PTC System Certification. If a Type Approval for a PTC system exists, another railroad may also use that Type Approval provided there are no variances in the system as described in the Type Approval's PTCDP. In such cases, the other railroad may avoid submitting its own PTCDP by simply incorporating by reference the supporting information in the Type Approval's PTCDP and certifying that no variances in the PTC system have been made.

This proposed section describes the contents of the PTCDP required to obtain FRA approval in the form of issuance of a Type Approval number. The proposed provisions of this section require each PTCDP to include all the elements and practices listed in this section to provide reasonable assurance that the subject PTC system will meet the statutory requirements and are developed consistent with generally-accepted principles and risk-oriented proof of safety methods surrounding this technology. FRA believes it is necessary to include the provisions contained in this section in order to provide reasonable assurance that the product, when developed and deployed, will have no adverse impact on the safety of railroad employees, the public, and the movement of trains.

FRA recognizes that much of the information required by § 236.1013 normally resides with the PTC system's developer or supplier maintains and not the client railroad. While FRA expects that each railroad and its PTC system supplier may jointly draft a PTCDP, the railroad has the primary responsibility for the safety of its operations and for providing the information required under § 236.1013. Accordingly, each railroad required to submit a PTCDP under subpart I should make the necessary arrangements to ensure that the requisite information is readily available from the supplier for submission to the agency. FRA believes that suppliers and railroads will develop a PTCDP for most products that adequately address the requirements of the new subpart without substantial additional expense. As part of the design and evaluation process, it is essential to ensure that an adequate analysis of the features and capabilities is made to minimize the possibility of conflicts resulting from any use or feature, including a software fault. Since this analysis is a normal cost of software engineering development, FRA does not believe this requirement imposes any additional significant costs beyond what should already be done when developing safety-critical software.

In proposed §§ 236.1013 and 236.1015, various adjectives may precede the several of the requirements. For instance, certain paragraphs require “a complete description,” “a detailed description,” or simply a “description.” These phrases are inherited from subpart H. Their inclusion in subpart I are similarly not to imply that any description should be more or less detailed or complete than any other description required. By contrast, they are included merely for the purposes of emphasis.

Paragraph (a)(1) proposes to require that the PTCDP include system specifications that describe the overall product and identify each component and its physical relationship in the system. FRA will not dictate specific product architectures, but will examine each PTC system to fully understand how its various parts interrelate. Safety-critical functions in particular will be reviewed to determine whether they are designed to be fail-safe. FRA believes this provision is an important element that can be applied to determine whether safety is maximized and maintainability can be achieved.

Paragraph (a)(2) proposes to require a description of the operation where the product will be used. Upon receipt of this information within a PTCDP, FRA will have better contextual knowledge of the product as it applies to the type of operation on which it is designed to be used. Where operational behaviors are not applicable to a particular railroad, or the product design is not intended to address a particular operational behavior, FRA would expect a short statement indicating which operational characteristics do not apply and why they are not applicable.

Paragraph (a)(3) proposes that the PTCDP include a concept of operations, a list of the product's functional characteristics, and a description explaining how various components within the system are controlled. FRA expects that the information provided under paragraphs (a)(2) and (a)(3) will together provide a thorough understanding of the PTC system. FRA will review this information—primarily by comparing the subject PTC system's functionalities with those underlying principles contained in standards for existing signal and train control systems—to determine whether the PTC system is designed to account for all relevant safety issues. While FRA proposes to not prescribe PTC system design standards, FRA expects that each applicant compare the concepts contained in existing standards to the operational concepts, functionalities, and controls contemplated for the PTC system in order to determine whether a sufficient level of safety will be achieved. For example, the proposed requirements prescribe that where a track relay is de-energized, a switch or derail is improperly lined, a rail is removed, or a control circuit is opened, each signal governing movements into the subject block occupied by a train, locomotive, or car must display its most restrictive aspect for the safety of train operations. The principle behind the requirement is that, when a condition exists in the operating environment, or with respect to the functioning of the system, that entails a potential hazard, the system will assume its most restrictive state to protect the safety of train operations.

Paragraph (a)(4) proposes that each PTCDP include a document that identifies and describes each safety-critical function of the subject PTC system. The product architecture includes both hardware and software aspects that identify the protection developed against random hardware faults and systematic errors. Further, the document should identify the extent to which the architecture is fault tolerant. FRA intends to use this information to determine whether appropriate safety concepts have been incorporated into the proposed PTC system. For example, existing regulations require that when a route has been cleared for a train movement, it cannot be changed until the governing signal has been caused to display its most restrictive indication and a predetermined time interval has expired where time locking is used or where a train is in approach to the location where approach locking is used. FRA intends to use this information to determine whether all the safety-critical functions are included. Where such functionalities are not clearly determined to exist as a result of technology development, FRA will expect the reasoning to be stated and a justification provided describing how that technology provides the required level of safety. Where FRA identifies a void in safety-critical functions, FRA may not approve the PTCDP until remedial action is taken to rectify the concern.

FRA recognizes that the information required under paragraph (a)(4) may already be provided when complying with paragraph (a)(1). In such a case, the railroad shall cross reference where in the PTCDP that both paragraphs (a)(1) and (a)(4) are jointly satisfied.

Paragraph (a)(5) proposes to require that each PTCDP address the minimum requirements under § 236.1005 for development of safety-critical PTC systems. FRA expects the information provided under paragraph (a)(5) to cover: identification of all safety requirements that govern the operation of a system; evaluation of the total system to identify known or potential safety hazards that may arise over the life-cycle of the system; identification of all safety issues during the design phase of the process; elimination or reduction of the risks posed by the hazards identified; resolution of safety issues presented; development of a process to track progress; and development of a program of testing and analysis to demonstrate that safety requirements are met. Paragraph (a)(5) also requires that each railroad identify the PTC system's safety assurance concepts.

Paragraph (a)(6) proposes to require a submission of a preliminary human factors analysis that addresses each applicable human-machine interface (HMI) and all proposed product functions to be performed by humans to enhance or preserve safety. FRA expects this analysis to place special emphasis on proposed human factors responses—and the result of any failure to perform such a response—to safety-critical hazards, including the consequences of human failure to perform. For each HMI, the PTCDP should address the proposed basis of assumptions used for selecting each such interface, its potential affect upon safety, and all potential hazards associated with each interface. Where more than one employee is expected to perform duties dependent upon HMI input or output, the analysis must address the consequences of failure by one or multiple employees. FRA intends to use this information to determine the proposed HMI's effect upon the safety of railroad operations. The preliminary human factors analysis must propose how the railroad or its PTC system supplier plans to address the HMI criteria listed in Appendix E to part 236 or any alternatives proposed by the railroad and deemed acceptable by the Associate Administrator.

Paragraph (a)(6) also proposes that the PTCDP explain how the proposed HMI will affect interoperability. RSIA08 requires that each subject railroad explain how it intends to obtain system interoperability. The ability of a train crew member to operate another railroad's PTC system significantly depends upon a commonly understood HMI. The HMI provides the end user with a method of interacting with the underlying system and accessing the PTC functionality. FRA expects that each railroad will adopt an HMI standard that will ensure ease of use of the PTC system both within, and between, railroads.

Paragraph (a)(7) proposes to require an analysis regarding how subparts A through G of part 236 apply, or no longer apply, to the subject PTC system. FRA recognizes that while a PTC system may be designed in accordance with the underlying safety concepts of subparts A through G, the specific existing requirements contained in those subparts are not applicable. In any event, the PTCDP must identify each pertinent requirement considered to be inapplicable, fully describe the alternative method used to fulfill that underlying safety concept, and explain how the proposed PTC system supports the underlying safety principle. FRA notes that certain sections in subparts A though G may always be applicable to PTC systems certified under subpart I.

FRA is concerned about all dimensions of system security. Thus, paragraph (a)(8) proposes to require the PTCDP to include a description of the security measures necessary to meet the specifications for each PTC system. Security is an important element in the design and development of PTC systems and covers issues such as developing measures to prevent hackers from gaining access to software and to preclude sudden system shutdown, mechanisms to provide message integrity, and means to authenticate the communicating parties. Safety and security are two closely related topics. Both are elements for ensuring that a subject is protected and without risk of harm. In the industrial marketplace, the goals of safety and security are to create an environment protecting assets from hazards or harm. While activities to ensure safety usually relate to the possibility of accidental harm, activities to ensure security usually relate to protecting a subject from intentional malicious acts such as espionage, theft, or attack. Since system performance may be affected by either inadvertent or deliberate hazards or harms, the safety and security involved in the implementation and operation of a PTC system must both be considered.

Integrated security recognizes that optimum protection comes from three mutually supporting elements: physical security measures, operational procedures, and procedural security measures. Today, the convergence of information and physical security is being driven by several powerful forces, including: interdependency, efficiency and organizational simplification, security awareness, regulations, directives, standards, and the evolving global communications infrastructure. Physical security describes measures that prevent or deter attackers from accessing a facility, resource, or information stored on physical media and guidance on how to design structures to resist various hostile acts. Communications security describes measures and controls taken to deny unauthorized persons information derived from telecommunications and ensure the authenticity of such telecommunications. Because of the integrated nature of security, FRA expects that each PTCDP will address security as a holistic concept, and not be restricted to limited or specific aspects.

Paragraph (a)(9) proposes to require documentation of assumptions concerning reliability and availability targets of mechanical, electrical, and electronic components. When building a PTC system, designers may make numerous presumptions that will directly impact specific implementation decisions. These fundamental assumptions usually come in the form of data (e.g., facts collected as the result of experience, observation or experiment, or processes, or premises) that can be randomly sampled. FRA does not expect to audit all of the fundamental assumptions on which a PTC system has been developed. Instead, FRA envisions sampling and reviewing fundamental assumptions prior to product implementation and after operation for some time. FRA expects that the data sampled may vary, depending upon the PTC system. It is not possible to provide a single set of quantitative numbers applicable to all systems, especially when systems have yet to be designed and for which the fundamental assumptions are yet to be determined. Quantification is part of the risk management process for each project. FRA believes that the actual performance of the system observed during the pre-operational testing and post-implementation phases will provide indications of the validity of the fundamental assumptions. FRA proposes that this review process will occur for the life of the PTC system (i.e., as long as the product is kept in operation). The depth of details required will depend upon what FRA observes. The range of difference between a PTC system's predicted and actual performance may indicate to FRA the validity of the underlying fundamental assumptions. Generally, if the actual performance matches the predicted performance, FRA believes that it will not have to extensively review the fundamental assumptions. If the actual performance does not match predicted performance, FRA may need to more extensively review the fundamental assumptions.

FRA expects each subject railroad to confirm the validity of initial assumptions by comparing them to actual in-service data. FRA is aware that mechanical and electronic component failure rates and times to repair are easily quantified data, and usually are kept as part of the logistical tracking and maintenance management of a railroad. FRA believes that this proposed criterion will enhance the quality of risk assessments conducted pursuant to this subpart by forcing PTC system designers and users to consider the long-term effects of operation over the course of the PTC system's projected life-cycle. If a PTC system can be used beyond its design life-cycle, FRA expects that any continued use would be only under a waiver provided in accordance with part 211 or under a PTCDP or PTCSP amended in accordance with § 236.1021. In its request for waiver or request for amendment, the railroad should address any new risks associated with the life-cycle extension.

Paragraph (a)(9) also proposes to require specification of the target safety levels. This includes the identity of each potential hazard and how the events leading to a hazard will be identified for each safety-critical subsystem; the proposed safety integrity level of each safety-critical subsystem, and the proposed means that accomplishment of these targets will be evaluated. This paragraph also requires identification of the proposed backup methods of operation and safety-critical assumptions regarding availability of the product. FRA believes this information is essential for making determinations about the safety of a product and both the immediate and long-term effect of its failure. FRA contends that availability is directly related to safety to the extent the backup means of controlling operations involves greater risk (either inherently or because it is infrequently practiced).

Paragraph (a)(10) proposes to require a complete description of how the PTC system will enforce all pertinent authorities and block signal, cab signal, or other signal related indications. FRA appreciates that not all PTC architectures will seek to enforce the speed restrictions associated with intermediate signals directly, but nevertheless a clear description of these functions is necessary for clarity and evaluation.

Proposed paragraph (a)(11) requires that, if the railroad is seeking to deviate from the requirements of section 236.1029 with respect to movement of trains with onboard equipment that has failed en route using the flexibility provided by paragraph (c) of that section, a justification must be provided in the PTCDP. Paragraph (c) of proposed § 236.1029 provides that, in order for a PTC train that operates at a speed above 90 miles per hour to deviate from the operating limitations contain in paragraph (b) of that section, the deviation must be described and justified in the FRA approved PTCDP or PTCSP, or by reference to an Order of Particular Applicability, as applicable. For instance, if Amtrak wished to continue to operate at up to 125 miles per hour with cab signals and automatic train control in the case of failure of onboard ACSES equipment, Amtrak would request to do so based on the applicable language of the Order of Particular Applicability that required installation of that system on portions of the Northeast Corridor. Similarly, a railroad wishing more liberal requirements for a high speed rail system on a dedicated right-of-way could request that latitude by explaining how the safety of all affected train movements would be maintained.

Paragraph (a)(12) requires a complete description of how the PTC system will appropriately and timely enforce all hazard detectors that are interconnected with the PTC system in accordance with § 236.105(c)(3), as may be applicable.

Proposed paragraph (b) specifies the approval standard that will be employed by the Associate Administrator. The PTCDP is not expected to provide absolute assurance to the Associate Administrator that every potential hazard will be eliminated with complete certainty. It only needs to establish that the PTC system meets the appropriate statutory and regulatory requirements for a PTC system required under this subpart, and that there is a reasonable chance that once built, it will meet the required safety standards for its intended use. FRA emphasizes that approval of a PTCDP and issuance of a Type Approval does not constitute final approval to operate the product in revenue service. Such approval only comes when the Associate Administrator issues an applicable PTC System Certification.

Paragraph (c) proposes a time limit on the validity of a Type Approval. Provided that at least one product is certified within the 5 year period after issuance of the Type Approval, the Type Approval remains valid until final retirement of the system. The main purpose of this requirement is to incentivize installation, not just creation, of a PTC system. This paragraph would also allow FRA to periodically clean out its records relating to Type Approvals and PTCDPs for obsolete PTC systems.

Paragraph (d) proposes the conditions under which a Type Approval may be used by another railroad. These conditions consist of the railroad maintaining a continually updated PTCPVL pursuant to § 236.1023(c) and the railroad providing licensing information associated with the use of the Type Approval. Under paragraph (d), FRA intends to ensure the implementation of the proper technology and not any orphan product using apparently similar, but actually different, technology. When a railroad submits a previously issued Type Approval for its PTC system, FRA expects that all the proper licensing agreements provide for continued use and maintenance of the PTC system are in place. To ensure FRA's confidence in this area, FRA proposes to require each Type Approval submission to include this relevant licensing information. FRA recognizes that there may be various licensing arrangements available relating to the exclusivity and sublicensing of manufacturing or vending of a particular PTC system. There may be other intellectual property variables that may make arrangements even more complex. To adequately capture all applicable arrangements, FRA proposes to generally require the submission of “licensing information.” More specific language may preclude FRA's ability to collect information necessary to fulfill its intent. If any of this information were to change, either through any type of sale, transfer, or sublicense of any right or ownership, then FRA would expect the railroad to submit a request for amendment of its PTCDP in accordance with § 236.1021. FRA recognizes that this may be difficult for a railroad to accomplish, given the railroad may not be privy to any intellectual property transactions that may occur outside of its control. In any event, FRA would expect that a railroad would ensure, either through contractual obligation or otherwise, that its vendor or supplier provide it with updated licensing information on a continuing basis. FRA seeks comments on this proposal.

Paragraph (e) proposes to require that a railroad submitting a PTCDP demonstrate that its vendor has a suitable quality control system. This requirement provides protection to the railroad and FRA that there is a reasonable probability that the vendor can design and manufacture the product such that it will meet the design targets specified in paragraph (a). FRA expects that compliance with paragraph (e) will eliminate the operation of a PTC system where its vendor has inadequate quality control procedures and processes to support the proper development of a safety critical product.

Paragraph (f) proposes language retaining the Associate Administrator's ability to impose any conditions necessary to ensure the safety of the public, train crews, and train operations when approving the PTCDP and issuing a Type Approval. While FRA expects that adherence to the remainder of this section's requirements should justify issuance of a Type Approval, FRA also recognizes that there may be situations where other unaccounted for variables may reduce the Associate Administrator's confidence in the PTC system, its manufacturer, supplier, vendor, or operator.

Section 236.1015 PTCSP Content Requirements and PTC System Certification

The PTC Safety Plan (PTCSP) is the core document that provides the Associate Administrator the information necessary to certify that the as-built PTC system fulfills the required statutory PTC functions and is in compliance with the requirements of this subpart. Issuance of a PTC System Certification is contingent upon the approval of the PTCSP by the Associate Administrator. Under the proposed rules, the filing and approval of the PTCSP and issuance of a PTC System Certification is a mandatory prerequisite for PTC system operation in revenue service. Each PTCSP is unique to each railroad and must addresses railroad-specific implementation issues associated with the PTC system identified by the submitted Type Approval. Paragraph (a) proposes language explaining these meanings and limits.

When filing a PTCSP, proposed paragraph (b) proposes to require each railroad to: Include the applicable and approved PTCIP, PTCDP, and Type Approval; describe any changes subsequently made to the PTC system, as reflected in the PTCSP, that would require amendment of the PTCIP or PTCDP; and assure FRA whether the PTC system built is the same PTC system described in the PTCDP and PTCSP. Paragraph (b)(1) effectively merges the approved PTCIP and PTCDP into the PTCSP so that there will be a single “package” available for PTC operations and FRA review before and after issuance of a PTC System Certification. If a PTCSP is approved, and the railroad receives a PTC System Certification, all three plans continue to “live” and can only be amended in accordance with § 236.1021.

FRA recognizes the possibility that between PTCIP or PTCDP approval, and prior to PTCSP submission, there may be changes to the former two documents. While such changes may only be made in accordance with § 236.1021, documentation of those changes may not be readily apparent to the reader of the PTCSP. Accordingly, under proposed paragraph (b)(2), FRA expects that each PTCSP shall include a clear and complete description of any such changes by specifically and rigorously documenting each variance. Paragraph (b)(2) also proposes to require that the PTCSP include an explanation of each variance's significance. To ensure that there are no other existing variances not documented in the PTCSP, FRA also proposes under this paragraph to require the railroad to attest that there are no further variances. For the same reason, paragraph (b)(3) proposes that, if there have been no changes to the plans or to the PTC system as intended, the railroad be required to attest that there are no such variances.

Proposed paragraph (c) delineates the contents of the PTCSP. The first elements of the PTCSP are the same elements as the PTCDP (and are described more fully in the section by section for 236.1013). If the railroad had already submitted, and FRA had already approved, the PTCDP, then attachment of the PTCDP to the PTCSP should fulfill this requirement.

The additional, proposed railroad specific elements are as follows:

Paragraph (c)(1) proposes to require that the PTCSP include a hazard log comprehensively describing all hazards to be addressed during the life-cycle of the product, including maximum threshold limits for each hazard. For unidentified hazards, the threshold shall be exceeded at one occurrence. In other words, if the hazard has not been predicted, then any single occurrence of that hazard is unacceptable. The hazard log addresses safety-relevant hazards, or incidents or failures that affect the safety and risk assumptions of the PTC system. Safety relevant hazards include events such as false proceed signal indications and false restrictive signal indications. If false restrictive signal indications occur with any type of frequency, they could influence train crew members, roadway workers, dispatchers, or other users to develop an apathetic attitude towards complying with signal indications or instructions from the PTC system, creating human factors problems.

Incidents in which stop indications are inappropriately displayed may also necessitate sudden brake applications that may involve risk of derailment due to in-train forces. Other unsafe or wrong-side failures which affect the safety of the product will be recorded on the hazard log. The intent of this paragraph is to identify all possible safety-relevant hazards which would have a negative effect on the safety of the product. Right-side failures, or product failures which have no adverse effect on the safety of the product (i.e., do not result in a hazard) would not be required to be recorded on the hazard log.

Paragraph (c)(2) proposes to require that a risk assessment be included in the PTCSP. FRA will use this information as a basis to confirm compliance with the appropriate performance standard. A performance standard specifies the outcome required, but leaves the specific measures to achieve that outcome up to the discretion of the regulated entity. In contrast to a design standard or a technology-based standard that specifies exactly how to achieve compliance, a performance standard sets a goal and lets each regulated entity decide how to meet that goal. An appropriate performance standard should provide reasonable assurance of safe and effective performance by making provision for: (1) Considering the construction, components, ingredients, and properties of the device and its compatibility with other systems and connections to such systems; (2) testing of the product on a sample basis or, if necessary, on an individual basis; (3) measurement of the performance characteristics; and (4) requiring that the results of each or of certain of the tests required show that the device is in conformity with the portions of the standard for which the test or tests were required. Typically, the specific process used to design, verify and validate the product is specified in a private or public standard. The Administrator may recognize all or part of an appropriate standard established by a nationally or internationally recognized standard development organization.

Paragraph (c)(3) proposes to require that the PTCSP include a hazard mitigation analysis. The hazard mitigation analysis must identify the techniques used to investigate the consequences of various hazards and list all hazards addressed in the system hardware and software including failure mode, possible cause, effect of failure, and remedial actions. A safety-critical system must satisfy certain specific safety requirements specified by the system designer or procuring entity. To determine whether these requirements are satisfied, the safety assessor must determine that: (1) Hazards associated with the system have been comprehensively identified; (2) hazards have been appropriately categorized according to risk (likelihood and severity); (3) appropriate techniques for mitigating the hazards have been identified; and (4) hazard mitigation techniques have been effectively applied. See Leveson, Nancy G., Safeware: System Safety and Computers, (Addison-Wesley Publishing Company, 1995).

FRA does not expect that the safety assessment will prove that a product is absolutely safe. However, the safety assessment should provide evidence that risks associated with the product have been carefully considered and that steps have been taken to eliminate or mitigate them. Hazards associated with product use need to be identified, with particular focus on those hazards found to have significant safety effects. The risk assessment proposed under paragraph (c)(2) must include each hazard that cannot be mitigated by system designs (e.g., human over-reliance of the automated systems) no matter how low its probability may be. After the risk assessment, the designer must take steps to remove them or mitigate their effects. Hazard analysis methods are employed to identify, eliminate, and mitigate hazards. Under certain circumstances, FRA may require an independent third party assessment in accordance with proposed § 236.1017 to review these methods as a prerequisite to FRA approval.

Paragraph (c)(4) also proposes that the PTCSP address safety Verification and Validation procedures as defined under part 236. FRA believes that Verification and Validation for safety are vital parts of the PTC system development process. Verification and Validation require forward planning. Consequently, the PTCSP should identify the testing to be performed at each stage of development and the levels of rigor applied during the testing process. FRA will use this information to ensure that the adequacy and coverage of the tests are appropriate.

Paragraph (c)(5) proposes to require the railroad to include in its PTCSP the training, qualification, and designation program for workers regardless of whether those railroad employees will perform inspection, testing, and maintenance tasks involving the PTC system. FRA believes many benefits accrue from the investment in comprehensive training programs and are fundamental to creating a safe workforce. Effective training programs can result in fewer instances of human casualties and defective equipment, leading to increased operating efficiencies, less troubleshooting, and decreased costs. FRA expects any training program to include employees, supervisors, and contractors engaged in railroad operations, installation, repair, modification, testing, or maintenance of equipment and structures associated with the product.

Paragraph (c)(6) proposes to require the PTCSP to identify specific procedures and test equipment necessary to ensure the safe operation, installation, repair, modification and testing of the product. Requirements for operation of the system must be succinct in every respect. The procedures must be specific about the methodology to be employed for each test to be performed that is required for installation, repair, or modification including documenting the results thereof. FRA will review and compare the repair and test procedures for adequacy against existing similar requirements prescribed for signal and train control systems. FRA intends to use this information to ascertain whether the product will be properly installed, maintained, tested, and repaired.

Paragraph (c)(7) proposes that each railroad develop a manual covering the requirements for the installation, periodic maintenance and testing, modification, and repair for its PTC system. The railroad's Operations and Maintenance Manual must address the issues of warnings and describe the warning labels to be placed on each piece of PTC system equipment as necessary. Such warnings include, but are not limited to: Means to prevent unauthorized access to the system; warnings of electrical shock hazards; cautionary notices about improper usage, testing, or operation; and configuration management of memory and databases. The PTCSP should provide an explanation justifying each such warning and an explanation of why there are no alternatives that would mitigate or eliminate the hazard for which the warning is placed.

Paragraph (c)(8) proposes to require that the PTCSP identify the various configurable applications of the product, since this rule mandates use of the product only in the manner described in its PTCDP. Given the importance of proper configuration management in safety-critical systems, FRA believes it is essential that railroads learn of and take appropriate configuration control of hardware and software. FRA believes that a requirement for configuration management control will enhance the safety of these systems and ultimately provide other benefits to the railroad as well. Under this proposed paragraph, railroads are responsible—through its applicable Operations and Maintenance Plan and other supporting documentation maintained throughout the system's life-cycle—for all changes to configuration of their products in use, including both changes resulting from maintenance and engineering control changes, which result from manufacturer modifications to the product. Since not all railroads may experience the same software faults or hardware failures, the configuration management and fault reporting tracking system play a crucial role in the ability of the railroad and the FRA to determine and fully understand the risks and their implications. Without an effective configuration management tracking system in place, it is difficult, if not impossible, to fairly evaluate risks associated with a product over the life of the product.

Paragraph (c)(9) proposes to require the railroad to develop comprehensive plans and procedures for product implementation. Implementation (field validation or cutover) procedures must be prepared in detail and identify the processes necessary to verify that the PTC system is properly installed and documented, including measures to provide for the safety of train operations during installation. FRA will use this information to ascertain whether the product will be properly installed, maintained, and tested. FRA also believes that configuration management should reduce disarrangement issues. Further, configuration management will reduce the cost of troubleshooting by reducing the number of variables and will be more effective in promoting safety.

Paragraph (c)(10) proposes to require the railroad to provide a complete description of the particulars concerning measures required to assure that the PTC system, once implemented, continues to provide the expected safety level without degradation or variation over its life-cycle. The measures specifically provide the prescribed intervals and criteria for the following: testing; scheduled preventive maintenance requirements; procedures for configuration management; and procedures for modifications, repair, replacement and adjustment of equipment. FRA intends to use this information, among other data, to monitor the PTC system to assure it continually functions as intended.

Paragraph (c)(11) proposes to include in each PTCSP a description of each record concerning safe operation. Recordkeeping requirements for each product are discussed in proposed § 236.1037.

Paragraph (c)(12) proposes to require a safety analysis of unintended incursions into a work zone. Measuring incursion risks is a key safety risk assumption. Failing to identify incursion risk can have the effect of making a system seem safer on paper than it actually is. The requirements set forth in this paragraph attempt to mandate design consideration of incursion protection at an early stage in the product development process. The totality of the arrangements made to prevent unintended incursions or operation at higher than authorized speed within the work zone must be analyzed. That is, in addition to the functions of the PTC system, the required actions for dispatchers, train crews, and roadway workers in charge must be evaluated. Regardless of whether a PTC system has been previously approved or recognized, FRA will not accept a system that allows a single point human failure to defeat the essential protection intended by the Congress. See NTSB Recommendations R-08-05 and R-08-06. FRA believes that exposure should be identified because increases in risk due to increased exposure could be easily distinguished from increases in risk due solely to implementation and use of the proposed PTC system.

In the past, little attention was given to formalizing incursion protection procedures. Training for crews has also not been uniform among organizations, and has frequently received inadequate attention. As a result, a variety of procedures and techniques evolved based on what has been observed or what just seemed correct at the time. This lack of structure, standardization, and formal training is inconsistent with the goal of increasing the safety and efficiency.

Paragraph (c)(13) proposes to require a more detailed description of any alternative arrangements provided under proposed § 236.1011(a)(10), pertaining to at grade rail-to-rail crossings.

Paragraph (c)(14) proposes to require a complete description of how the PTC system will enforce mandatory directives and signal indications, unless already addressed in the PTCDP. FRA recognizes that all systems will enforce all signal indications; however, the PTCDP must describe where the architecture of the system performs this function.

Proposed paragraph (c)(15) refers to the requirement of § 236.1019(e) that the PTCSP is aligned with the PTCIP, including any amendments.

Under proposed § 236.1029(b), FRA proposes to require certain limitations on PTC trains operating over 90 miles per hour. Under § 236.1029(c), FRA provides railroads with an opportunity to deviate from those limitations if the railroad describes and justifies the deviation in its PTCDP, PTCSP, or by reference to an Order of Particular Applicability, as applicable. Thus, proposed paragraph (c)(16) to § 236.1015 reminds railroads that this is one of the optional elements that may be included in a PTCSP. This need may also be addressed through review of the PTCDP, and FRA reserves the right to so provide in the final rule.

Railroads are required under § 236.1005(c) to submit a complete description of its compliance regarding hazard detector integration and under §§ 236.1005(g)-(k) to submit a temporary rerouting plan in the event of emergencies and planned maintenance. Railroads must also submit a document indicating any alternative arrangements for each rail at-grade crossing not adhering to the table under § 236.1005(a)(1)(i). Proposed paragraphs (c)(17), (c)(18), and (c)(19) to § 236.1015 reminds railroads that such requirements must be fulfilled with the submission of the PTCSP. For example, under proposed paragraph (c)(18), FRA expects each temporary rerouting plan to explain the host railroad's procedure relating to detouring the applicable traffic. In other words, FRA expects that each temporary rerouting plan address how the host railroad will choose the track that traffic will be rerouted onto. For instance, the plan should explain the factors that will be considered in determining whether and how the railroad should take advantage of temporary rerouting. FRA remains concerned about the unnecessary commingling of PTC and non-PTC traffic on the same track and expects each temporary rerouting plan to address this possibility. More specifically, each plan should describe how the railroad expects to make decisions to reroute non-PTC train traffic onto a PTC line, especially where another non-PTC line may be available. While FRA recognizes each railroad may seek to use the most cost effective route, FRA expects the railroad to also consider the level of risk associated with that route.

In paragraph (d), FRA proposes to state the criteria that FRA will refer to when evaluating the PTCSP, depending upon the underlying technical approach. Whereas in subpart H the safety case is evaluated to determine whether it demonstrates with a high degree of confidence that relevant risk will be no greater under the new product than previously, the statutory mandate for PTC calls for a different approach. In crafting the proposed approach, FRA has attempted to limit requirements for quantitative risk assessment to those situations where the technique is truly needed. Regardless of the type of PTC system, the safety case for the system must demonstrate that it will reliably execute all of the functions required by this subpart (particularly those provided under proposed §§ 236.1005 and 236.1007). With this foundation, the additional criteria that must be met depend upon the type of PTC technology to be employed.

It is FRA's understanding that PTC systems may be categorized as one of the following four system types: Non-vital overlay; vital overlay; standalone; and mixed. Initially, however, all PTC systems will have some features that are not fully fail-safe in nature, even if onboard processing and certain wayside functions are fully fail-safe. Common causes include surveying errors of the track database, errors in consist weight or makeup from the railroad information technology systems, and the crew input errors of critical operational data. To the extent computer-aided dispatching systems are the only check on potential dispatcher error in the creation or inappropriate cancellation of mandatory directives, some room for undetected wrong-side failure will continue to exist in this function as well. This issue is addressed under paragraph (g) of this section.

Proposed paragraph (d)(1) specifies the required behavior for non-vital overlay systems. Based on previous experience with non-vital systems, FRA believes it is well within the technical capability of the railroads to reduce the level of risk on any particular track segment to a level of risk 80% lower than the level of risk prior to installation of PTC on that segment. For subsequent PTC system installations on the same line segment, FRA recognizes that requiring an additional 80% improvement may not be technically or economically practical. Therefore, FRA is only proposing that an entity installing or modifying an existing PTC system need only demonstrate that the level of safety is equal to, and preferably greater than, the level of safety of the prior PTC system. The risk that must be reduced is the risk against which the PTC functionalities are directed, assuming a high level of availability. Note that the required functionalities themselves do not call for elimination of all risk of mishaps. It is scope of risk reduction that the functionalities describe that becomes the 100% universe which is the basis of comparison. Although it is understood that the system will endeavor to eliminate 100% of this risk—meaning that if the system worked as intended every time and was always available, 100% of the target risk would be eliminated—the analysts will need to account for cases where wrong side failure of the technology is coincident with a human failure potentially induced by reliance on the technology. Since, within an appropriate conservative engineering analysis (i.e., pro forma analysis), non-vital processing has the theoretical potential to result in more failures than will typically be experienced, a 20% margin is provided. In preparing the PTCSP, the railroad will want to affirmatively address how training and oversight—including programs of operational testing under 49 CFR 217.9—will reduce the potential for inappropriate reliance by those charged with functioning in accordance with the underlying method of operation.

The 80% reduction in risk for PTC preventable accidents must be demonstrated by an appropriate risk analysis acceptable to the Associate Administrator and must address all intended track segments upon which the system will be installed. Again, FRA does not expect, or require, that these types of systems will prevent all wrong side failures. However, FRA expects that the systems will be designed to be robust, all pertinent risk factors (including human factors) will be fully addressed, and that no corners will be cut to “take advantage” of the nominal allowance provided for non-vital approaches. FRA also encourages those using non-vital approaches to preserve as much as possible the potential for a transition to vital processing.

Proposed paragraph (d)(2) addresses vital overlays. Unlike a non-vital system, the vital system must be designed to address, at a minimum, the factors delineated in Appendix C. The railroad and their vendors are encouraged to carry out a more thorough design analysis addressing any other potential product specific hazards. FRA cannot overemphasize that vital overlay system designs must be fully designed to address the factors contained in Appendix C. The associated risk analysis supporting this design analysis demonstrating compliance may be accomplished using any of the risk analysis approaches in subpart H, including abbreviated risk analysis.

Proposed paragraph (d)(3) addresses stand-alone PTC systems that are used to replace existing methods of operations. The PTCSP design and risk analysis submitted to the Associate Administrator must show that the system does not introduce any new hazards that have not been acceptably mitigated, based upon all proposed changes in railroad operation. The required analysis for standalone systems is much more comprehensive than that required for vital overlay systems, since it must provide sufficient information to the Associate Administrator to make a decision with a high degree of confidence. FRA will uniquely and separately consider each request for standalone operations, and will render decisions in the context of the proposed operation and the associated risks. FRA recognizes that application of this standard to a new rail system for which there is no clear North American antecedent could present a conceptual challenge. FRA invites comments regarding how best to frame the risk assessment showing for a standalone system applied to a new rail operation.

Proposed paragraph (d)(4) addresses mixed systems (i.e., systems that include a combination of the systems identified in paragraphs (d)(1) through (d)(3). Because of the inherent complexity of these systems, FRA will determine an appropriate approach to demonstrating compliance after consultation with the railroad. Any approach will, of course, require that the system perform the PTC requirements as proposed in §§ 236.1005 and 236.1007.

Paragraph (e) discusses proposed factors that the Associate Administrator will consider in reviewing the PTCSP. In general, PTC systems will have some features that are not failsafe in nature. Examples include surveys of the track database, errors in consist data from the railroad such as weight and makeup, and crew input errors. FRA participation in the design and testing of the PTC system product helps FRA to better understand the strengths and weaknesses of the product for which approval is requested, and facilitates the approval process.

The railroad must establish through safety analysis that its assertions are true. This standard places the burden on the railroad to demonstrate that the safety analysis is accurate and sufficiently supports certification of the PTC system. The FRA Associate Administrator will determine whether the railroad's case has been made. As provided in subpart H, FRA believes that final agency determinations under this new subpart I should also be made at the technical level, rather than the policy level, due to the complex and sometimes esoteric subject matters associated with risk analysis and evaluation. This is particularly appropriate in light of the RSIA08's designation of the Associate Administrator for Railroad Safety as the Chief Safety Officer of FRA. When considering the PTC system's compliance with recognized standards in product development, FRA will weigh appropriate factors, including: The use of recognized standards in system design and safety analyses; the acceptable methods in risk estimates; the proven safety records for proposed components; and the overall complexity and novelty of the product design. In those cases where the submission lacks information the Associate Administrator deems necessary to make an informed safety decision, FRA will solicit the data from the railroad. If the railroad does not provide the requested information, FRA may determine that a safety hazard exists. Depending upon the amount and scope of the missing data, PTCSP approval, and the subsequent system certification, may be denied.

While paragraph (e) summarizes how FRA intends to evaluate the risk analysis, proposed paragraph (f) applies specifically to cases where a PTC system has already been installed and the railroad subsequently wants to put in a new PTC system. Paragraph (f) re-emphasizes that FRA policy regarding the safety of PTC systems is not, and cannot expect to be, static. Rather, FRA policy may evolve as railroad operations evolve, operating rules are refined, related hazards are addressed (e.g., broken rails), and other readily available options for risk reduction emerge and become more affordable. FRA embraces the concept of progressive improvement and expects that when new systems are installed to replace existing systems that actual safety outcomes equal or exceed those for the existing systems.

Section 236.1017 Independent Third Party Review of Verification and Validation

As previously noted in the discussion of proposed § 236.1009(e), FRA may require a railroad to engage in an independent assessment of its PTC system. In the event an independent assessment is required, § 236.1017 proposes the applicable rules and procedures.

Proposed paragraph (a) establishes factors considered by FRA when requiring a third-party assessment. FRA will attempt to make a determination of the necessary level of third party assessment as early as possible in the approval process. However, based on issues that may arise during the development and testing processes, or during the detailed technical reviews of the PTCDP and PTCSP, FRA may deem it necessary to require a third party assessment at any time during the review process.

Proposed paragraph (b) is intended to make it clear that it is FRA that will make the determination of the acceptability of the independence of the third party to avoid any potential issues downstream regarding the acceptability of the assessor's independence. If a third party assessment is required, each railroad is encouraged to identify in writing what entity it proposes to utilize as its third party assessor. Compliance with paragraph (b) is not mandatory. However, if FRA determines that the railroad's choice of a third party does not meet the level of independence contemplated under proposed paragraph (c), then the railroad will be obligated to have the assessment repeated, at its expense, until it has been completed by a third party suitable to FRA.

Paragraph (c) proposes a definition of the term “independent third party” as used in this section. It limits independent third parties to those that are compensated by the railroad or an association on behalf of one or more railroads that is independent of the PTC system supplier. FRA believes that requiring the railroad to compensate a third party will heighten the railroad's interest in obtaining a quality analysis and will avoid ambiguous relationships between suppliers and third parties that could indicate possible conflicts of interest.

Proposed paragraph (d) explains that the minimum requirements of a third party audit are outlined in Appendix F (which is modeled on current Appendix D, which is used in conjunction with subpart H) and that FRA has discretion to limit the extent of the third party assessment. FRA intends to limit the scope of the assessment to areas of the safety Verification and Validation as much as possible, within the bounds of FRA's regulatory obligations. This will allow reviewers to focus on areas of greatest safety concern and eliminate any unnecessary expense to the railroad. In order to limit the number of third-party assessments, FRA first strives to inform the railroad as to what portions of a submittal could be amended to avoid the necessity and expense of a third-party assessment altogether. However, FRA wishes to make it clear that Appendix F represents minimum requirements and that, if circumstances warrant, FRA may expand upon the Appendix F requirements as necessary to enable FRA to render a decision that is in the public interest (i.e., if FRA is unable to certify the system without the additional information).

Section 236.1019 Main Line Track Exceptions

The RSIA08 generally defines “main line” as “a segment of railroad tracks over which 5,000,000 or more gross tons of railroad traffic is transported annually.” See 49 U.S.C. 20157(i)(2). However, FRA may also define “main line” by regulation “for intercity rail passenger transportation or commuter rail passenger transportation routes or segments over which limited or no freight railroad operations occur.” See 49 U.S.C. 20157(i)(2)(B); 49 CFR 1.49(oo). FRA recognizes that there may be circumstances where certain statutory PTC system implementation and operation requirements are not practical and provide no significant safety benefits. In those circumstances, FRA proposes to exercise its statutory discretion provided under 49 U.S.C. 20157(i)(2)(B).

In accordance with the authority provided by the statute and with carefully considered recommendations from the RSAC, FRA proposes to consider requests for designation of track over which rail operations are conducted as “other than main line track” for passenger and commuter railroads, or freight railroads operating jointly with passenger or commuter railroads. Such relief may be granted only after request by the railroad or railroads filing a PTCIP and approval by the Associate Administrator.

Paragraph (a), therefore, proposes to require the submittal of a main line track exclusion addendum (MTEA) to any PTCIP filed by a railroad that seeks to have any particular track segment deemed as other than main line. Since the statute only provides for such regulatory flexibility as it applies to passenger transportation routes or segments which limited or no freight railroad operations occur, only a passenger railroad may file an MTEA as part of its PTCIP. This may include a PTCIP jointly filed by freight and passenger railroads. In fact, FRA expects that in the case of joint operations, only one MTEA should be agreed upon and submitted by the railroads filing the PTCIP. After reviewing a submitted MTEA, FRA may provide full or partial approval for the requested exemptions.

Each MTEA must clearly identify and define the physical boundaries, use, and characterization of the trackage for which exclusion is requested. When describing the tracks' use and characterization, FRA expects the requesting railroad or railroads to include copies of the applicable track and signal charts. Ultimately, FRA expects each MTEA to include information sufficiently specific to enable easy segregation between main line track and non-main line track. In the event the railroad subsequently requests additional track to be considered for exclusion, a well-defined MTEA should reduce the amount of future information required to be submitted to FRA. Moreover, if FRA decides to grant only certain requests in an MTEA, the portions of track for which FRA has determined should remain considered as main line track can be easily severed from the MTEA. Otherwise, the entire MTEA, and thus its concomitant PTCIP, may be entirely disapproved by FRA, increasing the risk of the railroad or railroads not meeting its statutory deadline for PTC implementation and operation.

For each particular track segment, the MTEA must also provide a justification for such designation in accordance with paragraphs (b) or (c) of this section.

Proposed paragraph (b) specifically addresses the conditions for relief for passenger and commuter railroads with respect to passenger-only terminal areas. As noted previously in the analysis of § 236.1005(b), FRA proposes to except from the definition of main line any track within a yard used exclusively by freight operations moving at restricted speed. In those situations, operations are usually limited to preparing trains for transportation and do not usually include actual transportation. FRA does not propose to extend this automatic exclusion to yard or terminal tracks that include passenger operations. Such operations may also include the boarding and disembarking of passengers, heightening FRA's sensitivity to safety and blurring the lines between what defines “transportation” and “preparing for transportation.” Moreover, while FRA could not expend its resources to review whether a freight-only yard should be deemed other than main line track, FRA believes that the relatively lower number of passenger yards and terminals would allow for such review. Accordingly, FRA believes that it is appropriate to review these circumstances on a case-by-case basis.

During the PTC Working Group discussions, the major passenger railroads requested an exception for tracks in passenger terminal areas because of the impracticability of installing PTC. These are locations where signal systems govern movements over very complex special track work divided into short signal blocks. Operating speeds are low (not to exceed 20 miles per hour), and locomotive engineers moving in this environment expect conflicting traffic and restrictive signals. Although low-speed collisions do occasionally occur in these environments, the consequences are low; and the rate of occurrence is very low in relation to the exposure. It is the nature of current-generation PTC systems that they work with averages in terms of stopping distance and use conservative braking algorithms. Applying this approach in congested terminals would add to congestion and frustrate efficient passenger service, in the judgment of those who operate these railroads. The density of wayside infrastructure required to effect PTC functions in these terminal areas would also be exceptionally costly in relation to the benefits obtained. FRA agrees that technical solutions to address these concerns are not presently available. FRA does believe that the appropriate role for PTC in this context is to enforce the maximum allowable speed (which is presently accomplished in cab signal territory through use of automatic speed control, a practice which could continue where already in place).

If FRA grants relief, the proposed conditions of (b)(1), (b)(2), or (b)(3), as applicable, must be strictly adhered to. These three conditions represent the minimum conditions FRA believes is necessary for safe operations. FRA reserves the right to add more restrictive conditions if necessary to provide for the safety of the public and train crews. If FRA approves a MTEA and the railroad subsequently violates any of the applicable conditions, civil penalties may apply.

Under paragraph (b)(1), FRA proposes to limit relief under paragraph (b) to operations that do not exceed 20 miles per hour. The PTC Working Group agreed upon the 20 miles per hour limitation, instead of requiring restricted speed, because the operations in question will be by signal indication in congested and complex terminals with short block lengths and numerous turnouts. FRA agrees with the PTC Working Group that the use of restricted speed in this environment would exacerbate congestion, delay trains, and diminish the quality of rail passenger service.

Moreover, when trains on the excluded track are controlled by a locomotive with an operative PTC onboard apparatus, FRA proposes to require that PTC system component to enforce the regulatory speed limit or actual maximum authorized speed, whichever is less. While the actual track may not be outfitted with a PTC system in light of a MTEA approval, FRA believes it would be nevertheless prudent to require such enforcement when the technology is available on the operating locomotives. This can be accomplished in cab signal territory using existing automatic train stop technology and outside of cab signal territory by mapping the terminal and causing the onboard computer to enforce the maximum speed allowed.

Under paragraph (b)(2), FRA proposes to also limit relief under paragraph (b) to operations that enforce interlocking rules. Under interlocking rules, trains are prohibited from moving in reverse directions without dispatcher permission on track where there are no signal indications. FRA believes that such a restriction would minimize the potential for a head-on impact.

Also, under proposed paragraph (b)(3), such operations would only be allowed in yard or terminal areas where no freight operations are permitted. While the definition of main line may not include yard tracks used solely by freight operations, FRA does not propose to extend any relief or exception to tracks within yards or terminals shared by freight and passenger operations. The collision of a passenger train with a freight consist is typically a more severe condition because of the greater mass of the freight equipment.

Paragraph (c) proposes the conditions under which joint limited passenger and freight operations may occur on defined track segments without the requirement for installation of PTC. This paragraph proposes three alternative paths to the main line exception.

First, under paragraph (c)(1), an exception may be available where both the freight and passenger trains are limited to restricted speed. Such operations are feasible only for short distances, and FRA would examine the circumstances involved to ensure that the exposure is limited and that appropriate operating rules and training are in place.

Second, under paragraph (c)(2), FRA will consider an exception where temporal separation of the freight and passenger operations can be ensured. A more complete definition of temporal separation is provided in paragraph (d). Temporal separation of passenger and freight services reduces risk because the likelihood of a collision is reduced (e.g., due to freight cars engaged in switching that are not properly secured) and the possibility of a relatively more severe collision between a passenger train and much heavier freight consist is obviated.

Third, under paragraph (c)(3), FRA will consider commingled freight and passenger operations provided that a jointly agreed risk analysis is provided by the passenger and freight railroads, and the level of safety is the same as that which would be provided under one of the two prior options selected as the base case. FRA seeks comments on whether FRA or the subject railroad should determine the appropriate base case. FRA recognizes that there may be situations where temporal separation may not be possible. In such situations, FRA may allow commingled operations provided the risk to the passenger operation is no greater than if the passenger and freight trains where operating under temporal separation or with all trains limited to restricted speed. For an exception to be made under paragraph (c)(3), FRA requires a risk analysis jointly agreed to and submitted by the applicable freight and passenger services. This ensures that the risks and consequences to both parties have been fully analyzed, understood, and mitigated to the extent practical.

Paragraph (d) proposes the definition of temporal separation with respect to paragraph (c)(2). The temporal separation approach is currently used under the FRA-Federal Transit Administration Joint Policy on Shared Use, which permits co-existence of light rail passenger services (during the day) and local freight service (during the nighttime). See Joint Statement of Agency Policy Concerning Shared Use of the Tracks of the General Railroad System by Conventional Railroads and Light Rail Transit Systems, 65 FR. 42,526 (July 10, 2000); FRA Statement of Agency Policy Concerning Jurisdiction Over the Safety of Railroad Passenger Operations and Waivers Related to Shared Use of the Tracks of the General Railroad System by Light Rail and Conventional Equipment, 65 FR 42529 (July 10, 2000). Conventional rail technology and secure procedures are used to ensure that these services do not commingle. Amtrak representatives in the PTC Working Group were confident that more refined temporal separation strategies could be employed on smaller railroads that carry light freight volumes and few Amtrak trains (e.g., one train per day or one train per day in each direction). The Passenger Task Force agreed.

Proposed paragraph (e) ensures that by the time the railroad submits its PTCSP, it has made no unapproved changes to the MTEA and that the PTC system, as implemented, reflects the PTCIP and its MTEA. Under the proposed rule, the PTCSP shall reflect the PTCIP, including its MTEA, as it was approved or how it has been modified in accordance with proposed § 236.1021. FRA believes that it is also important that the railroad attest that no other changes to the documents or to the PTC system, as implemented, have been made.

FRA understands that as a railroad implements its PTC system in accordance with its PTCIP or even after it receives PTC System Certification, the railroad may decide to modify the scope of which tracks it believes to be other than main line. To effectuate such changes, paragraph (f) proposes to require FRA review. In the case that the railroad believes that such relief is warranted, the railroad may file in accordance with proposed § 236.1021 a request for amendment of the PTCIP, which will eventually be incorporated into the PTCSP upon PTCSP submission. Each request, however, must be fully justified to and approved by the Associate Administrator before the requested change can be made to the PTCIP. If such a RFA is submitted simultaneously with the PTCSP, the RFA may not be approved, even if the PTCSP is otherwise acceptable. A change made to a MTEA subsequent to FRA approval of its associated PTCIP that involves removal or reduction in functionality of the PTC system is treated as a material modification. In keeping with traditional signaling principles, such requests must be formally submitted for review and approval by FRA.

Section 236.1021 Discontinuances, Material Modifications, and Amendments

FRA recognizes that after submittal of a plan or implementation of a train control system, the subject railroad may have legitimate reasons for making changes in the system design and the locations where the system is installed. In light of the statutory and regulatory mandates, however, FRA believes that the railroad should be required to request FRA approval prior to effectuating certain changes. Section 236.1021 proposes the scope and procedure for requesting and approving those changes. For example, all requests for covered changes must be made in a request for amendment (RFA) of the subject PTC system or plan. While § 236.1021 includes lengthy descriptions of what changes may, or may not, require FRA approval, there are various places elsewhere in subpart I that also require the filing of a RFA.

Under paragraph (a), FRA proposes to require FRA approval prior to certain PTC system changes. FRA expects that if a railroad wants to make a PTC system change covered by subpart I, then any such change would result in noncompliance with one of the railroad's plans approved under this subpart. For instance, if a railroad seeks to modify the geographical limits of its PTC implementation, such changes would not be reflected in the PTCIP. Accordingly, under paragraph (a), after a plan is approved by FRA and before any change is made to the PTC system's development, implementation, or operation, FRA proposes that the railroad file a RFA to the subject plan.

FRA considers an amendment to be a formal or official change made to the PTC system or its associated PTCIP, PTCDP, or PTCSP. Amendments can add, remove, or update parts of these documents, which may reflect proposed changes to the development, implementation, or operation of its PTC system. FRA believes that an amending procedure provides a simpler and cleaner option than requiring the railroad to file an entirely new plan.

While the railroad may develop a RFA without FRA input or involvement, FRA believes that it is more advantageous for the railroad to informally confer with FRA before formally submitting its RFA. If FRA is not involved in the drafting process, FRA may not have a complete understanding of the system, making it difficult for FRA to evaluate the impact of the proposed changes on public safety. After RFA submission, all applicable correspondence between FRA and the railroad must be made formally in the associated docket, as further discussed below. In such a situation, FRA's review may take a significantly longer time than usual. If FRA continues to not understand the impact, it may request a third party audit, which would only further delay a decision on the request. Accordingly, FRA believes it is more advantageous for the railroad drafting an RFA to informally confer with FRA before its formal submission of the change request. The railroad would then be provided an opportunity to discuss the details of the change and to assure FRA's understanding of what the railroad wishes to change and of the change's potential impact.

Paragraph (b) proposes a mechanism for requesting such change. Once the RFA is approved, the railroad may—and, in fact, is required under paragraph (b)—to adopt those changes into the subject plan and immediately ensure that its PTC complies with the plan, as amended. FRA expects that each PTC system accurately reflects the information in its associated approved plans. FRA believes that this requirement will also incentivize railroads to make approved changes as quickly as possible. Otherwise, if a railroad delays in implementing the changes reflected in an approved RFA, FRA may find it difficult to enforce its regulations until implementation is completed, since they plans and PTC system to not accurately and adequately reflect each other. In such circumstances, railroads may be assessed a civil penalty for violating its plan or for falsifying records.

Any change to a PTCIP, PTCDP, or PTCSP, which may include removal or discontinuance of any signal system, may not take effect until after FRA has approved the corresponding submitted or amended PTCIP, PTCDP, or PTCSP. FRA may provide partial or conditional approval. Until FRA has granted appropriate relief or approval, the railroad may not make the change, and once a requested change has been made, the railroad must comply with requested change.

FRA recognizes that a railroad may wish to remove an existing train control system due to new and appropriate PTC system implementation. For train control systems existing prior to promulgation of subpart I, any request for a material modification or discontinuance must be made pursuant to part 235. FRA proposes in paragraph (c), however, to provide the railroads with an opportunity to instead request such changes in accordance with proposed § 236.1021. FRA believes that this proposal would reduce the number of required filings and would otherwise simplify the process requesting material modifications or discontinuances.

Paragraph (d) proposes the minimum information required to be submitted to FRA when requesting an amendment. While FRA proposes to promulgate procedural rules here different than those in part 235, FRA expects that the same or similar information be provided. Accordingly, under paragraph (d)(1), the RFA must contain the information required in 235.10. Paragraph (d)(1) also requires the railroad to submit, upon FRA request, certain additional information, including the information referenced in § 235.12. Paragraphs (d)(2) through (d)(7) provide further examples of such information. While such information may only be required upon request, FRA urges each railroad to include this information in its RFA to help expedite the review process.

FRA believes that proposed paragraphs (d)(2) through (d)(6) are self-explanatory. However, according to proposed paragraph (d)(7), FRA may require with each RFA an explanation of whether each change to the PTCSP is planned or unplanned. Planned changes are those that the system developer and the railroad have included in the safety analysis associated with the PTC system, but have not yet implemented. These changes provide enhanced functionality to the system, and FRA strongly encourages railroads to include PTC system improvements that further increase safety. A planned change may require FRA approved regression testing to demonstrate that its implementation has not had an adverse affect on the system it is augmenting. Each planned change must be clearly identified as part of the PTCSP, and the PTCSP safety analysis must show the affect that its implementation will have on safety.

Unplanned changes are those either not foreseen by the railroad or developer, but nevertheless necessary to ensure system safety, or are unplanned functional enhancements from the original core system. The scope of any additional necessary work necessary to ensure safety may depend upon when in the development cycle phase the changes are introduced. For instance, if the PTCDP has not yet been submitted to FRA, no FRA involvement is required. However if the PTCDP has been submitted to FRA, or if the change impacts the safety functionality of the system once a Type Approval has been issued, and a PTCSP has not yet submitted, the railroad must submit a RFA requesting and documenting that change. Once FRA approves that RFA, FRA expects the subsequently filed PTCSP to account for the change in analysis.

If the change is made after approval of the PTCSP and the system has been certified by FRA, a RFA must be submitted to FRA for approval. Because this requires significant effort by FRA and the railroad, FRA expects that every effort will be made to eliminate the need for unplanned changes. If the railroad and the vendor submit unplanned safety related changes that FRA believes are a significant amount or inordinately complex, FRA may revoke any approvals previously granted and disallow the use of the product until such time the railroad demonstrates the product is sufficiently mature.

Paragraph (e) proposes that if a RFA is submitted for a discontinuance or a material modification to a portion or all of its PTC system, a notice of its submission shall be published in the Federal Register. Interested parties will be provided an opportunity to comment on the RFA, which will be located in an identified docket.

Proposed paragraph (f) makes it clear that FRA will consider all impacts on public safety prior to approval or disapproval of any request for discontinuance, modification, or amendment of a PTC system and any associated changes in the existing signal system that may have been concurrently submitted. While the economic impact to the affected parties may be considered by the FRA, the primary and final deciding factor on any FRA decision is safety. FRA will consider not only how safety is affected by installation of the system, but how safety is impacted by the failure modes of the system.

The purpose of proposed paragraph (g) is to emphasize the right of FRA to unilaterally issue a new Type Approval, with whatever conditions are necessary to ensure safety based on the impact of the proposed changes.

In proposed paragraph (h), FRA makes clear that it considers any implemented PTC system to be a safety device. Accordingly, the discontinuance, modification, or other change of the implemented system or its geographical limits will not be authorized without prior FRA approval. While this requirement primarily applies to safety critical changes, FRA believes that they should also apply to all changes that will affect interoperability. FRA seeks comments on this issue. The principles expressed in the paragraph parallel those embodied in part 235, which implements 49 U.S.C. 20502(a).

That said, FRA recognizes that there are a limited number of situations where changes of the PTC system may not have an adverse impact upon public safety. Specific situations where prior FRA approval is required are proposed in paragraphs (h)(1) through (h)(4).

Paragraph (i) proposes the exceptions from the requirement for prior approval in cases where the discontinuance of a system or system element will be treated as pre-approved, as when a line of railroad is abandoned.

Paragraph (j) proposes exceptions for certain lesser changes that are not expected to materially affect system risk, such as removal of an electric lock from a switch where speed is low and trains are not allowed to clear.

Paragraph (k) proposes additional exceptions consisting of modifications associated with changes in the track structure or temporary construction. FRA notes that only temporary removal of the PTC system without prior FRA approval is allowed to support highway rail separation construction or damage to the PTC system by catastrophic events. In both cases, the PTC system must be restored to operation no later than 6 months after completion of the event.

Section 236.1023 Errors and Malfunctions

Because PTC systems are approved, in part, based on certain assumptions regarding expected failure modes and frequencies, reporting and recording of errors and malfunctions takes on critical importance. If the number of errors and malfunctions exceeds those originally anticipated in the design, or errors and malfunctions that were not predicted are observed to occur, the validity of the risk analysis becomes suspect. Since not all railroads may experience the same software faults or hardware failures, the developer's development, configuration management, and fault reporting tracking system play a crucial role in the ability of the railroad and FRA to determine and fully understand the risks and their implications. Without an effective configuration management tracking system in place, it is difficult, if not impossible, to fairly evaluate PTC system risks during the system's life cycle.

In the event of a safety-essential PTC system component failing to perform as intended, FRA intends to propose under § 236.1023 that the cause be identified and corrective action be taken without undue delay. Until the repair is completed, the railroad and vendors are required to take appropriate measures to assure the safety of train movements, roadway workers, and on-track equipment. This requirement mirrors the current requirements of 49 CFR 236.11, which applies to all signal system components. FRA recognizes that there may be situations where reducing the severity of such hazards will suffice for an equivalent reduction in risk. For example, a reduction in operating speeds may not reduce the frequency of certain hazards involving safety-critical products, but it may reduce the severity of such hazards in most cases.

Paragraph (a) proposes a direct obligation on suppliers to report safety-relevant failures, including “wrong-side” failures and other failures significantly impacting availability, where the PTCSP indicates availability to be a material issue in the safety performance of the larger railroad system. FRA expects each applicable supplier to identify the problem and the necessary corrective actions, recommended risk mitigations, and provide an estimated amount of time it expects to complete the corrective actions. FRA believes that it should be informed to ensure public safety in any case where a commercial dispute (e.g., over liability) might disrupt communication between a railroad and supplier.

Paragraph (b) proposes a similar responsibility on the part of the railroad to report safety relevant failures to the supplier and FRA, and to keep the vendor and FRA apprised of any subsequent failures. To aid FRA in understanding the scope of a problem on a railroad, and to aid the railroad in communicating any PTC system failures to the appropriate vendor, paragraph (c) proposes to require that each railroad keep a currently updated PTC Product Vendor List (PTCVPL), which must identify each supplier of PTC equipment on its railroad.

Paragraph (d) proposes the requirement that each railroad identify the procedures for action upon notification from the manufacturer of a safety-critical upgrade, patch, or revision performed within the scope of the applicable PTCDP. FRA expects that when issues are discovered that may adversely affect the safe operation of the system, regardless if the railroad has experienced the problem, the railroad will take corrective action without undue delay (see § 236.11). FRA believes this is necessary to ensure that each railroad promptly addresses applicable errors to maintain a common safety baseline by performing component changes that, if left uncorrected, would increase risk or interfere with the safety of train operations. If the action were to take a significant amount of time, FRA proposes to require the railroad to provide FRA with periodic frequent progress reports.

Paragraph (e) proposes time limits for reporting failures and malfunctions and the minimum reporting requirements. FRA has no specific format for the reports, and will accept any format provided it contains at least the information required by this proposed rule. FRA will accept delivery of these reports by commercial courier, fax, and e-mail.

Paragraph (f) proposes to require the manufacturer to provide a detailed explanation of the problem and the intended or performed corrective action to FRA upon request, in the event that a PTC system is found to be unsafe due to a design or manufacturing defect. While the railroad may be able to report symptoms of a problem, it is the manufacturer who is in the best position to determine its underlying root cause. FRA may require this information to determine the full impact of the problem, and to determine if any additional restrictions or limitations on the use of the PTC may be warranted to ensure the safety of the general public and the railroad personnel.

Proposed paragraph (g) is intended to limit unnecessary reporting. If the failure was the result of improper operation of the PTC system outside of the design parameters or of non-compliance with the applicable operating instructions, FRA believes that compliance with paragraph (f) is not necessary. Instead, FRA expects, and proposes to require, the railroad to engage in more narrow remedial measures, including remedial training by the railroad in the proper operation of the PTC system. Similarly, once a problem has been identified to all stakeholders, FRA does not believe it is necessary for a manufacturer to repeatedly submit a formal report in accordance with paragraph (f). In either situation, however, FRA expects that all users of the equipment are proactively and timely notified of the misuse that occurred and the corrective actions taken.

Such reports, however, do not have to be made within seven days of occurrence, as required for other notifications under paragraph (e), but within a reasonable time appropriate to the nature and extent of the problem.

Proposed paragraph (h) is intended to make clear that the reporting requirements of part 233 are not a substitute for the proposed reporting requirements of this subpart. Both requirements apply. In the case of a false proceed signal indication, FRA would not expect the railroad to wait for the frequency of such occurrences to exceed the threshold reporting level assigned in the hazard log of the PTCSP. Rather, current § 233.7 requires all such instances to be reported.

Section 236.1027 Exclusions

This section retains similarities to, but also establishes contrasts with, § 236.911, which deals with exclusions from subpart H. In particular, § 236.911(c) offers reassurance that a stand-alone computer aided dispatching (CAD) system would not be considered a safety-critical processor-based system within the purview of subpart H. CADs have long been used by large and small railroads to assist dispatchers in managing their workload, tracking information required to be kept by regulation, and—most importantly—providing a conflict checking function designed to alert dispatchers to incipient errors before authorities are delivered. Even § 236.911, however, states that “a subsystem or component of an office system must comply with the requirements of this subpart if it performs safety-critical functions within, or affects the safety performance of, a new or next-generation train control system.” In fact, FRA is currently working with a vendor on a simple CAD that provides authorities in an automated fashion, without the direct involvement of a dispatcher.

For subpart I, FRA wishes to retain the exception referred to in § 236.911 for CAD systems not associated with a PTC system. Many smaller railroads use CAD systems to good effect, and there is no reason to impose additional regulations where dispatchers contemporaneously retain the function of issuing mandatory directives. However, in the present context, it is necessary to recognize that PTC systems utilize CAD systems as the “front end” of the logic chain that defines authorities enforced by the PTC system, particularly in non-signaled territory.

Accordingly, paragraph (a) proposes the potential exclusion of certain office systems technologies from subpart I compliance. These existing systems have been implemented voluntarily to enhance productivity and have proven to provide a reasonably high level of safety, reliability, and functionality. FRA recognizes that full application of subpart I to these systems would present the rail industry with a tremendous burden. The burdens of subpart I may discourage voluntary PTC implementation and operation by the smaller railroads.

However, FRA proposes to apply subpart I to those subsystems or components that perform safety critical functions or affect the safety performance of the associated PTC system. The level and extent of safety analysis and review of the office systems will vary depending upon the type of PTC system with which the office system interfaces. For example, to prevent the issuance of overlapping and inconsistent authorities, FRA expects that each PTC system demonstrate sufficient credible evidence that the requisite safety-critical, conflict resolution (although not necessarily vital) hardware and software functions of the system will work as intended. FRA also expects that the applicable PTCDP's and PTCSP's risk analysis will identify the associated hazards and describe how they have been mitigated. Particularly where mandatory directives and work authorities are evaluated for use in a PTC system use without separate oral transmission from the dispatcher to the train crew or employee in charge—with the opportunity for receiving personnel to evaluate and confirm the integrity of the directive or authority received and the potential for others overhearing the transmission to note conflicting actions by the dispatching center—FRA will insist on explanations sufficient to provide reasonable confidence that additional errors will not be introduced.

Paragraph (b) proposes requirements for modifications of excluded PTC systems. At some point when a change results in degradation of safety or in a material increase in safety-critical functionality, changes to excluded PTC systems or subsystems may be significant enough to require application of subpart I's safety assurance processes. FRA believes that all modifications caused by unforeseen implementation factors will not necessarily cause the product to become subject to subpart I. These types of implementation modifications will be minor in nature and be the result of site specific physical constraints. However, FRA expects that implementation modifications that will result in a degradation of safety or a material increase in safety-critical functionality, such as a change in executive software, will cause the PTC system or subsystem to be subject to subpart I and its requirements. FRA is concerned, however, that a series of incremental changes, while each individually not meeting the threshold for compliance with this subpart, may when aggregated result in a product which differs sufficiently so as to be considered a new product. Therefore, FRA reserves the right to require products that have been incrementally changed in this manner to comply with the requirements of this subpart. Prior to FRA making such a determination, the affected railroad will be allowed to present detailed technical evidence why such a determination should not be made. This provision mirrors paragraph (d) of existing § 236.911.

Proposed paragraph (c) addresses the integration of train control systems with other locomotive electronic control systems. The earliest train control systems were electro-mechanical systems that were independent of the discrete pneumatic and mechanical control systems used by the locomotive engineer for normal throttle and braking functions. Examples of these train control systems included cab signals and ACS/ATC appliances. These systems included a separate antenna for interfacing with the track circuit or inductive devices on the wayside. Their power supply and control logic were separate from other locomotive functions, and the cab signals were displayed from a separate special-purpose unit. Penalty brake applications by the train control system bypassed the locomotive pneumatic and mechanical control systems to directly operate a valve that accomplished a service reduction of brake pipe pressure and application of the brakes as well as reduction in locomotive tractive power. In keeping with this physical and functional separation, train control equipment on board a locomotive came under part 236, rather than the locomotive inspection requirements of part 229.

Advances in hardware and software technology have allowed the various PTC systems' and components' original equipment manufacturers (OEMs) to repackage individual components, eliminating parts and system function control points access. Access to control functions became increasingly restricted to the processor interfaces using proprietary software. While this resulted in significant simplification of the previously complex discrete pneumatic and mechanical control train and locomotive control systems into fewer, more compact and reliable devices, it also creates significant challenges with respect to compatibility of the application programs and configuration management.

FRA encourages such enhancements, and believes, if properly done, can result in significant safety, as well as operational, improvements. Locomotive manufacturers can certainly provide secure locomotive and train controls, and it is important that they do so if locomotives are to function safely in their normal service environment. FRA highly encourages the long-term goal of common platform integration. However, when such an integration occurs, it must not be done at the expense of decreasing the safe, and reliable operation of the train control system. Accordingly FRA expects that the complete integrated system will be shown to have been designed to fail-safe principles, and then demonstrated that the system operates in a fail safe mode. Any commingled system must have a manual failsafe fall back up that allows the engineer to be brought to a safe stop in the event of an electronic system failure. This analysis must be provided to FRA for approval in the PTCDP and PTCSP as appropriate. This provision mirrors the heightened scrutiny called for by § 236.913(c) of subpart H for commingled systems, but is more explicit with respect to FRA's expectations. The provision in general accords with the requirements for locomotive systems that are currently under development in the RSAC's Locomotive Safety Standards Working Group.

Finally proposed paragraph (d) clarifies the application of subparts A through H to products excluded from compliance with Subpart I. These products are excluded from the requirements of subpart I, but FRA expects that the developing activity demonstrates compliance of products with Subparts A through H. FRA believes that railroads not mandated to implement PTC, or that are implementing other non-PTC related processor based products should be given the option to have those products approved under subpart H by submitting a PSP and otherwise complying with subpart H or voluntarily complying with subpart I. This provision mirrors § 236.911(e) of subpart H.

Section 236.1029 PTC System Use and En Route Failures

This section proposes minimum requirements, in addition to those found in the PTC system's plans, for each PTC system with a PTC System Certification. Railroads are allowed, and encouraged, to adopt more restrictive rules that increase safety.

Paragraph (a) proposes to require that, in the event of the failure of a component essential to the safety of a PTC system to perform as intended, the cause be identified and corrective action taken without undue delay. The paragraph also requires that until the corrective action is completed, the railroad is required at a minimum, to take the appropriate measures, including those specified in the PTCSP, to assure the safety of train movements, roadway workers, and on-track equipment. This proposed requirement mirrors current requirements of § 236.11, which applies to all signal and train control system components. Under proposed paragraph (a), FRA intends to apply to PTC systems provided PTC System Certification under subpart I the same standard in current § 236.11.

Paragraph (b) proposes the circumstance where a PTC onboard apparatus on a lead locomotive that is operating in or is to be operated within a PTC system fails or is otherwise cut-out while en route. Under proposed paragraph (b), the subject train may only continue such operations in accordance with specific limitations. An en route failure is applicable only in instances after the subject train has departed its initial terminal, having had a successful initialization, and subsequently rendering it no longer responsive to the PTC system. For example, FRA believes that an en route failure may occur when the PTC onboard apparatus incurs an onboard fault or is otherwise cut out.

Under subpart H, existing § 236.567 provides specific limitations on each train failing en route in relation to its applicable automatic cab signal, train stop, and train control system. FRA believes that it would be desirable to impose somewhat more restrictive conditions given the statutory mandate and the desire to have an appropriate incentive to properly maintain the equipment and to timely respond to en route failures. For instance, FRA recognizes that the limitations of § 236.567 do not account for the statutory mandates of the core PTC safety functions. However, during the PTC Working Group meetings, no consensus was reached on how to regulate en route failures on PTC territory. Nevertheless, proposed § 236.1029, and in particular proposed paragraph (b), purposefully intend to parallel the limitations contained in § 236.567. In other words, FRA intends that § 236.567 and proposed paragraph (b) to § 236.1029 will share the common purpose of maintaining a level of safety generally in accord with that expected with the train control system fully functional. This is accomplished by requiring supplementary procedures to heighten awareness and provide operational control (limiting the frequency of unsafe events) and by restricting the speed of the failed train (reducing the potential severity of any unsafe event).

Paragraph (b)(1) proposes to allow the subject train to proceed at restricted speed—or at medium speed if a block signal system is in operation according to signal indication—to the next available point where communication of a report can be made to a designated railroad officer of the host railroad. The intent of this requirement is to ensure that the occurrence of an en route failure may be appropriately recorded and that the necessary alternative protection of absolute block is established.

After a report is made in accordance with paragraph (b)(1), or made electronically and immediately by the PTC system itself, paragraph (b)(2) proposes to allow the train to continue to a point where an absolute block can be established in advance of the train in accordance with the limitations that follow in paragraphs (b)(2)(i) and (ii). Paragraph (b)(2)(i) proposes to require that where no block signal system is in use, the train may proceed at restricted speed. Alternatively, under proposed paragraph (b)(2)(ii), the train may proceed at a speed not to exceed medium speed where a block signal system is in operation according to signal indication.

Paragraph (b)(3) proposes to require that, upon the subject train reaching the location where an absolute block has been established in advance of the train, the train may proceed in accordance with the limitations that follow in paragraphs (b)(3)(i), (ii), or (iii). Proposed paragraph (b)(3)(i) requires that where no block signal system is in use, the train may proceed at medium speed; however, if the involved train is a train which is that of the criteria requiring the PTC system installation (i.e., a passenger train or a train hauling any amount of PIH material), it may only proceed at a speed not to exceed 30 miles per hour. Paragraph (b)(3)(ii) requires that where a block signal system is in use, a passenger train may proceed at a speed not to exceed 59 miles per hour and a freight train may proceed at a speed not to exceed 49 miles per hour. Paragraph (b)(3)(iii) requires that except as provided in paragraph (c), where a cab signal system with an automatic train control system is in operation, the train may proceed at a speed not to exceed 79 miles per hour.

Paragraph (c) requires that, in order for a PTC train that operates at a speed above 90 miles per hour to deviate from the operating limitations contained in paragraph (b) of this section, the deviation must be described and justified in the FRA approved PTCDP or PTCSP, or the Order of Particular Applicability, as applicable.

Paragraph (d) proposes to require that the railroad operate its PTC system within the design and operational parameters specified in the PTCDP and PTCSP. Railroads will not exceed maximum volumes, speeds, or any other parameter provided for in the PTCDP or PTCSP. On the other hand, a PTCDP or PTCSP could be based upon speed or volume parameters that are broader than the intended initial application, so long as the full range of sensitivity analyses is included in the supporting risk assessment. FRA feels this requirement will help ensure that comprehensive product risk assessments are performed before products are implemented.

Paragraph (e) sets forth the requirement that any testing of the PTC system must not interfere with its normal safety-critical functioning, unless an exception is obtained pursuant to 49 CFR 236.1035, where special conditions have been established to protect the safety of the public and the train crew. Otherwise, paragraph (e) requires that each railroad ensure that the integrity of the PTC system not be compromised, by prohibiting the normal functioning of such system to be interfered with by testing or otherwise without first taking measures to provide for the safety of train movements, roadway workers, and on-track equipment that depend on the normal safety-critical functioning of the system. This provision parallels current § 236.4, which applies to all systems. By requiring this paragraph, FRA also intends to clarify that the standard in current § 236.4 also applies to subpart I PTC systems.

Paragraph (f) proposes to require that each member of the operating crew has appropriate access to the information and functions necessary to perform his or her job safely when products are implemented and used in revenue service. Where two-person crews are employed, availability of a screen and any needed function keys will enable the second crew person to carry out PTC onboard computer-related activities without distracting the locomotive engineer from maintaining situational awareness of activities outside the locomotive cab. FRA's existing regulations for train control in § 236.515 requires that the cab signal display be clearly visible to each member of the crew. FRA believes the decision to operate with one PTC screen, only accessible to the engineer, can only be made after careful analysis of the human factor implications, the associated risks, and the sensitivity of the safety analysis that is used to potentially justify the decision. FRA notes that the principles of crew resource management and current crew briefing practices in the railroad industry require that all members of a functioning team (e.g., engineer, conductor, dispatcher, roadway worker in charge) have all relevant information available to facilitate constructive interactions and permit incipient errors to be caught and corrected. Retaining and reinforcing this level of cooperation will be particularly crucial during the early PTC implementation as errors in train consist information, errors generated in on-board processing, delays in delivery of safety warnings due to radio frequency congestion, and occasional errors in dispatching challenge the integrity of PTC systems even as the normal reliability of day-to-day functioning supports reductions in vigilance. Loss of crew cooperation could easily spill over to other functions, including switching operations and management of emergency situations.

This issue was the subject of significant disagreement within the PTC Working Group. FRA appreciates the views of those who suggest that the cost of additional displays is not warranted and the argument that, where there is an additional crew member assigned, no value may be added by isolating the second crew member from potentially corrupted information communicated from the PTC display. However, FRA believes that there is a strong likelihood that railroads will at some point in the future seek to deliver electronically all mandatory directives from the dispatcher to the PTC onboard apparatus, obviating the need for oral transmission. When this occurs, FRA believes that having a second crew member involved in receipt and confirmation of the authority will be useful to verify situational appropriateness and avoid information overload of the locomotive engineer.

Section 236.1031 Previously Approved PTC Systems

FRA recognizes that substantial effort has been voluntarily undertaken by the railroads to develop, test, and deploy PTC systems prior to the passage of the RSIA08, and that some of the PTC systems have accumulated a significant history of safe and reliable operations. In order to facilitate the ability of the railroads to leverage the results of PTC design, development, and implementation efforts that have been previously been approved or recognized by FRA prior to the adoption of this subpart, FRA is proposing an expedited certification process in this section.

Under proposed paragraph (a), each railroad that has a PTC system that may qualify for expedited treatment would have to submit a Request for Expedited Certification (REC) letter. Products that have not received approval under the subpart H, or that have not been previously recognized by FRA, would be ineligible. The REC letter may be jointly submitted by PTC railroads and suppliers as long as there is at least one PTC railroad. A PTC system may qualify for expedited certification if it fulfills at least one of the descriptions proposed in paragraphs (a)(1) through (a)(3). While these descriptions are objective in nature, FRA intends them to cover ETMS, ITCS, and ACSES, respectively.

Proposed paragraph (a)(1) applies to systems that have been recognized or approved by FRA after submission of a product safety plan (PSP) in accordance with subpart H. Subpart I generally reflects the same criteria required for a PSP under subpart H. Thus, FRA believes that most of the PTCDP and PTCSP requirements in subpart I can be fulfilled with the submission of the existing and approved PSP. However, FRA notes that the subject railroad will also need to submit the information required in a PTCDP and PTCSP that is not in the current PSP.

FRA also recognizes that certain PTC systems may currently operate in revenue service with FRA approval through the issuance of a waiver or order. Proposed paragraphs (a)(2) and (a)(3) intend to cover those systems.

If a PTC system complying with paragraph (a)(1) is provided expedited certification, the system plans should ultimately match the criteria required for each PTCDP and PTCSP. As previously noted, a railroad may seek to use a PTC system that has already received a Type Approval. To extend this benefit as it applies to previously used systems for which expedited certification is provided, paragraph (b) proposes to give the Associate Administrator the ability to provide a Type Approval to systems receiving expedited certification in accordance with paragraph (a)(1).

FRA recognizes that certain systems eligible for expedited certification may not entirely comply with the subsequently issued statutory mandate. Accordingly, under paragraph (c), FRA is compelled to propose that before any Type Approval or expedited certification may be provided, the PTC system must be shown to reliably execute the same functionalities of every other PTC system required by subpart I. Nothing in this abbreviated process should be construed as implying the automatic granting by FRA of a Type Approval or PTC System Certification. Each expedited request for a Type Approval or PTC System Certification must be submitted by the railroad under this abbreviated process and, as required under subpart I, must demonstrate that the system reliably enforces positive train separation and prevents overspeed derailments, incursions into roadway worker zones, and movements through misaligned switches.

Under proposed paragraph (d), FRA encourages railroads, to the maximum extent possible, to use proven service history data to support their requests for Type Approval and PTC System Certification. While proven service history cannot be considered a complete replacement for an engineering analysis of the risks and mitigations associated with a PTC product, it provides great creditability for the accuracy of the engineering analysis. Testing and operation can only show the absence or mitigation of a particular failure mode, and FRA believes that there will always be some failure modes that may only be determined through analysis. Due to this inherent limitation associated with testing and operation, FRA also strongly encourages the railroads to also submit any available analysis or information.

Paragraph (e) proposes that, to the extent that the PTC system proposed for implementation under this subpart is different in significant detail from the system previously approved or recognized, the changes shall be fully analyzed in the PTCDP or PTCSP as would be the case absent prior approval or recognition. FRA understands that the PTC product for which expedited Type Approval and PTC System Certification is sought may differ in terms of functionality or implementation from the PTC product previously approved or recognized by FRA. In such a case, the service history and analysis may not align directly with the new variant of the product. Similarly, the available service history and analysis associated with a PTC product may be inconclusive about the reliability of a particular function. It is because of these possible situations that FRA can not unequivocally promise that all requests for expedited Type Approval and PTC System Certification submitted by a railroad under this subpart will be automatically granted. FRA will, however, apply the available service history and analytical data as credible evidence to the maximum extent possible. FRA believes that this still greatly simplifies each railroad's task in making its safety case, since the additional testing and analysis required need only address those areas for which credible evidence is insufficient. To reduce the overall level of financial resources and effort necessary to obtain sufficient credible evidence to support the claims being made for the safety performance of the product, FRA also encourages each railroad to share with other railroads a system's service history and the results of any analysis, even in the case where the shared information does not fully support a particular railroad's safety analysis.

Proposed paragraph (f) defines terms used only in this section. “Approved” refers to approval of a Product Safety Plan under subpart H. As this NPRM was being prepared, only BNSF Railway's ETMS Configuration I had been so approved, but other systems were under development. “Recognized” refers to official action permitting a system to be implemented for control of train operations under an order or waiver, after review of safety case documentation for the implementation. As this NPRM was being prepared, only ACSES I had been recognized under an order of particular applicability, and ACSES II was under review for potential approval. Only one system, the ITCS in place on Amtrak's Michigan line, had been approved for unrestricted revenue service under waiver.

FRA was unable to fashion an outright “grandfathering” of equipment previously used in transit and foreign service. FRA does not have the same degree of direct access to the service history of these systems. Transit systems—except those that are connected to the general railroad system—are not directly regulated by FRA. FRA has had limited positive experience eliciting safety documentation from foreign authorities, particularly given the influence of national industrial policies.

However, FRA believes that, while complete exclusion may not be available in those circumstances, procedural simplification may be possible. FRA is considering a procedure under which the railroad and supplier could establish safety performance at the highest level of analysis for the particular product, relying in part on experience in the other service environments and showing why similar performance should be expected in the U.S. environment. Foreign signal suppliers should be in a good position to marshal service histories for these products and present them as part of the railroad's PTCSP. For any change, the applicant must provide additional information that will enable FRA to make an informed decision regarding the potential impact of the change on safety. This information must include, but is not limited to, the following: (1) A detailed description of the change; (2) a detailed description of the hardware and software impacted by the change; (3) a detailed description of any new functional data flows resulting from the change; (4) the results of the analysis used to verify that the change did not introduce any new safety risks or, if the change did introduce any new safety risks, a detailed description of the new safety risks and the associated risk mitigation actions taken; (5) the results of the tests used to verify and validate the correct functionality of the product after the change has been made; (6) a detailed description of any required modifications in the railroad training plan that are necessary for continued safe operation of the product after the change; and (7) a detailed description of any new test equipment and maintenance procedures required for the continued safe operation of the product. FRA requests comment on whether and in what way these concepts might be captured in the final rule.

In the same vein, paragraph (g) encourages re-use of safety case documentation previously reviewed, whether under subpart H or subpart I.

Section 236.1033 Communications and Security Requirements

Subpart I proposes specific communications security requirements for PTC system messages. Proposed § 236.1033 originated from the radio and communications task force within the PTC Working Group. The objectives of the proposal are to ensure data integrity and authentication for communications with and within a PTC system.

In data communications, “cleartext” is a message or data in a form that is immediately comprehensible to a human being without additional processing. In particular, it implies that this message is transferred or stored without cryptographic protection. It is related to, but not entirely equivalent to, the term “plaintext.” Formally, plaintext is information that is fed as an input to a cryptographic process, while “ciphertext” is what comes out of that process. Plaintext might be compressed, encrypted, or otherwise manipulated before the cryptographic process is applied, so it is quite common to find plaintext that is not cleartext. Cleartext material is sometimes in plain text form, meaning a sequence of characters without formatting, but this is not strictly required. The security requirements proposed in this document are consistent with the Department of Homeland Security (DHS) guidance for SCADA systems and the National Institute of Standards and Technology guidance. FRA has coordinated this proposal with DHS.

Proposed paragraph (a) establishes the requirement for message integrity and authentication. Integrity is the assurance that data is consistent and correct. Generally speaking, in cryptography and information security, integrity refers to the validity of data. Integrity can be compromised through malicious altering—such as an attacker altering an account number in a bank transaction, or forgery of an identity document—or accidental altering—such as a transmission error, or a hard disk crash. A level of data integrity can be achieved by mechanisms such as parity bits and Cyclic Redundancy Codes (CRCs). Such techniques, however, are designed only to detect some proportion of accidental bit errors; they are powerless to thwart deliberate data manipulation by a determined adversary whose goal is to modify the content of the data for his or her own gain. To protect data against this sort of attack, cryptographic techniques are required. Thus, appropriate algorithms and keys must be employed and commonly understood between the entity wanting to provide data integrity and the entity wanting to be assured of data integrity.

Authentication is the act of establishing or confirming something (or someone) as authentic. Various systems have been invented to provide a means for readers to reliably authenticate the sender. In any event, the communication must be properly protected; otherwise, an eavesdropper can simply copy the relevant data and later replay it, thereby successfully masquerading as the original, legitimate entity.

Sender authentication typically finds application in two primary contexts. Entity identification serves simply to identify the specific entity involved, essentially in isolation from any other activity that the entity might want to perform. The second context is data origin identification, which identifies a specific entity as the source or origin of a given piece of data. This is not entity identification in isolation, nor is it entity identification for the explicit purpose of enabling some other activity. Rather, this is identification with the intent of statically and irrevocably binding the identified entity to some particular data, regardless of any subsequent activities in which the entity might engage. Cryptographically based signatures provide nearly irrefutable evidence that can be used subsequently to prove to a third party that this entity did originate—or at least possess—the data.

Proposed paragraph (b)(1) requires that cryptographic algorithms and keys used to establish integrity and authenticity be approved by either the National Institute of Standards or a similar standards organization acceptable to FRA. As a practical matter, cryptographic algorithms can be believed secure by competent, experienced, practicing cryptographers. This requires that the algorithms be publicly known and have been seriously studied by working cryptographers. Algorithms that have been approved by NIST (or similar standards bodies) can be assured of being both publicly known and seriously studied.

Proposed paragraph (b)(2) allows the use of either manual or automated means to distribute keys. Key distribution is the most important component in secure transmissions. The general key distribution problem refers to the task of distributing keys between communicating parties to provide the required security properties. Frequent key changes are usually desirable to limit the amount of data compromised if an attacker learns the key. Therefore, the strength of any cryptographic system results with the key distribution technique, a term that refers to the means of delivering a key to two parties that wish to exchange data without allowing others to see the key. Key distribution can be achieved in a number of ways. There are various combinations by which a key can be selected manually or in automation amongst one or multiple parties.

Proposed paragraph (b)(3) establishes the conditions under which cryptographic keys must be revoked. Paragraph (b)(3)(i) addresses the situation when a key has actually been found to have been compromised and when the possibility of key compromise exists. Cryptographic algorithms are part of the foundations of the security house, and any house with weak foundations will collapse. Adequate procedures should be foreseen to take an algorithm out of service or to upgrade an algorithm which has been used beyond its lifetime

Proposed paragraph (d) addresses physical protection as applied to cryptographic equipment. Compliance does not necessitate locking devices within mechanical safes or enclosing their electronics within thick steel or concrete shields (i.e. making them tamper-proof). Compliance does, however, involve using sound design practices to construct a system capable of attack detection by a comprehensive range of sensors (i.e. tamper resistant). The level of physical security suggested should be such that unauthorized attempts at access or use will either be unsuccessful or will have a high probability of being detected during or after the event. Additionally, the cryptographic equipment should be prominently situated in operation so that its condition (outward appearance, indicators, controls, etc.) is easily visible to minimize the possibility of undetected penetration. In any system containing detection and destruction methods as described here, there is naturally a cost penalty for providing very high levels of tamper resistance, due to construction and test requirements by the manufacturer. It is naturally important to analyze the risks of key disclosure against cost of protection and specify a suitable implementation.

Confidentiality has been defined by the International Organization for Standardization (ISO) as “ensuring that information is accessible only to those authorized to have access.” Confidentiality, integrity, and authentication all rely on the same basic cryptographic primitives—algorithms with basic cryptographic properties—and their relationship to other cryptographic problems. These primitives provide fundamental properties, which guarantee one or more of the high-level security properties. In proposed paragraph (e)(1), FRA makes it clear that while providing for confidentiality of message data is not a regulatory requirement, if confidentiality is elected to be implemented by a railroad, that the same protection mechanisms applicable to the cryptographic primitives that support integrity and authentication must also be provided for the cryptographic primitives that support confidentiality.

It is only the difficulty of obtaining the key that determines security of the system, provided that there is no analytic attack (i.e., a “structural weakness” in the algorithms or protocols used), and assuming that the key is not otherwise available (such as via theft, extortion, or compromise of computer systems). A key should therefore be large enough that a brute force attack (possible against any encryption algorithm) is infeasible, whereas the attack would take too long to execute. Under information theory, to achieve perfect secrecy, it is necessary for the key length to be at least as large as the message to be transmitted and only used once (this algorithm is called the one-time pad). In light of this, and the practical difficulty of managing such long keys, modern cryptographic practice has discarded the notion of perfect secrecy as a requirement for encryption, and instead focuses on computational security. Under this definition, the computational requirements of breaking an encrypted text must be infeasible for an attacker. Paragraph (e)(2) proposes to require that in the event that a railroad elects to implement confidentiality, the chosen key length should provide the appropriate level of computational complexity to protect the information being protected, and that this information be included in the PTCSP. Both academic and private organizations provide recommendations and mathematical formulas to approximate the minimum key size requirement for security based on mathematic attacks; they generally do not take algorithmic attacks, hardware flaws, or other such issues into account.

Key management—the process of handling and controlling cryptographic keys and associated material during their life cycle in a cryptographic system—includes ordering, generating, distributing, storing, loading, escrowing, archiving, auditing, and destroying the different types of material. Paragraph (e) proposes to require that cleartext stored cryptographic keys be protected from unauthorized disclosure, modification, or substitution. During key management, however, it may be necessary to validate the accuracy of the key being entered, especially in cases where the key management process is being done manually. During the key entry process, keys not encrypted to protect against disclosures may be temporarily displayed to allow visual verification. However, if the key has been encrypted to protect against disclosure, then the cleartext version of the key may not be displayed. This does not, however, preclude the display of the encrypted version of the key.

In proposed paragraph (f), FRA requires that each railroad implement a service restoration and mitigation plan to address restoral of communications services in the event of their loss or disruption and to make this plan available to FRA. Loss of communications services reduces or eliminates the effectiveness of a PTC system and FRA requires that these critical safety systems, once implemented, are restored to operation as soon as practical. FRA believes that the restoration plan must include testing and validating the plan, communicating the plan, and validating backup and restoration operations.

To ensure that these or any other procedures work in the railroads operational environment, the railroad must validate each procedure intended for implementation. The backup and restoration plan should clearly describe who is to implement procedures and how they are to do it. The primary information to be communicated includes: the team or person (specified as an individual or a role) that is responsible for determining when restoration of service is required and the procedures to be used to restore service, as well as the team or person responsible for implementing procedures for each restoration scenario; the criteria for determining which restoration procedures are most appropriate for a specific situation; the time estimates for restoration of service in each restoration scenario; the restoration procedures to be used, including the tools required to complete each procedure; and the information required to restore data and settings.

Finally, paragraph (g) is proposed to make clear that railroads are permitted to implement more restrictive security requirements provided the requirements do not adversely impact the interoperability.

Section 236.1035 Field Testing Requirements

Initial field or subsequent regression testing of a PTC product on the general rail system is often required before the product has been certified in order to obtain data to support the safety case presented in the PTCSP. To ensure the safety of the public and train crews, prior FRA approval is required to conduct test operations on the general rail system. This paragraph proposes an alternative to the waiver process when only part 236 regulations are involved. When regulations concerning track safety grade crossing safety or when operational rules are involved, however, this process would not be available. Such testing may also implicate other safety issues, including adequacy of warning at highway-rail crossings (including part 234 compliance), qualification of passenger equipment (part 238), sufficiency of the track structure to support higher speeds or unbalance (part 213), and a variety of other safety issues, not all of which can be anticipated in any special approval procedure. Approval under this part for testing does not grant relief from other parts of this title and the railroads must still apply for relief from the non-part 236 regulations under the discrete special approval sections of those regulations, the provisions of part 211 related to waivers, or both.

The information required for this filing is described in proposed paragraphs 236.1035(a)(1) through (a)(7). This information is necessary in order for FRA to make informed decisions regarding the safety of testing operations. FRA would prefer that the informational filings to test under this part be accompanied by any requests for relief from non-part 236 regulations so that they may be considered as a whole.

Proposed paragraph (b) provides notification that FRA may—based on the results of the review of the information provided in paragraph (a) and in order to provide additional oversight to ensure the safety of rail operations—impose special conditions on the execution of the testing, including the appointment of a FRA test monitor. When a test monitor is appointed, he or she has the authority to stop testing if unsafe conditions arise, require additional tests as necessary to demonstrate the safe operation of the system, or have tests rerun when the results are in question.

Paragraph (c) reemphasizes the earlier discussion that either temporary or permanent requests for relief for other than requirements of part 236 must be submitted in accordance with the waiver processes specified by part 211.

Sections 236.103 Through 236.1049

In subpart H, §§ 236.917 through 236.929 contain various requirements that involve PSPs. FRA believes that these requirements should apply equally to PTC systems governed by subpart I. FRA has included proposed §§ 236.1037 to 236.1049 to inform interested parties how these elements would apply. FRA intends that the meanings of those sections in subpart H, as described in the preamble to its proposed and final rules, would also apply equally in the context of this proposal. While FRA has considered amending these sections in subpart H to incorporate references to subpart I, FRA believes such an attempt and its results would be cumbersome and awkward. Thus, FRA has included the provisions in proposed subpart I for clarity. FRA seeks comments on this issue.

Appendix B to Part 236—Risk Assessment Criteria

FRA proposes modifying Appendix B of part 236 to enhance the language for risk assessment criteria in a light of experience gained during the initial stage of PTC system implementation under subpart H and to accommodate the requirements of subpart I regulating the use of mandatory PTC systems. As modified, Appendix B will modify certain headings and incorporate new language in paragraphs (a) through (h).

Paragraph (a) reflects the change in the required length of time over which the system's risk must be computed. FRA replaces the requirement to assess risk for the system “over the life-cycle of 25 years or greater” with the requirement to assess risk “over the designed life-cycle of the product.” FRA believes that the proposed language is consistent with the preamble discussion of the subpart H final rule inasmuch that they do not specify the length of a system's life cycle, thereby providing flexibility for new processor-based systems to have a life cycle other than 25 years.

FRA proposes to modify paragraph (b) only to clarify FRA's intent.

FRA proposes to modify the heading and content of paragraph (c) to better identify the main purpose of this requirement and to ensure its consistency with the associated requirements of §§ 236.909(c) and (d). FRA believes that current paragraph (c) and its heading do not fully support or clarify the main intent of subpart H, which requires that the total cost of hazardous events should be the risk measure for a full risk assessment and that the mean time to hazardous event (MTTHE) calculations for all hazardous events should be the risk measure for the abbreviated risk assessment. The existing subpart H text asks for both the base case and the proposed case to be expressed in the same metrics. Paragraph (c) of this appendix, as currently written, does not fully reflect FRA's intent that the same risk metric is to be used in the risk assessment for both the previous and current conditions (see § 236.913(g)(2)(vii). FRA believes that the revised title of this paragraph poses the right question and that its new language provides better guidance on how to perform risk assessment for previous and current conditions.

FRA proposes to modify the heading and text of paragraph (d) to create a comprehensive and detailed list of system characteristics that must be included in the risk assessment for each proposed PTC system subject to requirements of subpart H or subpart I, or both, as applicable. FRA believes that the extended description of system characteristics better suits the risk assessment requirements of subpart H and subpart I. For example, the proposed revisions clarify that the risk assessment must account for the total volume of traffic, the type of transported freight materials (PIH, PIH), and any additional requirements for PTC systems with trains operating at certain speeds.

FRA proposes to modify paragraph (e) to clarify its intent and reflect the industry's experience in risk assessment techniques gained during the initial stage of PTC system implementation under subpart H. In the proposed language of paragraph (e), FRA provides more specific guidance on how to derive the main risk characteristics, MTTHE, and what role reliability and availability parameters, such as mean time to failure (MTTF) or mean time between failures (MTBF), for different system components can play while assessing risk for vital and non-vital hardware or software components of the system. FRA emphasizes that it is critical that each railroad and its vendors include the software failure rates into risk assessments for the system. FRA also finds it necessary to advise each railroad and its vendors to include reliability and availability characteristics, such as MTTF or MTBF, into its risk assessment to account for potential system exposure to hazards during system failures or malfunctioning when the system operates in its fall back mode—the back-up operation, as described in the PTCSP, when the PTC system fails to operate.

FRA believes that the proposed modifications to paragraph (e) more accurately address the industry's need for clarity in interpretation and execution of the requirements related to risk assessment.

FRA proposes to modify paragraph (f)(2) to reflect FRA's understanding that a software failure analysis may not necessarily be based on MTTHE “Verification and Validation” processes and that MTTHE characteristics cannot be easily obtained for the system software components. Therefore, the proposed modification intends to outline the significance of detailed software fault/failure analysis and software testing to demonstrate repeatable predictive results that all software defects are identified and corrected.

FRA proposes to modify paragraph (g) to clarify that MMTHE calculations should account for the restoration time after system or component failure and that the system design must be assessed for adequacy through the Verification and Validation process.

FRA proposes to modify paragraph (h) to emphasize the need to document all assumptions made during the risk assessment process. FRA believes that the assumptions should be documented while deriving the total cost of potential accident consequences for full risk assessment or MTTHE values for abbreviated risk assessment, rather than only documenting assumptions for her intermediate parameters, such as MTTF and MTTR, as currently required. These two referenced parameters may or may not be relevant for the risk assessment.

Appendix C to Part 236—Safety Assurance Criteria and Processes

FRA proposed to modify Appendix C to Part 236 to enhance and clarify its language, re-organize the existing list of safe system design principles in accordance with the well established models of system safety engineering, and augment the list of safe system design principles with the principles related to safe system software design. A safe state is a system configuration that the system defaults to in the event of a fault or failure or when unacceptable or dangerous conditions are detected. The safe state is a state of the process operation where the hazardous event cannot occur. Paragraph (a), as proposed, is revised to reflect the main purpose of this appendix in clear, accurate, and consistent language that will be repeatedly used throughout the appendix. It also outlines that the requirements of this appendix will be applicable to each railroad's PTCIP and PTCSP, as required by subpart I.

Paragraph (b), as proposed, is modified and restructured to consistently present a complete list of safety assurance principles properly classified or categorized in accordance with well established system safety engineering principles that need to be followed by the designer of the system to assure that all system components perform safely under normal operating conditions and under failures, accounting for human factor impacts, external influencing, and procedures and policies related to maintenance, repair, and modification of the system. FRA also proposes adding language indicating that these principles must also be applicable to PTC systems designed and implemented under the requirements of subpart I. FRA's intent in promulgating Appendix C was to ensure that safety principles are followed during the design stage and that Verification and Validation methods are used to assure that the product meets the safety criteria established in § 236.909. The heading of this paragraph and its subparagraphs are changed to more adequately and precisely capture this paragraph's purpose. For instance, FRA proposes to modify the heading of paragraph (b)(1) to better suit the chosen base of classification for all safety principles under paragraph (b).

Under paragraph (b)(3), FRA proposes to amend the definition of Closed Loop Principle to reflect its industry accepted definition provided by the AREMA Manual. FRA believes that the current definition is too general and does not reflect the essence of the most significant principles of safe signaling system design.

Under paragraph (b)(4), FRA proposes to add a list of Safety Assurance Concepts that the designer may consider for implementation to assure sail-safe system design and operation. These principles are predominantly applicable for the safe system software design and quoted from the IEEE-1483 standard. Based on this proposed amendment, FRA also proposes to renumber some of the remaining subparagraphs of paragraph (b) to follow the chosen scheme for the proper classification and sequence of safety principles.

FRA proposes to amend paragraph (c) reflect the changes in recommended standards. For instance, the standard “EN50126: 1999, Railway Applications: Specification and Demonstration of Reliability, Availability, Maintainability and Safety” (RAMS) is superseded by the standard IEC62278: 2002 under the same title. The standard “EN50128 (May 2001), Railway Applications: Software for Railway Control and Protection Systems” is superseded by the Standard IEC62279: 2002 under the same title.

Under paragraph (c)(3)(i), FRA references additional IEEE standards that have become available and will support the designs of PTC systems that are widely using communications as their main component. In addition to existing reference under paragraph (c)(3)(i)(A) for IEEE-1483 Standard, the following standards are added to paragraph (c)(3)(i): IEEE 1474.2-2003, Standard for user interface requirements in communications based train control (CBTC) systems; and IEEE 1474.1-2004, Standard for Communications-Based Train Control (CBTC) Performance and Functional Requirements.

After an analysis of the current applicability of ATCS Specification 130 and 140, FRA believes that they are not being used. Thus, FRA proposes to remove these standards from the list of referenced standards. However, FRA also proposes to add the ATCS 200, Data Communication standard that remains relevant for communication segment of PTC system designs.

FRA also considers it necessary to reference several additional sections of the current AREMA 2009 Communications and Signal Manual of Recommended Practices. In addition to Section 17 of this manual referenced in a previous version of Appendix C, FRA proposes to add to the list of references Section 16 Vital Circuit and Software Design; Section 21 Data Transmission; and Section 23 Communication-Based Signaling.

VII. Regulatory Impact and Notices

A. Executive Order 12866 and DOT Regulatory Policies and Procedures

This proposed rule has been evaluated in accordance with existing policies and procedures, and determined to be significant under both Executive Order 12866 and DOT policies and procedures (44 FR 11034; Feb. 26, 1979). We have prepared and placed in the docket a regulatory impact analysis (RIA) addressing the economic impact of this proposed rule. FRA invites comments on this RIA.

The costs anticipated to accrue from adopting this proposed rule would include: (1) Costs associated with developing implementation plans and administrative functions related to the implementation and operation of PTC systems, including the information technology and communication systems that make up the central office; (2) hardware costs for onboard locomotive system components, including installation; (3) hardware costs for wayside system components, including installation; and (4) maintenance costs for all system components.

Two types of benefits are expected to result from the implementation of this proposed rule—benefits from railroad accident reduction and business benefits from efficiency gains. The first type would include safety benefits or savings expected to accrue from the reduction in the number and severity of casualties arising from train accidents that would occur on lines equipped with PTC systems. Casualty mitigation estimates are based on a value of statistical life of $6 million. In addition, benefits related to accident preventions would accrue from a decrease in damages to property such as: Locomotives, railroad cars, and track; environmental damage; track closures; road closures; and evacuations. Benefits more difficult to monetize—such as the avoidance of hazmat accident related costs incurred by Federal, State, and local governments and impacts to local businesses—will also result. FRA also expects that once PTC systems are refined, there would likely be substantial additional business benefits resulting from more efficient transportation service; however such benefits are not included because of significant uncertainties regarding whether and when individual elements will be achieved and given the complicating factor that some benefits might, absent deployment of PTC, be captured using alternative technologies at lower cost. FRA requests comments on whether this proposed regulation exercises the appropriate level of discretion and flexibility to comply with RSIA08 in the most cost effective and beneficial manner.

This document presents a 20-year analysis of the costs and benefits associated with FRA's proposed rule, using both 7 percent and 3 percent discount rates, and two types of sensitivity analyses. The first is associated with varying cost assumptions used for estimating PTC implementation costs. The second takes into account potential business benefits from realizing service efficiencies and related additional societal benefits from attainment of environmental goals and an overall reduction in transportation risk from modal diversion.

The 20-year total cost estimates are $10.00 billion (PV, 7%) and $13.85 billion (PV, 3%). Annualized costs are $0.95 billion (PV, 7%) and $0.93 billion (PV, 3%). Using high-cost assumptions, the 20-year total cost estimates would be $17.12 billion (PV, 7%) and $23.76 billion (PV, 3%). Using low-cost assumptions, the 20-year cost estimates would be $7.09 billion (PV, 7%) and $9.84 billion (PV, 3%). The later the expenditures are made, the lower the discounted cost impact, which in any event is a very small portion of the total PTC costs.

Twenty-year railroad safety (railroad accident reduction) benefit estimates associated with implementation of the proposed rule are $608 million (PV, 7%) and $931 million (PV, 3%). Annualized benefits are $57 million (PV, 7%), and $63 million (PV, 3%). Some forecasts predict significant growth of both passenger and freight transportation demands, and it is thus possible that greater activity on the system could present the potential for larger safety benefits than estimated in this analysis. The presence of a very large PTC-equipped freight locomotive fleet also supports the opportunity for introduction of new passenger services of higher quality at less cost to the sponsor of that service. Information is not presently available to quantify that benefit.

Total 20—Year Benefits and Discounted Benefits

[At 3% and 7%]

Discount rate	3.00%	7.00%
Costs:
Central Office and Development	$283,025,904	$263,232,675
Wayside Equipment	3,109,098,494	2,586,453,456
On-Board Equipment	1,643,839,209	1,416,706,349
Maintenance	8,812,624,111	5,741,220,231
Total	13,848,587,717	10,007,612,712
Railroad Safety Benefits	931,253,681	607,711,640

The Port Authority Trans Hudson (PATH), a commuter railroad, is apparently considering the system used by the New York City Transit Authority on the Canarsie line. This system, which is known as Communication-Based Train Control, is not similar in concept to any of the other PTC systems (including the CSX CBTC, with which its name might easily be confused), and would not be suitable, as FRA understands the system, except on a railroad with operating characteristics similar to a heavy rail mass transit system. FRA believes that, in absence of the statutory mandate or this rulemaking, PATH would have adopted PTC for business reasons.

Although costs associated with implementation of the proposed rule are significant and such costs would far exceed the benefits, FRA is constrained by the requirements of RSIA08, which do not provide latitude to for implementing PTC differently. Nevertheless, FRA has taken several steps to avoid triggering unnecessary costs in the proposed rule. For instance, FRA is not proposing to require use of separate monitoring of switch position in signal territory or that the system be designed to determine the position of the end of the train. FRA also minimized costs, such as by proposing a requirement to monitor derails protecting the mainline, but limiting it to derails connected to the signal system; and by proposing a requirement to monitor hazard detectors protecting the mainline, but limiting it to hazard detectors connected to the signal system. FRA also minimized costs related to diamond crossings, where a PTC equipped railroad crosses a non-PTC equipped railroad at grade; included exceptions to main track for passenger train operations, and proposed provisions that would permit some Class III railroad operation of trains not equipped with PTC over Class I railroad freight lines equipped with PTC.

RSIA08 requires the railroads to have all mandatory PTC systems operational on or before December 31, 2015. Members of the PTC Working Group, especially railroad and supplier representatives, said that the timeframe was very tight, and that the scheduled implementation dates would be difficult to meet. In general, the faster a government agency requires a regulated entity to adopt new equipment of procedures, the more expensive compliance becomes. In part, this is due to supply elasticity being less over shorter time periods.

FRA is unable to estimate the potential savings if Congress provided a longer implementation schedule or provided incentives, rather than mandates, for PTC system installation. In order to estimate the likely reduction in costs in such situations, FRA would need to develop some other schedule for implementation. The element least sensitive to an implementation's schedule appears to be onboard costs. Each PTC system's onboard equipment seems similar and is not very different from existing onboard systems. Further, the 2015 deadline is not so restrictive that it would cause railroads to pull locomotives out of service just to install on board PTC equipment. Locomotives must be inspected thoroughly every 90 and more extensively every 360 days. The inspections can last from one to several days. Railroads usually bring locomotives into their shops to perform these inspections, during which time a skilled and experienced team could install the on board equipment for PTC. System development is much less certain, and more time would enable vendors to develop, test, and implement the software at a more reasonable cost. Wayside costs are also sensitive to the installation timetable, as the wayside must be mapped and measured, and then the railroads must install wayside interface units (WIUs). Wayside mapping and measurement takes a highly skilled workforce. A larger workforce is necessary to timely implement the required PTC systems in a shorter amount of time. WIU installation is likely similar to existing signal or communication systems installation, and is likely to involve use of existing railroad skilled workers. The shorter the installation time period, the more work will be done at overtime rates, which are, of course, higher.

FRA believes that lower costs could result from a longer installation period, but FRA also believes that the differences in costs would be within the range of the low costs provided in the main analysis of the proposed rule. The 2004 report included some lower cost estimates, but in light of current discussions with railroads, the cost estimates in the 1998 report seem more accurate. The lower estimates FRA received in preparing the 2004 report were both overly optimistic, and excluded installation costs, as well as higher costs which stem from meeting the performance standards.

Some of the costs of PTC implementation, operation, and maintenance may be offset by business benefits, especially in the long run, although there is uncertainty regarding the timing and level of those benefits. Economic and technical feasibility of the necessary system refinements and modifications to yield the potential business benefits has not yet been demonstrated. FRA analyzed business benefits associated with PTC system implementation and presented its findings in the 2004 Report. Due to the aggressive implementation schedule for PTC and the resulting need to issue a rule promptly, FRA has not formally updated this study. Nevertheless, FRA believes that there is opportunity for significant business benefits to accrue several years after implementation once the systems have been refined to the degree necessary. Thus, FRA conducted a sensitivity analysis of potential business benefits based on the 2004 Report.

The 2004 Report included business benefits from improved or enhanced locomotive diagnostics, fuel savings attributable to train pacing, precision dispatch, and capacity enhancement. Although railroads are enhancing locomotive diagnostics using other technologies, FRA believes that PTC could provide the basis for significant gains in the other three areas.

In the years since the 2004 Report, developing technology and rising fuel costs have caused the rail supply industry and the railroads to focus on additional means of conserving diesel fuel while minimizing in-train forces that can lead to derailments and delays from train separations (usually broken coupler knuckles). Software programs exist that can translate information concerning throttle position and brake use, together with consist information and route characteristics, to produce advice for prospective manipulation of the locomotive controls to limit in-train forces. Programs are also being conceived that project arrival at meet points and other locations on the railroad. These types of tools can be consolidated into programs that either coaches the locomotive engineer regarding how to handle the train or even take over the controls of the locomotive under the engineer's supervision. The ultimate purpose of integrating this technology is to conserve fuel use while handling the train properly and arriving at a designated location “just in time” (e.g., to meet or pass a train or enter a terminal area in sequence ahead of or behind other traffic). Further integrating this technology with PTC communications platforms and traffic planning capabilities could permit transmittal of “train pacing” information to the locomotive cab in order to conserve fuel. Like the communications backbone, survey data concerning route characteristics can be shared by both systems. The cost of diesel fuel for road operations to the Class I railroads is approximately $3.5 billion annually and is gradually rising. If PTC technology helps to spur the growth and effective use of train pacing, fuel savings of 5% ($175,000,000 annually) or greater could very likely be achieved. Clearly, if the railroads are able to conserve use of fuel, they will also reduce emissions and contribute to attainment of environmental goals, even before modal diversion occurs.

The improvements in dispatch and capacity have further implications. With those improvements, railroads could improve the reliability of shipment arrival time and, thus, dramatically increase the value of rail transportation to shippers, who in turn would divert certain shipments from highway to rail. Such diversion would yield greater overall transportation safety benefits since railroads have much lower accident risk than highways, on a point-to-point ton-mile basis. The total societal benefits of PTC system implementation and operation, following the analysis, would be much greater than total societal costs, although the costs would fall disproportionately more heavily on the railroads.

At present, the PTC systems contemplated by the railroads, with the possible exception of PATH, would not increase capacity, at least not for some time. If the locomotive braking algorithms need to be made more conservative in order to ensure that each train does not exceed the limits of its authority, PTC system operation may actually decrease rail capacity where applied in the early years. Further investment would be required to bring about the synergy that would result in capacity gains. A more significant business benefit of PTC system operation would be derived from precision dispatching, which decreases the variance of arrival times of delivered freight. To avoid the risk of running out of stock, shippers often overstock their inventory at an annual cost of approximately 25% of its inventory value, regardless of the material being stored. This estimate accounts for shrinkage, borrowing costs, and storage costs. Of course, freight with more value per unit of mass or volume tends to have greater storage costs per unit. At present, no rail precision dispatch system exists. However, if a shipper would take advantage of precision dispatching, thus increasing freight arrival time accuracy, then it could reduce its overstock inventory. Accurate train data is a necessary, but not a sufficient condition, for precision dispatch. At least two of the Class I railroads have unsuccessfully attempted to develop precision dispatch systems. The mandatory installation of PTC systems is likely to divert any resources that might have been devoted to precision dispatch, so these benefits are unlikely during the first several years of this rule.

Applying current factors to the variables used in the 2004 Report to Congress, the resulting analysis indicates that diversion could result in highway annual safety benefits of $744 million by 2022, and $1,148 million by 2032. Of course, these benefits require that the productivity enhancing systems be added to PTC, and are heavily dependent on the underlying assumptions of the 2004 model.

Modal diversion would also yield environmental benefits. The 2004 Report estimated that reduced air pollution costs would have been between $68 million and $132 million in 2010 (assuming PTC would be implemented by 2010), and between $103 million and $198 million in 2020. This benefit would have accrued to the general public. FRA has not broken out the pollution cost benefit of the current rule, but offers the estimates from the 2004 Report as a guide to the order of magnitude of such benefits.

While railroads argued that many of the benefits identified in FRA's 2004 report were exaggerated, shortly after the publication of the report, several railroads began developing strategies for PTC system development and implementation. This investment by the railroads would seem to illustrate that they believe that there is some potential for PTC to provide a boost to railroad profits, beyond providing any of the aforementioned societal benefits.

Modal diversion is highly sensitive to service quality. Problems with terminal congestion and lengthy dwell times might overwhelm the benefits of PTC or other initiatives which the railroads have been pursuing (reconfiguration of yards, pre-blocking of trains, shared power arrangements, car scheduling, Automatic Equipment Identification, etc.) might actually work in synergy with PTC. It should also be noted that, in the years since the 2004 Report was developed, the Class I railroads have shown an increased ability to retain operating revenue as profit, rather than surrendering it in the form of reduced rates. This was particularly true during the period prior to the current recession, when strained highway capacity favored the growth of rail traffic. The sensitivity analysis performed by FRA indicates that realization of business benefits could yield benefits sufficient to close the gap between PTC implementation costs and rail accident reduction benefits within the first 20 years of the rule, applying a 3% discount rate, and by year 25 of the rule, applying a discount rate of 7%. Accordingly, the precise partition of business and societal benefits cannot be estimated with any certainty.

FRA recognizes that the likelihood of business benefits is uncertain and that the cost-to-benefit comparison of this rule, excluding any business benefits, is not favorable. However, FRA has taken measures to minimize the rule's adverse impacts and to provide as much flexibility as FRA is authorized to grant under RSIA08.

B. Regulatory Flexibility Act and Executive Order 13272

The Regulatory Flexibility Act (5 U.S.C. 601 et seq.) and Executive Order 13272 require a review of proposed and final rules to assess their impacts on small entities. An agency must prepare an initial regulatory flexibility analysis (IRFA) unless it determines and certifies that a rule, if promulgated, would not have a significant impact on a substantial number of small entities. FRA has not determined whether this proposed rule would have a significant economic impact on a substantial number of small entities. Therefore, we are publishing this IRFA to aid the public in commenting on the potential small business impacts of the proposals in this NPRM. We invite all interested parties to submit data and information regarding the potential economic impact that would result from adoption of the proposals in this NPRM. We will consider all comments received in the public comment process when making a determination in the Final Regulatory Flexibility Assessment.

In accordance with the Regulatory Flexibility Act, an IRFA must contain:

(1) A description of the reasons why action by the agency is being considered;

(2) A succinct statement of the objectives of, and the legal basis for, the proposed rule;

(3) A description of, and where feasible, an estimate of the number of small entities to which the proposed rule will apply;

(4) A description of the projected reporting, recordkeeping and other compliance requirements of the proposed rule, including an estimate of the classes of small entities that will be subject to the requirement and the type of professional skills necessary for preparation of the report or record;

(5) An identification, to the extent practicable, of all relevant Federal rules that may duplicate, overlap, or conflict with the proposed rule; and

(6) A description of any significant alternatives to the proposed rule that accomplish the stated objectives of applicable statutes and which minimize any significant economic impact of the proposed rule on small entities. 5 U.S.C. 603(b), (c).

1. Reasons for Considering Agency Action

PTC systems will be designed to prevent train-to-train collisions, overspeed derailments, incursions into established work zone limits, and the movement of a train through a switch left in the wrong position.

As discussed in more detail in section I of the preamble, the RSIA08 mandates that widespread implementation of PTC across a major portion of the U.S. rail industry be accomplished by December 31, 2015. RSIA08 requires each Class I carrier and each entity providing regularly scheduled intercity or commuter rail passenger transportation to develop a plan for implementing PTC by April 16, 2010. The Secretary of Transportation is responsible for reviewing and approving or disapproving such plans. The Secretary has delegated this responsibility to FRA. This proposed rule details the process and procedure for obtaining FRA approval of the plans.

2. Legal Basis for the Proposed Rule

As discussed earlier in the preamble, FRA is issuing this proposed rule to provide regulatory guidance and performance standards for the development, testing, implementation, and use of Positive Train Control (PTC) systems for railroads mandated by the Rail Safety Improvement Act of 2008. section 104, Public Law 110-432, 122 Stat. 4848, 4856, (Oct. 16, 2008) (codified at 49 U.S.C. 20157).

3. Description and Estimate of Small Entities Affected

“Small entity” is defined in 5 U.S.C. 601. Section 601(3) defines a “small entity” as having the same meaning as “small business concern” under section 3 of the Small Business Act. This includes any small business concern that is independently owned and operated, and is not dominant in its field of operation. Section 601(4) includes not-for-profit enterprises that are independently owned and operated, and are not dominant in their field of operations within the definition of “small entities.” Additionally, section 601(5) defines as “small entities” governments of cities, counties, towns, townships, villages, school districts, or special districts with populations less than 50,000.

The U.S. Small Business Administration (SBA) stipulates “size standards” for small entities. It provides that the largest a for-profit railroad business firm may be (and still classify as a “small entity”) is 1,500 employees for “Line-Haul Operating” railroads, and 500 employees for “Short-Line Operating” railroads. See “Table of Size Standards,” U.S. Small Business Administration, January 31, 1996, 13 CFR part 121; see also NAICS Codes 482111 and 482112.

SBA size standards may be altered by Federal agencies in consultation with SBA, and in conjunction with public comment. Pursuant to the authority provided to it by SBA, FRA has published a final policy, which formally establishes small entities as railroads that meet the line haulage revenue requirements of a Class III railroad. See 68 FR 24,891 (May 9, 2003). Currently, the revenue requirements are $20 million or less in annual operating revenue, adjusted annually for inflation. The $20 million limit (adjusted annually for inflation) is based on the Surface Transportation Board's threshold of a Class III railroad carrier, which is adjusted by applying the railroad revenue deflator adjustment. See also 49 CFR part 1201. The same dollar limit on revenues is established to determine whether a railroad shipper or contractor is a small entity. FRA proposes to use this definition for this rulemaking.

The IRFA's “universe” of considered entities generally includes only those small entities that can reasonably be expected to be directly regulated by the proposed action. One type of small entity is potentially affected by this proposed rule: railroads. The level of impact on small railroads will vary from railroad to railroad. Class III railroads will be impacted for one or more of the following reasons: (1) They operate on Class I railroad lines that carry PIH materials and are required to have PTC, in which case they would need to equip the portion of their locomotive fleet that operates on such lines; (2) they operate on Amtrak or commuter rail lines, including freight railroad lines that host such service; (3) they host regularly scheduled intercity or commuter rail transportation; or (4) they have at-grade railroad crossings over lines required by RSIA08 to have PTC. Generally, to the extent that Class III railroads incur costs associated with implementation of PTC it will limited to equipping locomotives, and not the wayside, for the reasons discussed below.

The proposed rule would apply to small railroads' tracks over which a passenger railroad conducts intercity or commuter operations and locomotives operating on main lines of Class I freight railroads required to have PTC and on railroads conducting intercity passenger or commuter operations. The impact on Class III railroads that operate on Class I railroad lines required to be equipped with PTC will depend on the nature of such operations. Class III railroads often make short moves on Class I railroad lines for interchange purposes. To the extent that their moves do not exceed four per day or 20 miles in length of haul (one way), Class III railroads will be exempt from the requirement to equip the locomotives. However some Class III railroads operate much more extensively on Class I railroad lines that will be required to have PTC and would have to equip some of their locomotives. It is likely that Class III railroads will dedicate certain locomotives to such service, if they have not done so already. FRA estimates that approximately 55 small railroads would have to equip locomotives with PTC system components because they have trackage rights on Class I freight railroad PIH lines that would be required to have PTC and would not be able to qualify for any of the operational exceptions discussed.

FRA further estimates that 10 small railroads have trackage rights on intercity passenger or commuter railroads or other freight railroads hosting such operations, and might need to equip some locomotives with PTC systems. Half of these would need to equip locomotives anyway, because they also have trackage rights on Class I railroads that haul PIH and would otherwise be required to have PTC.

Thus, a total of 60 railroads would need to equip locomotives. FRA estimates that the average small railroad will need to equip four locomotives, at a per railroad cost of $55,000 each, totaling $220,000, and that the total cost for all 60 small railroads which will need to equip locomotives would be $13,200,000. The annual maintenance cost would be 15% of that total, equaling $33,000 per railroad or $1,980,000 total for all small railroads. FRA requests comments regarding this cost estimate.

In addition, 15 small railroads host commuter or intercity passenger operations on what might be defined as main line track under the accompanying rulemaking; however, only five of these railroads are neither terminal or port railroads, which tend to be owned and operated by large railroads or port authorities, nor subsidiaries of large short line holding companies with the expertise and resources across the disciplines comparable to larger railroads. Of those five railroads, only one has trackage exceeding 3.8 miles. The other four railroads may request that FRA define such track as other than main line after ensuring that all trains will be limited to restricted speed. The cost burden on the remaining railroad will likely be reduced by restricting speed, temporally separating passenger train operations, or by passing the cost to the passenger railroad. Thus, the expected burden to small entities hosting passenger operations is minimal. FRA requests comments related to this analysis.

At rail-to-rail crossings where at least one of the intersecting tracks allows operating speeds in excess of 40 miles per hour, the approaching non-PTC line must have a permanent maximum speed limit of 20 miles per hour and either have some type of positive stop enforcement or a split-point derail incorporated into the signal system on the non-PTC route.. FRA believes that the cost of the derail would be borne by the PTC-equipped railroad, and that slowing to 20 miles per hour reflects current practice at most diamond crossings. FRA estimates that ten crossings exist, on five small railroads with two crossings each, where the newly burdened small railroad will be slowing to 20 miles per hour from a higher track speed. FRA estimates that the average traffic on the newly burdened route is two trains per day, and that the cost to slow from a higher track speed is $30 per train, for a total cost of $60 per crossing per day, a per railroad cost of $120 per day, and a total national cost for all ten small railroads of $600 per day and an annual cost of $43,800 per railroad and a total for all small railroads of $219,000 per year. FRA estimates that only five railroads will be affected by this provision, and that they will be railroads not affected by the requirement to equip locomotives, because railroads with equipped locomotives could simply use the PTC system and avoid the requirement to slow down. This analysis yields a total of 65 affected small entities that may be impacted by implementation of the proposed rule. FRA requests comments regarding this estimate of small entities potentially impacted.

4. Description of Reporting, Recordkeeping, and Other Compliance Requirements and Impacts on Small Entities Resulting From Specific Proposed Requirements

Class III railroads that host intercity or commuter rail service will need to file implementation plans, whether or not they directly procure or manage installation of the PTC system. FRA believes that although the implementation plan must be jointly filed by the small host railroad and passenger tenant railroad, the cost of these plans will be borne by the passenger railroads. FRA believes that only one small entity, as described above, is likely to have PTC installed on its lines. The implementation plan is likely to be an extension of the passenger railroad's plan, and the marginal cost will be the cost of tailoring the plan to the host railroad, which will be borne by the passenger railroad, and maintaining copies of the plan at the host railroad, which FRA estimates to be approximately $1,000 per year.

The total cost to small entities would include the initial cost of equipping locomotives, $13,200,000; annual costs of $1,980,000 for maintenance; $219,000 due to operating speed restrictions at diamond crossings; and $1,000 to maintain a copy of the PTC implementation plan. The total annual costs to small entities after initial acquisition would be $2,200,000 ($1,980,000 + $219,000 + $1,000). Individual railroads affected would either face an initial cost of $220,000 to equip locomotives, and an annual cost of $33,000 to maintain the PTC systems on those locomotives, or would face a per railroad cost of $43,800 per year to slow at diamond crossings.

5. Identification of Relevant Duplicative, Overlapping, or Conflicting Federal Rules

There are no Federal rules that would duplicate, overlap, or conflict with this proposed rule.

6. Alternatives Considered

FRA is unaware of any significant alternatives that would meet the intent of RSIA08 and that would minimize the economic impact on small entities. FRA is exercising its discretion to provide the greatest flexibility for small entities available under RSIA08 by proposing to allow operations of unequipped trains operated by small entities on the main lines of Class I railroads, and in defining main track on passenger railroads to avoid imposing undue burdens on small entities. The definition of passenger main track was adopted based on PTC Working Group recommendations that were backed strongly by representatives of small railroads. The provisions permitting operations of unequipped trains of Class I railroads exceeded the maximum flexibility for which the PTC Working Group could reach a consensus. FRA requests comments on this finding of no significant alternative related to small entities. FRA also requests comments on whether this proposed regulation exercises the appropriate level of discretion and flexibility to comply with RSIA08 in the most cost effective and beneficial manner.

The process by which this proposed rule was developed provided outreach to small entities. As noted earlier in the preamble, this notice was developed in consultation with industry representatives via the RSAC, which includes small railroad representatives. From January to April 2009, FRA met with the entire PTC Working Group five times over the course of twelve days. This PTC Working Group established a task force to focus on issues specific to short line and regional railroads. The discussions yielded many insights and this proposed rule takes into account the concerns expressed by small railroads during the deliberations.

C. Paperwork Reduction Act

The information collection requirements in this proposed rule have been submitted for approval to the Office of Management and Budget (OMB) under the Paperwork Reduction Act of 1995, 44 U.S.C. 3501 et seq. The sections that contain the new information collection requirements and the estimated time to fulfill each requirement are as follows:

CFR section	Respondent universe	Total annual responses	Average time per response (hours)	Total annual burden hours
234.275—Processor-Based Systems—Deviations from Product Safety Plan (PSP)—Letters	20 Railroads	25 letters	4	100
236.18—Software Mgmt Control Plan	184 Railroads	184 plans	2,150	395,600
—Updates to Software Mgmt. Control Plan	90 Railroads	20 updates	1.50	30
236.905—Updates to RSPP	78 Railroads	6 plans	135	810
—Response to Request For Additional Info	78 Railroads	1 updated doc	400	400
—Request for FRA Approval of RSPP Modification	78 Railroads	1 request/modified RSPP	400	400
236.907—Product Safety Plan (PSP)—Dev	5 Railroads	5 plans	6,400	32,000
236.909—Minimum Performance Standard.
—Petitions For Review and Approval	5 Railroads	2 petitions/PSP	19,200	38,400
—Supporting Sensitivity Analysis	5 Railroads	5 analyses	160	800
236.913—Notification/Submission to FRA of Joint Product Safety Plan (PSP)	6 Railroads	1 joint plan	25,600	25,600
—Petitions for Approval/Informational Filings	6 Railroads	6 petitions	1,928	11,568
—Responses to FRA Request For Further Info. After Informational Filing	6 Railroads	2 documents	800	1,600
—Responses to FRA Request For Further Info. After Agency Receipt of Notice of Product Development	6 Railroads	6 documents	16	96
—Consultations	6 Railroads	6 consults	120	720
—Petitions for Final Approval	6 Railroads	6 petitions	16	96
—Comments to FRA by Interested Parties	Public/RRs	7 comments	240	1,680
—Third Party Assessments of PSP	6 Railroads	1 assessment	104,000	104,000
—Amendments to PSP	6 Railroads	15 amendments	160	2,400
—Field Testing of Product—Info. Filings	6 Railroads	6 documents	3,200	19,200
236.917—Retention of Records.
—Results of tests/inspections specified in PSP	6 Railroads	3 documents/records	160,000; 160,000; 40,000	360,000
—Report to FRA of Inconsistencies with frequency of safety-relevant hazards in PSP	6 Railroads	1 report	104	104
236.919—Operations & Maintenance Man.
—Updates to O & M Manual	6 Railroads	6 updated docs	40	240
—Plans For Proper Maintenance, Repair, Inspection of Safety-Critical Products	6 Railroads	6 plans	53,335	320,010
—Hardware/Software/Firmware Revisions	6 Railroads	6 revisions	6,440	38,640
236.921—Training Programs: Development	6 Railroads	6 Tr. Programs	400	2,400
—Training of Signalmen & Dispatchers	6 Railroads	300 signalmen; 20 dispatchers	40; 20	12,400
236.923—Task Analysis/Basic Requirements: Necessary Documents	6 railroads	6 documents	720	4,320
—Records	6 railroads	350 records	1 10	58
SUBPART I—NEW REQUIREMENTS
236.1001—RR Development of More Stringent Rules Re: PTC Performance Stds	30 railroads	3 rules	80	240
236.1005—Requirements for PTC Systems.
—Temporary Rerouting: Emergency Requests	30 railroads	50 requests	8	400
—Written/Telephonic Notification to FRA Regional Administrator	30 railroads	50 notifications	2	100
—Temporary Rerouting Requests Due to Track Maintenance	30 railroads	95 requests	8	760
—Temporary Rerouting Requests That Exceed 30 Days	30 railroads	800 requests	8	6,400
236.1006—Requirements for Equipping Locomotives Operating in PTC Territory.
—Reports of Movements in Excess of 20 Miles/RR Progress on PTC Locomotives	35 railroads	35 reports	16	560
236.1007—Additional Requirements for High Speed Service.
—Required HSR-125 Documents with approved PTCSP	30 railroads	11 documents	3,200	35,200
—Requests to Use Foreign Service Data	30 railroads	2 requests	8,000	16,000
—PTC Railroads Conducting Operations at More than 150 MPH with HSR-125 Documents	30 railroads	11 documents	4,000	44,000
236.1009-Procedural Requirements.
—PTC Implementation Plans (PTCIP)	30 Railroads	30 plans	535	16,050
—Host Railroads Filing PTCIP or Request for Amendment (RFAs)	30 Railroads	1 PCTIP; 15 RFAs	535; 320	5,335
—Notification of Failure to File Joint PTCIP	30 Railroads	30 notifications	32	960
—Comprehensive List of Issues Causing Non-Agreement	30 Railroads	30 lists	80	2,400
—Conferences to Develop Mutually Acceptable PCTIP	30 Railroads	3 conf. calls	1 30	2
—Type Approval	30 Railroads	10 Type Appr.	8	80
—PTC Development Plans Requesting Type Approval	30 Railroads	20 Ltr. + 20 App. + 5 Plans	8; 8; 6,400	32,320
—PTCIP/PTCDP/PTCSP Plan Contents—Documents Translated into English	30 Railroads	1 document	8,000	8,000
—Requests for Confidentiality	30 Railroads	30 ltrs; 30 docs	8; 800	24,240
—Field Test Plans/Independent Assessments—Req. by FRA	30 Railroads	150 field tests; 2 assessments	800	121,600
—FRA Access: Interviews with RR PTC Personnel	30 Railroads	60 interviews	1 30	30
236.1011—PTCIP Requirements—Review and Public Comments on PTCIPs, PTCDPs, and PTCSPs	7 Interested Groups	21 reviews + 60 comments	143; 8	3,483
236.1015—PTCSP Content Requirements & PTC System Certification.
—Non-Vital Overlay	30 Railroads	2 PTCSPs	16,000	32,000
—Vital Overlay	30 Railroads	16 PTCSPs	22,400	358,400
—Stand Alone	30 Railroads	10 PTCSPs	32,000	320,000
—Mixed Systems—Conference with FRA regarding Case/Analysis	30 Railroads	3 conferences	32	96
—Mixed Sys. PTCSPs (incl. safety case)	30 Railroads	2 PTCSPs	28,800	57,600
—FRA Request for Additional PTCSP Data	30 Railroads	15 documents	3,200	48,000
—PTCSPs Applying to Replace Existing Certified PTC Systems	30 Railroads	15 PTCSPs	3,200	48,000
—Non-Quantitative Risk Assessments Supplied to FRA	30 Railroads	15 assessments	3,200	48,000
236.1017—PTCSP Supported by Independent Third Party Assessment	30 Railroads	1 assessment	8,000	8,000
—Written Requests to FRA to Confirm Entity Independence	30 Railroads	1 request	8	8
—Provision of Additional Information After FRA Request	30 Railroads	1 document	160	160
—Independent Third Party Assessment: Waiver Requests	30 Railroads	1 request	160	160
—RR Request for FRA to Accept Foreign Railroad Regulator Certified Info	30 Railroads	1 request	32	32
236.1019—Main Line Track Exceptions.
—Submission of Main Line Track Exclusion Addendums (MTEAs)	30 Railroads	30 MTEAs	160	4,800
—Passenger Terminal Exception—MTEAs	30 Railroads	23 MTEAs	160	3,680
—Limited Operation Exception—Risk Mitigation Plans	30 Railroads	30 plans	160	4,800
—Temporal Separation Procedures	30 Railroads	15 procedures	160	2,400
236.1021—Discontinuances, Material Modifications, Amendments—Requests to Amend (RFA) PTCIP, PTCDP or PTCSP	30 Railroads	15 RFAs	80	1,200
—Review and Public Comment on RFA	7 Interested Groups	7 reviews + 20 comments	3; 16	341
236.1023—PTC Errors and Malfunctions—Notifications	30 Railroads	60 notifications	32	1,920
—Notifications of PTC Defect That Decreases Safety	30 Railroads	150 notifications	16	2,400
—Notification Updates of PTC Defect	30 Railroads	150 updates	16	2,400
—PTC Product Vendor Lists (PTCPVL)	30 Railroads	30 lists	8	240
—RR Procedures Upon Notification of PTC System Safety-Critical Upgrades, Rev., Etc	30 Railroads	30 procedures	16	480
—Manufacturer's Report of Investigation of PTC Defect	5 System Suppliers	5 reports	400	2,000
236.1029—Report of On-Board Lead Locomotive PTC Device Failure	30 Railroads	960 reports	96	92,160
236.1031—Previously Approved PTC Systems.
—Request for Expedited Certification (REC) for PTC System	30 Railroads	3 REC Letters	160	480
—Requests for Grandfathering on PTCSPs	30 Railroads	3 requests	1,600	4,800
236.1035—Field Testing Requirements	30 railroads	150 field test plans	800	120,000
236.1037—Records Retention.
—Results of Tests in PTCSP and PTCDP	30 railroads	960 records	4	3,840
—PTC Service Contractors Training Records	30 Railroads	9,000 records	1 30	4,500
—Reports of Safety Relevant Hazards Exceeding Those in PTCSP and PTCDP	30 Railroads	4 reports	8	32
—Final Report of Resolution of Inconsistency	30 Railroads	4 final reports	160	640
236.1039—Operations & Maintenance Manual (OMM): Development	30 railroads	30 manuals	250	7,500
—Positive Identification of Safety-critical Components	30 railroads	75,000 i.d. components	1	75,000
—Designated RR Officers in OMM regarding PTC issues	30 railroads	60 designations	2	120
236.1041—PTC Training Programs	30 Railroads	30 programs	400	12,000
236.1043—Task Analysis/Basic Requirements: Training Evaluations	30 railroads	6 evaluations	720	4,320
—Training Records	30 railroads	350 records	1 10	58
236.1045—Training Specific to Office Control Personnel	30 railroads	20 trained employees	20	400
236.1047—Training Specific to Loc. Engineers & Other Operating Personnel.
—PTC Conductor Training	30 railroads	5,000 trained conductors	3	15,000
1 In minutes.

All estimates include the time for reviewing instructions; searching existing data sources; gathering or maintaining the needed data; and reviewing the information. Pursuant to 44 U.S.C. 3506(c)(2)(B), FRA solicits comments concerning: Whether these information collection requirements are necessary for the proper performance of the functions of FRA, including whether the information has practical utility; the accuracy of FRA's estimates of the burden of the information collection requirements; the quality, utility, and clarity of the information to be collected; and whether the burden of collection of information on those who are to respond, including through the use of automated collection techniques or other forms of information technology, may be minimized. For information or a copy of the paperwork package submitted to OMB, contact Mr. Robert Brogan, Information Clearance Officer, at 202-493-6292, or Ms. Nakia Jackson at 202-493-6073.

Organizations and individuals desiring to submit comments on the collection of information requirements should direct them to Mr. Robert Brogan or Ms. Nakia Jackson, Federal Railroad Administration, 1200 New Jersey Avenue, SE., 3rd Floor, Washington, DC 20590. Comments may also be submitted via e-mail to Mr. Brogan or Ms. Jackson at the following address: [e-mail]; [e-mail].

OMB is required to make a decision concerning the collection of information requirements contained in this proposed rule between 30 and 60 days after publication of this document in the Federal Register. Therefore, a comment to OMB is best assured of having its full effect if OMB receives it within 30 days of publication. The final rule will respond to any OMB or public comments on the information collection requirements contained in this proposal.

FRA is not authorized to impose a penalty on persons for violating information collection requirements which do not display a current OMB control number, if required. FRA intends to obtain current OMB control numbers for any new information collection requirements resulting from this rulemaking action prior to the effective date of the final rule. The OMB control number, when assigned, will be announced by separate notice in the Federal Register.

D. Federalism Implications

This proposed rule has been analyzed in accordance with the principles and criteria contained in Executive Order 13132, “Federalism” (64 FR 43255, Aug. 4, 1999).

As discussed earlier in the preamble, this proposed rule would provide regulatory guidance and performance standards for the development, testing, implementation, and use of Positive Train Control (PTC) systems for railroads mandated by the Railroad Safety Improvement Act of 2008.

Executive Order 13132 requires FRA to develop an accountable process to ensure “meaningful and timely input by State and local officials in the development of regulatory policies that have Federalism implications.” Policies that have “Federalism implications” are defined in the Executive Order to include regulations that have “substantial direct effects on the States, on the relationship between the national government and the States, or on the distribution of power and responsibilities among the various levels of government.” Under Executive Order 13132, the agency may not issue a regulation with Federalism implications that imposes substantial direct compliance costs and that is not required by statute, unless the Federal government provides the funds necessary to pay the direct compliance costs incurred by State and local governments, or the agency consults with State and local government officials early in the process of developing the proposed regulation. Where a regulation has Federalism implications and preempts State law, the agency seeks to consult with State and local officials in the process of developing the regulation.

FRA has determined that this proposed rule would not have substantial direct effects on the States, on the relationship between the national government and the States, nor on the distribution of power and responsibilities among the various levels of government. In addition, FRA has determined that this proposed rule, which is required by the Railroad Safety Improvement Act of 2008, would not impose any direct compliance costs on State and local governments. Therefore, the consultation and funding requirements of Executive Order 13132 do not apply.

However, this proposed rule would have preemptive effect. Section 20106 of Title 49 of the United States Code provides that States may not adopt or continue in effect any law, regulation, or order related to railroad safety or security that covers the subject matter of a regulation prescribed or order issued by the Secretary of Transportation (with respect to railroad safety matters) or the Secretary of Homeland Security (with respect to railroad security matters), except when the State law, regulation, or order qualifies under the local safety or security exception to section 20106. The intent of § 20106 is to promote national uniformity in railroad safety and security standards. 49 U.S.C. 20106(a)(1). Thus, subject to a limited exception for essentially local safety or security hazards, this proposed rule would establish a uniform Federal safety standard that must be met, and State requirements covering the same subject matter would be displaced, whether those State requirements are in the form of a State law, regulation, or order.

In sum, FRA has analyzed this proposed rule in accordance with the principles and criteria contained in Executive Order 13132. As explained above, FRA has determined that this proposed rule has no Federalism implications, other than the preemption of State laws covering the subject matter of this proposed rule, which occurs by operation of law under 49 U.S.C. 20106 whenever FRA issues a rule or order. Accordingly, FRA has determined that preparation of a Federalism summary impact statement for this proposed rule is not required.

E. Environmental Impact

FRA has evaluated this proposed rule in accordance with its “Procedures for Considering Environmental Impacts” (“FRA's Procedures”) (64 FR 28545, May 26, 1999) as required by the National Environmental Policy Act (42 U.S.C. 4321 et seq.), other environmental statutes, Executive Orders, and related regulatory requirements. FRA has determined that this proposed rule is not a major FRA action (requiring the preparation of an environmental impact statement or environmental assessment) because it is categorically excluded from detailed environmental review pursuant to section 4(c)(20) of FRA's Procedures. In accordance with section 4(c) and (e) of FRA's Procedures, the agency has further concluded that no extraordinary circumstances exist with respect to this regulation that might trigger the need for a more detailed environmental review. As a result, FRA finds that this proposed rule is not a major Federal action significantly affecting the quality of the human environment.

F. Unfunded Mandates Reform Act of 1995

The Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4, 2 U.S.C. 1531) requires agencies to prepare a written assessment of the costs, benefits, and other effects of proposed or final rules that include a Federal mandate likely to result in the expenditures by State, local or tribal governments, in the aggregate, or by the private sector, of more than $100 million annually (adjusted annually for inflation with base year of 1995). The value equivalent of $100 million in CY 195, adjusted annually for inflation to CY 2008 levels by the Consumer Price Index for All Urban Consumers (CPI-U) is $141.3 million. The assessment may be included in conjunction with other assessments, as it is here.

The proposed rule itself would not create an unfunded mandate in excess of the threshold amount. The bulk of unfunded mandate for implementation of PTC is attributable to RSIA08. The effects are discussed earlier in this document in the Regulatory Impact Analysis. Any unfunded mandates attributable to the proposed rulemaking would pertain to the costs of filing paperwork to prove compliance with RSIA08.

G. Energy Impact

Executive Order 13211 requires Federal agencies to prepare a Statement of Energy Effects for any “significant energy action.” 66 FR 28355 (May 22, 2001). Under the Executive Order, a “significant energy action” is defined as any action by an agency (normally published in the Federal Register) that promulgates or is expected to lead to the promulgation of a final rule or regulation, including notices of inquiry, advance notices of proposed rulemaking, and notices of proposed rulemaking: (1)(i) That is a significant regulatory action under Executive Order 12866 or any successor order, and (ii) is likely to have a significant adverse effect on the supply, distribution, or use of energy; or (2) that is designated by the Administrator of the Office of Information and Regulatory Affairs as a significant energy action. FRA has evaluated this proposed rule in accordance with Executive Order 13211. FRA has determined that this proposed rule is not likely to have a significant adverse effect on the supply, distribution, or use of energy. Consequently, FRA has determined that this regulatory action is not a “significant regulatory action” within the meaning of Executive Order 13211.

H. Privacy Act

FRA wishes to inform all interested parties that anyone is able to search the electronic form of any written communications and comments received into any of our dockets by the name of the individual submitting the document (or signing the document), if submitted on behalf of an association, business, labor union, etc.). Interested parties may also review DOT's complete Privacy Act Statement in the Federal Register published on April 11, 2000 (65 FR 19477) or visit http://www.regulations.gov.

List of Subjects

49 CFR Part 234

• Highway safety
• Penalties
• Railroad safety
• Reporting and recordkeeping requirements

49 CFR Part 235

• Administrative practice and procedure
• Penalties
• Railroad safety
• Reporting and recordkeeping requirements

49 CFR Part 236

• Penalties
• Positive Train Control
• Railroad safety
• Reporting and recordkeeping requirements

VIII. The Rule

In consideration of the foregoing, FRA proposes to amend chapter II, subtitle B of title 49, Code of Federal Regulations as follows:

PART 229—[AMENDED]

1. The authority citation for part 229 continues to read as follows:

Authority: 49 U.S.C. 20102-03, 20107, 20133, 20137-38, 20143, 20701-03, 21301-02, 21304; 28 U.S.C. 2401, note; and 49 CFR 1.49(c), (m).

2. Section 229.135 is amended by revising paragraphs (b)(3)(xxv) and (b)(4)(xxi) to read as follows:

§ 229.135

Event Recorders.

* * * * *

(b) * * *

(3) * * *

(xxv) Safety-critical train control data routed to the locomotive engineer's display with which the engineer is required to comply, specifically including text messages conveying mandatory directives and maximum authorized speed. The format, content, and proposed duration for retention of such data shall be specified in the product safety plan or PTC Safety Plan submitted for the train control system under subparts H or I, respectively, of part 236 of this chapter, subject to FRA approval under this paragraph. If it can be calibrated against other data required by this part, such train control data may, at the election of the railroad, be retained in a separate certified crashworthy memory module.

(4) * * *

(xxi) Safety-critical train control data routed to the locomotive engineer's display with which the engineer is required to comply, specifically including text messages conveying mandatory directives and maximum authorized speed. The format, content, and proposed duration for retention of such data shall be specified in the product safety plan or PTC Safety Plan submitted for the train control system under subparts H or I, respectively, of part 236 of this chapter, subject to FRA approval under this paragraph. If it can be calibrated against other data required by this part, such train control data may, at the election of the railroad, be retained in a separate certified crashworthy memory module.

PART 234—[AMENDED]

3. The authority citation for part 234 continues to read as follows:

Authority: 49 U.S.C. 20103, 20107; 28 U.S.C. 2461, note; and 49 CFR 1.49.

4. In § 234.275 revise paragraphs (b)(1), (b)(2), (c), and (f) to read as follows:

§ 234.275

Processor-based systems.

* * * * *

(b) Use of performance standard authorized or required. (1) In lieu of compliance with the requirements of this subpart, a railroad may elect to qualify an existing processor-based product under part 236, subparts H or I, of this chapter.

(2) Highway-rail grade crossing warning systems, subsystems, or components that are processor-based and that are first placed in service after June 6, 2005, which contain new or novel technology, or which provide safety-critical data to a railroad signal or train control system that is governed by part 236, subpart H or I, of this chapter, shall also comply with those requirements. New or novel technology refers to a technology not previously recognized for use as of March 7, 2005.

* * * * *

(c) Plan justifications. The Product Safety Plan in accordance with 49 CFR 236.903—or a PTC Development Plan (PTCDP) and PTC Safety Plan (PTCSP) required to be filed in accordance with 49 CFR 236.1011 and 236.1013—must explain how the performance objective sought to be addressed by each of the particular requiremnts of this subpart is met by the product, why the objective is not relevant to the product's design, or how the safety requirements are satisfied using alternative means. Deviation from those particular requirements is authorized if an adequate explanation is provided, making reference to relevant elements of the applicable plan, and if the product satisfies the performance standard set forth in § 236.909 of this chapter. (See § 236.907(a)(14) of this chapter.)

* * * * *

(f) Software management control for certain systems not subject to a performance standard. Any processor-based system, subsystem, or component subject to this part, which is not subject to the requirements of part 236, subpart H or I, of this chapter but which provides safety-critical data to a signal or train control system shall be included in the software management control plan requirements as specified in § 236.18 of this chapter.

PART 235—[AMENDED]

5. The authority citation for part 235 continues to read as follows:

Authority: 49 U.S.C. 20103, 20107; 28 U.S.C. 2461, note; and 49 CFR 1.49.

6. In § 235.7, add paragraph (a)(5) to read as follows:

§ 235.7

Changes not requiring filing of application.

(a) * * *

(5) Removal of an intermittent automatic train stop system in conjunction with the implementation of a positive train control system approved by FRA under subpart I of part 236.

* * * * *

PART 236—[AMENDED]

7. The authority citation for Part 236 is revised to read as follows:

Authority: 49 U.S.C. 20102-20103, 20107, 20133, 20141, 20157, 20301-20303, 20306, 21301-21302, 21304; 28 U.S.C. 2461, note; and 49 CFR 1.49.

* * * * *

8. Section 236.0 is amended by revising paragraphs (c) through (e) to read as follows:

§ 236.0

Applicability, minimum requirements, and penalties.

* * * * *

(c)(1) Prior to [insert date 24 months from publication of the final rule in the Federal Register], where a passenger train operates at a speed of 60 or more miles per hour, or a freight train operates at a speed of 50 or more miles per hour—

(i) A block signal system complying with the provisions of this part shall be installed; or

(ii) A manual block system shall be placed permanently in effect that shall conform to the following conditions:

(A) A train shall not be admitted, except for emergency purposes, to a block occupied by another train unless both trains are operating at restricted speed.

(B) A freight train, including a work train, may be authorized to follow a freight train, including a work train, into a block but the following train must proceed at restricted speed.

(2) On and after [insert date 24 months from publication of the final rule in the Federal Register], where a passenger train is permitted to operate at a speed of 60 or more miles per hour, or a freight train is permitted to operate at a speed of 50 or more miles per hour, a block signal system complying with the provisions of this part shall be installed, unless an FRA approved PTC system meeting the requirements of this part for the subject speed and other operating conditions, is installed.

(d)(1) Prior to December 31, 2015, where any train is permitted to operate at a speed of 80 or more miles per hour, an automatic cab signal, automatic train stop, or automatic train control system complying with the provisions of this part shall be installed, unless an FRA approved PTC system meeting the requirements of this part for the subject speed and other operating conditions, is installed.

(2) Subpart I of this part sets forth requirements for installation of PTC systems under conditions specified in that subpart.

(e) Nothing in this section authorizes the discontinuance of a block signal system, interlocking, traffic control system, automatic train control or train stop system, cab signal system, or PTC system without approval by the FRA under part 235 of this title. However, a railroad may apply for approval of discontinuance or material modification of a signal or train control system in connection with a request for approval of a Positive Train Control Development Plan (PTCDP) or Positive Train Control Safety Plan (PTCSP) as provided in subpart I of this part.

* * * * *

9. Section 236.909 is amended by adding a new sentence directly after the first sentence of paragraph (e)(1) and by revising paragraph (e)(2)(i) to read as follows:

§ 236.909

Minimum performance standards.

* * * * *

(e) * * *

(1) * * * The total risk assessment must have a supporting sensitivity analysis. The analysis must confirm that the risk metrics of the system are not negatively affected by sensitivity analysis input parameters including, for example, component failure rates, human factor error rates, and variations in train traffic affecting exposure. The sensitivity analysis must document the sensitivity to worst case failure scenarios. * * *

(2) * * *

(i) In all cases exposure must be expressed as total train miles traveled per year over the relevant railroad infrastructure. Consequences must identify the total cost, including fatalities, injuries, property damage, and other incidental costs, such as potential consequences of hazardous materials involvement, resulting from preventable accidents associated with the function(s) performed by the system.

* * * * *

10. Add a new subpart I to part 236 to read as follows:

Subpart I—Positive Train Control Systems

236.1001

Purpose and scope.

236.1003

Definitions.

236.1005

Requirements for Positive Train Control systems.

236.1006

Equipping locomotives operating in PTC territory.

236.1007

Additional requirements for high-speed service.

236.1009

Procedural requirements.

236.1011

PTCIP content requirements.

236.1013

PTCDP content requirements and Type Approval.

236.1015

PTCSP content requirements and PTC System Certification.

236.1017

Independent third party Verification and Validation.

236.1019

Main line track exceptions.

236.1021

Discontinuances, material modifications, and amendments.

236.1023

Errors and malfunctions.

236.1027

Exclusions.

236.1029

PTC system use and en route failures.

236.1031

Previously approved PTC systems

236.1033

Communications and security requirements.

236.1035

Field testing requirements.

236.1037

Records retention.

236.1039

Operations and Maintenance Manual.

236.1041

Training and qualification program, general.

236.1043

Task analysis and basic requirements.

236.1045

Training specific to office control personnel.

236.1047

Training specific to locomotive engineers and other operating personnel.

236.1049

Training specific to roadway workers.

Subpart I—Positive Train Control Systems

§ 236.1001

Purpose and scope.

(a) This subpart prescribes minimum, performance-based safety standards for PTC systems required by 49 U.S.C. 20157, this subpart, or an FRA order including requirements to ensure that the development, functionality, architecture, installation, implementation, inspection, testing, operation, maintenance, repair, and modification of those PTC systems will achieve and maintain an acceptable level of safety. This subpart also prescribes standards to ensure that personnel working with, and affected by, safety-critical PTC system related products receive appropriate training and testing.

(b) Each railroad may prescribe additional or more stringent rules, and other special instructions, that are not inconsistent with this subpart.

(c) This subpart does not exempt a railroad from compliance with any requirement of subpart A through H of this part or parts 233, 234, and 235 of this chapter, unless:

(1) it is otherwise explicitly excepted by this subpart; or

(2) the applicable PTCSP, as defined under § 236.1003 and approved by FRA under § 236.1015 provides for such an exception per § 236.1013.

§ 236.1003

Definitions.

(a) Definitions contained in subparts G and H of this part apply equally to this subpart.

(b) The following definitions apply to terms used only in this subpart unless otherwise stated:

After-arrival mandatory directive means any mandatory directive that makes the authority for train movement contingent upon the arrival of another train.

Associate Administrator means the FRA Associate Administrator for Railroad Safety and Chief Safety Officer.

Class I railroad means a railroad which in the last year for which revenues were reported exceeded the threshold established under regulations of the Surface Transportation Board (49 CFR part 1201.1-1 (2008)).

Cleartext means the un-encrypted text in its original, human readable, form. It is the input of an encryption or encipher process, and the output of an decryption or decipher process.

Host railroad means a railroad that has effective operating control over a segment of track .

Interoperability means the ability of a controlling locomotive to communicate with and respond to the PTC railroad's positive train control system, including uninterrupted movements over property boundaries.

Limited operations means operations on main line track that have limited or no freight operations and are approved to be excepted from this subpart's PTC system implementation and operation requirements in accordance with § 236.1019(c);

Main line means, except as provided in § 236.1019 or where all trains are limited to restricted speed within a yard or terminal area or on auxiliary or industry tracks, a segment or route of railroad tracks:

(1) of a Class I railroad, as documented in current timetables filed by the Class I railroad with the FRA under § 217.7 of this title, over which 5,000,000 or more gross tons of railroad traffic is transported annually; or

(2) used for regularly scheduled intercity or commuter passenger service, as defined in 49 U.S.C. 24102, or both. Tourist, scenic, historic, or excursion operations as defined in part 238 of this chapter are not considered intercity or commuter passenger service for purposes of this part.

Main line track exclusion addendum (“MTEA”) means the document submitted under §§ 236.1011 and 236.1019 requesting to designate track as other than main line.

PTC means positive train control as further described in § 236.1005.

PTCDP means a PTC Development Plan as further described in § 236.1013.

PTCIP means a PTC Implementation Plan as required under 49 U.S.C. 20157 and further described in § 236.1011.

PTC railroad means each Class I railroad and each entity providing regularly scheduled intercity or commuter rail passenger transportation required to implement or operate a PTC system.

PTCSP means a PTC Safety Plan as further described in § 236.1015.

PTCPVL means a PTC Product Vendor List as further described in § 236.1023.

PTC System Certification means certification as required under 49 U.S.C. 20157 and further described in §§ 236.1009 and 236.1015.

Request for Amendment (“RFA”) means a request for an amendment of a plan or system made by a PTC railroad in accordance with § 236.1021.

Request for Expedited Certification (“REC”) means, as further described in § 236.1031, a request by a railroad to receive expedited consideration for PTC System Certification.

Restricted speed means, Speed, restricted, as defined in subpart G of this part.

Safe State means a system configuration that cannot cause harm when the system fails.

Segment of track means any part of the railroad where a train operates.

Temporal separation means the process or processes in place to assure that limited passenger and freight operations do not operate on any segment of shared track during the same period and as further defined under § 236.1019.

Tenant railroad means a railroad, other than a host railroad, operating on track upon which a PTC system is required.

Track segment means segment of track.

Type Approval means a number assigned to a particular PTC system indicating FRA agreement that the PTC system could fulfill the requirements of this subpart.

Train means one or more locomotives, coupled with or without cars.

§ 236.1005

Requirements for Positive Train Control systems.

(a) PTC system requirements. Each PTC system required to be installed under this subpart shall:

(1) Reliably and functionally prevent:

(i) Train-to-train collisions—including collisions between trains operating over at-grade crossings of rail lines—where the risk associated with such collisions is unacceptable in accordance with the following table or alternative arrangements providing an equivalent level of safety as specified in an FRA approved PTCSP:

Crossing type	Max speed *	Protection required
Interlocking—one or more PTC routes intersecting with one or more non-PTC routes	≤40 miles per hour	Interlocking signal arrangement in accordance with the requirements of subparts A-G of this part and PTC enforced stop on PTC routes.
Interlocking—one or more PTC routes intersecting with one or more non-PTC routes	>40 miles per hour	Interlocking signal arrangement in accordance with the requirements of subparts A-G of this part, PTC enforced stop on all PTC routes, and either the use of other than full PTC technology that provides positive stop enforcement or a split-point derail incorporated into the signal system accompanied by 20 miles per hour maximum allowable speed on the approach of any intersecting non-PTC route.
Interlocking—all PTC routes intersecting	Any speed	Interlocking signal arrangements in accordance with the requirements of subparts A-G of this part, and PTC enforced stop on all routes.

(ii) Overspeed derailments, including derailments related to railroad civil engineering speed restrictions, slow orders, and excessive speeds over switches and through turnouts;

(iii) Incursions into established work zone limits without first receiving appropriate authority and verification from the dispatcher or roadway worker in charge, as applicable and in accordance with part 214 of this chapter; and

(iv) The movement of a train through a main line switch in the improper position as further described in paragraph (e) of this section.

(2) Include safety-critical integration of all authorities and indications of a wayside or cab signal system, or other similar appliance, method, device, or system of equivalent safety, in a manner by which the PTC system shall provide associated warning and enforcement to the extent, and except as, described and justified in the FRA approved PTCDP or PTCSP, as applicable;

(3) As applicable, perform the additional functions specified in this subpart;

(4) Provide an appropriate warning or enforcement when:

(i) A derail or switch protecting access to the main line required by § 236.1007, or otherwise provided for in the applicable PTCSP, is not in its derailing or protecting position, respectively;

(ii) An operational restriction is issued associated with a highway-rail grade crossing warning system malfunction as required by §§ 234.105, 234.106, or 234.107;

(iii) An after-arrival mandatory directive has been issued and the train or trains to be waited on has not yet passed the location of the receiving train;

(iv) Any movable bridge within the route ahead is not in a position to allow permissive indication for a train movement pursuant to § 236.312; and

(v) A hazard detector integrated into the PTC system that is required by paragraph (c) of this section, or otherwise provided for in the applicable PTCSP, detects an unsafe condition or transmits an alarm; and

(5) Limit the speed of passenger and freight trains to 59 miles per hour and 49 miles per hour, respectively, in areas without broken rail detection or equivalent safeguards.

(b) PTC system installation. (1) After December 31, 2015, a PTC system certified under § 236.1015 shall be installed by the host railroad on each:

(i) Main line over which is transported any quantity of poison- or toxic-by-inhalation (PIH) hazardous materials, as defined in §§ 171.8, 173.115 and 173.132 of this title;

(ii) Main line used for regularly provided intercity or commuter passenger service, except as provided in § 236.1019; and

(iii) Additional line of railroad as required by the applicable FRA-approved PTCSP, this subpart, or an FRA order requiring installation of a PTC system.

(2) For the purposes of paragraph (b)(1)(i) of this section, the information necessary to determine whether a Class I railroad's track segment shall be equipped with a PTC system shall be determined and reported as follows:

(i) The traffic density threshold of 5 million gross tons shall be based upon calendar year 2008 gross tonnage.

(ii) The presence or absence of any quantity of PIH hazardous materials shall be determined by whether one or more cars containing such product(s) was transported over the line segment in calendar year 2008.

(3) To the extent increases in freight rail traffic occur subsequent to calendar year 2008 that might affect the requirement to install a PTC system on any line not yet equipped, the railroad shall seek to amend its PTCIP by promptly filing an RFA in accordance with § 236.1021. The following criteria apply:

(i) To the extent rail traffic exceeds 5 million gross tons in any year after 2008, the tonnage shall be calculated for the preceding two calendar years in determining whether a PTCIP or its amendment is required.

(ii) To the extent PIH traffic is carried on a line segment as a result of a request for rail service or rerouting warranted under part 172 of this title, and if the line carries in excess of 5 million gross tons of rail traffic as determined under this paragraph. This does not apply when temporary rerouting is authorized in accordance with paragraph (g) of this section.

(iii) Once a railroad is notified by FRA that its RFA filed in accordance with this paragraph has been approved, the railroad shall equip the line with the applicable PTC system by December 31, 2015, or within 24 months, whichever is later.

(4) If a railroad has filed, and FRA has approved, its initial PTCIP, a railroad may file an RFA to request review of the requirement to install PTC on a line segment where a PTC system is required, but has not yet been installed, based upon changes in rail traffic such as reductions in total traffic volume or cessation of local PIH service. Any such RFA shall be accompanied by estimated traffic projections for the next 5 years (e.g., as a result of planned rerouting, coordinations, location of new business on the line). Where the request involves prior or planned rerouting of PIH traffic, the railroad must provide a supporting analysis that takes into consideration the requirements of subpart I, part 172 of this title, including any railroad-specific and interline routing impacts. FRA may approve the RFA if FRA finds that it would be consistent with safety and in the public interest.

(5) After December 31, 2015, no intercity or commuter rail passenger service shall continue or commence until a PTC system certified under this subpart has been installed and made operative.

(c) Hazard detectors. (1) All hazard detectors integrated into a signal or train control system on or after October 16, 2008, shall be integrated into PTC systems required by this subpart; and their warnings shall be appropriately and timely enforced as described in the applicable PTCSP.

(2) The applicable PTCSP may provide for receipt and presentation to the locomotive engineer and other train crew of warnings from additional hazard detectors using the PTC data network, onboard displays, and audible alerts. If the PTCSP so provides, the action to be taken by the system and by the crew members shall be specified.

(3) The PTCDP (as applicable) and PTCSP for any service described in § 236.1007 to be conducted above 90 miles per hour shall include a hazard analysis describing the hazards relevant to the specific route(s) in question (e.g., potential for track obstruction due to events such as falling rock or undermining of the track structure due to high water or displacement of a bridge over navigable waters), the basis for decisions concerning hazard detectors provided, and the manner in which such additional hazard detectors will be interfaced with the PTC system.

(d) Event recorders. (1) Each lead locomotive, as defined in part 229, of a train equipped and operating with a PTC system required by this subpart must be equipped with an operative event recorder, which shall:

(i) Record safety-critical train control data routed to the locomotive engineer's display that the engineer is required to comply with;

(ii) Specifically include text messages conveying mandatory directives and maximum authorized speeds; and

(iii) Include the display format, content, and data retention duration requirements specified in the PTC safety plan submitted and approved pursuant to this paragraph. If such train control data can be calibrated against other data required by this part, it may, at the election of the railroad, be retained in a separate memory module.

(2) Each lead locomotive, as defined in part 229, manufactured and in service after October 1, 2009, that is equipped and operating with a PTC system required by this subpart, shall be equipped with an event recorder memory module meeting the crash hardening requirements of § 229.135 of this chapter.

(3) Nothing in this subpart excepts compliance with any of the event recorder requirements contained in § 229.135 of this chapter.

(e) Switch position. The following requirements apply with respect to determining proper switch position under this section. When a main line switch position is unknown or improperly aligned for a train's route in advance of the train's movement, the PTC system will provide warning of the condition associated with the following enforcement:

(1) A PTC system must enforce restricted speed over any switch:

(i) Where train movements are made with the benefit of the indications of a wayside or cab signal system or other similar appliance, method, device, or system of equivalent safety proposed to FRA and approved by the Associate Administrator in accordance with this part; and

(ii) Where wayside or cab signal system or other similar appliance, method, device, or system of equivalent safety requires the train to be operated at restricted speed.

(2) A PTC system must enforce a positive stop short of any main line switch, and any switch on a siding where the allowable speed is in excess of 20 miles per hour, if movement of the train over the switch:

(i) Is made without the benefit of the indications of a wayside or cab signal system or other similar appliance, method, device, or system of equivalent safety proposed to FRA and approved by the Associate Administrator in accordance with this part; or

(ii) Would create an unacceptable risk. Unacceptable risk includes conditions when traversing the switch, even at low speeds, could result in direct conflict with the movement of another train (including a hand-operated crossover between main tracks, a hand-operated crossover between a main track and an adjoining siding or auxiliary track, or a hand-operated switch providing access to another subdivision or branch line, etc.).

(3) A PTC system required by this subpart shall be designed, installed, and maintained to perform the switch position detection and enforcement described in paragraphs (e)(1) and (e)(2) of this section, except as provided for and justified in the applicable, FRA-approved PTCDP or PTCSP.

(4) The control circuit or electronic equivalent for any movement authorities over any switches, movable-point frogs, or derails shall be selected through circuit controller or functionally equivalent device operated directly by switch points, derail, or by switch locking mechanism, or through relay or electronic device controlled by such circuit controller or functionally equivalent device, for each switch, movable-point frog, or derail in the route governed. Circuits or electronic equivalent shall be arranged so that any movement authorities can only be provided when each switch, movable-point frog, or derail in the route governed is in proper position, and shall be in accordance with subparts A through G of this part unless it is otherwise provided in a PTCSP approved under this subpart.

(f) Train-to-train collision. A PTC system shall be considered to be configured to prevent train-to-train collisions within the meaning of paragraph (a) of this section if trains are required to be operated at restricted speed and if the onboard PTC equipment enforces the upper limits of the railroad's restricted speed rule (15 or 20 miles per hour). This application applies to:

(1) Operating conditions under which trains are required by signal indication or operating rule to:

(i) Stop before continuing; or

(ii) Reduce speed to restricted speed and continue at restricted speed until encountering a more favorable indication or as provided by operating rule.

(2) Operation of trains within the limits of a joint mandatory directive.

(g) Temporary rerouting. A train equipped with a PTC system as required by this subpart may be temporarily rerouted onto a track not equipped with a PTC system and a train not equipped with a PTC system may be temporarily rerouted onto a track equipped with a PTC system as required by this subpart in the following circumstances:

(1) Emergencies. In the event of an emergency—including conditions such as derailment, flood, fire, tornado, hurricane, or other similar circumstance outside of the railroad's control—that would prevent usage of the regularly used track if:

(i) The rerouting is applicable only until the emergency condition ceases to exist and for no more than 14 consecutive calendar days, unless otherwise extended by approval of the Associate Administrator;

(ii) The railroad provides written or telephonic notification to the applicable Regional Administrator of the information listed in paragraph (i) within one business day of the beginning of the rerouting made in accordance with this paragraph; and

(iii) The conditions under paragraph (j) are followed.

(2) Planned maintenance. In the event of planned maintenance that would prevent usage of the regularly used track if:

(i) The maintenance period does not exceed 30 days;

(ii) A request is filed with the applicable Regional Administrator in accordance with paragraph (i) of this section no less than 10 business days prior to the planned rerouting; and

(iii) the conditions contained in paragraph (j) of this section are followed.

(h) Rerouting requests. (1) For the purposes of paragraph (g)(2) of this section, the rerouting request shall be self-executing unless the applicable Regional Administrator responds with a notice disapproving of the rerouting or providing instructions to allow rerouting. Such instructions may include providing additional information to the Regional Administrator or Associate Administrator prior to the commencement of rerouting. Once the Regional Administrator responds with a notice under this paragraph, no rerouting may occur until the Regional Administrator or Associate Administrator provides his or her approval.

(2) In the event the temporary rerouting described in paragraph (g)(2) of this section is to exceed 30 consecutive calendar days:

(i) The railroad shall provide a request in accordance with paragraphs (i) and (j) of this section with the Associate Administrator no less than 10 business days prior to the planned rerouting; and

(ii) The rerouting contemplated by this paragraph shall not commence until receipt of approval from the Associate Administrator.

(i) Content of rerouting request. Each notice or request referenced in paragraph (g) of this section must indicate:

(1) The dates that such temporary rerouting will occur;

(2) The number and types of trains that will be rerouted;

(3) The location of the affected tracks; and

(4) A description of the necessity for the temporary rerouting.

(j) Rerouting conditions. Rerouting of operations under paragraph (g) of this section may only occur if:

(1) An absolute block is established in advance of each rerouted train movement; and

(2) Each rerouted train movement shall not exceed 59 miles per hour for passenger and 49 miles per hour for freight.

(k) Rerouting cessation. The applicable Regional Administrator may order a railroad to cease any rerouting provided under paragraph (g) or (h) of this section.

§ 236.1006

Equipping locomotives operating in PTC territory.

(a) Except as provided in paragraph (b) of this section, each train operating on any track segment equipped with a PTC system shall be controlled by a locomotive equipped with an on-board PTC apparatus that is fully operative and functioning in accordance with the applicable PTCSP approved under this subpart.

(b) Exceptions. (1) Prior to December 31, 2015, each train controlled by a locomotive not equipped with an onboard PTC apparatus is permitted to operate.

(2) Prior to December 31, 2013, each train controlled by a locomotive equipped with an onboard PTC apparatus that is not fully operative is permitted only if:

(i) The subject locomotive failed initialization at the point of origin for the train or at the location where the locomotive was added to the train;

(ii) The railroad has included in its FRA approved PTC Implementation Plan a system for identifying PTC system reliability exceptions and responding with appropriate remedial actions, the railroad executes that plan, and the documentation for execution of the plan is currently available to FRA upon request; and

(iii) The percentage of controlling locomotives operating out of each railroad's initial terminals after receiving a failed initialization and over a track segment equipped with a PTC system, does not during each calendar month exceed:

(A) 20 percent until December 31, 2011;

(B) 15 percent from the end of the period in paragraph (A) to December 31, 2012; and

(C) 10 percent from the end of the period in paragraph (B) to December 31, 2013.

(3) A train controlled by a locomotive with an onboard PTC apparatus that has failed en route is permitted to operate in accordance with § 236.1029.

(4) A train operated by a Class II or Class III railroad, including a tourist or excursion railroad, and controlled by a locomotive not equipped with an onboard PTC apparatus is permitted to operate on a PTC operated track segment:

(i) That either:

(A) Has no regularly scheduled intercity or passenger rail passenger transportation traffic; or

(B) Has regularly scheduled intercity or passenger rail passenger transportation traffic and the applicable PTCIP permits the operation of a train operated by a Class II or III railroad and controlled by a locomotive not equipped with an onboard PTC apparatus;

(ii) Where operations are restricted to less than four such unequipped trains per day, whereas a train conducting a “turn” operation (e.g., moving to a point of interchange to drop off or pick up cars and returning to the track owned by a Class II or III railroad) is considered two trains for this purpose; and

(iii) Where each movement shall either:

(A) Not exceed 20 miles in length; or

(B) To the extent any movement exceeds 20 miles in length, such movement is not permitted without the controlling locomotive being equipped with an onboard PTC system after December 31, 2020, and each applicable Class II or III railroad shall report to FRA its progress in equipping each necessary locomotive with an onboard PTC apparatus to facilitate continuation of the movement. The progress reports shall be filed not later than December 31, 2017 and, if all necessary locomotives are not yet equipped, on December 31, 2019.

(c) When a train movement is conducted under the exceptions described in paragraph (b)(4) of this section, that movement shall be made in accordance with § 236.1029.

§ 236.1007

Additional requirements for high-speed service.

(a) A PTC railroad that conducts a passenger operation at or greater than 60 miles per hour or a freight operation at or greater than 50 miles per hour shall have installed a PTC system including or working in concert with technology that includes all of the safety-critical functional attributes of a block signal system meeting the requirements of this part, including appropriate fouling circuits and broken rail detection (or equivalent safeguards).

(b) In addition to the requirements of paragraph (a), a host railroad that conducts a freight or passenger operation at more than 90 miles per hour shall:

(1) Have an approved PTCSP establishing that the system was designed and will be operated to meet the failsafe operation criteria described in Appendix C to this part; and

(2) Prevent unauthorized or unintended entry onto the main line from any track not equipped with a PTC system compliant with this subpart by placement of split-point derails or equivalent means integrated into the PTC system; and

(3) Comply with § 236.1029(c).

(c) In addition to the requirements of paragraphs (a) and (b), a host railroad that conducts a freight or passenger operation at more than 125 miles per hour shall have an approved PTCSP accompanied by a document (“HSR-125”) establishing that the system:

(1) Will be operated at a level of safety comparable to that achieved over the 5-year period prior to the submission of the PTCSP by other train control systems that perform PTC functions required by this subpart, and which have been utilized on high-speed rail systems with similar technical and operational characteristics in the United States or in foreign service, provided that the use of foreign service data must be approved by the Associate Administrator before submittal of the PTCSP; and

(2) Has been designed to detect incursions into the right-of-way, including incidents involving motor vehicles diverting from adjacent roads and bridges, where conditions warrant.

(d) In addition to the requirements of paragraphs (a) through (c) of this section, a host railroad that conducts a freight or passenger operation at more than 150 miles per hour, which is governed by a Rule of Particular Applicability, shall have an approved PTCSP accompanied by a HSR-125 developed as part of an overall system safety plan approved by the Associate Administrator.

§ 236.1009

Procedural requirements.

(a) PTC Implementation Plan (PTCIP). (1) By April 16, 2010, each host railroad that is required to implement and operate a PTC system in accordance with § 236.1005(b) shall develop and submit in accordance with § 236.1011(a) a PTCIP for implementing a PTC system required under § 236.1005. Filing of the PTCIP shall not exempt the required filings of a PTCSP, PTCDP, or Type Approval.

(2) After April 16, 2010, a host railroad shall file:

(i) A PTCIP if it becomes a host railroad of a main line track; or

(ii) A request for amendment (“RFA”) of its current and approved PTCIP in accordance with § 236.1021 if it intends to:

(A) Initiate a new category of service (i.e., passenger or freight); or

(B) Add, subtract, or otherwise materially modify one or more lines of railroad for which installation of a PTC system is required.

(3) If the host railroad is a freight railroad, and the subject trackage would require installation and operation of a PTC system in accordance with §§ 236.1005(b)(2) or (b)(3), then a PTCIP required to be filed in accordance with this paragraph (a)(1) or (a)(2) of this section must be jointly filed with each entity providing regularly scheduled intercity or commuter rail passenger transportation over that subject trackage. If railroads are unable to jointly file a PTCIP in accordance with paragraphs (a)(1) and (a)(3) of this section, then they each shall:

(i) Separately file a PTCIP in accordance with paragraph (a)(1);

(ii) Notify the Associate Administrator that the subject railroads were unable to agree on a PTCIP to be jointly filed;

(iii) Provide the Associate Administrator with a comprehensive list of all issues not in agreement between the railroads that would prevent the subject railroads from jointly filing the PTCIP; and

(iv) Confer with the Associate Administrator to develop and submit a PTCIP mutually acceptable to all subject railroads.

(b) Type Approval. A host railroad, or one or more system suppliers and one or more host railroads, shall file prior to or simultaneously with the filing made in accordance with paragraph (a) of this section:

(1) An unmodified Type Approval previously issued by the Associate Administrator in accordance with § 236.1013 or § 236.1031(b) with its associated docket number;

(2) A PTCDP requesting a Type Approval for:

(i) A PTC system that does not have a Type Approval; or

(ii) A PTC system with a previously issued Type Approval that requires one or more variances;

(3) A PTCSP subject to the conditions set forth in paragraph (c) of this section, with or without a Type Approval; or

(4) A document attesting that a Type Approval is not necessary since the host railroad has no territory for which a PTC system is required under this subpart.

(c) PTCSP and PTC System Certification. The following apply to each PTCSP and PTC System Certification.

(1) A PTC System Certification for a PTC system may be obtained by submitting an acceptable PTCSP. If the PTC system is the subject of a Type Approval, the safety case elements contained in the PTCDP may be incorporated by reference into the PTCSP, subject to finalization of the human factors analysis contained in the PTCDP.

(2) Each PTCSP requirement under § 236.1015 shall be supported by information and analysis sufficient to establish that the requirements of this subpart have been satisfied.

(3) If the Associate Administrator finds that the PTCSP and supporting documentation support a finding that the system complies with this part, the Associate Administrator may approve the PTCSP. If the Associate Administrator approves the PTCSP, the railroad shall receive PTC System Certification for the subject PTC system and shall implement the PTC system according to the PTCSP.

(4) A required PTC system shall not:

(i) Be used in service until it receives from FRA a PTC System Certification; and

(ii) Receive a PTC System Certification unless FRA receives and approves an applicable:

(A) PTCIP and PTCSP; or

(B) Request for Expedited Certification (REC) as defined by § 236.1031(a).

(d) Plan contents. (1) No PTCIP shall receive approval unless it complies with § 236.1011. No railroad shall receive a Type Approval or PTC System Certification unless the applicable PTCDP or PTCSP, respectively, comply with §§ 236.1013 and 236.1015, respectively.

(2) All materials filed in accordance with this subpart must be in the English language, or have been translated into English and attested as true and correct.

(3) Each filing referenced in this section may include a request for full or partial confidentiality in accordance with § 209.11 of this chapter. If confidentiality is requested as to a portion of any applicable document, then in addition to the filing requirements under § 209.11 of this chapter, the person filing the document shall also file a copy of the original unredacted document, marked to indicate which portions are redacted in the document's confidential version without obscuring the original document's contents.

(e) Supporting documentation and information. (1) Issuance of a Type Approval or PTC System Certification is contingent upon FRA's confidence in the implementation and operation of the subject PTC system. This confidence may be based on FRA-monitored field testing or an independent assessment performed in accordance with § 236.1035 or § 236.1017, respectively.

(2) Upon request by FRA, the railroad requesting a Type Approval or PTC System Certification must engage in field testing or independent assessment performed in accordance with § 236.1035 or § 236.1017, respectively, to support the assertions made in any of the plans submitted under this subpart. These assertions include any of the plans' content requirements under this subpart.

(f) FRA conditions, reconsiderations, and modifications. (1) As necessary to ensure safety, FRA may attach special conditions to approving a PTCIP or issuing a Type Approval or PTC System Certification.

(2) After granting a Type Approval or PTC System Certification, FRA may reconsider the Type Approval or PTC System Certification upon revelation of any of the following factors concerning the contents of the PTCIP, PTCDP or PTCSP:

(i) Potential error or fraud;

(ii) Potentially invalidated assumptions determined as a result of in-service experience or one or more unsafe events calling into question the safety analysis supporting the approval.

(3) During FRA's reconsideration in accordance with this paragraph, the PTC system may remain in use if otherwise consistent with the applicable law and regulations and FRA may impose special conditions for use of the PTC system.

(4) After FRA's reconsideration in accordance with this paragraph, FRA may:

(i) Dismiss its reconsideration and continue to recognize the existing FRA approved Type Approval;

(ii) Allow continued operations under such conditions the Associate Administrator deems necessary to ensure safety; or

(iii) Revoke the Type Approval or PTC System Certification and direct the railroad to cease operations where PTC systems are required under this subpart.

(g) FRA access. The Associate Administrator, or that person's designated representatives, shall be afforded reasonable access to monitor, test, and inspect processes, procedures, facilities, documents, records, design and testing materials, artifacts, training materials and programs, and any other information used in the design, development, manufacture, test, implementation, and operation of the system, as well as interview any personnel:

(1) Associated with a PTC system for which a Type Approval or PTC System Certification has been requested or provided; or

(2) To determine whether a railroad has been in compliance with this subpart.

(h) Foreign regulatory entity verification. Information that has been certified under the auspices of a foreign regulatory entity recognized by the Associate Administrator may, at the Associate Administrator's sole discretion, be accepted as independently Verified and Validated and used to support each railroad's development of the PTCSP.

§ 236.1011

PTCIP content requirements.

(a) Contents. A PTCIP filed pursuant to this subpart shall, at a minimum, describe:

(1) The technology that will be employed;

(2) How the PTC railroad intends to comply with § 236.1009(c);

(3) How the PTC system will provide for interoperability of the system between the host and all tenant railroads on the lines required to be equipped with PTC systems under this subpart and:

(i) Include copies of relevant provisions of any agreements, executed by all applicable railroads, in place to achieve interoperability;

(ii) List all technologies used to obtain interoperability; and

(iii) Identify any railroads with respect to which interoperability agreements or compatible technology have not been achieved as of the time the plan is filed, the practical obstacles that were encountered that prevented resolution, and the further steps planned to overcome those obstacles;

(4) How, to the extent practical, the PTC system will be implemented to address areas of greater risk to the public and railroad employees before areas of lesser risk;

(5) The sequence and schedule in which line segments will be equipped and the basis for those decisions, and shall at a minimum address the following risk factors by line segment:

(i) Segment traffic characteristics such as typical annual passenger and freight train volume and volume of poison- or toxic-by-inhalation (PIH or TIH) shipments (loads, residue);

(ii) Segment operational characteristics such as current method of operation (including presence or absence of a block signal system), number of tracks, and maximum allowable train speeds, including planned modifications; and

(iii) Route attributes bearing on risk, including ruling grades and extreme curvature;

(6) The following information relating to rolling stock:

(i) What rolling stock will be equipped with PTC technology;

(ii) The schedule to equip that rolling stock by December 31, 2015; and

(iii) Unless the tenant railroad is filing its own PTCIP, the host railroad's PTCIP shall:

(A) Attest that the host railroad has made a formal written request to each tenant railroad requesting identification of each rolling stock to be PTC system equipped and the date each will be equipped; and

(B) Include each tenant railroad's response to the host railroad's written request made in accordance with paragraph (a)(6)(iii)(A) of this section;

(7) The number of wayside devices required for each line segment and the installation schedule to complete wayside equipment installation by December 31, 2015;

(8) which track segments the railroad considers mainline and non-mainline track. If the PTCIP includes a MTEA, as defined by § 236.1019, the PTCIP should identify the tracks included in the MTEA as main line track with a reference to the MTEA; and

(9) to the extent the railroad determines that risk-based prioritization required by paragraph (a)(4) of this section is not practical, the basis for this determination; and

(b) Additional Class I railroad PTCIP requirements. Each Class I railroad shall include:

(1) In its PTCIP a strategy for full deployment of its PTC system, describing the criteria that it will apply in identifying additional rail lines on its own network, and rail lines of entities that it controls or engages in joint operations with, for which full or partial deployment of PTC technologies is appropriate, beyond those required to be equipped under this subpart. Such criteria shall include consideration of the policies established by 49 U.S.C. 20156 (railroad safety risk reduction program), and regulations issued thereunder, as well as non-safety business benefits that may accrue.

(2) In the Technology Implementation Plan of its Risk Reduction Program, when first required to be filed in accordance with 49 U.S.C. 20156 and any regulation promulgated thereunder, a specification of rail lines selected for full or partial deployment of PTC under the criteria identified in its PTCIP.

(3) Nothing in this paragraph shall be construed to create an expectation or requirement than additional rail lines beyond those required to be equipped by this subpart must be equipped or that such lines will be equipped during the period of primary implementation ending December 31, 2015.

(4) As used in this paragraph, “partial implementation” of a PTC system refers to use, pursuant to subpart H of this part, of technology embedded in PTC systems that does not employ all of the functionalities required by this subpart.

(c) FRA review. Within 90 days of receipt of a PTCIP, the Associate Administrator will approve or disapprove of the plan and notify in writing the affected railroad or other entity. If the PTCIP is not approved, the notification will include the plan's deficiencies. Within 30 days of receipt of that notification, the railroad or other entity that submitted the plan shall correct all deficiencies and resubmit the plan in accordance with § 236.1009 and paragraph (a) of this section, as applicable.

(d) Subpart H. A railroad that elects to install a PTC system when not required to do so may elect to proceed under this subpart or under subpart H.

(e) Upon receipt of a PTCIP, PTCDP, or PTCSP, FRA posts on its public Web site notice of receipt and reference to the public docket in which a copy of the filing has been placed. FRA may consider any public comment on each document to the extent practicable within the time allowed by law and without delaying implementation of PTC systems.

§ 236.1013

PTCDP content requirements and Type Approval.

(a) For a PTC system to obtain a Type Approval from FRA, the PTCDP shall be filed in accordance with § 236.1009 and shall include:

(1) A complete description of the PTC system, including a list of all PTC system components and their physical relationships in the subsystem or system;

(2) A description of the railroad operation or categories of operations on which the PTC system is designed to be used, including train movement density (passenger, freight), operating speeds, track characteristics, and railroad operating rules;

(3) An operational concepts document, including a list with complete descriptions of all functions which the PTC system will perform to enhance or preserve safety;

(4) A document describing the manner in which the PTC architecture satisfies safety requirements;

(5) A description of the safety assurance concepts that are to be used for system development, including an explanation of the design principles and assumptions;

(6) A preliminary human factors analysis, including a complete description of all human-machine interfaces and the impact of interoperability requirements on the same;

(7) An analysis of the applicability to the PTC system of the requirements of subparts A-G of this part that may no longer apply or are satisfied by the PTC system using an alternative method, and a complete explanation of the manner in which those requirements are otherwise fulfilled;

(8) A description of the necessary security measures for the system;

(9) A description of target safety levels (e.g., MTTHE for major subsystems as defined in subpart H), including requirements for system availability and a description of all backup methods of operation and any critical assumptions associated with the target levels;

(10) A complete description of how the PTC system will enforce authorities and signal indications;

(11) A description of the deviation required under § 236.1029(c), if applicable; and

(12) A complete description of how the PTC system will appropriate and timely enforce all integrated hazard detectors in accordance with § 236.1005(c)(3), if applicable.

(b) If the Associate Administrator finds that the system described in the PTCDP would satisfy the requirements for PTC systems under this subpart and that the applicant has made a reasonable showing that a system built to the stated requirements would achieve the level of safety mandated for such a system under § 236.1015, the Associate Administrator may grant a numbered Type Approval for the system.

(c) Each Type Approval shall be valid for a period of 5 years, subject to automatic and indefinite extension provided that at least one PTC System Certification using the subject PTC system has been issued within that period and not revoked.

(d) A PTCSP submitted under this subpart may reference and utilize in accordance with this subpart any Type Approval previously issued by the Associate Administrator to any railroad, provided that the railroad:

(1) Maintains a continually updated PTCPVL pursuant to § 236.1023; and

(2) Provides the applicable licensing information.

(e) A railroad submitting a PTCDP under this subpart must show that the supplier from which they are procuring the PTC system has established and can maintain a quality control system for PTC system design and manufacturing acceptable to the Associate Administrator.

(f) The Associate Administrator may prescribe special conditions, amendments, and restrictions to any Type Approval as necessary for safety.

§ 236.1015

PTCSP content requirements and PTC System Certification.

(a) Before placing a PTC system required under this part in service, the host railroad must submit to FRA a PTCSP and receive a PTC System Certification. If the Associate Administrator finds that the PTCSP and supporting documentation support a finding that the system complies with this part, the Associate Administrator approves the PTCSP and issues a PTC System Certification. Receipt of a PTC System Certification affirms that the PTC system has been reviewed and approved by FRA in accordance with, and meets the requirements of, this part.

(b) A PTCSP submitted in accordance with this subpart shall:

(1) Include the applicable FRA approved PTCIP and, if applicable, the PTCDP and Type Approval;

(2)(i) Specifically and rigorously document each variance, including the significance of each variance between the PTC system and its applicable operating conditions as described in the applicable PTCIP and any applicable PTCDP from that as described in the PTCSP, and attest that are no other such variances; or

(ii) Attest that there are no variances between the PTC system and its applicable operating conditions as described in the applicable PTCIP and any applicable PTCDP from that as described in the PTCSP; and

(3) Attest that the system was otherwise built in accordance with the applicable PTCDP and PTCSP and achieves the level of safety represented therein.

(c) A PTCSP shall include the same information required for a PTCDP under § 236.1013(a). If a PTCDP has been filed and approved prior to filing of the PTCSP, PTCSP may incorporate the PTCDP by reference, with the exception that a final human factors analysis shall be provided. The PTCSP shall contain the following additional elements:

(1) A hazard log consisting of a comprehensive description of all safety-relevant hazards not previously addressed by the vendor to be addressed during the life cycle of the PTC system, including maximum threshold limits for each hazard (for unidentified hazards, the threshold shall be exceeded at one occurrence);

(2) A risk assessment of the as-built PTC system described;

(3) A hazard mitigation analysis, including a complete and comprehensive description of each hazard and the mitigation techniques used;

(4) A complete description of the safety assessment and Verification and Validation processes applied to the PTC system, their results, and whether these processes address the safety principles described in Appendix C to this part directly, using other safety criteria, or not at all;

(5) A complete description of the railroad's training plan for railroad and contractor employees and supervisors necessary to ensure safe and proper installation, implementation, operation, maintenance, repair, inspection, testing, and modification of the PTC system;

(6) A complete description of the specific procedures and test equipment necessary to ensure the safe and proper installation, implementation, operation, maintenance, repair, inspection, testing, and modification of the PTC system on the railroad and establish safety-critical hazards are appropriately mitigated. These procedures, including calibration requirements, shall be consistent with or explain deviations from the equipment manufacturer's recommendations;

(7) A complete description of any additional warning to be placed in the Operations and Maintenance Manual in the same manner specified in § 236.919 and all warning labels to be placed on equipment as necessary to ensure safety;

(8) A complete description of the configuration or revision control measures designed to ensure that the railroad or its contractor does not adversely affect the safety-functional requirements and that safety-critical hazard mitigation processes are not compromised as a result of any such change;

(9) A complete description of all initial implementation testing procedures necessary to establish that safety-functional requirements are met and safety-critical hazards are appropriately mitigated;

(10) A complete description of all post-implementation testing (validation) and monitoring procedures, including the intervals necessary to establish that safety-functional requirements, safety-critical hazard mitigation processes, and safety-critical tolerances are not compromised over time, through use, or after maintenance (adjustment, repair, or replacement) is performed;

(11) A complete description of each record necessary to ensure the safety of the system that is associated with periodic maintenance, inspections, tests, adjustments, repairs, or replacements, and the system's resulting conditions, including records of component failures resulting in safety-relevant hazards (see § 236.1033);

(12) A safety analysis to determine whether, when the system is in operation, any risk remains of an unintended incursion into a roadway work zone due to human error. If the analysis reveals any such risk, the PTCDP and PTCSP shall describe how that risk will be mitigated;

(13) A more detailed description of any alternative arrangements as already provided under § 236.1011(a)(10);

(14) A complete description of how the PTC system will enforce authorities and signal indications, unless already completely provided for in the PTCDP;

(15) A description of how the PTCSP complies with § 236.1019(e), if applicable;

(16) A description of the deviation required under § 236.1029(c), if applicable and unless already completely provided for in the PTCDP;

(17) A complete description of how the PTC system will appropriate and timely enforce all integrated hazard detectors in accordance with § 236.1005;

(18) An emergency and planned maintenance temporary rerouting plan indicating how operations on the subject PTC system will take advantage of the benefits provided under § 236.1005(g)-(k); and

(19) Any alternative arrangements for each rail at-grade crossing not adhering to the table under § 236.1005(a)(1)(i).

(d) The following additional requirements apply to:

(1) Non-vital overlay. A PTC system proposed as an overlay on the existing method of operation and not built in accordance with the safety assurance principles set forth in Appendix C of this part must, to the satisfaction of the Associate Administrator, be shown to:

(i) Reliably execute the functions set forth in § 236.1005;

(ii) Obtain at least 80 percent reduction of the risk associated with accidents preventable by the functions set forth in § 236.1005, when all effects of the change associated with the PTC system are taken into account. The supporting risk assessment shall evaluate all intended changes in railroad operations coincident with the introduction of the new system; and

(iii) Maintain a level of safety for each subsequent system modification that is equal to or greater than the level of safety for the previous PTC systems.

(2) Vital overlay. A PTC system proposed on a newly constructed track or as an overlay on the existing method of operation and is built in accordance with the safety assurance principles set forth in Appendix C of this part must, to the satisfaction of the Associate Administrator, be shown to:

(i) Reliably execute the functions set forth in § 236.1005; and

(ii) Have sufficient documentation to demonstrate that the PTC system, as built, fulfills the safety assurance principles set forth in Appendix C of this part. The supporting risk assessment may be abbreviated as that term is used in subpart H of this part.

(3) Stand-alone. A PTC system proposed on a newly constructed track, an existing track for which no signal system exists, as a replacement for an existing signal or train control system, or to otherwise intend to replace or materially modify the existing method of operation, shall:

(i) Demonstrate to reliably execute the functions required by § 236.1005; and

(ii) Have a PTCSP establishing, with a high degree of confidence, that the system will not introduce new hazards that have not been mitigated. The supporting risk assessment shall evaluate all intended changes in railroad operations in relation to the introduction of the new system and shall examine in detail the direct and indirect effects of all changes in the method of operations.

(4) Mixed systems. If a PTC system combining overlay, stand-alone, vital, or non-vital characteristics is proposed, the railroad shall confer with the Associate Administrator regarding appropriate structuring of the safety case and analysis.

(e) When determining whether the PTCSP fulfills the requirements under paragraph (d) of this section, the Associate Administrator may consider all available evidence concerning the reliability and availability of the proposed system and any and all safety consequences of the proposed changes. In any case where the PTCSP lacks data regarding safety impacts of the proposed changes, the Associate Administrator may request the necessary data from the applicant. If the requested data is not provided, the Associate Administrator may find that potential hazards could or will arise.

(f) If a PTCSP applies to a system designed to replace an existing certified PTC system, the PTCSP will be approved provided that the PTCSP establishes with a high degree of confidence that the new system will provide a level of safety not less than the level of safety provided by the system to be replaced.

(g) When reviewing the issue of the potential data errors (for example, errors arising from data supplied from other business systems needed to execute the braking algorithm, survey data needed for location determination, or mandatory directives issued through the computer-aided dispatching system), the PTCSP must include a careful identification of each of the risks and a discussion of each applicable mitigation. In an appropriate case, such as a case in which the residual risk after mitigation is substantial or the underlying method of operation will be significantly altered, the Associate Administrator may require submission of a quantitative risk assessment addressing these potential errors.

§ 236.1017

Independent third party Verification and Validation.

(a) The PTCSP must be supported by an independent third-party assessment when the Associate Administrator concludes that it is necessary based upon the same criteria set forth in § 236.913 of this chapter, with the exception that consideration of the methodology used in the risk assessment (§ 236.913(g)(2)(vii)) shall apply only to the extent that a comparative risk assessment was required. To the extent practicable, FRA makes this determination not later than review of the PTCIP and the accompanying PTCDP or PTCSP. If an independent assessment is required, the assessment may apply to the entire system or a designated portion of the system.

(b) If a PTC system is to undergo an independent assessment in accordance with this section, it may submit to the Associate Administrator a written request that FRA confirm whether a particular entity would be considered an independent third party pursuant to this section. The request should include supporting information in accordance with paragraph (c) of this section. FRA may request further information to make a determination or provide its determination in writing.

(c) As used in this section, “independent third party” means a technically competent entity responsible to and compensated by the railroad (or an association on behalf of one or more railroads) that is independent of the PTC system supplier and vendor. An entity that is owned or controlled by the supplier or vendor, that is under common ownership or control with the supplier or vendor, or that is otherwise involved in the development of the PTC system is not considered “independent” within the meaning of this section.

(d) The independent third party assessment must, at a minimum, consist of the activities and result in the production of documentation meeting the requirements of Appendix F to this part, unless excepted by this part or by FRA order or waiver.

(e) Information provided that has been certified under the auspices of a foreign railroad regulatory entity recognized by the Associate Administrator may, at the Associate Administrator's discretion, be accepted as having been independently verified.

§ 236.1019

Main line track exceptions.

(a) Scope and procedure. This section pertains exclusively to exceptions from the rule that trackage over which scheduled intercity and commuter passenger service is provided is considered main line track requiring installation of a PTC system. One or more intercity or commuter passenger railroads, or freight railroads conducting joint passenger and freight operation over the same segment of track may file a main line track exclusion addendum (“MTEA”) to its PTCIP requesting to designate track as not main line subject to the condition that such trackage may not be trackage otherwise required to be equipped (e.g., because of tonnage and PIH traffic) and to the further conditions set forth in paragraphs (b) and (c) of this section. No track shall be designated as yard or terminal unless it is identified in a MTEA that is part of an FRA approved PTCIP.

(b) Passenger terminal exception. FRA will consider an exception in the case of trackage used exclusively as yard or terminal tracks by or in support of regularly scheduled intercity or commuter passenger service where the MTEA describes in detail the physical boundaries of the trackage in question, its use and characteristics (including track and signal charts) and all of the following apply:

(1) The maximum authorized speed for all movements is not greater than 20 miles per hour, and that maximum is enforced by any available onboard PTC equipment within the confines of the yard or terminal;

(2) Interlocking rules are in effect prohibiting reverse movements other than on signal indications without dispatcher permission; and

(3) No freight operations are permitted.

(c) Limited operations exception. FRA will consider an exception in the case of trackage used for limited operations by at least one passenger railroad subject to at least one of the following conditions:

(1) All trains are limited to restricted speed;

(2) Temporal separation of passenger and other trains is maintained as provided in paragraph (d) of this section; or

(3) Passenger service is operated under a risk mitigation plan submitted by all railroads involved in the joint operation and approved by FRA. The risk mitigation plan must be supported by a risk assessment establishing that the proposed mitigations will achieve a level of safety not less than the level of safety that would obtain if the operations were conducted under paragraph (c)(1) or (c)(2) of this section.

(d) Temporal separation. As used in this section, temporal separation means the processes or physical arrangements, or both, in place to assure that limited passenger and freight operations do not operate on any segment of shared track during the same period. The use of exclusive authorities under mandatory directives is not, by itself, sufficient to establish that temporal separation is achieved. Procedures to ensure temporal separation shall include verification checks between passenger and freight and effective physical means to positively ensure segregation of passenger and freight operations in accordance with this paragraph.

(e) PTCSP requirement. No PTCSP filed after the approval of a PTCIP with an MTEA shall be approved by FRA unless it attests that no changes, except for those included in a FRA approved RFA, have been made to the information in the PTCIP and MTEA required by paragraph (b) or (c) of this section.

(f) Designation modifications. If subsequent to approval of its PTCIP or PTCSP the railroad seeks to modify which track or tracks should be designated as main line or not main line, it shall request modification of its PTCIP or PTCSP, as applicable, in accordance with § 236.1021.

§ 236.1021

Discontinuances, material modifications, and amendments.

(a) No changes, as defined by this section, to a PTC system, PTCIP, PTCDP, or PTCSP, shall be made unless:

(1) The railroad files a request for amendment (“RFA”) to the applicable PTCIP, PTCDP, or PTCSP with the Associate Administrator; and

(2) The Associate Administrator approves the RFA.

(b) After approval of a RFA in accordance with paragraph (a) of this section, the railroad shall immediately adopt and comply with the amendment.

(c) In lieu of a separate filing under part 235 of this chapter, a railroad may request approval of a discontinuance or material modification of a signal or train control system by filing a RFA to its PTCIP, PTCDP, or PTCSP with the Associate Administrator.

(d) A RFA made in accordance with this section will not be approved by FRA unless the request includes:

(1) The information listed in § 235.10 of this chapter and the railroad provides FRA upon request any additional information necessary to evaluate the RFA (see § 235.12), including:

(2) The proposed modifications;

(3) The reasons for each modification;

(4) The changes to the PTCIP, PTCDP or PTCSP, as applicable;

(5) Each modification's effect on PTC system safety;

(6) An approximate timetable for filing of the PTCDP, PTCSP, or both, if the amendment pertains to a PTCIP; and

(7) An explanation of whether each change to the PTCSP is planned or unplanned.

(A) Unplanned changes that affect the Type Approval's PTCDP require submission and approval in accordance with § 236.1013 of a new PTCDP, followed by submission and approval in accordance with § 236.1015 of a new PTCSP for the PTC system.

(B) Unplanned changes that do not affect the Type Approval's PTCDP require submission and approval of a new PTCSP.

(C) Unplanned changes are changes affecting system safety that have not been documented in the PTCSP. The impact of unplanned changes on PTC system safety has not yet been determined.

(D) Planned changes may be implemented after they have undergone suitable regression testing to demonstrate, to the satisfaction of the Associate Administrator, they have been correctly implemented and their implementation does not degrade safety.

(E) Planned changes are changes affecting system safety in the PTCSP and have been included in all required analysis under § 236.1017. The impact of these changes on the PTC system's safety has been incorporated as an integral part of the approved PTCSP safety analysis.

(e) If the RFA includes a request for approval of a discontinuance or material modification of a signal or train control system, FRA will publish a notice in the Federal Register of the application and will invite public comment in accordance with part 211 of this chapter.

(f) When considering the RFA, FRA will review the issue of the discontinuance or material modification and determine whether granting the request is in the public interest and consistent with railroad safety, taking into consideration all changes in the method of operation and system functionalities, both within normal PTC system availability and in the case of a system failed state (unavailable), contemplated in conjunction with installation of the PTC system. The railroad submitting the RFA must, at FRA's request, perform field testing in accordance with § 236.1035 or engage in Verification and Validation in accordance with § 236.1017.

(g) FRA may issue at its discretion a new Type Approval number for a PTC system modified under this section.

(h) Changes requiring filing of an RFA. Except as provided by paragraph (i), an RFA shall be filed to request the following:

(1) Discontinuance of a PTC system, or other similar appliance or device;

(2) Decrease of the PTC system's limits;

(3) Modification of a safety critical element of a PTC system; or

(4) Modification of a PTC system that affects the safety critical functionality of any other PTC system with which it interoperates.

(i) Discontinuances not requiring the filing of an RFA. It is not necessary to file an RFA for the following discontinuances:

(1) Removal of a PTC system from track approved for abandonment by formal proceeding;

(2) Removal of PTC devices used to provide protection against unusual contingencies such as landslide, burned bridge, high water, high and wide load, or tunnel protection when the unusual contingency no longer exists;

(3) Removal of the PTC devices that are used on a movable bridge that has been permanently closed by the formal approval of another government agency and is mechanically secured in the closed position for rail traffic; or

(4) Removal of the PTC system from service for a period not to exceed six months that is necessitated by catastrophic occurrence such as derailment, flood, fire, or hurricane.

(j) Changes not requiring the filing of an RFA. When the resultant change to the PTC system will comply with an approved PTCSP of this part, it is not necessary to file for approval to decrease the limits of a system when it involves the:

(1) Decrease of the limits of a PTC system when interlocked switches, derails, or movable-point frogs are not involved;

(2) Removal of an electric or mechanical lock from hand-operated switch in a PTC system where train speed over switch does not exceed 20 miles per hour; or

(3) Removal of an electric lock from hand-operated switch in a PTC system where trains are not permitted to clear the main track at such switch and the electric lock has not been a part of the conditional approval of a PTCSP.

(k) Modifications not requiring the filing of an RFA. When the resultant arrangement will comply with an approved PTCSP of this part, it is not necessary to file an application for approval of the following modifications:

(1) A modification that is required to comply with an order of the Federal Railroad Administration or any section of part 236 of this title;

(2) Installation of devices used to provide protection against unusual contingencies such as landslide, burned bridges, high water, high and wide loads, or dragging equipment;

(3) Elimination of existing track other than a second main track;

(4) Extension or shortening of a passing siding;

(5) A line relocation;

(6) Installation of new track; or

(7) The temporary or permanent arrangement of existing systems necessitated by highway rail separation construction. Temporary arrangements shall be removed within six months following completion of construction.

§ 236.1023

Errors and malfunctions.

(a) Except as provided in paragraph (g) of this section, when any PTC system, subsystem, component, product, or process fails, malfunctions, or otherwise experiences a defect that decreases, or eliminates, any safety functionality, its vendor—regardless of whether any railroad has indicated whether it experienced the same—shall notify FRA and the affected railroads of the following:

(1) The nature and specificity of the failure, malfunction, or defect;

(2) The vendor's procedures for responding to the issue until the failure, malfunction, or defect is cured;

(3) Any corrective action required;

(4) The risk mitigation actions to be taken pending resolution of the failure cause and issuance of the corrective action; and

(5) The estimated time to correct the failure.

(b) Any railroad implementing or operating a PTC system, subsystem, component, product, or process that fails, malfunctions, or otherwise experiences a defect that decreases, or eliminates, any safety or interoperability functionality, shall:

(1) Notify the applicable vendor and FRA of the failure, malfunction, or defect that decreased or eliminated the safety functionality; and

(2) Keep the applicable vendor and FRA apprised on a continual basis of the status of any and all subsequent failures.

(c) Each railroad implementing a PTC system on its property shall maintain a PTC Product Vendor List (PTCPVL) continually updated to include all vendors of each PTC system, subsystem, component, product, and process currently used in its PTC system. The PTCPVL shall be made available to FRA upon request and without undue delay.

(d) The railroad shall specify to FRA—and the applicable vendor if appropriate—its procedures for action upon notification of a safety critical upgrade, patch, or revision for the PTC system, subsystem, component, product, or process, and until the revision has been installed.

(e) Each notification required by this section shall:

(1) Be made within 7 days after the vendor or railroad discovers the failure, malfunction, or defect. However, a report that is due on a Saturday or a Sunday may be delivered on the following Monday and one that is due on a holiday may be delivered on the next workday;

(2) Be transmitted in a manner and form acceptable to the Associate Administrator and by the most expeditious method available; and

(3) Include as much available and applicable information as possible, including:

(i) PTC system name and model;

(ii) Identification of the part, component, or system involved. The identification must include the part number;

(iii) Nature of the failure, malfunctions, or defects;

(iv) Mitigation to ensure the safety of the crews and public; and

(v) The estimated time to correct the failure.

(f) Whenever any investigation of an accident or service difficulty report shows that an article is unsafe because of a manufacturing or design defect, the manufacturer shall, upon request of the Associate Administrator, report to the Associate Administrator the results of its investigation and any action taken or proposed by the manufacturer to correct that defect.

(g) The requirements of this section do not apply to failures, malfunctions, or defects that:

(1) Are caused by improper maintenance or improper usage; or

(2) Have been previously identified to the FRA, vendor, and applicable railroads.

(h) Any railroad experiencing a failure of a system resulting in a more favorable aspect than intended or another condition hazardous to movement of a train shall comply with the reporting requirements, including the making of a telephonic report of an accident or incident under part 233 of this chapter. Filing of one or more reports under part 233 of this chapter does not exempt a railroad or vendor from the reporting requirements contained in paragraphs (a) through (e) of this section.

§ 236.1027

Exclusions.

(a) The requirements of this subpart apply to each office automation system that performs safety-critical functions within, or affects the safety performance of, the PTC system. For purposes of this section, “office automation system” means any centralized or distributed computer-based system that directly or indirectly controls the active movement of trains in a rail network.

(b) Changes or modifications to PTC systems otherwise excluded from the requirements of this subpart by this section do not exclude those PTC systems from the requirements of this subpart if the changes or modifications result in a degradation of safety or a material decrease in safety-critical functionality.

(c) Primary train control systems cannot be integrated with locomotive electronic systems unless the complete integrated systems:

(1) Have been shown to be designed on fail safe principles;

(2) Have demonstrated to operate in a fail safe mode;

(3) Have a manual fail safe fallback and override to allow the locomotive to be brought to a safe stop in the event of any loss of electronic control; and

(4) Are included in the approved and applicable PTCDP and PTCSP.

(d) PTC systems excluded by this section from the requirements of this subpart remain subject to subparts A through H of this part as applicable.

§ 236.1029

PTC system use and en route failures.

(a) When any safety-critical PTC system component fails to perform its intended function, the cause must be determined and the faulty component adjusted, repaired, or replaced without undue delay. Until repair of such essential components are completed, a railroad shall take appropriate action as specified in its PTCSP.

(b) Where a PTC onboard apparatus on a lead locomotive that is operating in or is to be operated within a PTC system fails or is otherwise cut-out while en route (i.e., after the train has departed it's initial terminal), the train may only continue in accordance with the following:

(1) The train may proceed at restricted speed, or if a block signal system is in operation according to signal indication at medium speed, to the next available point where communication of a report can be made to a designated railroad officer of the host railroad;

(2) Upon completion and communication of the report required in paragraph (b)(1) of this section, or where immediate electronic report of said condition is appropriately provided by the PTC system itself, a train may continue to a point where an absolute block can be established in advance of the train in accordance with the following:

(i) Where no block signal system is in use, the train may proceed at restricted speed, or

(ii) Where a block signal system is in operation according to signal indication, the train may proceed at a speed not to exceed medium speed.

(3) Upon reaching the location where an absolute block has been established in advance of the train, as referenced in paragraph (b)(2) of this section, the train may proceed in accordance with the following:

(i) Where no block signal system is in use, the train may proceed at medium speed; however, if the involved train is a passenger train or a train hauling any amount of PIH material, it may only proceed at a speed not to exceed 30 miles per hour.

(ii) Where a block signal system is in use, a passenger train may proceed at a speed not to exceed 59 miles per hour and a freight train may proceed at a speed not to exceed 49 miles per hour.

(iii) Except as provided in paragraph (c), where a cab signal system with an automatic train control system is in operation, the train may proceed at a speed not to exceed 79 miles per hour.

(c) In order for a PTC train that operates at a speed above 90 miles per hour to deviate from the operating limitations contained in paragraph (b) of this section, the deviation must be described and justified in the FRA approved PTCDP or PTCSP, or the Order of Particular Applicability, as applicable.

(d) Each railroad shall comply with all provisions in the applicable PTCDP and PTCSP for each PTC system it uses and shall operate within the scope of initial operational assumptions and predefined changes identified.

(e) The normal functioning of any safety-critical PTC system must not be interfered with in testing or otherwise without first taking measures to provide for the safe movement of trains, locomotives, roadway workers, and on-track equipment that depend on the normal functioning of the system.

(f) The PTC system's onboard apparatus shall be so arranged that each member of the crew assigned to perform duties in the locomotive can view a PTC display and execute any functions necessary to that crew member's duties. The locomotive engineer shall not be required to perform functions related to the PTC system while the train is moving that have the potential to distract the locomotive engineer from performance of other safety-critical duties.

§ 236.1031

Previously approved PTC systems.

(a) Any PTC system fully implemented and operational prior to [insert effective date of final rule], may receive PTC System Certification if the applicable PTC railroad, or one or more system suppliers and one or more PTC railroads, submits a Request for Expedited Certification (REC) letter to the Associate Administrator. The REC letter must do one of the following:

(1) Reference a product safety plan (PSP) recognized or approved by FRA under subpart H of this part and include a document fulfilling the requirements under §§ 236.1011 and 236.1013 not already included in the PSP;

(2) Attest that the PTC system has been approved by FRA and in operation for at least 5 years and has already received an assessment of Verification and Validation from an independent third party under part 236 or a waiver supporting such operation; or

(3) Attest that the PTC railroad has implemented and is operating a PTC system required by a FRA order issued prior to [insert effective date of final rule].

(b) If a REC letter conforms to paragraph (a)(1) of this section, the Associate Administrator, at his or her sole discretion, may also issue a new Type Approval for the PTC system.

(c) In order to receive a Type Approval or PTC System Certification under paragraph (a) or (b) of this section, the PTC system must be shown to reliably execute the functionalities required by §§ 236.1005 and 236.1007 and otherwise conform to this subpart.

(d) Previous approval or recognition of a train control system, together with an established service history, may, at the request of the PTC railroad, and consistent with available safety data, be credited toward satisfaction of the safety case requirements set forth in this part for the PTCSP with respect to all functionalities and implementations contemplated by the approval or recognition.

(e) To the extent that the PTC system proposed for implementation under this subpart is different in significant detail from the system previously approved or recognized, the changes shall be fully analyzed in the PTCDP or PTCSP as would be the case absent prior approval or recognition.

(f) As used in this section—

(1) Approved refers to approval of a Product Safety Plan under subpart H of this part.

(2) Recognized refers to official action permitting a system to be implemented for control of train operations under an order or waiver, after review of safety case documentation for the implementation.

(g) Upon receipt of a REC, FRA will consider all safety case information to the extent feasible and appropriate, given the specific facts before the agency. Nothing in this section limits re-use of any applicable safety case information by a party other than the party receiving:

(1) A prior approval or recognition referred to in this section; or

(2) A Type Approval or PTC System Certification under this subpart.

§ 236.1033

Communications and security requirements.

(a) All wireless communications between the office, wayside, and onboard components in a PTC system shall provide cryptographic message integrity and authentication.

(b) Cryptographic keys required under paragraph (a) shall:

(1) Use an algorithm approved by the National Institute of Standards (NIST) or a similarly recognized and FRA approved standards body;

(2) Be distributed using manual or automated methods, or a combination of both; and

(3) Be revoked:

(i) If compromised by unauthorized disclosure of the cleartext key; or

(ii) When the key algorithm reaches its lifespan as defined by the standards body responsible for approval of the algorithm.

(c) The cleartext form of the cryptographic keys shall be protected from unauthorized disclosure, modification, or substitution, except during key entry when the cleartext keys and key components may be temporarily displayed to allow visual verification. When encrypted keys or key components are entered, the cryptographically protected cleartext key or key components shall not be displayed.

(d) Access to cleartext keys shall be protected by a tamper resistant mechanism.

(e) Each railroad electing to also provide cryptographic message confidentiality shall:

(1) Comply with the same requirements for message integrity and authentication under this section; and

(2) Only use keys meeting or exceeding the security strength required to protect the data as defined in the railroad's PTCSP and required under § 236.1017(a)(8).

(f) Each railroad, or its vendor, shall have a prioritized service restoration and mitigation plan for scheduled and unscheduled interruptions of service. This plan shall be included in the PTCDP or PTCSP as required by §§ 236.1013 or 236.1015, as applicable, and made available to FRA upon request, without undue delay, for restoration of communication services that support PTC system services.

(g) Each railroad may elect to impose more restrictive requirements than those in this section, consistent with interoperability requirements specified in the PTCSP for the system.

§ 236.1035

Field testing requirements.

(a) Before any field testing of an uncertified PTC system, or a product of an uncertified PTC system, or any regression testing of a certified PTC system is conducted on the general rail system, the railroad requesting the testing must provide:

(1) A complete description of the PTC system;

(2) An operational concepts document;

(3) A complete description of the specific test procedures, including the measures that will be taken to protect trains and on-track equipment;

(4) An analysis of the applicability of the requirements of subparts A-G of this part to the PTC system that will not apply during testing;

(5) The date the proposed testing shall begin;

(6) The test locations; and

(7) The effect on the current method of the PTC system under test operation.

(b) FRA may impose additional testing conditions that it believes may be necessary for the safety of train operations.

(c) Relief from regulations other than from subparts A-G of this part that the railroad believes are necessary to support the field testing, must be requested in accordance with part 211 of this title.

§ 236.1037

Records retention.

(a) Each railroad with a PTC system required to be installed under this subpart shall maintain at a designated office on the railroad:

(1) A current copy of each FRA approved Type Approval, if any, PTCDP, and PTCSP that it holds;

(2) Adequate documentation to demonstrate that the PTCSP and PTCDP meet the safety requirements of this subpart, including the risk assessment;

(3) An Operations and Maintenance Manual, pursuant to § 236.1039; and

(4) Training and testing records pursuant to § 236.1043(b).

(b) Results of inspections and tests specified in the PTCSP and PTCDP must be recorded pursuant to § 236.110.

(c) Each contractor providing services relating to the testing, maintenance, or operation of a PTC system required to be installed under this subpart shall maintain at a designated office training records required under § 236.1039(b).

(d) After the PTC system is placed in service, the railroad shall maintain a database of all safety-relevant hazards as set forth in the PTCSP and PTCDP and those that had not been previously identified in either document. If the frequency of the safety-relevant hazards exceeds the threshold set forth in either of these documents, then the railroad shall:

(1) Report the inconsistency in writing by mail, facsimile, e-mail, or hand delivery to the Director, Office of Safety Assurance and Compliance, FRA, 1200 New Jersey Ave., SE., Mail Stop 25, Washington, DC 20590, within 15 days of discovery. Documents that are hand delivered must not be enclosed in an envelope;

(2) Take prompt countermeasures to reduce the frequency of each safety-relevant hazard to below the threshold set forth in the PTCSP and PTCDP; and

(3) Provide a final report when the inconsistency is resolved to the FRA Director, Office of Safety Assurance and Compliance, on the results of the analysis and countermeasures taken to reduce the frequency of the safety-relevant hazard(s) below the threshold set forth in the PTCSP and PTCDP.

§ 236.1039

Operations and Maintenance Manual.

(a) The railroad shall catalog and maintain all documents as specified in the PTCDP and PTCSP for the installation, maintenance, repair, modification, inspection, and testing of the PTC system and have them in one Operations and Maintenance Manual, readily available to persons required to perform such tasks and for inspection by FRA and FRA-certified State inspectors.

(b) Plans required for proper maintenance, repair, inspection, and testing of safety-critical PTC systems must be adequate in detail and must be made available for inspection by FRA and FRA-certified State inspectors where such PTC systems are deployed or maintained. They must identify all software versions, revisions, and revision dates. Plans must be legible and correct.

(c) Hardware, software, and firmware revisions must be documented in the Operations and Maintenance Manual according to the railroad's configuration management control plan and any additional configuration/revision control measures specified in the PTCDP and PTCSP.

(d) Safety-critical components, including spare equipment, must be positively identified, handled, replaced, and repaired in accordance with the procedures specified in the PTCDP and PTCSP.

(e) Each railroad shall designate in its Operations and Maintenance Manual an appropriate railroad officer responsible for issues relating to scheduled interruptions of service contemplated by § 236.1029.

§ 236.1041

Training and qualification program, general.

(a) Training program for PTC personnel. Employers shall establish and implement training and qualification programs for PTC systems subject to this subpart. These programs must meet the minimum requirements set forth in the PTCDP and PTCSP in §§ 236.1039 through 236.1045 as appropriate, for the following personnel:

(1) Persons whose duties include installing, maintaining, repairing, modifying, inspecting, and testing safety-critical elements of the railroad's PTC systems, including central office, wayside, or onboard subsystems;

(2) Persons who dispatch train operations (issue or communicate any mandatory directive that is executed or enforced, or is intended to be executed or enforced, by a train control system subject to this subpart);

(3) Persons who operate trains or serve as a train or engine crew member subject to instruction and testing under part 217 of this chapter, on a train operating in territory where a train control system subject to this subpart is in use;

(4) Roadway workers whose duties require them to know and understand how a train control system affects their safety and how to avoid interfering with its proper functioning; and

(5) The direct supervisors of persons listed in paragraphs (a)(1) through (a)(4) of this section.

(b) Competencies. The employer's program must provide training for persons who perform the functions described in paragraph (a) of this section to ensure that they have the necessary knowledge and skills to effectively complete their duties related to operation and maintenance of the PTC system.

§ 236.1043

Task analysis and basic requirements.

(a) Training structure and delivery. As part of the program required by § 236.1041, the employer shall, at a minimum:

(1) Identify the specific goals of the training program with regard to the target population (craft, experience level, scope of work, etc.), task(s), and desired success rate;

(2) Based on a formal task analysis, identify the installation, maintenance, repair, modification, inspection, testing, and operating tasks that must be performed on a railroad's PTC systems. This includes the development of failure scenarios and the actions expected under such scenarios;

(3) Develop written procedures for the performance of the tasks identified;

(4) Identify the additional knowledge, skills, and abilities above those required for basic job performance necessary to perform each task;

(5) Develop a training and evaluation curriculum that includes classroom, simulator, computer-based, hands-on, or other formally structured training designed to impart the knowledge, skills, and abilities identified as necessary to perform each task;

(6) Prior to assignment of related tasks, require all persons mentioned in § 236.1041(a) to successfully complete a training curriculum and pass an examination that covers the PTC system and appropriate rules and tasks for which they are responsible (however, such persons may perform such tasks under the direct onsite supervision of a qualified person prior to completing such training and passing the examination);

(7) Require periodic refresher training and evaluation at intervals specified in the PTCDP and PTCSP that includes classroom, simulator, computer-based, hands-on, or other formally structured training and testing, except with respect to basic skills for which proficiency is known to remain high as a result of frequent repetition of the task; and

(8) Conduct regular and periodic evaluations of the effectiveness of the training program specified in § 236.1041(a)(1) verifying the adequacy of the training material and its validity with respect to current railroads PTC systems and operations.

(b) Training records. Employers shall retain records which designate persons who are qualified under this section until new designations are recorded or for at least one year after such persons leave applicable service. These records shall be kept in a designated location and be available for inspection and replication by FRA and FRA-certified State inspectors.

§ 236.1045

Training specific to office control personnel.

(a) Any person responsible for issuing or communicating mandatory directives in territory where PTC systems are or will be in use must be trained in the following areas, as applicable:

(1) Instructions concerning the interface between the computer-aided dispatching system and the train control system, with respect to the safe movement of trains and other on-track equipment;

(2) Railroad operating rules applicable to the train control system, including provision for movement and protection of roadway workers, unequipped trains, trains with failed or cut-out train control onboard systems, and other on-track equipment; and

(3) Instructions concerning control of trains and other on-track equipment in case the train control system fails, including periodic practical exercises or simulations, and operational testing under part 217 of this chapter to ensure the continued capability of the personnel to provide for safe operations under the alternative method of operation.

(b) [Reserved]

§ 236.1047

Training specific to locomotive engineers and other operating personnel.

(a) Operating personnel. Training provided under this subpart for any locomotive engineer or other person who participates in the operation of a train in train control territory must be defined in the PTCDP as well as the PTCSP. The following elements must be addressed:

(1) Familiarization with train control equipment onboard the locomotive and the functioning of that equipment as part of the system and in relation to other onboard systems under that person's control;

(2) Any actions required of the onboard personnel to enable, or enter data to, the system, such as consist data, and the role of that function in the safe operation of the train;

(3) Sequencing of interventions by the system, including pre-enforcement notification, enforcement notification, penalty application initiation and post-penalty application procedures;

(4) Railroad operating rules and testing (part 217) applicable to the train control system, including provisions for movement and protection of any unequipped trains, or trains with failed or cut-out train control onboard systems and other on-track equipment;

(5) Means to detect deviations from proper functioning of onboard train control equipment and instructions regarding the actions to be taken with respect to control of the train and notification of designated railroad personnel; and

(6) Information needed to prevent unintentional interference with the proper functioning of onboard train control equipment.

(b) Locomotive engineer training. Training required under this subpart for a locomotive engineer, together with required records, must be integrated into the program of training required by part 240 of this chapter.

(c) Full automatic operation. The following special requirements apply in the event a train control system is used to effect full automatic operation of the train:

(1) The PTCDP and PTCSP must identify all safety hazards to be mitigated by the locomotive engineer.

(2) The PTCDP and PTCSP must address and describe the training required with provisions for the maintenance of skills proficiency. As a minimum, the training program must:

(i) As described in § 236.1047(a)(2), develop failure scenarios which incorporate the safety hazards identified in the PTCDP and PTCSP including the return of train operations to a fully manual mode;

(ii) Provide training, consistent with § 236.1047(a), for safe train operations under all failure scenarios and identified safety hazards that affect train operations;

(iii) Provide training, consistent with § 236.1047(a), for safe train operations under manual control; and

(iv) Consistent with § 236.1047(a), ensure maintenance of manual train operating skills by requiring manual starting and stopping of the train for an appropriate number of trips and by one or more of the following methods:

(A) Manual operation of a train for a 4-hour work period;

(B) Simulated manual operation of a train for a minimum of 4 hours in a Type I simulator as required; or

(C) Other means as determined following consultation between the railroad and designated representatives of the affected employees and approved by FRA. The PTCDP and PTCSP must designate the appropriate frequency when manual operation, starting, and stopping must be conducted, and the appropriate frequency of simulated manual operation.

(d) Conductor training. Training required under this subpart for a conductor, together with required records, must be integrated into the program of training required under this chapter.

§ 236.1049

Training specific to roadway workers.

(a) Roadway worker training. Training required under this subpart for a roadway worker must be integrated into the program of instruction required under part 214, subpart C of this chapter (“Roadway Worker Protection”), consistent with task analysis requirements of § 236.1039. This training must provide instruction for roadway workers who provide protection for themselves or roadway work groups.

(b) Training subject areas. (1) Instruction for roadway workers must ensure an understanding of the role of processor-based signal and train control equipment in establishing protection for roadway workers and their equipment.

(2) Instruction for all roadway workers working in territories where PTC is required under this subpart must ensure recognition of processor-based signal and train control equipment on the wayside and an understanding of how to avoid interference with its proper functioning.

(3) Instructions concerning the recognition of system failures and the provision of alternative methods of on-track safety in case the train control system fails, including periodic practical exercises or simulations and operational testing under part 217 of this chapter to ensure the continued capability of roadway workers to be free from the danger of being struck by a moving train or other on-track equipment.

11. Revise Appendix B to part 236 to read as follows:

Appendix B to Part 236—Risk Assessment Criteria

The safety-critical performance of each product for which risk assessment is required under this part must be assessed in accordance with the following minimum criteria or other criteria if demonstrated to the Associate Administrator for Safety to be equally suitable:

(a) How are risk metrics to be expressed? The risk metric for the proposed product must describe with a high degree of confidence the accumulated risk of a train control system that operates over the designated life-cycle of the product. Each risk metric for the proposed product must be expressed with an upper bound, as estimated with a sensitivity analysis, and the risk value selected must be demonstrated to have a high degree of confidence.

(b) How does the risk assessment handle interaction risks for interconnected subsystems/components? The risk assessment of each safety-critical system (product) must account not only for the risks associated with each subsystem or component, but also for the risks associated with interactions (interfaces) between such subsystems.

(c) What is the main principle in computing risk for the previous and current conditions? The risk for the previous condition must be computed using the same metrics as for the new system being proposed. A full risk assessment must consider the entire railroad environment where the product is being applied, and show all aspects of the previous condition that are affected by the installation of the product, considering all faults, operating errors, exposure scenarios, and consequences that are related as described in this part. For the full risk assessment, the total societal cost of the potential numbers of accidents assessed for both previous and new system conditions must be computed for comparison. An abbreviated risk assessment must, as a minimum, clearly compute the MTTHE for all of the hazardous events identified for both previous and current conditions. The comparison between MTTHE for both conditions is to determine whether the product implementation meets the safety criteria as required by Subpart H or Subpart I as applicable.

(d) What major system characteristics must be included when relevant to risk assessment? Each risk calculation must consider the total signaling and train control system and method of operation, as subjected to a list of hazards to be mitigated by the signaling and train control system. The methodology requirements must include the following major characteristics, when they are relevant to the product being considered:

(1) Track plan infrastructure, switches, rail crossings at grade and highway-rail grade crossings as applicable;

(2) Train movement density for freight, work, and passenger trains where applicable and computed over a time span of not less than 12 months;

(3) Train movement operational rules, as enforced by the dispatcher, roadway worker/Employee in Charge, and train crew behaviors;

(4) Wayside subsystems and components;

(5) Onboard subsystems and components;

(6) Consist contents such as hazardous material, oversize loads; and

(7) Operating speeds if the provisions of Part 236 cite additional requirements for certain type of train control systems to be used at such speeds for freight and passenger trains.

(e) What other relevant parameters must be determined for the subsystems and components? In order to derive the frequency of hazardous events (or MTTHE) applicable for a product, subsystem or component included in the risk assessment, the railroad may use various techniques, such as reliability and availability calculations for subsystems and components, Fault Tree Analysis (FTA) of the subsystems, and results of the application of safety design principles as noted in Appendix C. Such failure frequency is to be derived for both fail-safe and non-fail-safe subsystems or components. The lower bounds of the MTTF or MTBF determined from the system sensitivity analysis, which account for all necessary and well justified assumptions, may be used to represent the estimate of MTTHE for the associated non-fail-safe subsystem or component in the risk assessment.

(f) How are processor-based subsystems/components assessed? (1) An MTTHE value must be calculated for each processor-based subsystem or component, or both, indicating the safety-critical behavior of the integrated hardware/software subsystem or component, or both. The human factor impact must be included in the assessment, whenever applicable, to provide the integrated MTTHE value. The MTTHE calculation must consider the rates of failures caused by permanent, transient, and intermittent faults accounting for the fault coverage of the integrated hardware/software subsystem or component, phased-interval maintenance, and restoration of the detected failures.

(2) Software fault/failure analysis must be based on the proper assessment of the design and implementation of the application code, its operating/executive program, and associated device drivers, historical performance data, analytical methods and experimental safety-critical performance testing performed on the subsystem or component. The software assessment process must demonstrate through repeatable predictive results that all software defects have been identified and corrected by process with a high degree of confidence.

(g) How are non-processor-based subsystems/components assessed? (1) The safety-critical behavior of all non-processor-based components, which are part of a processor-based system or subsystem, must be quantified with an MTTHE metric. The MTTHE assessment methodology must consider failures caused by permanent, transient, and intermittent faults, phase-interval maintenance and restoration of operation after failures and the effect of fault coverage of each non-processor-based subsystem or component.

(2) MTTHE compliance verification and validation must be based on the assessment of the design for adequacy by a documented verification and validation process, historical performance data, analytical methods and experimental safety-critical performance testing performed on the subsystem or component. The non-processor-based quantification compliance must be demonstrated to have a high degree of confidence.

(h) What assumptions must be documented for risk assessment? (1) The railroad shall document any assumptions regarding the derivation of risk metrics used. For example, for the full risk assessment, all assumptions made about each value of the parameters used in the calculation of total cost of accidents should be documented. For abbreviated risk assessment, all assumptions made for MTTHE derivation using existing reliability and availability data on the current system components should be documented. The railroad shall document these assumptions in such a form as to permit later automated comparisons with in-service experience.

(2) The railroad shall document any assumptions regarding human performance. The documentation shall be in such a form as to facilitate later comparisons with in-service experience.

(3) The railroad shall document any assumptions regarding software defects. These assumptions shall be in a form which permits the railroad to project the likelihood of detecting an in-service software defect. These assumptions shall be documented in such a form as to permit later automated comparisons with in-service experience.

(4) The railroad shall document all of the identified safety-critical fault paths to a mishap as predicted by the safety analysis methodology. The documentation shall be in such a form as to facilitate later comparisons with in-service faults.

12. Revise Appendix C to read as follows:

Appendix C to Part 236—Safety Assurance Criteria and Processes

(a) What is the purpose of this appendix? This appendix provides safety criteria and processes that the designer must use to develop and validate the product that meets safety requirements of this part. FRA uses the criteria and processes set forth in this appendix to evaluate the validity of safety targets and the results of system safety analyses provided in the RSPP, PSP, PTCIP, PTCDP, and PTCSP documents as appropriate. An analysis performed under this appendix must:

(1) Address each of the safety principles of paragraph (b) of this appendix, or explain why they are not relevant, and

(2) Employ a validation and verification process pursuant to paragraph (c) of this appendix.

(b) What safety principles must be followed during product development? The designer shall address each of the following safety considerations principles when designing and demonstrating the safety of products covered by subpart H or I of this part. In the event that any of these principles are not followed, the PSP or PTCDP or PTCSP shall state both the reason(s) for departure and the alternative(s) utilized to mitigate or eliminate the hazards associated with the design principle not followed.

(1) System safety under normal operating conditions. The system (all its elements including hardware and software) must be designed to assure safe operation with no hazardous events under normal anticipated operating conditions with proper inputs and within the expected range of environmental conditions. All safety-critical functions must be performed properly under these normal conditions. Absence of specific operator actions or procedures will not prevent the system from operating safely. The designer must identify and categorize all hazards that may lead to unsafe system operation. Hazards categorized as unacceptable or undesirable, which is determined by hazard analysis, must be eliminated by design. Those undesirable hazards that cannot be eliminated should be mitigated to the acceptable level as required by this part.

(2) System safety under failures.

(i) It must be shown how the product is designed to eliminate or mitigate or eliminate unsafe systematic failures—those conditions which can be attributed to human error that could occur at various stages throughout product development. This includes unsafe errors in the software due to human error in the software specification, design or coding phases, or both; human errors that could impact hardware design; unsafe conditions that could occur because of an improperly designed human-machine interface; installation and maintenance errors; and errors associated with making modifications.

(ii) The product must be shown to operate safely under conditions of random hardware failure. This includes single as well as multiple hardware failures, particularly in instances where one or more failures could occur, remain undetected (latent) and react in combination with a subsequent failure at a later time to cause an unsafe operating situation. In instances involving a latent failure, a subsequent failure is similar to there being a single failure. In the event of a transient failure, and if so designed, the system should restart itself if it is safe to do so. Frequency of attempted restarts must be considered in the hazard analysis required by § 236.907(a)(8).

(iii) There shall be no single point failures in the product that can result in hazards categorized as unacceptable or undesirable. Occurrence of credible single point failures that can result in hazards must be detected and the product must achieve a known safe state before falsely activating any physical appliance.

(iv) If one non-self-revealing failure combined with a second failure can cause a hazard that is categorized as unacceptable or undesirable, then the second failure must be detected and the product must achieve a known safe state before falsely activating any physical appliance.

(v) Another concern of multiple failures involves common mode failures in which two or more subsystems or components intended to compensate one another to perform the same function all fail by the same mode and result in unsafe conditions. This is of particular concern in instances in which two or more elements (hardware or software, or both) are used in combination to ensure safety. If a common mode failure exists, then any analysis performed under this appendix cannot rely on the assumption that failures are independent. Examples include: The use of redundancy in which two or more elements perform a given function in parallel and when one (hardware or software) element checks/monitors another element (of hardware or software) to help ensure its safe operation. Common mode failure relates to independence, which must be ensured in these instances. When dealing with the effects of hardware failure, the designer shall address the effects of the failure not only on other hardware, but also on the execution of the software, since hardware failures can greatly affect how the software operates.

(3) Closed loop principle. System design adhering to the closed loop principle requires that all conditions necessary for the existence of any permissive state or action be verified to be present before the permissive state or action can be initiated. Likewise the requisite conditions shall be verified to be continuously present for the permissive state or action to be maintained. This is in contrast to allowing a permissive state or action to be initiated or maintained in the absence of detected failures. In addition, closed loop design requires that failure to perform a logical operation, or absence of a logical input, output or decision shall not cause an unsafe condition, i.e., system safety does not depend upon the occurrence of an action or logical decision.

(4) Safety assurance concepts. The product design must include one or more of the following Safety Assurance Concepts as described in IEEE-1483 standard to ensure that failures are detected and the product is placed in a safe state. One or more different principles may be applied to each individual subsystem or component, depending on the safety design objectives of that part of the product.

(i) Design diversity and self-checking concept. This concept requires that all critical functions be performed in diverse ways, using diverse software operations and/or diverse hardware channels, and that critical hardware be tested with Self-Checking routines. Permissive outputs are allowed only if the results of the diverse operations correspond, and the Self-Checking process reveals no failures in either execution of software or in any monitored input or output hardware. If the diverse operations do not agree or if the checking reveals critical failures, safety-critical functions and outputs must default to a known safe state.

(ii) Checked redundancy concept. The Checked Redundancy concept requires implementation of two or more identical, independent hardware units, each executing identical software and performing identical functions. A means is to be provided to periodically compare vital parameters and results of the independent redundant units, requiring agreement of all compared parameters to assert or maintain a permissive output. If the units do not agree, safety-critical functions and outputs must default to a known safe state.

(iii) N-version programming concept. This concept requires a processor-based product to use at least two software programs performing identical functions and executing concurrently in a cycle. The software programs must be written by independent teams, using different tools. The multiple independently written software programs comprise a redundant system, and may be executed either on separate hardware units (which may or may not be identical) or within one hardware unit. A means is to be provided to compare the results and output states of the multiple redundant software systems. If the system results do not agree, then the safety-critical functions and outputs must default to a known safe state.

(iv) Numerical assurance concept. This concept requires that the state of each vital parameter of the product or system be uniquely represented by a large encoded numerical value, such that permissive results are calculated by pseudo-randomly combining the representative numerical values of each of the critical constituent parameters of a permissive decision. Vital algorithms must be entirely represented by data structures containing numerical values with verified characteristics, and no vital decisions are to be made in the executing software, only by the numerical representations themselves. In the event of critical failures, the safety-critical functions and outputs must default to a known safe state.

(v) Intrinsic fail-safe design concept. Intrinsically fail-safe hardware circuits or systems are those that employ discrete mechanical and/or electrical components. The fail-safe operation for a product or subsystem designed using this principle concept requires a verification that the effect of every relevant failure mode of each component, and relevant combinations of component failure modes, be considered, analyzed, and documented. This is typically performed by a comprehensive failure modes and effects analysis (FMEA) which must show no residual unmitigated failures. In the event of critical failures, the safety-critical functions and outputs must default to a known safe state.

(5) Human factor engineering principle. The product design must sufficiently incorporate human factors engineering that is appropriate to the complexity of the product; the educational, mental, and physical capabilities of the intended operators and maintainers; the degree of required human interaction with the component; and the environment in which the product will be used.

(6) System safety under external influences. The product must be shown to operate safely when subjected to different external influences, including:

(i) Electrical influences such as power supply anomalies/transients, abnormal/improper input conditions (e.g., outside of normal range inputs relative to amplitude and frequency, unusual combinations of inputs) including those related to a human operator, and others such as electromagnetic interference or electrostatic discharges, or both;

(ii) Mechanical influences such as vibration and shock; and

(iii) Climatic conditions such as temperature and humidity.

(7) System safety after modifications. Safety must be ensured following modifications to the hardware or software, or both. All or some of the concerns identified in this paragraph may be applicable depending upon the nature and extent of the modifications. Such modifications must follow all of the concept, design, implementation and test processes and principles as documented in the PSP for the original product. Regression testing must be comprehensive and documented to include all scenarios which are affected by the change made, and the operating modes of the changed product during normal and failure state (fallback) operation.

(c) What standards are acceptable for verification and validation? (1) The standards employed for verification or validation, or both, of products subject to this subpart must be sufficient to support achievement of the applicable requirements of subpart H and subpart I of this part.

(2) U.S. Department of Defense Military Standard (MIL-STD) 882C, “System Safety Program Requirements” (January 19, 1993), is recognized as providing appropriate risk analysis processes for incorporation into verification and validation standards.

(3) The following standards designed for application to processor-based signal and train control systems are recognized as acceptable with respect to applicable elements of safety analysis required by subpart H and subpart I of this part. The latest versions of the standards listed below should be used unless otherwise provided.

(i) IEEE standards as follows:

(A) IEEE 1483-2000, Standard for the Verification of Vital Functions in Processor-Based Systems Used in Rail Transit Control.

(B) IEEE 1474.2-2003, Standard for user interface requirements in communications based train control (CBTC) systems.

(C) IEEE 1474.1-2004, Standard for Communications-Based Train Control (CBTC) Performance and Functional Requirements.

(ii) CENELEC Standards as follows:

(A) EN50129: 2003, Railway Applications: Communications, Signaling, and Processing Systems-Safety Related Electronic Systems for Signaling; and

(B) EN50155:2001/A1:2002, Railway Applications: Electronic Equipment Used in Rolling Stock.

(iii) ATCS Specification 200 Communications Systems Architecture.

(iv) ATCS Specification 250 Message Formats.

(v) AREMA 2009 Communications and Signal Manual of Recommended Practices, Part 16, Part 17, 21, and 23.

(vi) Safety of High Speed Ground Transportation Systems. Analytical Methodology for Safety Validation of Computer Controlled Subsystems. Volume II: Development of a Safety Validation Methodology. Final Report September 1995. Author: Jonathan F. Luedeke, Battelle. DOT/FRA/ORD-95/10.2.

(vii) IEC 61508 (International Electrotechnical Commission), Functional Safety of Electrical/Electronic/Programmable/Electronic Safety (E/E/P/ES) Related Systems, Parts 1-7 as follows:

(A) IEC 61508-1 (1998-12) Part 1: General requirements and IEC 61508-1 Corr. (1999-05) Corrigendum 1-Part 1: General Requirements.

(B) IEC 61508-2 (2000-05) Part 2: Requirements for electrical/electronic/programmable electronic safety-related systems.

(C) IEC 61508-3 (1998-12) Part 3: Software requirements and IEC 61508-3 Corr.1 (1999-04) Corrigendum 1-Part3: Software requirements.

(D) IEC 61508-4 (1998-12) Part 4: Definitions and abbreviations and IEC 61508-4 Corr.1 (1999-04) Corrigendum 1-Part 4: Definitions and abbreviations.

(E) IEC 61508-5 (1998-12) Part 5: Examples of methods for the determination of safety integrity levels and IEC 61508-5 Corr.1 (1999-04) Corrigendum 1 Part 5: Examples of methods for determination of safety integrity levels.

(F) IEC 61508-6 (2000-04) Part 6: Guidelines on the applications of IEC 61508-2 and -3.

(G) IEC 61508-7 (2000-03) Part 7: Overview of techniques and measures.

(H) IEC62278: 2002, Railway Applications: Specification and Demonstration of Reliability, Availability, Maintainability and Safety (RAMS);

(I) IEC62279: 2002 Railway Applications: Software for Railway Control and Protection Systems;

(4) Use of unpublished standards, including proprietary standards, is authorized to the extent that such standards are shown to achieve the requirements of this part. However, any such standards shall be available for inspection and replication by FRA and for public examination in any public proceeding before the FRA to which they are relevant.

13. A new Appendix F to part 236 is added to read as follows:

Appendix F to Part 236—Requirements of Mandatory Independent Third-Party Assessment of PTC System Safety Verification and Validation

(a) This appendix provides minimum requirements for mandatory independent third-party assessment of PTC system safety verification and validation pursuant to subpart H or I of this part. The goal of this assessment is to provide an independent evaluation of the PTC system manufacturer's utilization of safety design practices during the PTC system's development and testing phases, as required by the applicable PSP, PTCDP, and PTCSP, the applicable requirements of subpart H or I of this part, and any other previously agreed-upon controlling documents or standards.

(b) The supplier may request advice and assistance of the independent third-party reviewer concerning the actions identified in paragraphs (c) through (g) of this appendix. However, the reviewer should not engage in design efforts in order to preserve the reviewer's independence and maintain the supplier's proprietary right to the PTC system.

(c) The supplier shall provide the reviewer access to any and all documentation that the reviewer requests and attendance at any design review or walkthrough that the reviewer determines as necessary to complete and accomplish the third party assessment. The reviewer may be accompanied by representatives of FRA as necessary, in FRA's judgment, for FRA to monitor the assessment.

(d) The reviewer shall evaluate with respect to safety and comment on the adequacy of the processes which the supplier applies to the design and development of the PTC system. At a minimum, the reviewer shall compare the supplier processes with acceptable methodology and employ any other such tests or comparisons if they have been agreed to previously with FRA. Based on these analyses, the reviewer shall identify and document any significant safety vulnerabilities which are not adequately mitigated by the supplier's (or user's) processes. Finally, the reviewer shall evaluate the adequacy of the railroad's applicable PSP or PTCSP, and any other documents pertinent to the PTC system being assessed.

(e) The reviewer shall analyze the Preliminary Hazard Analysis (PHA) for comprehensiveness and compliance with industry, national, or international standards.

(f) The reviewer shall analyze all Fault Tree Analyses (FTA), Failure Mode and Effects Criticality Analysis (FMECA), and other hazard analyses for completeness, correctness, and compliance with industry, national, or international standards.

(g) The reviewer shall randomly select various safety-critical software modules, as well as safety-critical hardware components if required by FRA for audit to verify whether the vendors and industry, national, or international standards were followed. The number of modules audited must be determined as a representative number sufficient to provide confidence that all unaudited modules were developed in compliance industry, national, or international standards

(h) The reviewer shall evaluate and comment on the plan for installation and test procedures of the PTC system for revenue service.

(i) The reviewer shall prepare a final report of the assessment. The report shall be submitted to the railroad prior to the commencement of installation testing and contain at least the following information:

(1) Reviewer's evaluation of the adequacy of the PSP or PTCSP including the supplier's MTTHE and risk estimates for the PTC system, and the supplier's confidence interval in these estimates;

(2) PTC system vulnerabilities, potentially hazardous failure modes, or potentially hazardous operating circumstances which the reviewer felt were not adequately identified, tracked or mitigated;

(3) A clear statement of position for all parties involved for each PTC system vulnerability cited by the reviewer;

(4) Identification of any documentation or information sought by the reviewer that was denied, incomplete, or inadequate;

(5) A listing of each applicable vendor, industry, national or international standard, process, or procedure which was not properly followed;

(6) Identification of the hardware and software verification and validation procedures for the PTC system's safety-critical applications, and the reviewer's evaluation of the adequacy of these procedures;

(7) Methods employed by PTC system manufacturer to develop safety-critical software, such as use of structured language, code checks, modularity, or other similar generally acceptable techniques; and

(8) If directed by FRA, methods employed by PTC system manufacturer to develop safety-critical hardware.

Karen J. Rae,

Deputy Administrator.