[Federal Register Volume 75, Number 10 (Friday, January 15, 2010)]
[Rules and Regulations]
[Pages 2598-2722]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: E9-31362]



[[Page 2597]]

-----------------------------------------------------------------------

Part II





Department of Transportation





-----------------------------------------------------------------------



Federal Railroad Administration



-----------------------------------------------------------------------



49 CFR Part 229, 234, 235, et al.



Positive Train Control Systems; Final Rule

Federal Register / Vol. 75 , No. 10 / Friday, January 15, 2010 / 
Rules and Regulations

[[Page 2598]]


-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Railroad Administration

49 CFR Parts 229, 234, 235, and 236

[Docket No. FRA-2008-0132, Notice No. 3]
RIN 2130-AC03


Positive Train Control Systems

AGENCY: Federal Railroad Administration (FRA), Department of 
Transportation (DOT).

ACTION: Final rule; request for comment on specific issues.

-----------------------------------------------------------------------

SUMMARY: FRA is issuing regulations implementing a requirement of the 
Rail Safety Improvement Act of 2008 that defines criteria for certain 
passenger and freight rail lines requiring the implementation of 
positive train control (PTC) systems. This final rule includes required 
functionalities of PTC system technology and the means by which PTC 
systems will be certified. This final rule also describes the contents 
of the PTC implementation plans required by the statute and contains 
the process for submission of those plans for review and approval by 
FRA. These regulations could also be voluntarily complied with by 
entities not mandated to install PTC systems. This is a final rule; 
however, FRA has identified specific provisions for which we are 
considering making changes to the final rule, if warranted by the 
public comments received. We expect to publish our response to those 
comments, including any possible changes to the rule made as a result 
of them, as soon as possible following the end of the comment period. 
However, the limited areas of this rule open for additional comment do 
not affect the requirement for railroads to prepare and submit plans in 
accordance with the deadlines established in this final rule.

DATES: This final rule is effective March 16, 2010. Petitions for 
reconsideration must be received on or before March 16, 2010. Comments 
must be received on or before February 16, 2010.

ADDRESSES: Petitions for reconsideration and comments: Any petitions 
for reconsideration or comments related to Docket No. FRA-2008-0132, 
may be submitted by any of the following methods:
     Web site: The Federal eRulemaking Portal, http://www.regulations.gov. Follow the Web site's online instructions for 
submitting comments.
     Fax: 202-493-2251.
     Mail: Docket Management Facility, U.S. Department of 
Transportation, 1200 New Jersey Avenue, SE., W12-140, Washington, DC 
20590.
     Hand Delivery: Room W12-140 on the Ground level of the 
West Building, 1200 New Jersey Avenue, SE., Washington, DC between 9 
a.m. and 5 p.m. Monday through Friday, except Federal holidays.
    Instructions: All submissions must include the agency name and 
docket number or Regulatory Identification Number (RIN) for this 
rulemaking. Note that all petitions received will be posted without 
change to http://www.regulations.gov including any personal 
information. Please see the Privacy Act heading in the SUPPLEMENTARY 
INFORMATION section of this document for Privacy Act information 
related to any submitted petitions, comments, or materials.
    Docket: For access to the docket to read background documents or 
comments received, go to http://www.regulations.gov or to Room W12-140 
on the Ground level of the West Building, 1200 New Jersey Avenue, SE., 
Washington, DC between 9 a.m. and 5 p.m. Monday through Friday, except 
Federal holidays.

FOR FURTHER INFORMATION CONTACT: Thomas McFarlin, Office of Safety 
Assurance and Compliance, Staff Director, Signal & Train Control 
Division, Federal Railroad Administration, Mail Stop 25, West Building 
3rd Floor, Room W35-332, 1200 New Jersey Avenue, SE., Washington, DC 
20590 (telephone: 202-493-6203); or Jason Schlosberg, Trial Attorney, 
Office of Chief Counsel, RCC-10, Mail Stop 10, West Building 3rd Floor, 
Room W31-217, 1200 New Jersey Avenue, SE., Washington, DC 20590 
(telephone: 202-493-6032).

SUPPLEMENTARY INFORMATION: FRA is issuing this final rule to provide 
regulatory guidance and performance standards for the development, 
testing, implementation, and use of Positive Train Control (PTC) 
systems for railroads mandated by the Rail Safety Improvement Act of 
2008 Sec.  104, Public Law 110-432, 122 Stat. 4854 (Oct. 16, 2008) 
(codified at 9 U.S.C. 20157) (hereinafter ``RSIA08''), to implement PTC 
systems. These regulations may also be voluntarily complied with by 
entities not mandated to install PTC in lieu of the requirements 
contained in subpart H of part 236. The final rule establishes 
requirements for PTC system standard design and functionality, the 
associated submissions for FRA PTC system approval and certification, 
requirements for training, and required risk-based criteria. The RSIA08 
mandates that widespread implementation of PTC across a major portion 
of the U.S. rail industry be accomplished by December 31, 2015. This 
final rule intends to provide the necessary Federal oversight, 
guidance, and assistance toward successful completion of that 
congressional requirement. This final rule also necessitates or results 
in some minimal revision or amendment to parts 229, 234, and 235, as 
well as previously existing subparts A through H of part 236.

Table of Contents for Supplementary Information

I. Introduction
II. Background
    A. The Need for Positive Train Control Technology
    B. Earlier Efforts To Encourage Voluntary PTC Implementation
    C. Technology Advances Under Subpart H
III. The Rail Safety Improvement Act of 2008
IV. Public Participation
    A. RSAC Process
    B. Public Hearing and Comments Filed
V. Overview: The Proposed Rule, Comments, and Resolution of Comments
VI. Seeking Further Comments
VII. Section-by-Section Analysis
VIII. Regulatory Impact and Notices
    A. Executive Order 12866 and DOT Regulatory Policies and 
Procedures
    B. Regulatory Flexibility Act and Executive Order 13272
    C. Paperwork Reduction Act
    D. Federalism Implications
    E. Environmental Impact
    F. Unfunded Mandates Reform Act of 1995
    G. Energy Impact
    H. Privacy Act
IX. The Rule

I. Introduction

    This final rule provides new performance standards for the 
implementation and operation of PTC systems as mandated by the RSIA08 
and as otherwise voluntarily adopted. This final rule also details the 
process and identifies the documents that railroads and operators of 
passenger trains are to utilize and incorporate in their PTC 
implementation plans required by the RSIA08. The final rule also 
details the process and procedure for obtaining FRA approval of such 
plans.
    While developing this final rule, FRA applied the performance-based 
principles embodied in existing subpart H of part 236 to identify and 
remedy any weaknesses discovered in the subpart H regulatory approach, 
while exploiting lessons learned from products developed under subpart 
H. FRA has continued to make performance-based safety decisions while 
supporting railroads in their development and implementation of PTC 
system technologies. Development of this final rule was enhanced with 
the participation of the Railroad Safety

[[Page 2599]]

Advisory Committee (RSAC), which tasked a PTC Working Group to provide 
advice regarding development of implementing regulations for PTC 
systems and their deployment that are required under the RSIA08. The 
PTC Working Group made a number of consensus recommendations, which 
were identified and included in the proposed rule, and has contributed 
further refinements in the form of recommendations for resolution of 
the public comments. The preamble discusses the statutory background, 
the regulatory background, the RSAC proceedings, the alternatives 
considered and the rationale for the options selected, the proceedings 
to date, as well as the comments and conclusions on general issues. 
Other comments and resolutions are discussed within the corresponding 
section-by-section analysis.

II. Background

A. The Need for Positive Train Control Technology

    Since the early 1920s, systems have been in use that can intervene 
in train operations by warning crews or causing trains to stop if they 
are not being operated safely because of inattention, misinterpretation 
of wayside signal indications, or incapacitation of the crew. Pursuant 
to orders of the Interstate Commerce Commission (ICC)--whose safety 
regulatory activities were later transferred to FRA when it was 
established in 1967--cab signal systems, automatic train control, and 
automatic train stop systems were deployed on a significant portion of 
the national rail system to supplement and enforce the indications of 
wayside signals and operating speed limitations. However, these systems 
were expensive to install and maintain, and with the decline of 
intercity passenger service following the Second World War, the ICC and 
the industry allowed many of these systems to be discontinued. During 
this period, railroads were heavily regulated with respect to rates and 
service responsibilities. The development of the Interstate Highway 
System and other factors led to reductions in the railroads' revenues 
without regulatory relief, leading to bankruptcies, railroad mergers, 
and eventual abandonment of many rail lines. Consequently, railroads 
focused on fiscal survival, and investments in expensive relay-based 
train control technology were economically out of reach. The removal of 
these train control systems, which had never been pervasively 
installed, permitted train collisions to continue, notwithstanding 
enforcement of railroad operating rules designed to prevent them.
    As early as 1970, following its investigation of the August 20, 
1969, head-on collision of two Penn Central Commuter trains near 
Darien, Connecticut, in which 4 people were killed and 45 people were 
injured, the National Transportation Safety Board (NTSB) asked FRA to 
study the feasibility of requiring a form of automatic train control 
system to protect against train operator error and prevent train 
collisions. Following the Darien accident, the NTSB continued to 
investigate one railroad accident after another caused by human error. 
During the next two decades, the NTSB issued a number of safety 
recommendations asking for train control measures. Following its 
investigation of the May 7, 1986, rear-end collision involving a Boston 
and Maine Corporation commuter train and a Consolidated Rail 
Corporation (Conrail) freight train in which 153 people were injured, 
the NTSB recommended that FRA promulgate standards to require the 
installation and operation of a train control system that would provide 
for positive train separation. NTSB Recommendation R-87-16 (May 19, 
1987), available at http://www.ntsb.gov/Recs/letters/1987/R87_16.pdf. 
When the NTSB first established its Most Wanted List of Transportation 
Safety Improvements in 1990, the issue of Positive Train Separation was 
among the improvements listed, and it remained on the list until just 
after enactment of the RSIA08. Original ``Most Wanted'' list of 
Transportation Safety Improvements, as adopted September 1990, 
available at http://www.ntsb.gov/Recs/mostwanted/original_list.htm. 
The NTSB continues to follow the progress of the technology's 
implementation closely and participated through staff in the most 
recent PTC Working Group deliberations.
    Meanwhile, enactment of the Staggers Rail Act of 1980 signaled a 
shift in public policy that permitted the railroads to shed 
unprofitable lines, largely replace published ``tariffs'' with 
appropriately priced contract rates, and generally respond to 
marketplace realities, which increasingly demanded flexible service 
options responsive to customer needs. The advent of microprocessor-
based electronic control systems and digital data radio technology 
during the mid-1980s led the freight railroad industry, through the 
Association of American Railroads (AAR) and the Railway Association of 
Canada, to explore the development of Advanced Train Control Systems 
(ATCS). With broad participation by suppliers, railroads, and FRA, 
detailed specifications were developed for a multi-level ``open'' 
architecture that would permit participation by many suppliers while 
ensuring that systems deployed on various railroads would work in 
harmony as trains crossed corporate boundaries. ATCS was intended to 
serve a variety of business purposes, in addition to enhancing the 
safety of train operations. Pilot versions of ATCS and a similar system 
known as Advanced Railroad Electronic Systems (ARES) were tested 
relatively successfully, but the systems were never deployed on a wide 
scale primarily due to cost. However, sub-elements of these systems 
were employed for various purposes, particularly for replacement of 
pole lines associated with signal systems.
    Collisions, derailments, and incursions into work zones used by 
roadway workers continued as a result of the absence of effective 
enforcement systems designed to compensate for the effects of fatigue 
and other human factors. Renewed emphasis on rules compliance and 
federal regulatory initiatives, including rules for the control of 
alcohol and drug use in railroad operations, operational testing and 
inspection programs designed to verify railroad rules compliance, 
requirements for qualification and certification of locomotive 
engineers, and negotiated rules for roadway worker protection, led to 
substantial reductions in risk. However, the lack of an effective 
collision avoidance system allowed the continued occurrence of 
accidents, some involving tragic losses of life, serious injury, and 
significant property damage.

B. Earlier Efforts To Encourage Voluntary PTC Implementation

    As the NTSB continued to highlight the opportunities for accident 
prevention associated with emerging train control technology through 
its investigations and findings, Congress showed increasing interest, 
mandating three separate reports over the period of a decade. In 1994, 
FRA reported to Congress on this problem, calling for implementation of 
an action plan to deploy PTC systems (Report to Congress on Railroad 
Communications and Train Control (July 1994) (hereinafter ``1994 
Report'')). The 1994 Report forecasted substantial benefits of advanced 
train control technology in supporting a variety of business and safety 
purposes, but noted that an immediate regulatory mandate for PTC could 
not be justified based upon normal cost-benefit principles relying on 
direct safety

[[Page 2600]]

benefits. The report outlined an aggressive Action Plan implementing a 
public-private sector partnership to explore technology potential, 
deploy systems for demonstration, and structure a regulatory framework 
to support emerging PTC initiatives.
    Following through on the 1994 Report, FRA committed approximately 
$40 million through the Next Generation High-Speed Rail Program and the 
Research and Development Program to support development, testing, and 
deployment of PTC prototype systems in the Pacific Northwest, Michigan, 
Illinois, Alaska, and on some Eastern railroads. FRA also initiated a 
comprehensive effort to structure an appropriate regulatory framework 
for facilitating voluntary implementation of PTC and for evaluating 
future safety needs and opportunities.
    In September of 1997, FRA asked the RSAC to address the issue of 
PTC. The RSAC accepted three tasks: Standards for New Train Control 
Systems (Task 1997-06), Positive Train Control Systems-Implementation 
Issues (Task 1997-05), and Positive Train Control Systems-Technologies, 
Definitions, and Capabilities (Task 1997-04). The PTC Working Group was 
established, comprised of representatives of labor organizations, 
suppliers, passenger and freight railroads, other federal agencies, and 
interested state departments of transportation. The PTC Working Group 
was supported by FRA counsel and staff, analysts from the Volpe 
National Transportation Systems Center (Volpe Center), and advisors 
from the NTSB staff.
    In 1999, the PTC Working Group provided to the Federal Railroad 
Administrator a consensus report (Report of the Railroad Safety 
Advisory Committee to the Federal Railroad Administrator, 
Implementation of Positive Train Control Systems (August 1999) 
(hereinafter ``1999 Report'')) with an indication that it would be 
continuing its efforts. The 1999 Report defined the PTC core functions 
to include: prevention of train-to-train collisions (positive train 
separation); enforcement of speed restrictions, including civil 
engineering restrictions (curves, bridges, etc.) and temporary slow 
orders; and protection for roadway workers and their equipment 
operating within their limits of authority. The PTC Working Group 
identified additional safety functions that might be included in some 
PTC architectures: provide warning of on-track equipment operating 
outside their limits of authority; receive and act upon hazard 
information, when available, in a more timely or more secure manner 
(e.g., compromised bridge integrity, wayside detector data); and 
provide for future capability by generating data for transfer to 
highway users to enhance warning at highway-rail grade crossings. The 
PTC Working Group stressed that efforts to enhance highway-rail grade 
crossing safety must recognize the train's necessary right of way at 
grade crossings and that it is important that warning systems employed 
at highway-rail grade crossings be highly reliable and ``fail-safe'' in 
their design.
    As the PTC Working Group's work continued, other collaborative 
efforts, including development of Passenger Equipment Safety Standards 
(including private standards through the American Public Transit 
Association), Passenger Train Emergency Preparedness rules, and 
proposals for improving locomotive crashworthiness (including improved 
fuel tank standards) have targeted reduction in collision and 
derailment consequences.
    In 2003, in light of technological advances and potential increased 
cost and system savings related to prioritized deployment of PTC 
systems, the Appropriations Committees of Congress requested that FRA 
update the costs and benefits for the deployment of PTC and related 
systems. As requested, FRA carried out a detailed analysis that was 
filed in August of 2004, Benefits and Costs of Positive Train Control 
(Report in Response to Committees on Appropriations, August 2004) 
(``2004 Report''), which indicated that under one set of highly 
controversial assumptions, substantial public benefits would likely 
flow from the installation of PTC systems on the railroad system. 
Further, the total amount of these benefits was subject to considerable 
controversy. While many of the other findings of the 2004 Report were 
disputed, there were no data submitted to challenge the 2004 Report 
finding that reaffirmed earlier conclusions that the safety benefits of 
PTC systems were relatively small in comparison to the large capital 
and maintenance costs. Accordingly, FRA continued to believe that an 
immediate regulatory mandate for widespread PTC implementation could 
not be justified based upon traditional cost-benefit principles relying 
on direct railroad safety benefits.
    Despite the economic infeasibility of PTC based on safety benefits 
alone, as outlined in the 1994, 1999, and 2004 Reports, FRA continued 
with regulatory and other efforts to facilitate and encourage the 
voluntary installation of PTC systems. As part of the High-Speed Rail 
Initiative, and in conjunction with the National Railroad Passenger 
Corporation (Amtrak), the AAR, the State of Illinois, and the Union 
Pacific Railroad Company (UP), FRA created the North American Joint 
Positive Train Control (NAJPTC) Program, which set out to describe a 
single standardized open source PTC architecture and system. UP's line 
between Springfield and Mazonia, Illinois was selected for initial 
installation of a train control system to support Amtrak operations up 
to 110 miles per hour, and the system was installed and tested on 
portions of that line. Although the system did not prove viable as then 
conceived, the project hastened the development of PTC technology that 
was subsequently employed in other projects. Promised standards for 
interoperability of PTC systems also proved elusive.
    In addition to financially supporting the NAJPTC Program, FRA 
continued to work with the rail carriers, rail labor, and suppliers on 
regulatory reforms to facilitate voluntary PTC implementation. The 
regulatory reform effort culminated when FRA issued a final rule on 
March 7, 2005, establishing a technology neutral safety-based 
performance standard for processor-based signal and train control 
systems. This new regulation, codified as subpart H to part 236, was 
carefully crafted to encourage the voluntary implementation and 
operation of processor-based signal and train control systems without 
impairing technological development. 70 FR 11,052 (Mar. 7, 2005).
    FRA intended that final rule--developed through the RSAC process in 
close cooperation with rail management, rail labor, and suppliers--to 
further facilitate individual railroad efforts to voluntarily develop 
and deploy cost effective PTC technologies that would make system-wide 
deployment more economically viable. It also appeared very possible 
that major railroads would elect to make voluntary investments in PTC 
to enhance safety, improve service quality, and foster efficiency 
(e.g., better asset utilization, reduced fuel use through train 
pacing).

C. Technology Advances Under Subpart H

    While FRA and RSAC worked to develop consensus on the regulations 
that would become subpart H, the railroads continued with PTC prototype 
development. The technology neutral, performance-based regulatory 
process established by subpart H proved to be very successful in 
facilitating the development of other PTC implementation approaches. 
Although the railroads prototype development efforts were generally 
technically

[[Page 2601]]

successful and offered significant improvements in safety, costs of 
nationwide deployment continued to be untenable in the judgment of 
those determining allocation of railroad capital. Information gained 
from prototype efforts did little to reduce the estimated costs for 
widespread implementation of the core PTC safety functions on the 
nation's railroads.
    Working under subpart H, the BNSF Railway Company (BNSF), CSX 
Transportation, Inc. (CSXT), the Norfolk Southern Corporation (NS), and 
UP undertook more aggressive design and implementation work. The new 
subpart H regulatory approach also made it feasible for smaller 
railroads, such as the Alaska Railroad and the Ohio Central Railroad, 
to begin voluntary design and implementation work on PTC systems that 
best suited their needs. FRA provided, and continues to provide, 
technical assistance and guidance regarding regulatory compliance to 
enable the railroads to more effectively design, install, and test 
their respective systems.
    In December 2006, FRA approved the initial version of the 
Electronic Train Management System (ETMS[supreg]) product for 
deployment on 35 of BNSF's subdivisions (``ETMS I Configuration'') 
comprising single track territory that was either non-signaled or 
equipped with traffic control systems. ETMS is a registered trademark 
of Wabtec Railway Electronics. BNSF Railway has also referred to its 
application of this technology as ``ETMS.''
    In a separate proceeding, FRA agreed that ETMS could be installed 
in lieu of restoring a block signal system on a line for which 
discontinuance had been authorized followed by a significant increase 
in traffic. During the same period, BNSF successfully demonstrated a 
Switch Point Monitoring System (SPMS)--a system that contains devices 
attached to switches that electronically report the position of the 
switches to the railroad's central dispatching office and to the crew 
of an approaching train--and a Track Integrity Warning System (TIWS)--a 
system that also electronically reports to the railroad's central 
dispatching office and to the crew of an approaching train if there are 
any breaks in the rail that might lead to derailments or the condition 
of track occupancy. FRA believes both of these technologies help to 
reduce risk in non-signaled territory and are forward-compatible for 
use with existing and new PTC systems. To be forward-compatible, not to 
be confused with the similar concept of extensibility, a system must be 
able to gracefully provide input intended for use in later system 
versions. The introduction of a forward-compatible technology implies 
that older devices can partly understand and provide data generated or 
used by new devices or systems. The concept can be applied to 
electrical interfaces, telecommunication signals, data communication 
protocols, file formats, and computer programming languages. A standard 
supports forward-compatibility if older product versions can receive, 
read, view, play, execute, or transmit data to the new standard. In the 
case of wayside devices, they are said to be forward-compatible if they 
can appropriately communicate and interact with a PTC system when later 
installed. A wayside device might serve the function of providing only 
information or providing information and accepting commands from a new 
system.
    In addition to scheduling the installation of the ETMS I 
configuration as capital funding became available, BNSF voluntarily 
undertook the design and testing of complementary versions of ETMS that 
would support BNSF operations on more complex track configurations, at 
higher allowable train speeds, and with additional types of rail 
traffic. Meanwhile, CSXT was in the process of redesigning and 
relocating the test bed for its Communications Based Train Management 
(CBTM) system, which it has tested for several years, and UP and NS 
were working on similar systems using vital onboard processing.
    As congressional consideration of legislation that resulted in the 
RSIA08 commenced, all four major railroads had settled on the core 
technology developed for them by Wabtec Railway Electronics 
(``Wabtec''). As the legislation progressed, the railroads and Wabtec 
worked toward greater commonality in the basic functioning of the 
onboard system with a view toward interoperability. PTC applications of 
ETMS include the non-vital PTC systems of BNSF's ETMS I and ETMS II, 
CSXT's CBTM, UP's Vital Train Management System (VTMS), and NS's 
Optimized Train Control (OTC). Further work is being undertaken by BNSF 
to advance the capability of ETMS by integrating Amtrak operations 
(ETMS III). For a description of system enhancements planned by BNSF as 
per the Product Safety Plan filed in accordance with subpart H, see FRA 
Docket No. 2006-23687, Document 0017, at pp. 40-43.
    While the freight railroads' efforts for developing and installing 
PTC systems progressed over a relatively long period of time, starting 
with demonstrations of ATCS and ARES in the late 1980s and culminating 
in the initial ETMS Product Safety Plan approval in December of 2006, 
Amtrak demonstrated its ability to turn on revenue-quality PTC systems 
on its own railroad in support of high-speed rail. Beginning in the 
early 1990s, Amtrak developed plans for enhanced high-speed service on 
the Northeast Corridor (NEC), which included electrification and other 
improvements between New Haven and Boston and introduction of the Acela 
trainsets as the premium service from Washington to New York and New 
York to Boston. In connection with these improvements, which support 
train speeds up to 150 miles per hour, Amtrak undertook to install the 
Advanced Civil Speed Enforcement System (ACSES) as a supplement to 
existing cab signals and automatic train control (speed control). 
Together, these systems deliver PTC core functionalities. In support of 
this effort, FRA issued an order for the installation of the system, 
which required all passenger and freight operators in the New Haven-
Boston segment to equip their locomotives with ACSES. See 63 FR 39,343 
(July 22, 1998). ACSES was installed between 2000 and 2002, and has 
functioned successfully between New Haven and Boston, and on selected 
high-speed segments between Washington and New York, for a number of 
years.
    Amtrak voluntarily began development of an architecturally 
different PTC system, the Incremental Train Control System (ITCS), for 
installation on its Michigan Line. Amtrak developed and installed ITCS 
under waivers from specific sections of 49 CFR part 236, subparts A 
through G, granted by FRA. ITCS was applied to tenant NS locomotives as 
well as Amtrak locomotives traversing the route. Highway-rail grade 
crossings on the route were fitted with ITCS units to pre-start the 
warning systems for high-speed trains and to monitor crossing warning 
system health in real time. The ITCS was tested extensively in the 
field for safety and reliability, and it was placed in revenue service 
in 2001. As experience was gained, FRA authorized increases in speed to 
95 miles per hour; and FRA is presently awaiting final results of an 
independent assessment of verification and validation for the system 
with a view toward authorizing operations at the design speed of 110 
miles per hour.
    Despite these successes, the widespread deployment of these various 
train control systems, particularly on the general freight system, 
remained very much constrained by prohibitive capital costs. While the 
railroads were committed to installing these new systems to enhance the 
safety afforded

[[Page 2602]]

to the public and their employees, the railroads' actual widespread 
implementation remained forestalled due to an inability to generate 
sufficient funding for these new projects in excess of the capital 
expenditures necessary to cover the ongoing operating and maintenance 
costs. Accordingly, the railroads continued to plan very slow 
deployments of PTC system technologies.

III. The Rail Safety Improvement Act of 2008

    On May 1, 2007, H.R. 2095 was introduced in the House of 
Representatives, which would, among other things, mandate the 
implementation and use of PTC systems. The bill passed the House, as 
amended, on October 17, 2007. The bill was then amended and passed by 
the Senate on August 1, 2008. While the bill was awaiting final 
passage, the FRA Administrator testified before Congress that ``FRA is 
a strong supporter of PTC technology and is an active advocate for its 
continued development and deployment.'' Senate Commerce Committee 
Briefing on Metrolink Accident, 110th Cong. (Sept. 23, 2008) (written 
statement of Federal Railroad Administrator Joseph H. Boardman), 
available at http://www.fra.dot.gov/downloads/PubAffairs/09-23-08FinalStatementFRAAdministratorPTC_Sen_Boxer_Meeting.pdf.
    On September 24, 2008, the House concurred with the Senate 
amendment and added another amendment pursuant to H. Res. 1492. When 
considering the House's amendment, various Senators made statements 
referencing certain train accidents that were believed to be PTC-
preventable. For instance, Senator Lautenberg (NJ) took notice of the 
collision at Graniteville, South Carolina, in 2005, and Senators 
Lautenberg, Hutchinson (TX), Boxer (CA), Levin (MI), and Carper (DE) 
took notice of an accident at Chatsworth, California, on September 12, 
2008. According to Senator Levin, federal investigators have said that 
a collision warning system could have prevented that crash and the 
subject legislation would require that new technology to prevent 
crashes be installed in high risk tracks. Senators Carper and Boxer 
made similar statements, indicating that PTC systems are designed to 
prevent train derailments and collisions, like the one in Chatsworth. 
154 Cong. Rec. S10283-S10290 (2008). Ultimately, on October 1, 2008, 
the Senate concurred with the House amendment.
    The Graniteville accident referenced by Senator Lautenberg occurred 
in the early morning hours of January 6, 2005, when a northbound NS 
freight train, operating within non-signaled (dark) territory, 
encountered an improperly lined switch that diverted the train from the 
main line onto an industry track, where it struck the locomotive of an 
unoccupied, parked train. The collision derailed both locomotives and 
16 of the 42 freight cars of the moving train, as well as the 
locomotive and 1 of the 2 cars of the parked train. Among the derailed 
cars from the moving train were three tank cars containing chlorine, 
one of which was breached, releasing about 60 tons of chlorine gas. The 
train engineer and eight other people died as a result of chlorine gas 
inhalation. About 554 people complaining of respiratory difficulties 
were taken to local hospitals. Of these, 75 were admitted for 
treatment. Because of the chlorine release, about 5,400 people within a 
1-mile radius of the derailment site were evacuated for almost 2 weeks.
    The Chatsworth train collision occurred on the afternoon of 
September 12, 2008, when a UP freight train and a Metrolink commuter 
train collided head-on on a single main track equipped with a Traffic 
Control System (TCS) in the Chatsworth district of Los Angeles, 
California. Although NTSB has not yet released its final report, 
evidence summarized at the NTSB's public hearing suggested that the 
Metrolink passenger train was being operated on the main track past an 
absolute signal at a control point displaying a stop indication, when 
it trailed through a power-operated switch lined against its movement, 
and entered a section of single track where the opposing UP freight 
train was operating on a permissive signal indication. The UP train was 
lined to enter the siding at the control point, after which the switch 
would have been lined for the Metrolink train to proceed. As a 
consequence of the accident, 25 people died and over 130 more were 
seriously injured.
    Prior to the accidents in Graniteville and Chatsworth, the 
railroads' slow incremental deployment of PTC technologies--while not 
uniformly agreed upon by the railroads, FRA, and NTSB--was generally 
deemed acceptable by them in view of the tremendous costs involved. 
Partially as a consequence and severity of these very public accidents, 
coupled with a series of other less publicized accidents, Congress 
passed the RSIA08 and it was signed into law by the president on 
October 16, 2008, marking a public policy decision that, despite the 
implementation costs, railroad employee and general public safety 
warranted mandatory and accelerated installation and operation of PTC 
systems.
    As immediately relevant to this rulemaking, the RSIA08 requires the 
installation and operation of PTC systems on all rail main lines, 
meaning all intercity and commuter lines--with limited exceptions 
entrusted to FRA--and on freight-only rail lines when they are part of 
a Class I railroad system, carrying at least 5 million gross tons of 
freight annually, and carrying any amount of poison- or toxic-by-
inhalation (PIH or TIH) materials. While the statute vests certain 
responsibilities with the Secretary of the U.S. Department of 
Transportation, the Secretary has since delegated those 
responsibilities to the FRA Administrator. See 49 CFR 1.49(oo); 74 FR 
26,981 (June 5, 2009); see also 49 U.S.C. 103(g).
    In the RSIA08, Congress established very aggressive dates for PTC 
system build-out completion. Each subject railroad is required to 
submit to FRA by April 16, 2010, a PTC Implementation Plan (PTCIP) 
indicating where and how it intends to install PTC systems by December 
31, 2015.
    In light of the timetable instituted by Congress, and to better 
support railroads with their installation while maintaining safety, FRA 
decided that it is appropriate for mandatory PTC systems to be reviewed 
by FRA differently than the regulatory approval process provided under 
subpart H. FRA believes that it is important to develop a process more 
suited specifically for PTC systems that would better facilitate 
railroad reuse of safety documentation and simplify the process of 
showing that the installation of the intended PTC system did not 
degrade safety. FRA also believes that subpart H does not clearly 
address the statutory mandates and that such lack of clarity would 
complicate railroad efforts to comply with the new statutory 
requirements. Accordingly, FRA hereby amends part 236 by modifying 
existing subpart H and adding a new subpart I.

IV. Public Participation

A. RSAC Process

    In March 1996, FRA established the RSAC, which provides a forum for 
collaborative rulemaking and program development. The RSAC includes 
representatives from all of the agency's major stakeholder groups, 
including railroads, labor organizations, suppliers and manufacturers, 
other government agencies, and other interested parties. When 
appropriate, FRA assigns a task to the RSAC, and after consideration 
and debate, the RSAC may accept or reject

[[Page 2603]]

the task. If accepted, the RSAC establishes a working group comprised 
of persons that possess the appropriate expertise and representation of 
interests to develop recommendations to FRA for action on the task. 
These recommendations are developed by consensus. The working group may 
establish one or more task forces or other subgroups to develop facts 
and options on a particular aspect of a given task. The task force, or 
other subgroup, reports to the working group. If the working group 
comes to consensus on recommendations for action, the package is 
presented to the RSAC for a vote. If the proposal is accepted by a 
simple majority of the RSAC, the proposal is formally recommended to 
FRA. FRA then determines what action to take on the recommendation. 
Because FRA staff has played an active role at the working group and 
subgroup levels in discussing the issues and options and in drafting 
the language of the consensus proposal, and because the RSAC 
recommendation constitutes the consensus of some of the industry's 
leading experts on a given subject, FRA is generally favorably inclined 
toward the RSAC recommendation. However, FRA is in no way bound to 
follow the recommendation and the agency exercises its independent 
judgment on whether the recommended rule achieves the agency's 
regulatory goals, is soundly supported, and was developed in accordance 
with the applicable policy and legal requirements. Often, FRA varies in 
some respects from the RSAC recommendation in developing the actual 
regulatory proposal.
    In developing the proposed rule in this proceeding, FRA adopted the 
RSAC approach by re-convening the PTC Working Group that had produced 
the rule recommendation resulting in subpart H. As part of this effort, 
FRA worked with the major stakeholders affected by this rulemaking in 
collaborative a manner as possible. FRA believes establishing a 
collaborative relationship early in the product development and 
regulatory development cycles can help bridge the divide between the 
railroad carrier's management, railroad labor organizations, the 
suppliers, and FRA by ensuring that all stakeholders are working with 
the same set of data and have a common understanding of product 
characteristics and functionality or their related processes production 
methods, including the regulatory provisions, with which compliance is 
mandatory. However, where the group failed to reach consensus on an 
issue, FRA used its authority to resolve the issue, attempting to 
reconcile as many of the divergent positions as possible through 
traditional rulemaking proceedings.
    On December 10, 2008, the RSAC accepted a task (No. 08-04) entitled 
``Implementation of Positive Train Control Systems.'' The purpose of 
this task was defined as follows: ``To provide advice regarding 
development of implementing regulations for Positive Train Control 
(PTC) systems and their deployment under the Rail Safety Improvement 
Act of 2008.'' The task called for the RSAC PTC Working Group to 
perform the following:
     Review the mandates and objectives of the Act related to 
deployment of PTC systems;
     Help to describe the specific functional attributes of 
systems meeting the statutory purposes in light of available 
technology;
     Review impacts on small entities and ascertain how best to 
address them in harmony with the statutory requirements;
     Help to describe the details that should be included in 
the implementation plans that railroads must file within 18 months of 
enactment of the Act;
     Offer recommendations on the specific content of 
implementing regulations; and
    The task also required the PTC Working Group to:
     Report on the functionalities of PTC systems;
     Describe the essential elements bearing on 
interoperability and the requirements for consultation with other 
railroads in joint operations; and
     Determine how PTC systems will work with the operation of 
non-equipped trains.
    The PTC Working Group was formed from interested organizations that 
are members of the RSAC. The following organizations contributed 
members:

American Association of State Highway and Transportation Officials 
(AAHSTO)
American Chemistry Council (ACC)
American Public Transportation Association (APTA)
American Short Line and Regional Railroad Association (ASLRRA)
Association of American Railroads (AAR)
Association of State Rail Safety Managers (ASRSM)
Brotherhood of Maintenance of Way Employes Division (BMWED)
Brotherhood of Locomotive Engineers and Trainmen Division (BLET)
Brotherhood of Railroad Signalmen (BRS)
Federal Transit Administration* (FTA)
International Brotherhood of Electrical Workers (IBEW)
National Railroad Construction and Maintenance Association
National Railroad Passenger Corporation (Amtrak)
National Transportation Safety Board (NTSB)*
Railway Supply Institute (RSI)
Transport Canada*
Tourist Railway Association Inc.
United Transportation Union (UTU)
------------
    *Indicates associate (non-voting) member.

    From January to April 2009, FRA met with the entire PTC Working 
Group 5 times over the course of 12 days. During those meetings, in 
order to efficiently accomplish the tasks assigned to it, the PTC 
Working Group empowered three task forces to work concurrently. These 
task forces were the passenger, short line and regional railroad, and 
the radio and communications task forces. Each discussed issues 
specific to its particular interests and needs and produced proposed 
rule language for the PTC Working Group's consideration. The majority 
of the proposals were adopted into the proposed rule as agreed upon by 
the working group, with rule language related to a remaining few issues 
being further discussed and enhanced for inclusion into the rule by the 
PTC Working Group.
    The passenger task force discussed testing issues relating to parts 
236 and 238 and the definition of ``main line'' under the statute, 
including possible passenger terminal and limited operations exceptions 
to PTC implementation. Recommendations of the task force were presented 
to the PTC Working Group, which adopted or refined each suggestion.
    The short line and regional railroad task force was formed to 
address the questions pertaining to Class II and Class III railroads. 
Specifically, the group discussed issues regarding the trackage rights 
of Class II and III railroads using trains not equipped with PTC 
technology over a Class I railroad's PTC territory, passenger service 
over track owned by a Class II or Class III railroads where PTC would 
not otherwise be required, and rail-to-rail crossings-at-grade 
involving a Class I railroad's PTC equipped line and a Class II or III 
railroad's PTC unequipped line. After much discussion, there were no 
consensus resolutions reached to any of the main issues raised. 
However, the discussion yielded insights utilized by FRA in preparing 
this final rule.
    The radio and communications task force addressed wireless 
communications issues, particularly as they relate to communications 
security, and recommended language for Sec.  236.1033.
    FRA staff worked with the PTC Working Group and its task forces in

[[Page 2604]]

developing many facets of the final rule. FRA gratefully acknowledges 
the participation and leadership of representatives who served on the 
PTC Working Group and its task forces. These points are discussed to 
show the origin of certain issues and the course of discussion on these 
issues at the task force and working group levels. We believe this 
helps illuminate the factors FRA weighed in making its regulatory 
decisions regarding this final rule and the logic behind those 
decisions.
    In general, the PTC Working Group agreed on the process for 
implementing PTC under the statute, including decisional criteria to be 
applied by FRA in evaluating safety plans, adaptation of subpart H 
principles to support this mandatory implementation, and refinements to 
subpart H and the part 236 appendices necessary to dovetail the two 
regulatory regimes and take lessons from early implementation of 
subpart H, including most aspects of the training requirements. Notable 
accords were reached, as well, on major functionalities of PTC and on 
exceptions applicable to passenger service (terminal areas and limited 
main line exceptions). Major areas of disagreement included whether to 
allow non-equipped trains on PTC lines, extension of PTC to lines not 
within the statutory mandate, and whether to provide for onboard 
displays or terminals visible and accessible to employees other than 
the locomotive engineer when two or more persons are regularly assigned 
duties in the cab. Some additional areas of concern were discussed but 
could not be resolved in the time available. It was understood that 
where discussion did not yield agreement, FRA would make proposals 
within a Notice of Proposed Rulemaking (NPRM) and receive public 
comment.

B. Public Hearing and Comments Filed

    FRA issued an NPRM on July 21, 2009, and accepted comments on this 
proposed regulation until August 20, 2009. A public hearing was also 
held in connection with the NPRM in Washington, DC, on August 13, 2009, 
as further described below.
    During the comment period, a number of entities filed comments 
requesting that FRA extend the comment period to the proposed rule in 
this proceeding. FRA regrettably denied those requests due to the 
urgent need to prepare, process, and publish a final rule at the 
earliest possible date. Since railroads subject to the rules are each 
required to file a PTCIP by April 16, 2010, under the terms of the 
RSIA08, it was important that FRA provide reliable guidance for this 
process to occur in a timely manner. However, FRA responded to two of 
those requests on the record, indicating that it is FRA's policy to 
consider late-filed comments to the extent practicable and inviting the 
railroads to supplement their comments as soon as possible even if it 
is necessary to file after the formal comment period has closed.
    On August 13, 2009, FRA held a hearing to provide interested 
parties an opportunity to enter oral statements into the record. The 
AAR, Amtrak, BNSF, and CSXT entered prepared statements into the record 
and UP and NS indicated their concurrence with those statements. An 
oral statement was also entered into the record by a representative of 
six (6) rail labor organizations, including the American Train 
Dispatchers Association (ATDA), BLET, BMWED, BRS, IBEW, and UTU 
(collectively, the ``Rail Labor Organizations'' or ``RLO''). AASHTO 
also provided an oral statement at the hearing, indicating that it 
fully supports the implementation of the proposed rule. Copies of the 
prepared statements and of the hearing transcript can be found in the 
docket to this proceeding.
    Subsequently, written comments were filed by the American Shortline 
and Regional Railroad Association (ASLRRA), Amtrak, APTA, ACC, AAR, 
BNSF, Caltrain, Canadian Pacific (CP), The Chlorine Institute (CI), 
CSXT, Friends of the Earth, GE Transportation (GE), HCRQ, Inc. and 
Cattron Group International (collectively, ``HCRQ/CGI''), Invensys Rail 
Group--Safetran Systems (``Safetran''), NTSB, New York State 
Metropolitan Transportation Authority (NYSMTA), NJ Transit, Northern 
Indiana Commuter Transportation District (NICTD), Pacific Southwest 
Railway Museum, RLO, Railroad Passenger Car Alliance, San Bernardino 
Railway Historical Society, Southern California Regional Rail Authority 
(SCRRA or Metrolink), The Fertilizer Institute (TFI), Tourist Railway 
Association, Trinity Railway Express (TRE or Trinity), Utah Transit 
Authority (UTA) and a number of individuals.
    After the comment period closed on August 20, 2009, the RSAC PTC 
Working Group was reconvened for 3 days. The PTC Working Group agreed 
on a number of recommendations for resolution of comments which were 
presented to the full RSAC on September 10. In voting by mail ballot 
that concluded on September 24, the RSAC adopted the recommendations, 
which are discussed below in the context of the specific issues that 
they address.

V. Overview: The Proposed Rule, Comments, and Resolution of Comments

    In broad summary, the proposed rule provided for joint filing of 
PTCIPs by all railroads engaged in joint operations. Each PTCIP was to 
be accompanied or preceded by a PTC Development Plan (PTCDP) or PTC 
Safety Plan (PTCSP) detailing the technology to be employed, or by a 
Type Approval obtained by another railroad through approval of a PTCDP. 
As further discussed below, this overall structure was generally 
embraced by the industry parties and the commenters; but the extended 
period for delivery of interoperability standards has given rise to the 
need for some significant adjustments that are included in the final 
rule.
    Under the NPRM language, Class I freight railroads would be 
required to describe in their PTCIPs the routes to be equipped based on 
traffic densities (lines carrying more than 5 million gross tons) and 
presence of PIH traffic during calendar year 2008. They would be 
permitted to amend those plans if FRA found that removal of a line was 
``consistent with safety and in the public interest.'' The discussion 
below reflects the serious objections of the Class I railroads to this 
``base year'' approach and adjustments that FRA makes in this final 
rule to provide somewhat greater flexibility on the face of the 
regulation. The discussion and final rule also provide FRA's response 
to a suggestion by the AAR that FRA create a ``de minimis'' exception 
to the requirement that lines carrying PIH traffic be equipped with 
PTC, an issue raised for the first time in response to the NPRM.
    FRA proposed to adapt the performance-based structure of subpart H, 
which had been developed through the consensus process to encourage 
deployment of PTC and related technologies to provide a means of 
qualifying PTC systems under the RSIA08. In order to promote completion 
of PTC deployment by the end of 2015, as required by law, FRA proposed 
functional requirements that could be met by available technology. 
These provisions continue to enjoy broad support from the industry 
parties and commenters, but the final rule makes numerous perfecting 
changes to the implementing language in response to specific comments.
    The NPRM set forth requirements for equipping of trains with PTC 
that reflected FRA's perception of practical considerations (e.g., not 
all locomotives can be equipped at once, and switching out locomotives 
to commit them to

[[Page 2605]]

equipped routes would involve significant cost and safety exposure), 
historic tolerance for some incidental unequipped movements under 
circumstances where strict adherence would create obvious hardship 
without commensurate safety benefits (e.g., locomotives of Class II and 
III railroads generally spend little time on Class I railroads and have 
a good safety record, yet requiring that they be equipped could result 
in expenditures greater than the previous value of the locomotives), 
and movement restrictions applicable where controlling locomotives 
might have failed onboard PTC equipment. These proposals elicited some 
strong objections and proposals for improvement. Several commenters 
asked that occasional movement of trains led by historic locomotives be 
permitted without equipping the locomotives with PTC technology. The 
final rule makes a number of changes, while endeavoring to carry 
forward the lessons of many decades and while recognizing the need for 
regulatory flexibility.
    Relying on existing train control requirements, the NPRM proposed 
that each assigned crew member be able to view the PTC display and 
perform assigned functions from their normal position in the cab. The 
NPRM also addressed the need to avoid task overload on the locomotive 
engineer by having that person perform functions that could distract 
from attention to current safety duties. FRA has considered the Class I 
railroads' argument that, if a single display was acceptable under 
subpart H, it should be acceptable under the proposed subpart I. 
Although FRA has considered carefully the carriers' arguments on this 
point, the final rule carries forward principles of crew resource 
management by ensuring that each crew member has the information and 
ability to perform their assigned function and, therefore, where a PTC 
overlay system is used, that all of the safety features of the 
underlying operation to which PTC is added will be kept.
    One of the critical choices assigned to FRA under the law was 
specification of any exceptions to passenger ``main track'' requiring 
installation of PTC. The NPRM carried forward narrow exceptions crafted 
at the request of commuter and intercity railroads. Amtrak followed 
with comments on the NPRM asking for a broader exception. They noted in 
particular that the incremental costs of PTC on some lines with limited 
freight traffic and relatively few Amtrak trains might need to be borne 
by states that support particular services, and the funding might not 
be available to do so. Following recommendations from the RSAC Working 
Group, FRA is including additional latitude to bring forward specific 
exceptions for FRA review and approval, with or without conditions.
    The NPRM was technology neutral and directed at the outcomes 
desired. A number of the comments addressed the issue of market 
concentration and absence of effective choices in selecting PTC 
technology. In this regard, some felt that FRA should specify 
attributes of interoperability in the form of open standards. The final 
rule continues to rely on safety performance as the basis for FRA 
certification of PTC systems. FRA declines at this time to deprive 
those railroads that have served as technology leaders in developing 
PTC systems of the latitude to implement their systems, given their 
apparent willingness to provide open standards for attributes of the 
technology over which they have control, and given the predictable 
delays that would ensue should alternative approaches be specified. FRA 
is aware that this creates a degree of reliance on others with respect 
to those railroads that stood back and waited for others to develop PTC 
technology. Further, some degree of market concentration may exist on 
the general freight network, in particular, given the dominance of one 
vendor or supplier with respect to the core of the onboard systems. FRA 
financially supported development of interoperability standards through 
the North American Positive Train Control Program (the technology 
selected for demonstration was not deployed, and no standards were 
delivered) and again through the American Railway Engineering and 
Maintenance Association (standards have been published and are 
available, but no railroad has signaled an intention to employ them). 
The choice of technology that will be deployed should, in FRA's view, 
be made by those who are making the investments.
    Finally, the NPRM took a traditional approach to recognition of 
technology, requiring that railroads step forward, individually or with 
their suppliers, to request recognition of PTC systems. Suppliers 
commented that they should be able to step forward without railroad 
participation and receive recognition for systems, subsystems, and 
components that would later be incorporated in PTC systems approved by 
FRA. They noted that the NPRM would burden them with reporting 
obligations while not conferring status to receive direct product 
recognition. While recognizing the commenters' logic, FRA could not 
find a means in the final rule to relieve these concerns, given limited 
technical staffing at FRA, the potential for filings representing 
technology that the industry would not employ, the inherent difficulty 
associated with addressing the safety of technology below the system 
level, and the critical need to provide rapid responses to necessary 
filings.
    Each of the comments on the NPRM, including comments not within the 
scope of this overview, is discussed in relation to the topic addressed 
in the section-by-section analysis below.

VI. Seeking Further Comments

    While this final rule is effective on the date indicated herein, 
FRA believes that certain issues warrant further discussion. 
Accordingly, FRA will continue to seek comments limited to increasing 
the clarity, certainty, and transparency of the criteria governing the 
removal from a PTCIP (and therefore from the requirement to install 
PTC) of any track segments on which PTC systems have yet to be 
installed for which a railroad seeks relief from the requirement to 
install PTC. FRA considers this issue separate and distinct from the 
discontinuance of any already installed or existing PTC systems, which 
is governed under Sec.  236.1021, part 235 of this title, and the 
``Signal Inspection Act'' (codified at 49 U.S.C. 20501-20505). Any 
further comments should be limited to the scope of the issues indicated 
in this preamble to which FRA seeks further comments.
    In Sec.  236.1005(b)(4)(i)(A)(2), the final rule provides certain 
factors that FRA will consider when determining whether to approve 
exclusion of a line from the PTCIP in the case of cessation of PIH 
traffic over a particular track segment. For instance, under Sec.  
236.1005(b)(4)(i)(A)(2)(ii), the requesting railroad must show that any 
rerouting of PIH traffic from the subject track segment is justified 
based upon the route analysis submitted. FRA seeks comments on how the 
elements of a route analysis should be weighed by FRA when determining 
whether rerouting as provided under this paragraph is sufficiently 
justified.
    Section 236.1005(b)(4)(i)(A)(2)(iii) concerns the risk remaining on 
a track segment if PIH traffic were to be removed. FRA also seeks 
comments on how to measure the appropriate level of risk established in 
Sec.  236.1005(b)(4)(i)(A)(2)(iii) to require the installation of PTC 
on lines not carrying PIH or passenger traffic. No railroad has 
supplied data supporting further track exceptions from PTC system 
installation consistent with

[[Page 2606]]

statutory and safety requirements. Thus, FRA requests additional data 
to support commenters' positions. FRA also seeks comment and 
information on ways that it might consider risk mitigations other than 
by a compensating extension of PTC or PTC technologies.
    In Sec.  236.1005(b)(4)(i), the final rule provides an exception to 
PTC system implementation where such implementation would provide only 
a de minimis PIH risk. While in the proposed rule FRA sought means to 
reduce the railroads' burdens associated with this rule, no specific de 
minimis exception was proposed. The AAR mentioned this possibility in 
its comment filed during the comment period and offered in 
supplementary comments filed after the comment period to work with FRA 
on this issue. FRA believes that the de minimis exception provided in 
this final rule falls within the scope of the issues set forth in the 
proposed rule. However, since none of the parties has had an 
opportunity to comment on this specific exception as provided in this 
final rule, FRA seeks comments on the extent of the de minimis 
exception.
    As further explained below, this final rule uses 2008 traffic data 
as an initial baseline in each PTCIP to determine the breadth and scope 
of PTC system implementation and, in recognition of the fact that 
traffic patterns are likely to change to some degree before December 
31, 2015, provides means of adjusting the track segments on which PTC 
must be installed where adjustments are appropriately justified. These 
issues relate to the potential scaling back of the breadth and scope of 
that baseline through the request by the railroads--made 
contemporaneously or subsequently to PTCIP submission and prior to 
actual PTC system implementation--on the subject track segments for FRA 
to apply certain regulatory exceptions. Under the procedures set forth 
in this final rule, requests for such amendments may be made after 
PTCIP submission. Since these issues should not affect the PTCIP 
required to be filed by the April 16, 2010, statutory deadline, FRA 
believes that time is available for some further consideration.

VII. Section-by-Section Analysis

    Unless otherwise noted, all section references below refer to 
sections in title 49 of the Code of Federal Regulations (CFR). FRA 
sought comments on all proposals made in the NPRM. This portion of the 
preamble discusses the comments received, FRA's assessment of those 
comments, and the basis for the final rule provisions. Any analysis in 
the NPRM that is not explicitly modified in this final rule remains 
applicable.

Proposed Amendments to 49 CFR Part 229

Section 229.135 Event Recorders
    The proposed amendment to the existing event recorder section of 
the Locomotive Safety Standards is intended to make that section 
parallel to the additions in Sec.  236.1005(d) below. No comments were 
received, and the section is adopted as proposed.

Proposed Amendments to 49 CFR Part 234

Section 234.275 Processor-Based Systems
    Section 234.275 presently requires that each processor-based 
system, subsystem, or component used for active warning at highway-rail 
grade crossings that is new or novel technology, or that provides 
safety-critical data to a railroad signal or train control system which 
is qualified using the subpart H process, shall also be governed by 
those requirements, including approval of a Product Safety Plan. 
Particularly with respect to high-speed rail, FRA anticipates that PTC 
systems will in some cases incorporate new or novel technology to 
provide for crossing warning system pre-starts (eliminating the 
necessity of lengthening the approach circuits for high-speed trains), 
to verify crossing system health between the wayside warning system and 
approaching trains, or to slow trains approaching locations where 
vehicle storage has been detected on a crossing, among other options. 
Indeed, each of these functions is presently incorporated in at least 
one train control system, and others may one day be feasible (including 
in-vehicle warning). There would appear to be no reason why such a 
functionality intended for inclusion in a PTC system mandated by 
subpart I could not be qualified with the rest of the PTC system under 
subpart I. On the other hand, care should be taken to set an 
appropriate safety standard taking into consideration highway users, 
occupants of the high-speed trains, and others potentially affected.
    In fact, with new emphasis on high-speed rail, FRA needs to 
consider the ability of PTC systems to integrate this type of new 
technology and thereby reduce risk associated with high-speed rail 
service. Risk includes derailment of a high-speed train with 
catastrophic consequences after encountering an obstacle at a highway-
rail grade crossing. To avoid such consequences, as many crossings as 
possible should be eliminated. To that end, 49 CFR 213.347 requires a 
warning and barrier plan to be approved for Class 7 track (speeds above 
110 miles per hour) and prohibits grade crossings on Class 8 and 9 
track (above 125 miles per hour). That leaves significant exposure on 
Class 5 and 6 track (80 miles per hour for freight and 90 miles per 
hour for passenger trains, up to 110 miles per hour for either) which 
is currently not specifically addressed by regulation.
    At the public hearing in this proceeding, the RLO indicated its 
agreement with FRA's interpretation of 49 CFR 213.347 and stated that 
significant exposure remains at highway-rail grade crossings for Class 
5 and 6 track, because ``such plans or prohibitions are not currently 
addressed by Federal Regulation.'' In addition to the proposed 
amendments to Sec.  234.275, however, the RLO believes that PTC systems 
should also be mandated under subpart I to incorporate technology that 
would verify a highway-rail grade crossing warning system's activation 
for an approaching train and slow a train approaching a location where 
such system activation could not be verified. The RLO believes that 
such verification and speed restriction enforcement would significantly 
lower the exposure for a potential collision between a highway motor 
vehicle and a train. According to the RLO, this function is currently 
incorporated into at least one deployed train control system and is 
therefore feasible. In addition, the RLO propose that certain existing 
highway-rail grade crossing warning system regulations and 
requirements, including those in parts 213 and 234, and in subpart H to 
part 236, could be cross referenced or included in subpart I to ensure 
regulatory harmony.
    While AAR understands the safety concern, it asserts that this 
function is not related to the core PTC functions mandated by Congress. 
Furthermore, asserts AAR, the cost of installing wayside interface 
units at grade crossings on PTC routes would be prohibitively expensive 
and would divert resources that would otherwise be devoted to meeting 
the mandated PTC deadline.
    The NTSB recommends that the warning and barrier protection plans 
similar to those for Class 7 track at grade crossings in 49 CFR 213.347 
should also apply to Class 5 and 6 tracks. According to the NTSB, such 
protection at crossings (similar to protection at crossings afforded 
within the ITCS project) should be integrated as part of an approved 
PTC plan to reduce the risk

[[Page 2607]]

of high-speed catastrophic derailments at such grade crossings.
    FRA, while certainly recognizing these concerns, does not choose to 
provide further prescriptive requirements for highway-rail grade 
crossings beyond those set forth in Sec.  213.347. FRA will, however, 
require that highway-rail grade crossing safety at Class 5 and 6 track 
speeds be specifically addressed within a railroad's PTCDP and PTCSP 
(see Sec. Sec.  236.1013 and 236.1015 respectively) subject to FRA 
approval. FRA has separately developed Guidelines for Highway-Rail 
Grade Crossing Safety for high-speed rail that will be employed in the 
grant review and negotiation process under the American Recovery and 
Reinvestment Act of 2009, Pub. L. No. 111-5, 123 Stat. 115 (2009) 
(ARRA). These Guidelines encourage use of sealed corridor strategies 
for Emerging High-Speed Rail systems and integration of highway-rail 
warning systems with PTC where feasible. See Docket No. FRA-2009-0095.

Proposed Amendments to 49 CFR Part 235

Section 235.7 Changes Not Requiring Filing of Application
    FRA amends Sec.  235.7, which allows specified changes within 
existing signal or train control systems be made without the necessity 
of filing an application. The amendments consist of adding allowance 
for a railroad to remove an intermittent automatic train stop system in 
conjunction with the implementation of a PTC system approved under 
subpart I of part 236, and a couple of minor editorial corrections.
    The changes allowable under this section, without filing of an 
application, are those identified on the basis that the resultant 
condition will be at least no less safe than the previous condition. 
The required functions of PTC within subpart I provide a considerably 
higher level of functionality related to both alerting and enforcing 
necessary operating limitations than an intermediate automatic train 
stop system does. Additionally, in the event of the loss of PTC 
functionality (see Sec.  236.1029 regarding a failure en route), the 
operating restrictions required will provide the needed level of safety 
in lieu of the railroad being expected to keep and maintain an 
underlying system such as intermittent automatic train stop for use 
only in such cases. Therefore, FRA believes that with the 
implementation of PTC under the requirements of subpart I, the safety 
value of any previously existing intermittent automatic train stop 
system is entirely obviated. There were no objections in the PTC 
Working Group to this amendment.
    The AAR submitted comment that within Sec.  236.1021, paragraphs 
(j)(2) and (j)(3) should be revised to recognize the allowance for 
removal of a signal used in lieu of an electric or mechanical lock in 
the same manner as removal of the electric or mechanical lock. These 
two paragraphs are intended to recognize that where train speed over 
the switch does not exceed 20 miles per hour, or where trains are not 
permitted to clear the main track at such switch, removal of the 
devices intended to provide the necessary protection without filing for 
approval is appropriate.
    The regulation requiring the installation of an electric or 
mechanical lock identifies the allowance for a signal used in lieu 
thereof (see Sec.  236.410). FRA agrees with the AAR that when the 
requirement for an electric or mechanical lock, or a signal used in 
lieu thereof, are eliminated, the removal of any of these devices in 
their entirety without filing for approval is appropriate. FRA is 
therefore amending paragraphs (j)(2) and (j)(3) of Sec.  236.1021 as 
recommended in order to clarify these allowances.
    For the same reasoning and in a consistent manner, FRA is amending 
paragraphs (b)(2) and (b)(3) in existing Sec.  235.7 in order to 
provide the same allowances for removal of a signal used in lieu of an 
electric or mechanical lock within block signal systems without filing 
for approval.

Proposed Amendments to 49 CFR Part 236

Section 236.0 Applicability, Minimum Requirements, and Penalties
    FRA amends this existing section of the regulation to remove manual 
block from the methods of operation permitting speeds of 50 miles per 
hour or greater for freight trains and 60 miles per hour or greater for 
passenger trains. Manual block rules create a reasonably secure means 
of preventing train collisions. However, where the attributes of block 
signal systems are not present, misaligned switches, broken rails, or 
fouling equipment may cause a train accident. FRA believes that 
contemporary expectations for safe operations require this adjustment, 
which also provides a more orderly foundation for the application of 
PTC to the subject territories. There were no objections in the PTC 
Working Group to this change and the NTSB supports the removal of 
manual block from a method of operation permitting train speeds of 
above 49 and 59 miles per hour for freight and passenger trains, 
respectively. According to the NTSB, manual block does not afford the 
level of safety that block signal or PTC systems provide for the 
detection of misaligned switches, broken rails, or fouling equipment 
that may cause a train accident.
    After review of the NPRM, AAR stated that paragraph (c)(1)(ii)(A) 
seemed to preclude the operations identified in paragraph (c)(1)(ii)(B) 
and that it was unclear whether paragraph (c)(1)(ii)(A) applies to 
opposing trains or some other condition. Therefore, the AAR recommended 
that paragraphs (c)(1)(ii)(A) and (c)(1)(ii)(B) be revised. FRA agrees 
and has therefore revised paragraphs (c)(1)(ii)(A) and (c)(1)(ii)(B), 
and added paragraphs (c)(1)(ii)(C) and (c)(1)(ii)(D), in the final rule 
to improve clarity.
    FRA has also added paragraph (d)(2) in the final rule to address 
the use of automatic cab signal, automatic train stop, or automatic 
train control systems on or after December 31, 2015. On or after 
December 31, 2015, the method of protecting high-speed train operations 
will be through the use of PTC. FRA recognizes that there may be 
justifiable reasons for continued use of automatic cab signal, 
automatic train stop, or automatic train control systems on or after 
December 31, 2015 on certain lines, where the installation of PTC would 
be inappropriate. In situations where the automatic cab signal, 
automatic train stop, or automatic train control systems are an 
integral part of the PTC system design, no action will be required by a 
railroad. In any other situation, however, FRA will only allow 
continued use of an automatic cab signal, automatic train stop, or 
automatic train control system on a case-by-case basis after sufficient 
justification has been provided to the Associate Administrator.
    FRA has also added a preemption provision at the end of section 
236.0. Part 236, which FRA inherited from the Interstate Commerce 
Commission at the time FRA was created, has had preemptive effect by 
operation of law at least since enactment of the Federal Railroad 
Safety Act of 1970 (Pub. L. 111-43). However, no preemption provision 
was ever added, largely as an historical accident. Since enactment of 
the Implementing Recommendations of the 9/11 Commission Act of 2007 (9/
11 Commission Act of 2007), Public Law 110-53, which amended 49 U.S.C. 
20106 significantly, FRA has been updating the preemption provisions of 
its regulations to conform to the current statute as opportunities to 
do so are

[[Page 2608]]

presented. New subsection 236.0(i) is added to accomplish that and to 
recite the preemptive effect of the Locomotive Boiler Inspection Act 
(49 U.S.C. 20701-20703), which has been held by the U.S. Supreme Court 
to preempt the entire field of locomotive safety; therefore, this part 
preempts any state law, including common law, covering the design, 
construction, or material of any part of or appurtenance to a 
locomotive.
    The text of section 236.0(i)(1) and (2) directly reflects FRA's 
interpretation of 49 U.S.C. 20106, as amended. Read by itself, 49 
U.S.C. 20106(a) preempts state standards of care, including common law 
standards, Norfolk Southern Ry. v. Shanklin, 529 U.S. 344, 358-359 
(2000), CSX Transp., Inc. v. Easterwood, 507 U.S. 658, 664 (1993), but 
does not expressly state whether anything replaces the preempted 
standards of care for purposes of tort suits. The focus of that 
provision is clearly on who regulates railroad safety: The federal 
government or the states. It is about improving railroad safety, for 
which Congress deems nationally uniform standards to be necessary in 
the great majority of cases. That purpose has collateral consequences 
for tort law which new statutory section 20106 paragraphs (b) and (c) 
address. New paragraph (b)(1) creates three exceptions to the possible 
consequences flowing from paragraph (a). One of those exceptions 
(paragraph (b)(1)(B)) precisely addresses an issue presented in Lundeen 
v. Canadian Pacific Ry., 507 F.Supp.2d 1006 (D.Minn. 2007) that 
Congress wished to rectify: It allows plaintiffs to sue a railroad in 
tort for violation of its own plan, rule, or standard that it created 
pursuant to a regulation or order issued by either of the secretaries. 
None of those exceptions covers a plan, rule, or standard that a 
regulated entity creates for itself in order to produce a higher level 
of safety than federal law requires, and such plans, rules, or 
standards were not at issue in Lundeen. The key concept of section 
20106(b) is permitting actions under state law seeking damages for 
personal injury, death, or property damage to proceed using a federal 
standard of care. A plan, rule, or standard that a regulated entity 
creates pursuant to a federal regulation logically fits the paradigm of 
a federal standard of care--federal law requires it and determines its 
adequacy. A plan, rule, or standard, or portions of one, that a 
regulated entity creates on its own in order to exceed the requirements 
of federal law does not fit the paradigm of a federal standard of 
care--federal law does not require that the law be surpassed and, past 
the point at which the requirements of federal law are satisfied, says 
nothing about its adequacy. That is why FRA believes that section 
20106(b)(1)(B) covers the former, but not the latter. The basic purpose 
of the statute--improving railroad safety--is best served by 
encouraging regulated entities to do more than the law requires and 
would be disserved by increasing potential tort liability of regulated 
entities that choose to exceed federal standards, which would 
discourage them from ever exceeding federal standards again.
    In this manner, Congress adroitly preserved its policy of national 
uniformity of railroad safety regulation expressed in section 
20106(a)(1) and assured plaintiffs in tort cases involving railroads, 
such as Lundeen, of their ability to pursue their cases by clarifying 
that federal railroad safety regulations preempt the standard of care, 
not the underlying causes of action in tort. Under this interpretation, 
all parts of the statute are given meanings that work together 
effectively and serve the safety purposes of the statute.
Section 236.410 Locking, Hand-Operated Switch; Requirements
    In this final rule, FRA is removing the Note following paragraph 
(b) of this section. During FRA's review of the requirements contained 
in this part, FRA discovered that the Note following paragraph (b), 
which had previously been removed as part of FRA's 1984 amendments to 
this part, was inadvertently reprinted in the rule text several years 
later and has remained there. As reflected in the preamble discussion 
of the 1983 proposed rule, FRA moved the provisions for removal of 
electric or mechanical locks to Sec.  235.7 based on FRA's 
determination that the industry was capable of achieving compliance of 
train operations in procedures more suitable to individual properties.
    In light of the history of this section, FRA is taking the 
opportunity within this rulemaking to remove the Note following 
paragraph (b), which presents information in conflict with the 
allowances that have been added into Sec. Sec.  235.7(b)(2) and (b)(3).
Section 236.909 Minimum Performance Standard
    FRA is modifying paragraph (e)(1) of this section to include a 
requirement for the risk metric sensitivity analysis to be an integral 
part of the full risk assessment that is required to be provided in the 
Product Safety Plan (PSP) submittal in accordance with Sec.  
236.907(a)(7). Paragraph (e)(2) of this section is also being modified 
to eliminate an alternative option for a railroad to use a risk metric 
in which consequences of potential accidents are measured strictly in 
terms of fatalities.
    Prior to the modification of this section, paragraph (e)(1) 
discussed how safety and risk should be measured for the full risk 
assessment, but did not accentuate the need for running a sensitivity 
analysis on chosen risk metrics to ensure that the worst case scenarios 
for the proposed system failures or malfunctions are accounted for in 
the risk assessment. On the other hand, Appendix B to this part 
mandates that each risk metric for the proposed product must be 
expressed with an upper bound, as estimated with a sensitivity 
analysis. The FRA's experience gained while reviewing PSP documents 
required by subpart H of this part and submitted to FRA for approval 
revealed that railroads did not consider it mandatory to run a 
sensitivity analysis for the chosen risk metrics. Thus, an additional 
effort was required from the FRA staff reviewing PSP submittals to 
demonstrate to the railroads the validity and significance of such a 
request. Therefore, this final rule amends paragraph (e)(1) to 
explicitly require the performance of a sensitivity analysis for the 
chosen risk metrics. The language in paragraph (e)(1) of this section 
explains why the sensitivity analysis is needed and what key input 
parameters must be analyzed.
    FRA received comments on the proposed modification to paragraph 
(e)(1) of this section. While the RLO expressed support for making the 
risk metric sensitivity analysis an integral part of the full risk 
assessment, GE sought clarification and a sample regarding the proposed 
amendment to the clause regarding the risk assessment sensitivity 
analysis. GE believes that a literal interpretation of this clause 
would mean that the risk analysis must evaluate the risk sensitivity to 
variations in every individual electronic and mechanical component of 
the system. If so interpreted, GE asserts that the combinatorial 
calculations would present a significant barrier to the safety analysis 
and delay PTC system approval. GE further asserts that safety coverage 
of discrete component failures can be assured through other techniques 
in the overall system design. GE believes that the intent of this rule 
is that ``component'' should mean ``functional subsystem,'' as system 
safety can be completely addressed by performing the sensitivity 
analysis at that level. Accordingly, GE proffers that paragraph (e)(1) 
of this section should be modified to allow the level of detail

[[Page 2609]]

of the risk analysis to be chosen based on the system safety philosophy 
and technology chosen.
    Similar concerns were expressed by HCRQ/CGI, which questioned the 
need for an additional requirement in the rule that would require the 
sensitivity analysis to document the sensitivity to worst case failure 
scenarios. In the alternative, HCRQ/CGI suggested that the final rule 
should require a reasonable justification for all failure rates.
    In response to these comments, FRA would like to clarify that the 
lowest level of system elements constructing the overall system that 
would be subject to risk analysis and the following sensitivity 
analysis are ``components,'' ``modules,'' ``pieces of equipment,'' or 
``subsystems'' that are processor-based in nature, the functionality 
and performance of which are governed by this part. FRA declines, 
however, to provide a sample sensitivity analysis in this rulemaking 
document, as the technique of sensitivity analysis has been well 
covered by a number of system safety engineering studies.
    FRA notes that the term, ``worst case failure scenario'' is a 
subject of general theory of system safety and reliability. Therefore, 
it does not appear to be necessary to provide an interpretation of this 
term. Nonetheless, in response to comments that have been received on 
this issue, FRA would like to add a clarifying statement. A sensitivity 
analysis must be conducted by defining the range of values (i.e., lower 
bound, upper bound, and associated distribution) for key input 
parameters and assessing the impact of variations over those ranges on 
the overall system risk. The worst case analysis must consider 
realistic combinations of the key input parameters as they tend toward 
their worst case values. Justification must be provided for the ranges 
and process used in the design of the sensitivity analysis.
    Another comment from HCRQ/CGI relates to the requirement that ``the 
sensitivity analysis must confirm that the risk metrics of the system 
are not negatively affected by sensitivity analysis input parameters. * 
* *'' HCRQ/CGI requested that the meaning of the phrase ``negatively 
affected'' be specified. FRA agreed to provide such an explanation and 
therefore offered an interpretation of the words ``negatively 
affected'' in paragraph (e)(1).
    The modification to paragraph (e)(2) of this section is intended to 
clarify how the exposure and its consequences, as main components of 
the risk computation formula, must be measured. As stated in paragraph 
(e)(2), the exposure must be measured in train miles per year over the 
relevant railroad infrastructure where a proposed system is to be 
implemented. When determining the consequences of potential accidents, 
the railroad must identify the total costs involved, including those 
relating to fatalities, injuries, property damage, and other 
incidentals. This final rule eliminates the option of using an 
alternative risk metric, which would allow the measurement of 
consequences strictly in terms of fatalities. It is FRA's experience 
that measuring consequences of accidents strictly in term of fatalities 
did not serve as an adequate alternative to metrics of total cost of 
accidents for two main reasons. First, the statistical data on railroad 
accidents shows that accidents involving fatalities also cause injuries 
and significant damage to railroad property and infrastructure for both 
freight and especially passenger operations. Even though the cost of 
human life is often the highest component of monetary estimates of 
accident consequences, the dollar estimates of injuries, property 
losses, and damage to the environment associated with accidents 
involving fatalities cannot and should not be discounted in the risk 
analysis. Second, allowing fatalities to serve as the only risk metrics 
of accident consequences confused the industry and the risk assessment 
analysts attempting to determine the overall risk associated with the 
use of certain types of train control systems. As a result, some risk 
analysts inappropriately converted injuries and property damages for 
observed accidents into relative estimates of fatalities. This method 
cannot be considered acceptable because, while distorting the overall 
picture of accident consequences, it also raises questions on 
appropriateness of conversion coefficients. Therefore, FRA considers it 
appropriate to eliminate from the rule the alternative option for 
consequences to be measured in fatalities only. This approach gained 
the support of the RLO, who in their comments concur with a 
modification of paragraph (e)(2) that is eliminating an option of risk 
consequences to be measured in fatalities only.
Subpart I--Positive Train Control Systems
Section 236.1001 Purpose and Scope
    This section describes both the purpose and the scope of subpart I. 
Subpart I provides performance-based regulations for the development, 
test, installation, and maintenance of PTC systems, and the associated 
personnel training requirements, that are mandated for installation by 
FRA. This subpart details the process and identifies the documents that 
railroads and operators of passenger trains are to utilize and 
incorporate in their PTC implementation plans. This subpart also 
details the process and procedure for obtaining FRA approval of such 
plans.
    A number of railroads indicated concern with a potentially 
significant reprogramming of funds due to the statutorily mandated 
implementation of PTC systems. These railroads claim that the costs 
associated with PTC system implementation will lead to deferred capital 
improvements and maintenance elsewhere in the general railroad system, 
including degraded track, bridge, or drainage conditions, which may 
then lead to accidents. Thus, according to these railroads, the 
mandated PTC implementation, within an extremely aggressive timeframe, 
may lead to an overall reduced level of safety. FRA recognizes that the 
cost of PTC will be substantial. FRA does note that capital 
expenditures can often be financed; and the Railroad Rehabilitation and 
Improvement Financing (RRIF) program is one source of such financing. 
Other potential sources include private financing, public bond 
authority, and state and federal appropriations. It is the 
responsibility of each public and private railroad to determine 
appropriate funding sources to meet its needs.
    Various railroads also urge FRA to not use its discretion to 
require more than the minimum mandated by the RSIA08. These railroads 
note that under FRA's economic analysis, the costs of PTC 
implementation outweigh its benefits by a ratio of 15 to 1. While these 
railroads acknowledge that these costs are mostly unavoidable due to 
the congressional mandate, they believe that there are ways FRA may 
mitigate these and other costs associated with this rule. FRA has 
crafted this final rule to limit the cost of implementation and to 
avoid further PTC development that could require additional funding and 
additional time. Accordingly, in the proposed and final rule, FRA 
indicates a willingness to approve suitable systems employing non-vital 
onboard processing, to recognize wayside signal logic as an appropriate 
means of protecting movements over switches, to recognize systems that 
enforce the upper limit of restricted speed as suitable collision 
avoidance in the case of following trains and joint authorities, to 
avoid any requirements for monitoring of derails off the main line in 
conventional speed territory, to allow for conventional arrangements at 
rail-to-rail crossings at-

[[Page 2610]]

grade where speeds are moderate, and to recognize to the maximum extent 
possible safety case showings made under subpart H prior to the 
effective date of this rule. In addition, FRA has made allowances for 
operation of Class II and III locomotives in PTC territory and 
significant ``main line'' exceptions for passenger routes. Together, 
these actions will save the railroads billions of dollars of initial 
expense, as well as continuing expense in maintenance over the coming 
years.
Section 236.1003 Definitions
    Given that a natural language such as English contains, at any 
given time, a finite number of words, any comprehensive list of 
definitions must either be circular or leave some terms undefined. In 
some cases, it is not possible and indeed not necessary to state a 
definition. Where possible and practicable, FRA prefers to provide 
explicit definitions for terms and concepts rather than rely solely on 
a shared understanding of a term through use.
    Paragraph (a) reinforces the applicability of existing definitions 
of subparts A through H. The definitions of subparts A through H are 
applicable to subpart I, unless otherwise modified by this part.
    Paragraph (b) introduces definitions for a number of terms that 
have specific meanings within the context of subpart I. Paragraph (b) 
has been modified in the final rule by adding a definition for the 
term, ``Notice of Product Intent.''
    In lieu of analyzing each definition here, however, some of the 
delineated terms will be discussed as appropriate while analyzing other 
sections below.
    As a general matter, however, FRA believes it is important to 
explain certain organizational changes required pursuant to the RSIA08. 
The statute establishes the position of a Chief Safety Officer within 
FRA. The Chief Safety Officer has been designated as the Associate 
Administrator for Railroad Safety. Thus, the use of the term Associate 
Administrator in this subpart refers to the Associate Administrator for 
Railroad Safety and Chief Safety Officer, or as otherwise referenced, 
the Associate Administrator for Railroad Safety/Chief Safety Officer.
    The NPRM defined ``host railroad'' to mean ``a railroad that has 
effective operating control over a segment of track.'' This term is 
used in Sec.  236.1005(b) to identify the party responsible for 
installing PTC and in Sec.  236.1007 with respect to attributes of PTC 
systems for high-speed service. The host railroad is also responsible 
for planning and filing requirements (see, e.g., Sec.  236.1009). In 
proposing this definition, FRA sought to capture in a word the essence 
of fundamental responsibility for the rail operation. FRA considered 
terms such as ``track owner'' (used in the Track Safety Standards), but 
found that the alternatives had drawbacks of one kind or another. There 
are places, for instance, where a non-railroad State or local 
government or private corporation owns the underlying fee beneath the 
railroad infrastructure but is not engaged in any way in managing or 
benefitting from the railroad (except in some cases by receiving 
revenue from a lease). There are also situations where multiple 
railroads are dispatched from a common location, either by one of the 
railroads or by a third party. It is increasingly the case that 
commuter service is provided by a public authority through multiple 
contractors who are responsible for discrete portions of service as 
agents of the sponsoring entity (e.g., equipment maintenance, track and 
signal maintenance, train operations, dispatching). In short, it is 
hard to describe, in a common way, who is responsible here; 
nevertheless, in any concrete case, there can be but one entity 
ultimately responsible.
    The Southern California Regional Rail Authority submitted comments 
requesting that FRA provide additional clarification to what 
constitutes ``effective operating control'' as stated in the definition 
of the term ``host railroad.'' Specifically, SCRRA questioned whether 
FRA would consider control of dispatching as ``effective operating 
control'' even if responsibilities for the installation and maintenance 
of wayside devices and infrastructure are under a different party than 
the dispatcher. Although FRA does not find it necessary to change the 
definition contained in the regulation, FRA will offer clarification as 
to the intended meaning. As noted above, very often railroads cooperate 
in dispatching trains that traverse contiguous lines in order to 
maximize tactical planning and efficiency. Whether one railroad might 
dispatch another railroad's territory would not cause the dispatching 
railroad to take on the responsibilities of the host. Similarly, the 
fact that a railroad might contract with another railroad to dispatch 
all or a portion of its lines would not relieve the former railroad of 
responsibilities of the host.
    In the example of SCRRA's Metrolink operations, we would expect 
SCRRA, which defines its route structure and timetable for passenger 
operations, to undertake the duties of the host for the lines for which 
it enjoys effective control in the sense that it has the right to 
determine who operates over the lines and under what conditions. In 
general, those are the lines it owns directly or through public 
authorities that cooperate in the joint powers arrangement. Lines owned 
and operated by BNSF or UP and over which Metrolink trains operate 
would be the responsibility of BNSF and UP, respectively, even if SCRRA 
or its contractor has day-to-day responsibility for dispatching some of 
them.
    GE Transportation expressed concern regarding the definition and 
use of the term Type Approval in Sec.  236.1003 and subsequent 
sections, including Sec.  236.1031. GE Transportation notes that under 
the proposed rule Type Approvals apply only to complete PTC systems, 
although it is generally recognized in the industry that there are five 
core component subsystems in a PTC system configuration: (1) A 
locomotive onboard subsystem; (2) a dispatch center supervisory control 
and data acquisition (SCADA) subsystem; (3) a PTC server (central or 
wayside) if a server is required; (4) wayside interface units; and (5) 
a data communications network connecting the other subsystems. When a 
Type Approval is granted to a PTC system, GE Transportation suggests 
that core subsystems of that PTC system should be granted Component 
Type Approval under certain conditions. According to GE Transportation, 
the granting of such Component Type Approvals will drive simplified 
filings, faster approval, and faster deployment for new system 
configurations using a building block approach. In addition, states GE 
Transportation, it reduces the risks associated with PTC deployment by 
simplifying substitution of components in the event of a problem, the 
market for PTC system components becomes less restrictive, and the next 
logical step is for a supplier to be permitted to introduce a core 
subsystem component for approval. GE Transportation asserts that this 
will encourage market development and further reduce risks for PTC 
deployment and sustained operation.
    FRA understands GE's concern. However, it appears to be based on a 
misunderstanding of FRA's definition of ``Type Approval.'' In 
developing the ``Type Approval'' concept, FRA looked to the Federal 
Aviation Administration (FAA) model of system approval as a basis. 
However, FRA modified the FAA approach to better fit FRA's regulatory 
mandate and resources. FRA considers the ``Type Approval'' to be more 
akin to the FAA concept of an ``Airworthiness Certificate.'' Under FAA 
rules, an airworthiness certificate is only issued

[[Page 2611]]

to a system (and, in the case of the FAA, this system is an aircraft). 
This analogy is made only to make a minor clarification and should not 
necessarily be construed to entirely equate subpart I's Type Approval 
concept with that of FAA's Airworthiness Certificate concept.
    FRA has also considered GE's position that an FRA failure to issue 
component level approvals could restrict the development of new 
products. FRA notes that the current industry practice is based on 
vendor or supplier determination that there will be a market for a 
particular product. This determination may be based on a specific 
request from a customer, or on the vendor's or supplier's perception 
that there is a need for the product. While this process may consider 
the regulatory requirements that may be applicable to a component, it 
has not required FRA to issue an ``approval'' for any particular 
component. Given the number of new products that have been brought to 
market, FRA believes that this development model has worked very 
successfully. Further, the requirements of the RSIA08 require FRA to 
certify that the PTC system, not the PTC system components, meets the 
regulatory requirements. The ``Type Approval'' does not in any way 
certify a PTC system as required by statute; it only indicates to the 
system developer/integrator that FRA believes that the proposed system, 
if properly implemented, may meet the statutory requirements. FRA 
therefore declines, at this time, to issue component level ``type 
approvals''.
    The AAR believes that the definition of ``safe state'' includes 
conditions not necessarily applicable. According to AAR, this term may 
be utilized to describe the operation of a system in non-failure 
scenarios and, in fact, is arguably used in this fashion even within 
the NPRM preamble (see, e.g., 74 FR 35,966 (July 21, 2009) (``If a 
switch is misaligned, the PTC system shall provide an acceptable safe 
state of train operations.'')). Accordingly, the AAR asserts that the 
definition of ``safe state'' should be modified to strike the clause 
``when the system fails.''
    Some other commenters expressed the opinion that in the current 
definition of ``safe state,'' the clause ``cannot cause harm'' lacks 
specificity. FRA agrees to modify the definition of ``safe state'' by 
replacing the clause ``system configuration that cannot cause harm when 
the system fails'' with the clause ``system state that, when the system 
fails, cannot cause death, injury, occupational illness, or damage to 
or loss of property, or damage to the environment.'' This definition 
corresponds to that of the safe state definition in the U.S. Department 
of Defense Military Standard (MIL-STD) 882C. FRA, however, disagrees 
with AAR that the term ``safe state'' should be also applicable for the 
description of system state in non-failed conditions. The definition of 
the term ``safe state'' should not be confused with the term ``safe 
operation'' or ``operating safely.'' The term ``safe state'' was added 
in Sec.  236.1003 strictly for the purpose of defining a ``protective'' 
state (safe state) of the system, which the system must take when it 
fails. At the same time, FRA admits erroneous use of the term ``safe 
state'' in the section quoted by AAR (74 FR 35,966) and amends it to 
read: ``If a switch is misaligned, the PTC system shall provide an 
acceptable level of safety of train operations.''
Section 236.1005 Requirements for Positive Train Control Systems
    The RSIA08 specifically requires that each PTC system be designed 
to prevent train-to-train collisions, overspeed derailments, incursions 
into established work zone limits, and the movement of a train through 
a switch left in the wrong position. Section 236.1005 includes the 
minimum statutory requirements and provides amplifying information 
defining the necessary PTC functions and the situations under which PTC 
systems must be installed. Each PTC system must be reliable and perform 
the functions specified in the RSIA08.
    Train-to-train collisions. Paragraph (a)(1)(i) applies the 
statutory requirement that a mandatory PTC system must be designed to 
prevent train-to-train collisions. FRA understands this to mean head-
to-head, rear-end, and side and raking collisions between trains on the 
same, converging, or intersecting tracks. Currently available PTC 
technology can meet these needs by providing current and continuous 
guidance to the locomotive engineer and enforcement using predictive 
braking to stop short of known targets. FRA notes that the technology 
associated with currently available PTC systems may not completely 
eliminate all collisions risks. For instance, a PTC system mandated by 
this subpart is not required to prevent a collision caused by a train 
that derails and moves onto a neighboring or adjacent track (known in 
common parlance as a ``secondary collision'').
    During discussions regarding available PTC technology, it has been 
noted that this technology also has inherent limitations with respect 
to prevention of certain collisions that might occur at restricted 
speed. In signaled territory, there are circumstances under which 
trains may pass red signals, other than absolute signals without verbal 
authority, either at restricted speed or after stopping and then 
proceeding at restricted speed. To avoid rear end collisions, available 
PTC technology does not always track the rear-end of each train, but 
instead relies on the signal system to indicate the appropriate action. 
In this example, the PTC system would display ``restricted speed'' to 
the locomotive engineer as the action required and would enforce the 
upper limit of restricted speed (i.e., 15 or 20 miles per hour, 
depending on the railroad). This means that more serious rear end 
collisions will be prevented, because the upper limit of restricted 
speed is enforced. This also means that fewer low speed rear-end 
collisions will occur because a continuous reminder of the required 
action will be displayed to the locomotive engineer (rather than the 
engineer relying on the aspect displayed by the last signal, which may 
have been passed some time ago). However, some potential for a low 
speed rear-end collision will remain in these cases, and the rule is 
clear that this limitation has been accepted. Similar exposure may 
occur in non-signaled territory where trains are conducting switching 
operations or other activities under joint authorities. The PTC system 
can enforce the limits of the authority and the upper limit of 
restricted speed, but it cannot guarantee that the trains sharing the 
authority will not collide. Again, however, the likelihood and average 
severity of any potential collisions would be greatly reduced 
considering such movements would be made under restricted speed. FRA 
may address this issue in a later modification to subpart I if 
necessary as technology becomes available.
    FRA received comments on this discussion of the inherent 
limitations of available PTC technology with respect to the prevention 
of certain collisions that may occur at restricted speed from NYSMTA. 
NYSMTA sought clarification that PTC is not intended to enforce 
conformance of block entry speeds associated with wayside signal 
aspects or similar cab signal aspects provided without speed control, 
except when a train is operating under a wayside signal or cab signal 
aspect requiring a speed not to exceed restricted speed. FRA noted in 
the NPRM, and repeats here, that FRA recognizes that some PTC 
architectures will not directly enforce speed restrictions imposed by 
all intermediate signals. FRA does expect that the

[[Page 2612]]

PTCDP will be clear on how the system accomplishes train separation and 
regulation of speeds over turnouts.
    The final rule text, however, does provide an example of a 
potential train-to-train collision that a PTC system should be designed 
to prevent. Rail-to-rail crossings-at-grade--otherwise known as diamond 
crossings--present a risk of side collisions. FRA recognizes that such 
intersecting lines may or may not require PTC system implementation and 
operation. Since a train operating with an unregulated PTC system 
cannot necessarily recognize a train not operating with a PTC system or 
moving on an intersecting track without a PTC system, the PTC system--
no matter how intelligent--may not be able to prevent a train-to-train 
collision in such circumstances.
    Accordingly, paragraph (a)(1)(i) requires certain protections for 
such rail-to-rail crossings-at-grade. While these locations are 
specifically referenced in paragraph (a)(1)(i), their inclusion is 
merely illustrative and does not necessarily preclude any other type of 
potential train-to-train collision. Moreover, a host railroad may have 
alternative arrangements to the specific protections referenced in the 
associated table under paragraph (a)(1)(i), which it must submit in its 
PTCSP--discussed in detail below--and receive a PTC System 
Certification associated with that PTCSP.
    Rail-to-rail crossings-at-grade that have one or more PTC routes 
intersecting with one or more routes without a PTC system must have an 
interlocking signal arrangement in place developed in accordance with 
subparts A through G of part 236 and a PTC enforced stop on all PTC 
routes. FRA has also determined that the level of risk varies based 
upon the speeds at which the trains operate through such crossings, as 
well as the presence, or lack, of PTC equipped lines leading into the 
crossing. Accordingly, under a compromise accepted by the PTC Working 
Group, if the maximum speed on at least one of the intersecting tracks 
is more than 40 miles per hour, then the routes without a PTC system 
must also have either some type of positive stop enforcement or a 
split-point derail on each approach to the crossing and incorporated 
into the signal system, and a permanent maximum speed limit of 20 miles 
per hour. FRA expects that these protections be instituted as far in 
advance of the crossing as is necessary to stop the encroaching train 
from entering the crossing. The 40 miles per hour threshold appears to 
be appropriate given three factors. First, the frequency of collisions 
at these rail intersections is low, because typically one of the routes 
is favored on a regular basis and train crews expect delays until 
signals clear for their movement. Second, the special track structure 
used at these intersections, known as crossing diamonds, experiences 
heavy wear; and railroads tend to limit speeds over these locations to 
no more than 40 miles per hour. Finally, FRA recognizes that for a 
train on either intersecting route, elevated speed will translate into 
higher kinetic energy available to do damage in a collision-induced 
derailment. Thus, for the small number of rail crossings with one or 
more routes having an authorized train speed above 40 miles per hour, 
including higher speed passenger routes, it is particularly important 
that any collision be prevented. FRA believes that these more 
aggressive measures are required to ensure train safety in the event 
the engineer does not stop a train before reaching the crossing when 
the engineer does not have a cleared route displayed by the 
interlocking signal system and higher speed operations are possible on 
the route intersected. The split-point derail would prevent a collision 
in such a case by derailing the offending train onto the ground before 
it reaches the crossing. Should the train encounter a split-point 
derail as a result of the crew's failure to observe the signal 
indication, the slower speed at which the unequipped train is required 
to travel would minimize the damage to the unequipped train and the 
potential affect on the surrounding area.
    As an alternative to split-point derails, the non-PTC line may be 
outfitted with some other mechanism that ensures a positive stop of the 
unequipped crossing train. If a PTC system or systems are installed and 
operated on all crossing lines, there are no speed restrictions other 
than those that might be enforced as part of a civil or temporary speed 
restriction. However, the crossing must be interlocked and the PTC 
system or systems must ensure that each of the crossing trains can be 
brought safely to a stop before reaching the crossing in the event that 
another train is already cleared through or occupying the crossing.
    The Rail Labor Organizations shares FRA's concerns regarding 
diamond crossings, supporting the requirements for interlocking signal 
arrangements, a PTC enforced stop on PTC routes, and installation of 
split-point derails with a 20 miles per hour maximum authorized speed 
on the approach of any intersecting non-PTC route. However, the RLO 
believe that split-point derails should be required regardless of the 
PTC route's maximum speed in order to protect the PTC route against a 
non-equipped train passing through a stop indication and equipment 
inadvertently rolling out (i.e., a roll away) from the non-PTC route.
    AAR and CSXT challenge the imposition of split-point derails. CSXT 
believes that the proposed rule merely shifts the safety risks 
associated with Class II and III railroads, but does not eliminate them 
altogether. For instance, CSXT points out that unlike a PTC-compliant 
system, the split-point derail would not avoid derailment altogether; 
rather, it would simply cause the non-PTC Class II or III train to 
derail away from the crossing. According to CSXT, the most 
comprehensive safety regime that would avoid both collisions and 
derailments would be to require Class II and Class III railroads 
operating on PTC routes also to be PTC equipped.
    One commenter objected to the costs of derails being borne by PTC 
equipped Class I railroads. The NPRM did not purport to address who 
would pay this cost, but merely recited in a brief reference that the 
assumption had been made in the Regulatory Flexibility Analysis that 
the railroad installing PTC would bear the cost. FRA does not stipulate 
who is responsible for the cost of split-point derails at rail-to-rail 
crossings at-grade, as the cost will be borne in conformance with any 
agreements between the railroads or prior rights arising out of 
previous transactions under which property was acquired. FRA would have 
appreciated some indication of how those costs are likely to fall, but 
no information was provided on this point.
    The commenter also proposes exploration of lower-cost alternatives 
in lieu of split-point derails. FRA agrees that less expensive 
alternatives to split-point derails at rail-to-rail crossings at-grade 
can and should be proposed in a railroad's PTCIP or PTCDP. As FRA 
stated in the preamble discussion of paragraph (a)(1)(i) in the 
proposed rule, ``the non-PTC line may be outfitted with some other 
mechanism that ensures a positive stop of the unequipped * * * train.'' 
(74 FR 35,950, 35,960). FRA expects, however, that any alternative to 
the split-point derail will provide the same level of separation as 
that afforded by the installation of the split-point derail.
    CSXT submitted comments stating that the installation of split-
point derails would create a new danger, including a secondary 
collision. However, FRA believes that these aggressive measures at 
locations where train speeds exceed 40 miles per hour through rail-to-
rail crossings at-grade, where not all routes

[[Page 2613]]

have been equipped with a PTC system or positive stop enforcement, are 
necessary in order to ensure train safety. FRA fully agrees that full 
PTC technology that provides positive stop enforcement from all 
directions is a more desirable method of protecting such locations. 
However, where such technology has not been installed, the prescribed 
use of split-point derails in approach to the crossing-at-grade is 
deemed necessary in the event the engineer of a train operating on a 
line without positive stop enforcement does not have a cleared route 
and fails to stop the train prior to reaching the crossing. The split-
point derail, in combination with the required speed limitation of 20 
miles per hour or less, would prevent a collision by derailing the 
offending train onto the ground before it reached the crossing. Should 
such a train encounter a split-point derail in its derailing position 
as a result of the crew's failure to observe or adhere to the signal 
indication, the slower speed at which an unequipped train is required 
to travel would minimize damage to the unequipped train and the 
potential effect on the surrounding area.
    FRA has also considered the comments of the RLO that more secure 
arrangements should be provided at each rail-to-rail crossing-at-grade, 
regardless of speed. FRA believes that where the PTC-equipped and non-
PTC-equipped lines of the Class I railroads intersect, the railroads 
will generally utilize the available PTC technology to ensure a 
positive stop short of the crossing for any train required to stop 
short of the interlocking. The WIU at the location and available 
onboard capability supported by a radio data link should make this an 
obvious solution. FRA will scrutinize Class I PTCDPs to ensure that 
this is the case. FRA remains concerned that more aggressive solutions 
for intersections with Class II and III lines could impose substantial 
costs without returning significant benefits.
    Overspeed derailments. Paragraph (a)(1)(ii) requires that PTC 
systems mandated under subpart I be designed to prevent overspeed 
derailments and addresses specialized requirements for doing so. FRA 
notes that a number of passenger train accidents with a significant 
number of injuries have been caused by trains exceeding the maximum 
allowable speed at turnouts and crossovers and upon entering stations. 
Accordingly, FRA emphasizes the importance of enforcement of turnout 
and crossover speed restrictions, as well as civil speed restrictions.
    For instance, in the Chicago region, two serious train accidents 
occurred on the same Metra commuter line when locomotive engineers 
operated trains at more than 60 miles per hour while traversing between 
tracks using crossovers, which were designed to be safely traversed at 
10 miles per hour. For illustrative purposes, the rule text makes clear 
that such derailments may be related to railroad civil engineering 
speed restrictions, slow orders, and excessive speeds over switches and 
through turnouts and that these types of speed restrictions are to be 
enforced by the system.
    The UTA and APTA each submitted the same basic comment pertaining 
to paragraph (a)(1)(ii), with which SCRRA concurred. They contend that 
speed restrictions are often set at a speed that is far below a speed 
that would cause a derailment. Therefore, they request that a PTC 
system should allow or display a speed higher than the actual speed 
restriction, but well short of a speed that may cause a derailment.
    The RLO submitted a comment that, while the language ``prevent 
overspeed derailments'' accurately reflects the language found in the 
RSIA08, this paragraph misses the congressional intent of the statute 
and appears to be unenforceable unless a derailment occurs in 
conjunction with a PTC system that fails to enforce an overspeed event. 
The RLO believe that FRA should amend this paragraph to establish that 
it will be a violation of this section if the PTC system fails to 
enforce an overspeed condition that is not corrected by the locomotive 
engineer regardless of whether or not such overspeed results in a 
derailment. Since most overspeed occurrences do not result in a 
derailment, the RLO asserts that waiting for a derailment to happen 
before declaring that the PTC system is not operating as intended is 
contrary to the purpose of the law.
    FRA intends and believes that the PTC core feature concerning 
``overspeed derailments'' is such that the system shall enforce various 
speed restrictions (i.e., civil speed restrictions, temporary slow 
orders, excessive speeds over switches and through turnouts and 
crossovers, etc.) regardless of whether a derailment actually occurs. 
However, FRA elects to leave the rule text of paragraph (a)(1)(ii) as 
it was written in the proposed rule. FRA is aware of various train 
control systems that have a tolerance of 3 miles per hour before the 
system displays a warning to the train operator and that apply a 
penalty brake application when the train reaches a speed 5 miles per 
hour above the posted speed restriction. Appropriate speed margins or 
leeways associated with maximum authorized speed are expected, but they 
must be presented, justified, and approved within the context of a 
railroad's PTCDP and PTCSP.
    Roadway work zones. Paragraph (a)(1)(iii) requires that PTC systems 
mandated under subpart I be designed to prevent incursions into 
established work zone limits. Work zone limits are defined by time and 
space. The length of time a work zone limit is applicable is determined 
by human elements. Working limits are obtained by contacting the train 
dispatcher, who will confirm an authority only after it has been 
transmitted to the PTC system's server. Paragraph (a)(1)(iii) 
emphasizes the importance of each PTC system to provide positive 
protection for roadway workers working within the limits of their work 
zone. Accordingly, once a work zone limit has been established, the PTC 
system must be notified. The PTC system must continue to obey that 
limit until it is notified by the dispatcher or roadway worker in 
charge, with verification from the other, either that the limit has 
been released and the train is authorized to enter or the roadway 
worker in charge has authorized movement of the train through the work 
zone.
    As a way to achieve this technological functionality, FRA's Office 
of Railroad Development has funded the development of a Roadway Worker 
Employee in Charge (EIC) Portable Terminal that allows the EIC to 
control the entry of trains into the work zone. While no rule includes 
the commonly used term EIC, FRA recognizes that it is the equivalent to 
the term ``Roadway Worker In Charge'' as used in part 214. With the 
portable terminal, the EIC can directly control the entry of trains 
into the work zone and restrict the speed of the train through the work 
zone. If the EIC does not grant authority for the train to enter the 
work zone, the train is forced to a stop by the PTC system prior to 
violating the work zone authority limits. If the EIC authorizes entry 
of the train into the work zone, the EIC may establish a maximum 
operating speed for the train consistent with the safety of the roadway 
work employees. This speed is then enforced on the train authorized to 
enter and pass through the work zone. The technology is significantly 
less complex than the technology associated with dispatching systems 
and the PTC onboard system. In view of this, FRA strongly encourages 
deployment of such portable terminals as opposed to current methods 
that only require the locomotive engineer to, in some manner, 
``acknowledge'' his or her

[[Page 2614]]

authority to operate into or through the limits of the work zone (e.g., 
by pressing a soft key on the onboard display, even if in error).
    Pending the adoption of more secure technology, such as the EIC 
Portable Terminal, FRA will scrutinize each submitted PTCDP and PTCSP 
to determine whether they leave any opportunity for single point human 
failure in the enforcement of work zone limits. FRA again notes that 
some methods in the past have allowed the locomotive engineer to simply 
acknowledge a work zone warning, even if inappropriately, after which 
the train could proceed into the work zone. FRA expects that more 
secure procedures will be included in safety plans submitted under 
subpart I.
    The RLO submitted a comment that, in order for a PTC system to 
effectively perform the core function of protecting roadway workers 
operating within the limits of their authority, the PTC system must be 
designed in a manner that prevents override of an enforced stop prior 
to entering an established work zone through simple acknowledgement of 
the existence of work zone limits by a member of the train crew (i.e., 
by pressing a soft key on the onboard display, even if in error). The 
RLO expressed support for FRA's intention to closely scrutinize each 
PTCSP to determine whether they leave any opportunity for a single 
point human failure in the enforcement of work limits. The RLO strongly 
encouraged FRA to withhold approval of any PTC system that does not 
enforce a positive stop at the entrance to established work zones until 
notified directly by the dispatcher or the roadway worker in charge, 
with verification from the other, that the movement into the work zone 
has been authorized by the roadway worker in charge.
    FRA agrees with the concern expressed by the RLO on this issue. 
However, in the spirit of staying strictly within the mandate of the 
RSIA08 relating to required PTC functionality, FRA will require that 
the actual method of enforcement and acknowledgement associated with 
work zones be presented within the PTCDP and PTCSP and subject to FRA 
approval. FRA continues to strongly encourage use of EIC portable 
terminals with electronic handshake of acknowledgement and 
authorizations to enter work zones.
    Movement over main line switches. Paragraph (a)(1)(iv) requires 
that PTC systems mandated under subpart I be designed to prevent the 
movement of a train through a main line switch in the improper 
position. Given the complicated nature of switches--especially when 
operating in concert with wayside, cab, or other similar signal 
systems--the final rule provides more specific requirements in 
paragraph (e) as discussed further below.
    In numerous paragraphs, the final rule requires various operating 
requirements based primarily on signal indications. Generally, these 
indications are communicated to the engineer, who would then be 
expected to operate the train in accordance with the indications and 
authorities provided. However, a technology that receives the same 
information does not necessarily have the wherewithal to respond unless 
it is programmed to do so. Thus, paragraph (a)(2) requires PTC systems 
implemented under subpart I to obey and enforce all such indications 
and authorities provided by these safety-critical underlying systems. 
The integration of the delivery of the indication or authority with the 
PTC system's response to those communications must be described and 
justified in the PTCDP--further described below--and the PTCSP, as 
applicable, and then must comply with those descriptions and 
justifications. Again, FRA recognizes that in the case of intermediate 
signals, this may not involve direct enforcement of the signal 
indication.
    APTA submitted a comment that the draft language of paragraph 
(a)(2) appears to disallow systems such as moving block overlays that 
may provide superior service. Since APTA does not believe this was the 
intent of the provision, APTA suggests that FRA clarify the language in 
this paragraph.
    Paragraph (a)(2) is clear that the specified functions must be 
performed ``except as justified'' in the PTCDP or PTCSP. Here, FRA 
specifically intends to afford a means by which advanced systems 
permitting moving block operations could be qualified, either as stand-
alone systems or as overlays integrated with the existing signal and 
train control arrangements.
    The PTC Working Group had extensive discussions concerning the 
monitoring of main line switches and came to the following general 
conclusions:
    First, signal systems do a good job of monitoring switch position, 
and enforcement of restrictions imposed in accordance with the signal 
system is the best approach within signaled territory (main track and 
controlled sidings). As a general rule, the enforcement required for 
crossovers, junctions, and entry into and departure from controlled 
sidings will be a positive stop, and the enforcement provided for other 
switches (providing access to industry tracks and non-signaled sidings 
and auxiliary tracks) will be display and enforcement of the upper 
limit of restricted speed. National Transportation Safety Board 
representatives were asked to evaluate whether this strategy meets the 
needs of safety from their perspective. The NTSB returned with a list 
of accidents caused by misaligned switches that it had investigated in 
recent years, none of which was in signaled territory. Based on that 
data, the NTSB staff decided that it was not necessary to monitor 
individual switches in signaled territory.
    In a filing to this proceeding, the NTSB indicated that switch 
monitoring in both dark and signaled territories must demonstrate that 
a train will be stopped before crossing through a misaligned switch. 
Although the NTSB recognizes that signal systems currently provide 
information about switch positions, it asserts that FRA must ensure 
that any PTC system that uses the signal system to monitor switch 
positions will provide adequate safeguards to prevent trains from being 
routed through misaligned switches. Accordingly, the NTSB agreed with 
FRA's decision to protect switches within sidings with speed limits 
greater than 20 miles per hour to prevent switch misalignment 
accidents.
    Second, switch monitoring functions of contemporary PTC systems 
provide an excellent approach to addressing this requirement in dark 
territory. However, it is important to ensure that switch position is 
determined with the same degree of integrity that one would expect 
within a signaling system (e.g., fail-safe point detection, proper 
verification of adjustment). The PTC Working Group puzzled over sidings 
in dark territory and how to handle the requirement for switch 
monitoring in connection with those situations. (While these are not 
``controlled'' sidings, as such, they will often be mapped so that 
train movements into and out of the sidings are appropriately 
constrained.) At the final PTC Working Group meeting, a proposal was 
accepted that would treat a siding as part of the main line track 
structure requiring monitoring of each switch off of the siding if the 
siding is non-signaled and the authorized train speed within the siding 
exceeds 20 miles per hour. This issue is more fully discussed below.
    Other functions. While FRA has included the core PTC system 
requirements in Sec.  236.1005, there is the possibility that other 
functions may be explicitly or implicitly required elsewhere in subpart 
I. Accordingly, under paragraph (a)(3), each PTC system required by 
subpart I must also perform

[[Page 2615]]

any other functions specified in subpart I. According to 49 U.S.C. 
20157(g), FRA must prescribe regulations specifying in appropriate 
technical detail the essential functionalities of positive train 
control systems and the means by which those systems will be qualified.
    In addition to the general performance standards required under 
paragraphs (a)(1)-(3), paragraph (a)(4) contains more detailed 
standards relating to the situations paragraphs (a)(1)-(3) intend to 
prevent. Paragraph (a)(4) defines specific situations where FRA has 
determined that specific warning and enforcement measures are necessary 
to provide for the safety of train operations, their crews, and the 
public and to accomplish the goals of the PTC system's essential core 
functions. Under paragraph (a)(4)(i), FRA intends to prevent unintended 
movements onto PTC main lines and possible collisions at switches by 
ensuring proper integration and enforcement of the PTC system as it 
relates to derails and switches protecting access to the main line.
    Paragraph (a)(4)(ii) intends to account for operating restrictions 
associated with a highway-rail grade crossing active warning system 
that is in a reduced or non-operative state and unable to provide the 
required warning for the motoring public. In this situation, the PTC 
system must provide positive protection and enforcement related to the 
operational restrictions of alternative warning that are issued to the 
crew of any train operating over such crossing in accordance with part 
234. Paragraph (a)(4)(iii) concerns the movement of a PTC operated 
train in conjunction with the issuance of an after arrival mandatory 
directive. While FRA recognizes that the use of after arrival mandatory 
directives poses a risk that the train crew will misidentify one or 
more trains and proceed prematurely, PTC provides a means to intervene 
should that occur. Further, such directives may sometimes be considered 
operationally useful. Accordingly, FRA fully expects that the PTC 
system will prevent collisions between the receiving trains and the 
approaching train or trains.
    Numerous comments were received related to PTC system functional 
requirements associated with highway-rail grade crossing active warning 
systems. At the public hearing, the RLO asserted that the use of 
technologies providing warning system pre-starts, activation 
verification, and various health monitoring information related to the 
warning system to approaching trains needs to be a required component 
of the PTC system warning and enforcement functionalities where 
warranted. AASHTO submitted comments expressing agreement that 
inclusion of hazard warning detection in PTC systems for highway-rail 
grade crossing warning systems is a significant enhancement to mitigate 
potential risk. AASHTO also underlined its position of enhancing grade 
crossing safety further by implementation of a program to fully 
eliminate at-grade highway-rail crossings through consolidation and 
grade separation wherever possible.
    Some commenters expressed various logistic concerns with the 
proposed rule language relating to operational restrictions issued in 
response to a warning system malfunction as required by Sec. Sec.  
234.105, 236.106, and 236.107 of this part. Other commenters asserted 
that any PTC system functional requirements related to highway-rail 
grade crossing warning systems fall entirely outside the scope of the 
statutory mandate contained within the RSIA08 and therefore should not 
be addressed in this rulemaking.
    The AAR stated that, while they understand the safety concern, this 
function is not even remotely related to the ``core'' PTC functions 
mandated by Congress. Furthermore, the AAR asserts that the great cost 
of installing wayside interface units at grade crossings on PTC routes 
would be prohibitively expensive and would divert resources that would 
otherwise be devoted to meeting the mandated PTC deadline.
    NJ Transit stated that the RSIA08 does not indicate a requirement 
for highway-rail grade crossing inclusion in the PTC system speed and 
stop enforcement. Thus, the requirement contained in paragraph 
(a)(4)(ii) to include warning and enforcement functionality simply adds 
an additional effort to an already extremely aggressive December 31, 
2015, mandate for PTC.
    APTA and SCRRA stated that the requirements contained in proposed 
paragraph (a)(4)(ii) were unclear. APTA and SCRRA recommended that FRA 
should clarify that the language in paragraph (a)(4)(ii) is intended 
solely to provide that a dispatcher can place a restriction on a 
crossing that the PTC system must enforce in the event that a 
malfunction is reported. However, according to APTA, paragraph 
(a)(4)(ii) should not be read to require a PTC system to protect a 
grade crossing and restrict or prevent a movement authority of a train 
from being advanced across the crossing in the event of a failure being 
detected in real time; nor should paragraph (a)(4)(ii) be interpreted 
to require a grade crossing warning system to self-monitor and, if in a 
degraded condition, impose a speed restriction or stop for an 
approaching train.
    NYSMTA states that the addition of highway-rail grade crossings to 
this subpart falls outside the statutory mandate for PTC systems within 
the RSIA08. This additional functionality presents an additional burden 
for LIRR and Metro-North. Both railroads have hundreds of grade 
crossings in their rail networks. NYSMTA further asserted that the 
language in paragraph (a)(4)(ii) was ambiguous with respect to whether 
``warning or enforcement'' of reported grade crossing failures would be 
required, and what constitutes a ``warning.'' Required enforcement will 
increase the capital cost of PTC, have an adverse impact on operations, 
risk modifications to ACSES that could trigger verification and 
validation, and create a further impediment to meeting the other 
requirements of the proposed FRA regulations. NYSMTA therefore 
recommended that the final rule be limited at this time to the four 
requirements of the RSIA08.
    FRA believes that, although the RSIA08 does not specifically 
require PTC systems to cover highway-rail grade crossing warning system 
malfunctions and associated operational requirements, it does stipulate 
that FRA must develop rules and standards for PTC system functionality, 
which include the four core features identified. In light of the 
safety-critical nature of the specified operational limitations for 
providing alternative warning to highway users pursuant to Sec. Sec.  
234.105, 236.106, and 236.107, and the catastrophic consequences that 
have often been experienced when those operational limitations have not 
been accomplished (including actual and potential impacts with motor 
vehicles involving serious injury and loss of life) and the fact that 
these operational limitations equate to speed and stop targets that PTC 
systems may surely warn and enforce, FRA intends to carry the language 
contained within the proposed paragraph into this final rule. Although 
FRA believes that the proposed rule was clear that its purpose was to 
enforce dispatcher-issued ``stop-and-flag'' orders and slow orders 
associated with credible reports of highway-rail grade crossing warning 
device malfunctions, reference has been added to ``mandatory 
directives,'' a term with a well-established meaning in FRA regulatory 
parlance (see 49 CFR part 220).
    While FRA recognizes that technologies exist to provide even 
further interface with warning system activation and health, and 
encourages railroads to include these technologies

[[Page 2616]]

to the extent possible, FRA elects to not require those interfaces 
beyond that which has been already identified within this paragraph.
    The NTSB submitted comments recommending that requirements for 
warning and barrier protection plans for Class 7 track should also 
apply to Class 5 and 6 tracks as part of an approved PTCSP in order to 
reduce the risk of high-speed catastrophic derailments at associated 
grade crossings. FRA notes that the requirements contained within Sec.  
213.347 of this part require that a warning/barrier plan be approved 
and adhered to for Class 7 track operations and prohibit grade 
crossings on Class 8 and 9 track. Those requirements do not, however, 
address Class 5 and 6 tracks specifically. Therefore, FRA believes that 
this comment falls outside the scope of the present rulemaking. As 
noted elsewhere in this preamble, FRA has developed Guidelines for 
Highway-Rail Grade Crossing Safety on high-speed rail lines that 
endeavor to improve engineering with a strong emphasis on closures. 
Those Guidelines will be used to review and negotiate grants under 
ARRA.
    FRA recognizes that movable bridges, including draw bridges, 
present an operational issue for PTC systems. Under subpart C, Sec.  
236.312 already governs the interlocking of signal appliances with 
movable bridge devices and FRA believes that this section should 
equally apply to PTC systems governing movement over such bridges. 
While subparts A through H apply to PTC systems--as stated in Sec.  
236.1001--paragraph (a)(4)(iv) proposes to make this abundantly clear. 
Accordingly, in paragraph (a)(4)(iv) and consistent with Sec.  236.312, 
movable bridges within a PTC route are to be equipped with an 
interlocked signal arrangement which is also to be integrated into the 
PTC system. A train shall be forced to stop prior to the bridge in the 
event that the bridge locking mechanism is not locked, the locking 
device is out of position, or the bridge rails of the movable span are 
out of position vertically or horizontally from the rails of the fixed 
span. Effective locking of the bridge is necessary to assure that the 
bridge is properly seated and thereby capable to support both the 
weight of the bridge and that of a passing train(s) and preventing 
possible derailment or other potential unsafe conditions. Proper track 
rail alignment is also necessary to prevent derailments, either of 
which again could result in damage to the bridge or a train derailing 
off the bridge. No comments were received on this issue, and the 
provision is carried forward in the final rule.
    Paragraph (a)(4)(v) requires that hazard detectors integrated into 
the PTC system--as required by paragraph (c) of this section or the FRA 
approved PTCSP--must provide an appropriate warning and associated 
applicable enforcement through the PTC system. There are many types of 
hazard detection systems and devices. Each type has varying operational 
requirements, limitations, and warnings based on the types and levels 
of hazard indications and severities. FRA expects this enforcement to 
include a positive stop where necessary to protect the train (e.g., 
areas with high water, flood, rock slide, or track structure flaws) or 
to provide an appropriate warning with possible movement restriction 
being acknowledged (i.e., hot journal or flat wheel detection). The 
details of these warnings and associated required enforcements are to 
be specifically addressed within a PTCDP and PTCSP subject to FRA 
approval, and the PTC system functions are to be maintained in 
accordance with the system specifications. FRA does not expect that all 
hazard detectors be integrated into the PTC systems, but where they 
are, they must interact properly with the PTC system to protect the 
train from the hazard that the detector is monitoring. With the 
exception of the RLO's strong emphasis on safety in PTC system 
deployment, no comments were received on this issue; and the provision 
is carried forward in the final rule.
    Paragraph (a)(5) addresses the issue of broken rails, which is the 
leading cause of train derailments. FRA proposes to strictly limit the 
speed of passenger and freight operations in those areas where broken 
rail detection is not provided. Under Sec.  236.0(c), as amended in 
this final rule, 24 months after the publication of this final rule, 
freight trains operating at or above 50 miles per hour, and passenger 
trains operating at or above 60 miles per hour, are required to have a 
block signal system unless a PTC system meeting the requirements of 
this part is installed. Since current technology for block signal 
systems relies on track circuits--which also provide for broken rail 
detection--this final rule requires limiting speeds where broken rail 
detection is not available to the maximums allowed under amended Sec.  
236.0 when a block signal system is not installed. No comments were 
received on this issue, and the provision is carried forward in the 
final rule.
    Deployment requirements. Paragraph (a) of 49 U.S.C. 20157, as 
enacted by the RSIA08, reads as follows:

    ``(a) IN GENERAL.--
    ``(1) PLAN REQUIRED.--Not later than 18 months after the date of 
enactment of the Rail Safety Improvement Act of 2008, each Class I 
railroad carrier and each entity providing regularly scheduled 
intercity or commuter rail passenger transportation shall develop 
and submit to the Secretary of Transportation a plan for 
implementing a positive train control system by December 31, 2015, 
governing operations on--
    ``(A) its main line over which intercity rail passenger 
transportation or commuter rail passenger transportation, as defined 
in section 24102, is regularly provided;
    ``(B) its main line over which poison- or toxic-by-inhalation 
hazardous materials, as defined in parts 171.8, 173.115, and 173.132 
of title 49, Code of Federal Regulations,
    are transported; and
    ``(C) such other tracks as the Secretary may prescribe by 
regulation or order.
    ``(2) IMPLEMENTATION.--The plan shall describe how it will 
provide for interoperability of the system with movements of trains 
of other railroad carriers over its lines and shall, to the extent 
practical, implement the system in a manner that addresses areas of 
greater risk before areas of lesser risk. The railroad carrier shall 
implement a positive train control system in accordance with the 
plan.''

    It is plain on the face of the statute that certain actions are 
required and some are discretionary and that these actions must come 
together progressively over a period beginning on April 16, 2010 (18 
months after enactment) and ending on December 31, 2015. FRA has 
included revisions in this final rule designed to fully express this 
intent.
    In paragraph (b) of Sec.  236.1005 in the NPRM, FRA proposed to use 
2008 traffic levels as a baseline to fix the network that would receive 
PTC, subject to any subsequently requested and approved amendments to 
the PTCIP that would justify removal of the line, and subject to the 
addition of lines that might qualify under the statutory mandate based 
on later data. In addition to FRA's understanding of the rail lines 
Congress intended to cover, FRA had several other fundamental reasons 
for doing so. First, in order to reach completion by December 31, 2015, 
as required by law, the railroads and FRA need to identify the relevant 
route structure very early in the short implementation period and the 
railroads need to stage the financing and logistics to reach 
completion. Otherwise, the statutory deadline will not be met. Second, 
2009 traffic levels will be notably atypical as a result of the 
recession, which has caused overall traffic levels to fall by as much 
as 20%. Third, the burden of installing PTC, which the statute applies 
obligatorily to very large railroads but not to others, may create an 
incentive to further ``spin off'' certain lines to avoid installing PTC

[[Page 2617]]

on lines Congress intended to cover. Finally, FRA was concerned about 
responsive and anticipatory actions being taken by some railroads in 
the face of emerging regulatory influences. Accordingly, FRA sought in 
the NPRM to take a snapshot of the Class I system at the time the 
Congress directed the implementation of PTC and then, using its 
discretionary authority under the statute, to evaluate what adjustments 
may be in order.
    The Class I railroads responded with the suggestion that FRA is 
without discretion to require inclusion of lines that do not qualify as 
of 2015. However, FRA has already quoted the statute, which makes clear 
the inclusion of FRA-identified lines in the 2015 mandate. The 
statutory ``shall'' applies to these lines. Also, FRA and its 
predecessor agency have long enjoyed the power to require installation 
of train control under the ``Signal Inspection Act'' (codified at 49 
U.S.C. 20501-20505). Further, FRA has been mandated since 1970 to issue 
rules and standards covering ``every area of railroad safety'' (49 
U.S.C. 20103). In conferring new responsibilities, the Congress in no 
sense repealed what preceded them.
    Arguing in the alternative, the Class I railroads said that FRA had 
failed to rely on its discretionary authority to accomplish its 
purpose. In fact, the subject statutory provisions were called out in 
the authority section of the NPRM text, with the exception of the 
Signal Inspection Act, as codified (an oversight remedied here).\1\ FRA 
also explicitly stated in the preamble to the NPRM its intention to use 
its statutory discretion to preserve congressional intent and tied that 
intention to the use of 2008 traffic levels. The railroads' ancillary 
claim is that, in effect, FRA would be ``arbitrary and capricious'' 
should the agency require PTC on lines not carrying PIH as of the end 
of 2015 absent a further congressional mandate or a showing that PTC on 
the subject lines would be ``cost beneficial.''
---------------------------------------------------------------------------

    \1\ Here we recognize the interest of railroads that will be 
making very costly investments to meet the requirements of the 
statute and this rule. The ``Signal Inspection Act,'' as codified, 
makes it explicit that the presence of a signal or train control 
system on one line may not be considered in a civil action with 
respect to an accident on another line. This law is also explicit 
that, once installed, such a system may not be removed without 
approval. 49 U.S.C. 20501-20505. It should have been cited in the 
NPRM.
---------------------------------------------------------------------------

    FRA is very conscious of the fact that PTC is expensive, and the 
agency's regulatory evaluation for the proposed rule does not seek to 
conceal it. The unit costs will be particularly high during the period 
before December 31, 2015, and trying to do too much too fast could 
result in significant disruption of rail transportation. Accordingly, 
during the initial implementation period, FRA will not exercise its 
authority to require a build out of the PTC network beyond something on 
the order of what the Congress contemplated. However, FRA will exercise 
its discretion to ensure that the network design reflects safety needs 
and places a value on PTC that reflects an understanding of the value 
applied by the Congress.
    FRA understands the arguments surrounding PTC costs and benefits, 
having filed three congressionally-required reports since 1994 with 
information on the subject, having worked through the RSAC for several 
years evaluating this issue, having funded PTC technology development 
and overseen PTC pilot projects from the State of Washington to the 
State of South Carolina, and having provided testimony to the Congress 
on many occasions. However, FRA believes that the issue is now 
presented in a different light than before. The Congress was aware that 
the monetized safety benefits of PTC were not large in comparison with 
the loss of life and injuries associated with PTC-preventable 
accidents. With the passage of RSIA08, Congress has in effect set its 
own value on PTC and directed implementation of PTC without regard to 
the rules by which costs and benefits are normally evaluated in 
rulemaking.
    One could conclude that the Congress set the value only with 
respect to passenger trains and PIH releases, but that would assume 
that the interest expressed by the Congress over much more than a 
decade and a half was so limited. In fact, longtime congressional 
interest stemmed in large part from the loss of life among railroad 
crew members in collisions, as well the potential for release of other 
hazardous materials. Most of the NTSB investigations and investigations 
pertaining to this ``most wanted'' transportation safety improvement in 
fact derived from such events.
    In this light, the focus of the statute on PIH and scheduled 
passenger trains was clearly intended to provide specific guidance to 
the agency--a minimum standard for action--and reflected the prominence 
of passenger train accidents (Placentia, CA, April 23, 2002; 
Chatsworth, CA); and PIH releases (Macdona, TX, June 28, 2004; 
Graniteville, SC) in the most serious of the recent PTC-preventable 
accidents. FRA does not take this to mean that the Congress meant us to 
be indifferent to the crew fatality at Shepherd, Texas, on September 
15, 2005, which resulted from a misaligned main track switch in a 
collision very similar to the one at Graniteville. Nor do we believe 
that FRA was expected to be indifferent to the collision between two 
freight trains at Anding, Mississippi, on July 10, 2005, which killed 
four crew members, or the collision with release of liquefied propylene 
gas and ensuing explosion at Texarkana, Arkansas, on October 15, 2005, 
which killed a resident of a community abutting the railroad.\2\ See, 
e.g., Rail Safety Reauthorization: Hearing Before the Subcomm. on 
Surface Transportation and Merchant Marine of the S. Comm. on Commerce, 
Science, & Transportation, 110th Cong. (May 22, 2007) (statement of 
Robert L. Sumwalt, Vice Chairman, National Transportation Safety 
Board). Thus, FRA was provided latitude to require PTC system 
installation and operation on lines beyond those specifically 
prescribed by Congress. While FRA has enjoyed the same latitude under 
pre-existing authority, RSIA08 indicates Congress' elevated concern 
that FRA ensure the more serious and thoughtful proliferation of PTC 
system technologies. Although, as noted above, FRA would expect to 
exercise any such authority with significant reserve, given the high 
costs involved, it would be an abdication of the agency's 
responsibility not to determine that the basic core of the Class I 
system is addressed, as would be the case based on 2008 traffic 
patterns.
---------------------------------------------------------------------------

    \2\ Unique among these events, the Texarkana collision may not 
have been prevented by PTC technology now being perfected. However, 
the consequences which ensued, including the fatality, destruction 
of two residences and a highway bridge, and a significant evacuation 
are illustrative of the consequences that can result from release of 
flammable compressed gases in train accidents. There are 
approximately 100,000 carloads of PIH commodities shipped each year. 
There are approximately 228,000 carloads of flammable compressed 
gases (other than those classified as PIH) shipped each year.
---------------------------------------------------------------------------

    The tone of the Class I freight railroad comments justified FRA's 
concerns that railroads might take the wrong lesson from the statutory 
mandate. The lesson FRA perceives is that the core of the national rail 
system, which carries passenger and PIH traffic, needs to be equipped 
with PTC and that Congress used 5 million gross tons of freight 
traffic, the presence of PIH traffic, and the presence of passenger 
service as readily perceptible markers identifying the core lines on 
which Congress wants PTC to be installed. In making its judgments, 
Congress was necessarily looking at the national rail system as it 
existed in 2008 when the statute was passed. A corollary of that lesson 
is that the later disappearance or diminution of

[[Page 2618]]

one of those markers from a line does not necessarily mean that 
Congress would no longer see that line as part of the core national 
rail system meriting PTC. An alternative response would be to adopt 
policies and tactics that penalize rail passenger service and attempt 
to drive PIH traffic off the network, consolidating the traffic that 
remains on the smallest possible route structure for PTC.
    The freight railroads do not pretend that FRA is wrong in 
perceiving that the freight railroads wish to remove PIH traffic from 
the network. That is wise, since the public record is replete with 
pleas from the Class I railroads to remove their common carrier 
obligation to transport PIH traffic. Rather, they contend, in effect, 
that FRA should not trouble itself with this issue, since the Congress 
and the Surface Transportation Safety Board (STB) will ensure that PIH 
shippers receive fair treatment, and the Pipeline and Hazardous 
Materials Safety Administration (PHMSA) Rail Route Analysis Rule will 
determine whether the traffic goes on the safest and most secure 
routes.
    There are significant problems with this contention. First, while 
the Congress shows no interest in relieving the carriers of duty to 
transport PIH commodities, and STB has likewise brushed back a recent 
attempt by a Class I railroad to avoid this duty (see Surface 
Transportation Board Decision, Union Pacific Railroad Company--Petition 
for Declaratory Order, STB Finance Docket No. 35219 (June 11, 2009)), 
it is by no means yet determined how the cost burden associated with 
PTC will be borne. A railroad seeking to make the most favorable case 
for burdening a PIH shipper with the cost of PTC installation would 
first clear a line of overhead traffic through rerouting and then seek 
to surcharge the remaining shipper(s) for the incremental cost of 
installing the system. Under those circumstances, would the STB decide 
that the railroad should transfer all of those costs to other shippers, 
or would the STB uphold the surcharge in whole or in part, thereby 
potentially making the cost of transportation unsupportable?
    The carriers would have us rely on the PHMSA Rail Route Analysis 
Rule in determining whether the PIH criterion requires installation of 
PTC on a particular line. The Class I railroads' comments state that 
``FRA is not even the DOT agency with substantive responsibility for 
how railroads route TIH.'' This is an odd point, considering that: (1) 
The statutory authority for both this rulemaking and the Rail Route 
Analysis Rulemaking are vested in the Secretary of Transportation, and 
FRA and PHMSA have a long and well established history of working 
together for the safe transportation of hazardous materials; (2) as 
reflected in the rulemaking documents, FRA initiated the Rail Routing 
action in concert with PHMSA and participated in developing the 
proposed rule well before the Congress mandated that the rulemaking be 
concluded; (3) the final rule affirms that PHMSA issued the revision in 
coordination with FRA and TSA; (4) by delegation from the Secretary, 
FRA is the agency responsible for administering and enforcing the Rail 
Route Analysis Rule and has issued a final rule (73 FR 72,194 (Nov. 26, 
2008)) detailing the procedures railroads must follow when challenging 
FRA enforcement decisions; and (5) FRA and has worked with TSA to 
provide funding and oversight for development of the risk model 
intended for use under the rule.
    As it happens, FRA has good reason to be concerned with rail 
routing of PIH commodities (as well as explosives and high level 
radioactive waste, which are also covered by the PHMSA rule), both on 
the merits of the routing decisions (as the agency responsible for 
administering the rule) and in relation to the incidental impacts of 
re-routing decisions on the network of lines that will be equipped with 
PTC technology. Because the Rail Route Analysis Rule addresses both 
security and safety risks, operations under that rule necessarily lack 
the transparency typically afforded to safety risks.
    Significant re-routing has already occurred since 2008 as a result 
of the TSA Rail Transportation Security Rule (73 FR 72,130 (Nov. 26, 
2008)). In its comments, CSXT states that the TSA rule ``required 
railroads to modify their routing operations to ensure that only 
attended interchanges are used for transporting TIH.'' The resulting 
changes are said to be ``dramatic.'' Comment of CSX Transportation, 
Inc., Docket FRA-2008-0132-0028.1, at 12 (Aug. 24, 2009). However, the 
TSA regulation requires a secure chain of custody, not re-routing; and 
so any re-routing resulting from the TSA regulation presumably resulted 
not from the direct command of the rule itself but from the desire to 
hold down costs by focusing the handoffs of these commodities where 
personnel are already employed to oversee the transfers. This is 
perfectly sensible, of course, to the extent that the re-routing did 
not create greater safety or security concerns. However, since 
railroads have contended for years that their current routings were 
already optimized for safety, investigation is warranted.
    The Rail Route Analysis Rule is only now being put into effect. 
Most railroads will not complete their initial analysis until the first 
quarter of 2009, using 12 months of 2008 data (per their request in the 
subject rulemaking). While the rule requires railroads to consider the 
use of interchange agreements when considering alternative routes, FRA 
has not had the opportunity to verify that this has actually occurred 
with the two railroads opting to comply with the September 2009 due 
date for use of only six months of data.
    The risk model intended to provide the foundation for the rail 
routing process is still subject to considerable refinement. No 
methodology is currently specified for evaluating the potential impact 
of a PTC system (which would vary in risk reduction depending upon the 
underlying or previous method of operation). Under these circumstances, 
there is a distinct possibility the railroads may not give sufficient 
weight to train control (existing or planned).\3\ Railroads are not 
required to submit their route analysis and route selections to FRA for 
approval. While FRA intends to aggressively oversee railroads' route 
analysis and route selections during FRA's normal review process, 
including their consideration of PTC, and require rerouting when 
justified, this process will be resource-intensive and time-consuming 
to complete. So FRA sees no reason necessarily to defer in this context 
to decision making made under the Rail Route Analysis Rule, even as to 
the role of PTC in safeguarding the transportation of traffic within 
its ambit (PIH, certain explosives, and spent nuclear fuel). Instead, 
those decisions are simply useful information under this rule. In April 
of 2010 when railroads must complete their PTCIP's, a railroad may know 
its own routing decisions under the Rail Route Analysis Rule, but not 
FRA's evaluation of those decisions. Furthermore, the Rail Route 
Analysis Rule analysis does not consider the safety risk posed by the 
rail movement of hazardous materials it does not cover--but, as noted 
above, this is a legitimate concern when deciding where to put PTC.
---------------------------------------------------------------------------

    \3\ At least one Class I railroad consolidated some of its PIH 
traffic on signalized lines prior to adoption of the Rail Route 
Analysis Rule. This reflects a recognition that method of operations 
matters, but that is not the same thing as having completed a fully 
mature routing analysis against the 27 factors--something that will 
occur only over time in the face of great complexity.
---------------------------------------------------------------------------

    The Rail Route Analysis Rule considers both safety and security, 
and PHMSA and FRA have worked with TSA to ensure that the inherently

[[Page 2619]]

speculative risk of a security incident does not overwhelm known safety 
risks in the decision making. At the same time, the structure is very 
responsive to known threats and special circumstances. However, FRA is 
aware of at least one railroad that has balanced its evaluation of 
safety and security risks under the rule affording equal weight to each 
across the board. FRA will be working with that railroad to determine 
the basis for this action and may later require the railroad to revise 
its analysis and possibly reroute traffic. See Railroad Safety 
Enforcement Procedures; Enforcement, Appeal and Hearing Procedures for 
Rail Routing Decisions, 73 FR 72,194 (Nov. 26, 2008).
    Since any given railroad may have thousands of origin-destination 
pairs for its PIH traffic, and since railroads are just at the 
threshold of cooperation to evaluate interline re-routing options, this 
new program will settle out over a period of several years during which 
lessons are learned. As custodian of this program, FRA is best situated 
to conclude that using the products of initial analysis within a 
framework that confers significant discretion to utilize judgment 
should not control where PTC is built--particularly given the strong 
incentives that carriers perceive to reduce the wayside mileage 
equipped with PTC and the fact that installation of PTC might overwhelm 
other considerations with respect to PIH routing.
    In the proposed rule, FRA said that changes from the 2008 base 
could be granted if ``consistent with safety.'' Even though this is a 
familiar phrase drawn from FRA's basic safety statute, concern was 
expressed regarding how this term might be applied. The final rule 
further defines that standard by adding a rule for FRA decision making, 
i.e., if the remaining safety risk on the line exceeds the average 
safety risk per route mile on lines carrying PIH traffic, as determined 
in accordance with Appendix B to 49 CFR part 236, FRA denies the 
request. The provision leaves open the possibility of granting the 
request if the railroad making application offers a compensating 
further build out on another line where the resources would be better 
spent because they would enhance safety to a greater degree. FRA has 
available to it adequate data to construct a simple risk model for use 
in this context and expects to do so when reviewing such requests. This 
provision treats similarly risky rail lines similarly in carrying out 
the perceived congressional intent for PTC to be installed on the 
portion of the rail system Congress described, and it is an appropriate 
exercise of FRA's statutory discretion because it is rationally related 
to the reduction in risk Congress sought to achieve across the national 
rail system.
    The structure of paragraph (b) of Sec.  236.1005 is as follows:
    Paragraph (b)(1) brings together the policy of the statute 
requiring a phased, risk-based roll out of PTC with the types of lines 
required to be equipped. FRA has included the additional language 
``progressively equip'' to remind the industry that the law does not 
expect a risk-based implementation in which no safety benefits are 
achieved until December 31, 2015. To the contrary, the law and FRA 
evidence a strong expectation that PTC safety benefits will be 
increasingly achieved as lines and locomotives are equipped. See Sec.  
236.1006. FRA was distressed to hear claims in the Class I railroad 
testimonies and filings to the effect that, not only are the railroads 
under no legal obligations to deploy incrementally and take advantage 
of safety technology required by the law, FRA is without authority to 
require PTC system operation until December 31, 2015. We consider both 
claims to be without merit on the face of the law, including FRA's pre-
existing authority over signal and train control systems.
    Paragraph (b)(2) describes the operation of the 2008 baseline as 
the initial point of PTC implementation. The section is clear that if 
any track segment mandated for PTC exclusively on the basis of PIH 
traffic falls below 5 million gross tons for two consecutive years, the 
line would be eligible for removal. The paragraph also identifies the 
presence of PIH traffic in 2008 (or prior to filing the PTCIP) as 
initially identifying the track segment in the PTCIP for PTC 
implementation, but refers to paragraph (b)(4) as a means of removing 
it.
    Paragraph (b)(3) refers to changed conditions after the filing of 
the PTCIP that might require a line or track segment to be added. This 
could occur, inter alia, because overall freight volume increases, a 
shipper requests PIH service on the line, or PIH traffic is (actually 
or prospectively) rerouted over the line to satisfy the Rail Route 
Analysis Rule. The provision requires ``prompt'' filing when conditions 
change. It makes clear that the railroad will have at least 24 months 
after approval of its RFA to install the PTC system on the line.
    In the NPRM, FRA proposed that, in order to have a line segment no 
longer carrying the PIH traffic be excepted from the requirement that 
it be initially equipped, the railroad would need to provide estimated 
traffic projections for the next 5 years (e.g., as a result of planned 
rerouting, coordinations, location of new business on the line). In 
addition, where the request involves prior or planned rerouting of PIH 
traffic, the railroad would be required to provide a supporting 
analysis that takes into consideration the rail security provisions of 
the PHMSA rail routing rule, including any railroad-specific and 
interline routing impacts. FRA proposed that it could approve an 
exception if FRA finds that it would be consistent with safety and in 
the public interest.
    The AAR acknowledged in its comments that ``FRA does offer 
railroads the ability to apply to FRA for approval to not install PTC 
on a route which, in 2015, is no longer used for PIH traffic or which 
no longer meets the definition of a main line.'' However, asserted AAR, 
``FRA approval is predicated on the nebulous criteria of ``consistent 
with safety and in the public interest.''
    In this final rule, paragraph (b)(4) provides the methods by which 
a railroad may seek the exclusion or removal of track segments from its 
PTCIP. Paragraph (b)(4)(i) deals with the evaluation of track segments 
that no longer carry 5 million gross tons or PIH traffic that the 
railroad seeks to remove from the PTCIP, either at the time of initial 
filing or through an RFA thereafter. A request to remove a line would 
need to be accompanied by future traffic projections. FRA understands 
that, in some cases, railroads will not be able to state with certainty 
whether total tonnage or PIH traffic will return to a line; and 
certainty is not required. However, in other cases a railroad may in 
fact be able to make reasonable projections (because of control over a 
parallel main line that is approaching capacity, planned coordination 
with another railroad, etc.).
    In the case of cessation of passenger service or a decline of 
tonnage on a PIH line, FRA anticipates that approval of such requests 
will normally be routine. However, in light of AAR's comments, the 
final rule provides that, where PIH traffic has been removed (or is 
projected to be removed), three conditions must be met in order for FRA 
to approve such requests. First, it is not expected that there will be 
any local PIH traffic on the subject track segment. Second, to the 
extent overhead traffic has been (or will be) removed from the line, 
the request must be supported by routing analysis justifying the 
alternative routing of any traffic formerly traversing the line or 
which might traverse the line as an alternative routing. This is not 
the same routing analysis required under part 49 CFR part 172, but it 
may be presented

[[Page 2620]]

in the same format. The difference is that, under the Rail Route 
Analysis Rule, the current best route for the movement of security 
sensitive materials (which included PIH materials) must be determined, 
taking into consideration both safety and security and assuming the 
existing method of operation, any changes that a carrier may reasonably 
be anticipated to occur in the upcoming year, and any mitigation 
measures that the carrier intends to implement. That is a tactical 
question, which focuses on a particular geographical or logistical 
area. The question that needs to be addressed for PTC planning is the 
future best route, taking into consideration the fact that any route 
used for PIH will need to be equipped within the schedule contained in 
the approved PTCIP (but not later than December 31, 2015, for the least 
risky lines that need to be equipped). This is a strategic question, 
which applies to the carrier's entire network. Accordingly, this 
analysis would need to show that, even by equipping the subject line 
with PTC, it would not have an advantage over the route proposed to be 
selected.
    As noted in section VI of this preamble, FRA seeks comments on how 
elements of a route analysis should be weighed by FRA when determining 
whether rerouting under this paragraph is sufficiently justified.
    FRA includes one additional requirement that invokes its 
discretionary authority under the law. Even if a line has not or will 
not carry PIH traffic after the 2008 base year or later time period 
prior to filing of the PTCIP (i.e., for those filing a PTCIP for new 
service initiated after the statutory deadlines), the final rule 
requires an additional test that fleshes out the ``consistent with 
safety'' notion contained in the proposed rule with the desired 
objective of providing greater predictability, transparency, and 
consistency in decision making. This test requires that, in order for a 
track segment to be excluded, the remaining risk on the line not exceed 
the average risk extant on lines required to be equipped with PTC 
because they meet the threshold for tonnage of 5 million gross tons and 
carry PIH traffic. The effect of this test should be to allow a 
majority of lines that formerly carried PIH, which has been removed for 
legitimate reasons, to be removed from the PTCIP. With no intercity/
commuter passenger traffic and no PIH, these will mostly be lines with 
moderate traffic involving commodities such as coal or grain and 
minimal quantities of other hazardous materials. However, with respect 
to lines with higher risk, PTC may be required despite the 
consolidation of PIH traffic on other lines. For instance, FRA does not 
believe that consolidation of PIH traffic due to security reasons 
should unduly influence PTC deployment. Train crews, roadway workers, 
and communities along the routes have a strong interest in seeing PTC 
provided for their benefit. Examples of lines that could be captured by 
this requirement are very high density lines to coal fields or between 
major terminals where collision risk is significant and other very 
dangerous or environmentally sensitive hazardous materials are 
transported in significant quantities (e.g., flammable compressed gas, 
halogenated organic compounds). Non-signaled lines with traffic nearing 
capacity and many manually operated switches, together with significant 
hazardous materials, would also be candidates for retention.
    As previously noted in the Introduction and section VI to this 
preamble, FRA seeks further comments on paragraph (b)(4)(i). This 
provision describes the specific considerations FRA will take into 
account in determining whether a deviation from the baseline is 
``consistent with safety.'' FRA believes that this final rule could 
still benefit from input concerning this application of the 
``consistent with safety'' standard FRA has applied for decades in 
considering waivers under 49 U.S.C. 20103(d) and whether FRA should 
interpret that standard differently or in greater detail here. 
Accordingly, FRA continues to seek comments on this issue with the 
desired objective of providing greater predictability, transparency, 
and consistency in decision making. More specifically, FRA seeks 
comments that would help clarify what issues, facts, standards, and 
methodologies it should consider when determining whether to approve a 
request for amendment made pursuant to paragraph (b)(4)(i). FRA also 
seeks comments on how it should compare the levels of risk between 
lines with PIH and lines without PIH for the purposes of paragraph 
(b)(4)(i).
    Paragraph (b)(4)(ii) contains a new provision that provides a basis 
for a railroad to request removal of a track segment from a PTCIP 
either at the time of initial filing or through an RFA thereafter. The 
provision is being added in an effort to respond to comments submitted 
on the NPRM requesting a de minimis exception for low density track 
segments with minimal PIH traffic. The AAR noted that, under the 
proposed regulations, even one car containing PIH on a main line would 
require installation of PTC. AAR believes that this position is 
untenable in light of the cost-benefit concerns (e.g., the 15-to-1 cost 
to benefit ratio under FRA's economic analysis), especially on routes 
with minimal PIH traffic. The AAR takes the position that it would 
therefore be arbitrary and capricious for FRA to not employ a de 
minimis exception. According to AAR, its preliminary analysis shows 
that a meaningful de minimis exception could save the industry hundreds 
of millions of dollars without significantly changing the safety 
benefit calculation.
    The AAR and some of its member railroads assert that FRA has the 
authority to include a de minimis exception in the final rule. In 
separate comments, CSXT also recommends that FRA recognize a de minimis 
exception for PIH transport. CSXT asserts that, in cases where a 
limited quantity of PIH materials are transported on a particular 
route--or where a segment of track happens to carry PIH materials on a 
single occasion because of mere happenstance--there are no safety 
benefits that would justify costly PTC implementation. In addition, in 
the absence of specific language in the RSIA08 that would preclude FRA 
from recognizing a de minimis exception, CSXT asserts that FRA 
possesses the requisite authority to do so. In support of this 
assertion, CSXT points to three cases from the DC Circuit (Shays v. 
FEC, 414 F.3d 76 (DC Cir. 2005); Environmental Def. Fund, Inc. v. EPA, 
82 F.3d 451 (D.C. Cir. 1996); and State of Ohio v. EPA, 997 F.2d 1520 
(DC Cir. 1993)), in which the DC Circuit acknowledged the inherent 
authority conferred upon agencies, in the absence of an express 
prohibition, to promulgate a de minimis exception as a tool for 
implementing legislative design and avoiding pointless expenditures of 
effort.
    FRA has reviewed the suggestion of the Class I railroads that FRA 
possesses an inherent, or at least reasonably inferred, authority to 
withhold any requirement for deployment of PTC on lines with very low 
risk. FRA agrees that, as a general matter, it has an inherent 
authority to create de minimis exceptions in its regulations to 
statutes FRA administers. In fact, FRA has utilized this inherent 
authority in this final rule in the following areas: Providing limited 
exceptions for yard operations; addressing the movement of equipment 
with inoperative PTC systems; and providing for limited movements by 
non-equipped trains operated by Class II and Class III

[[Page 2621]]

railroads over PTC equipped main line.\4\ FRA believes these are all 
appropriate uses of its discretionary authority. Based on existing case 
law, as well as its review of the comments provided in this proceeding, 
FRA believes that a de minimis exception to the statutory mandate 
requiring the installation of PTC systems on any and all main lines 
transporting any quantity of PIH hazardous materials should also be 
provided to low density main lines with minimal safety hazards that 
carry a truly minimal quantity of PIH hazardous materials.
---------------------------------------------------------------------------

    \4\ This is not to say that there are independent justifications 
for each of these decisions. Yard operations involve a mix of 
switching movements and train movements and have never been within 
public expectations for PTC because of issues of impracticability 
and inapplicability, as well as greatly reduced safety concerns. 
Movement of trains with inoperative PTC equipment has historically 
been allowed for and governed within Interstate Commerce Commission 
and FRA regulations, and proceeding otherwise would be a virtual 
impossibility. FRA does not understand RSIA08 to specify whether all 
trains operating on PTC lines must be PTC equipped, and accordingly 
FRA believes that it is required to make discretionary decisions in 
that regard. That said, the de minimis concept clearly offers an 
alternative justification for each of these decisions.
---------------------------------------------------------------------------

    With this said, however, and as explained below, that discretionary 
authority will not sustain the creation of the broad-brush exception 
sought by the Class I railroads in this proceeding. United States 
Circuit Court decisions recognize that federal agencies may promulgate 
de minimis exemptions to statutes they administer. See, e.g., Shays v. 
FEC, 414 F.3d 76, 113 (DC Cir. 2005); Ass'n of Admin. Law Judges v. 
FLRA, 397 F.3d 957, 961-62 (DC Cir. 2005) (``[T]he Congress is always 
presumed to intend that pointless expenditures of effort be avoided'' 
and that such authority ``is inherent in most statutory schemes, by 
implication.''); Environmental Defense Fund, Inc. v. EPA, 82 F.3d 451, 
466 (DC Cir. 1996) (``[C]ategorical exemptions from the requirements of 
a statute may be permissible as an exercise of agency power, inherent 
in most statutory schemes, to overlook circumstances that in context 
may fairly be considered de minimis.'') (inner quotations and citation 
omitted); Alabama Power Co. v. Costle, 636 F.2d 323, 360 (DC Cir. 1979) 
(the ability to create a de minimis exemption ``is not an ability to 
depart from the statute, but rather a tool to be used in implementing 
the legislative design.''); New York v. EPA, 443 F.3d 880, 888 (DC Cir. 
2006) (noting the maxim de minimis non curat lex--``the law cares not 
for trifles.'').
    However, ``a de minimis exemption cannot stand if it is contrary to 
the express terms of the statute.'' Environmental Defense Fund, 82 F.3d 
at 466 (citing Public Citizen v. Young, 831 F.2d 1108, 1122 (DC Cir. 
1987)). In other words, agency authority to promulgate de minimis 
exemptions does not extend to ``extraordinarily rigid'' statutes. See 
Shays, 414 F.3d at 114 (``By promulgating a rigid regime, Congress 
signals that the strict letter of its law applies in all 
circumstances.''); Ass'n of ALJs, 397 F.3d at 962; Alabama Power, 636 
F.2d at 360-61 (As long as the Congress has not been ``extraordinarily 
rigid'' in drafting the statute, however, ``there is likely a basis for 
an implication of de minimis authority.''). Furthermore, such authority 
does not extend to situations ``where the regulatory function does 
provide benefits, in the sense of furthering regulatory objectives, but 
the agency concludes that the acknowledged benefits are exceeded by the 
costs.'' Public Citizen v. FTC, 869 F.2d 1541, 1557 (DC Cir. 1989) 
(quoting Alabama Power, 636 F.2d at 360-61) (emphasis removed); see 
also Shays, 414 F.3d at 114; Kentucky Waterways Alliance v. Johnson, 
540 F.3d 466, 483 (6th Cir. 2008). ``Instead, situations covered by a 
de minimis exemption must be truly de minimis.'' Shays, 414 F.3d at 
114. That is, they must cover only situations where ``the burdens of 
regulation yield a gain of trivial or no value.'' Environmental Defense 
Fund at 466 (inner quotations omitted) (citing Alabama Power, 636 F.2d 
at 360-61).
    In this case, where release of the contents of one PIH tank car can 
have catastrophic consequences (e.g., the 2005 Graniteville accident), 
FRA must determine whether the gain yielded by installing PTC on any 
rail line that carries a minimal amount of PIH materials is ``of 
trivial or no value.'' During the RSAC Working Group discussions 
conducted on August 31-September 2, 2009, the major freight railroads 
suggested that any track segment carrying fewer than 100 PIH cars 
annually should be considered to present a de minimis risk and be 
subject to an exception. (Their representatives were very clear that 
the request did not extend to lines carrying intercity or commuter 
passenger trains.) During the Working Group discussion, AAR was asked 
to describe additional safety limitations that might apply to these 
types of track segments (e.g., tonnage, track class, population 
densities). The AAR elected not to do so, adhering to the simple less 
than 100 car exception. Subsequently, in an October 7, 2009, docket 
filing, AAR suggested that safety mitigations could be applied where 
necessary to bring risk down to de minimis levels.
    FRA has considered AAR's proposed exception and has noted that, 
although the number of cars appears small, in fact only about 100,000 
loaded PIH cars are offered for transportation in the United States 
each year (approximately 200,000 loads and residue cars). Accordingly, 
FRA would expect that such an exception might have a significant impact 
on the number of miles of railroad subject to the PTC mandate. None of 
the filings in this docket, and none of the discussion in the PTC 
Working Group, shed light on the relevant facts despite an express 
request from FRA to Class I railroads to supply facts bearing on their 
requested exception. Based on the limited information available to FRA, 
FRA believes that such an exception would excuse installation of PTC on 
roughly 10,000 miles of railroad out of the almost 70,000 route miles 
FRA has projected would need to be equipped based on the proposed 
requirements. Based on the limited information available, it appears 
that some of the lines within the AAR request carry very heavy tonnages 
(with many train movements raising the risk for a collision) at freight 
speeds up to 60 or 70 miles per hour (predicting severe outcomes when 
accidents do occur). Putting trains with PIH bulk cargoes into this mix 
in the absence of effective train control would not be a de minimis 
risk as to those cars of PIH actually transported. Further, any public 
policy decision to excuse PTC installation under these circumstances 
would have to ignore other risk on those track segments. Creating a de 
minimis exception for less than 100 PIH cars on a very busy and risk-
laden track segment simply on the basis of the number of PIH cars 
would, accordingly, ignore the separate charge that the Congress gave 
to the agency in 1970 to adopt regulations ``as necessary'' for ``every 
area of railroad safety'' (49 U.S.C. 20103(a)) and the value that the 
Congress has obviously placed on PTC as a means of reducing risk within 
the reach of the four PTC core functions under the RSIA08. Further, it 
would stand on its head the structure of 49 U.S.C. 20157, as added by 
the RSIA08, which mandates completion by the end of 2015 of PTC on (1) 
lines of intercity and commuter passenger trains, (2) lines of Class I 
railroads carrying 5 million gross tons and PIH, and (3) ``such other 
tracks as the Secretary may prescribe by regulation or order.''
    FRA believes that the broad-based type of de minimis exception 
sought by the AAR and its member railroads based

[[Page 2622]]

solely on the number of PIH cars transported annually is not supported 
either legally or on a safety basis. However, FRA believes a limited 
exception is necessary and justified for those main lines that 
transport a truly limited quantity of PIH materials and that pose 
little safety hazard to the general public by not being equipped with 
an operational PTC system. Thus, FRA is including paragraph (b)(4)(ii) 
in this final rule to permit railroads exclude these types of main 
track segments from the statutory requirement to install a PTC system. 
The initial qualifying criterion is that of less than 100 PIH cars per 
year (loaded or residue), as suggested by the AAR.
    In order to foster as much clarity as possible regarding the 
exceptions provided, FRA has broken the concept into two separate 
divisions. The first creates a presumption that a requested exception 
will be provided based on existing circumstances on the line, plus an 
operating restriction. The second involves more challenging 
circumstances and involves no presumption, but the railroad may proffer 
safety mitigations in order to drive down risk to demonstrably 
negligible levels (subject to FRA review). Both are limited to lines 
that carry less than 15 million gross tons of traffic annually, a 
figure three times the threshold in the law. FRA has no confidence that 
a railroad could assure ``negligible risk'' in a busier and therefore 
more complex operation, and allowing for consideration of lines with 
more traffic could lead to neglect of other risk of concern (e.g., harm 
to train crews in collisions, casualties to roadway workers, release of 
other hazardous materials).
    Paragraph (b)(4)(ii)(B) specifies additional tests that apply to 
the first exception:
     The line segment must consist exclusively of Class 1 or 2 
track under the Track Safety Standards (maximum authorized speed 25 
mph);
     The line segment must have a ruling grade of less than 1 
percent; and
     Any train transporting a car containing PIH materials 
(including a residue car) must be operated under conditions of temporal 
separation, as explained in Sec.  236.1019(e) and in Appendix A to part 
211 of this title, from other trains using the line segment, as 
documented by a temporal separation plan submitted with the request and 
approved by FRA.

Limiting maximum authorized train speed reduces the kinetic energy 
available in any accident, and the forces impinging on the tank should 
be sustainable.\5\ Placing a limit on ruling grade helps to avoid any 
situation in which a train ``gets away'' as a result of a failure to 
invoke a brake application until momentum is such that no stop is 
possible (as the surface between the brake shoe and wheel ``goes 
liquid''). (PTC can prevent the initial overspeed and intervene early.) 
Requiring that a train carrying PIH and other trains be ``temporally 
separated'' can help prevent a collision in which a PIH car is struck 
directly by the locomotive of another train while traversing a turnout 
(potentially exceeding the force levels the tank can withstand). Given 
these combinations of circumstances, a de minimis exception should 
ordinarily be warranted. FRA would withhold approval only upon a 
showing of special circumstances, such as where there might be a need 
to protect movements over a moveable bridge. Should FRA identify such a 
circumstance, the railroad might elect to proceed under the additional 
exception.
---------------------------------------------------------------------------

    \5\ See Engineering Studies on Structural Integrity of Railroad 
Tank Cars Under Accident Conditions (DOT/FRA/ORD-9/18; October 
2009); see also 78 FR 17,818, 17,821 (Apr. 1, 2008) (discussion of 
proposed limitation on PIH train speeds in non-signaled territory 
prior to introduction of fully crashworthy tank cars, which was 
later withdrawn for other reasons).
---------------------------------------------------------------------------

    Paragraph (b)(4)(ii)(C) provides an alternative path to a de 
minimis exception by opening the door for proposed risk mitigations 
that could drive risk down to negligible levels. The railroad could 
offer any combination of operating procedures, technology, or other 
means of risk reduction. Basically, the paragraph requires the railroad 
to ``make its case'' to FRA as to why a limited exception should be 
provided for the identified main line. The railroad must provide FRA 
sufficient information to justify the application of a de minimis 
exception to the identified track segment, including current and future 
traffic predictions, detailed information regarding the safety hazards 
present on the involved track segment, and an explanation of how the 
proposed mitigations would reduce the risk to a negligible level. FRA 
believes that, beyond the relatively narrow categorical exception 
provided in (B), a separate case-by-case analysis of each request is 
necessary to properly apply its inherent discretionary authority to 
grant de minimis exceptions in this area. Approaching the issue in this 
manner also permits full consideration of mitigations tailored to the 
particular circumstances. FRA would evaluate the submittal and, if 
satisfied that the proffered mitigations would be successful, approve 
the exception of the line segment. FRA wishes to note that elements of 
PTC technology may in some cases provide the means for accomplishing 
this. Developing a track database for a line segment, installing an 
intermittent data radio capability, and utilizing PTC-equipped 
locomotives on the line could be used to enforce temporary speed 
restrictions and enforce track warrants without the major expense on 
the wayside. Where necessary, based on somewhat higher train speeds, 
key switches could be monitored; or, alternately, only those trains 
containing PIH cars could be speed restricted (with speed enforced on 
board). The notion here is to leverage investments already made with 
modest additional expenditures that capture the bulk of the safety 
benefits while specially protecting trains with PIH cars.
    FRA believes that the savings from these provisions should be 
substantial. Most of the line segments falling within the criteria set 
forth for de minimis risk will be non-signaled lines with limited 
freight traffic. The ability to omit equipping these routes with full 
data radio infrastructure and with switch position monitoring at all 
switches should constitute a significant savings. In fact, based on 
available information, FRA believes that as much as 3,500 miles of 
railroad could be included in one of the exceptions provided. FRA 
estimates that the gross savings from omitting PTC from these lines 
might amount to about $175 million and that mitigations might offset 
roughly $32 million of those savings, for net savings still exceeding 
$140 million. Of that amount, approximately $15 million could come from 
the first exception, which deals with very low risk lines left in their 
current state and operated under temporal separation of trains 
containing PIH traffic.
    This provision was developed in the absence of a robust record. On 
October 7, 2009, the AAR filed supplementary comments offering to work 
with FRA on a more flexible process for de minimis exceptions that 
would consider safety mitigations designed expressly to drive risk down 
to de minimis levels on candidate line segments. FRA attempted to 
respond to this late-filed comment in full recognition that the final 
rule will impose substantial costs and that avoiding unnecessary cost 
is desirable. However none of the parties has had an opportunity to 
comment on the exception provided in this final rule. Accordingly, FRA 
seeks comments on the extent of the de minimis exception. Such comments 
should be supported by sufficient and applicable safety data. FRA notes 
that the time required for

[[Page 2623]]

refinement of this provision should fit within the existing PTC system 
implementation timetable, since any lines where risk is low will be 
slated for PTC system installation relatively late in the 
implementation period that ends on December 31, 2015.
    Paragraph (b)(5) addresses an additional reason for proposing to 
use 2008 data as a baseline for PTC installation, rather than de facto 
conditions in 2015: i.e., the prospect that Class I railroads will 
divest lines in order to avoid the PTC mandate. Based on past practice 
at the Interstate Commerce Commission and STB, lines sales can occur 
under circumstances where the new operator of the line is to a large 
extent the alter ego of the seller. The seller may retain overhead 
trackage rights or merely lease the line; or circumstances may be such 
that the seller is the only available interchange partner and thus 
continues to enjoy the ``long haul'' portion of the rate. Typically the 
buyer will have a lower cost structure, and to the extent the sale is 
merely a recognition that the line has declined in traffic and will 
need to be redeveloped as a source of carload traffic, that may be the 
best way to preserve rail service. However, to the extent that the 
seller sheds costs while retaining significant practical control and 
depriving the buyer of adequate revenues, safety issues can arise. FRA 
has historically been reluctant to allow discontinuance of signal 
systems in some of these cases, particularly where it remained within 
the seller's ability to rebuild overhead traffic on the line 
downstream, where the seller retained the right to repossess the 
property at a later time, or where the line carried passenger traffic.
    This background may help explain why FRA made reference to the 
issue of whether omitting PTC on a line that carried PIH traffic in 
2008 might be ``in the public interest'' in the proposed rule. In 
references during the subsequent RSAC working group deliberations, some 
question was raised about what that could mean. In light of that 
confusion, FRA has omitted the phrase from the final rule but has added 
language addressing the issue of line sales that expresses more 
directly how FRA would handle line sales and modifications to a PTCIP. 
FRA's purpose is to ensure that decisions regarding where PTC is 
deployed are made in light of all the relevant circumstances. To the 
extent that this approach represents an exercise of discretionary 
authority (and should any such exercise in fact occur), FRA would 
expect to make the decision based upon safety criteria after the STB 
had determined the public interest with respect to rail service. Again, 
FRA would expect to recognize the value that the Congress placed on PTC 
as a means of risk reduction while not rewarding transactions designed 
to avoid installation of PTC on the line in question.
    Paragraph (b)(6) states that no new intercity or commuter passenger 
service shall commence after December 31, 2015, until a PTC system 
certified under this subpart has been installed and made operative. FRA 
believes this is a clearly necessary requirement to satisfy the 
statute. In response to the comments, FRA has removed the reference to 
``continuing'' of previous passenger service. FRA agrees that the 
remedy associated with any delays in completing PTC system installation 
should be determined based upon circumstances at the time and without 
disfavoring passenger service in relation to freight service.
    General objections to a 2008 baseline. FRA is aware that the 
approach embodied in the final rule may not play out as an elegantly 
optimized risk reduction strategy. If FRA were writing on a blank 
slate, the agency may have considered factors that drive risk and 
thresholds for those factors, taking into consideration more than PIH 
and intercity or commuter passenger traffic. Some lines that the 
Congress has required to be equipped by the end of 2015 because of PIH 
traffic would be left for deployment well downstream. Under such a 
hypothetical scenario, others with heavy train counts or without signal 
systems (and with robust traffic) may have been in theory added to the 
list for deployment of PTC by the end of 2015. But FRA is not writing 
on a clean slate. Rather, FRA is endeavoring to implement the statute 
with fidelity both to its terms and its intent, utilizing the 
discretion underscored by the law to get the job done.
    Part of the complexity of this task is the schedule. FRA has 
labored to publish this final rule as soon as humanly possible so that 
the industry could be ready to file PTC Implementation Plans by the 
statutory deadline of April 16, 2010. FRA will then be required, again 
by the statute, to approve or disapprove each plan within a period of 
90 days. Accordingly, establishing some degree of order in framing the 
Implementation Plan requirements is clearly necessary. Taking the 2008 
traffic base as a known starting point, and evaluating any deviations 
from that base, will permit FRA to identify any potentially 
inappropriate traffic consolidations and focus on those areas as 
matters for review. FRA could, of course, take a different approach and 
order a categorically broader implementation. However, that has been 
understandably opposed by the railroads; and crafting any such approach 
would likely not have been feasible during the time available for this 
rulemaking. Accordingly, what we have done in Sec.  236.1011(b) is to 
require the PTCIP to include a statement of criteria that the Class I 
railroad will apply in planning future deployment of PTC and a 
requirement that the railroad's Risk Reduction Program Plan (required 
by the RSIA08 to be filed in 2013) contain a specification of 
additional lines that will be equipped in full (meeting all of the 
requirements of subpart I) or as a partial implementation (subset of 
functionalities). Approaching the end of the initial deployment period, 
therefore, FRA should be in a position to consider whether requiring 
additional PTC deployments will be appropriate to address remaining 
risk or whether elective actions by the railroads will meet that need. 
Over time, then, any rough edges that remain should be smoothed over.
    Another objection to the 2008 baseline is that more may need to be 
accomplished (i.e., the need to capture more lines) in the period 
between enactment and December 31, 2015. FRA responds as follows: 
First, no more will need to be done than the Congress likely expected. 
If FRA, an expert agency, did not foresee the ``dramatic'' 
consolidation of PIH traffic resulting from the TSA rule, it is fairly 
unlikely that the Congress did. Second, the Class I freight industry 
has had it within its control to get this done, and one of FRA's major 
objectives in conducting this rulemaking has been to ensure success by 
keeping the technology bar at a reasonable height and deferring as much 
as possible to work already accomplished. During the September 10, 
2009, RSAC meeting, the leaders of the Interoperable Train Control 
project--an effort led by BNSF, CSXT, NS, and UP to develop 
interoperability standards for the general freight system--advised that 
those standards will not be available until the end of 2010 to the many 
commuter railroads and Amtrak working in concert with a major freight 
carrier. But the industry developed Advanced Train Control Standards in 
the 1980s, standards that FRA pronounced mature in its 1994 Report, 
after which the industry abandoned the project. PTC interoperability 
standards were identified as a need in the consensus report of the 
original PTC

[[Page 2624]]

Working Group to the FRA Administrator in 1999, and creation of such 
standards was a major deliverable of the North American PTC Program 
(funded jointly by the FRA, industry, and the State of Illinois). That 
delivery was never made. In the interim, the major signal suppliers, 
working through the American Railway Engineering and Maintenance 
Association managed to produce interoperability standards (again with 
FRA support), but these are not standards that the freight railroads 
have elected to employ. Accordingly, FRA concludes that the principal 
obstacle to completion of PTC is the perfection of technology, 
including interoperability standards, by an industry that has had two 
decades to work. Any further delays in that quadrant should not deprive 
the Nation of a reasonably scaled PTC deployment.
    Other comments. FRA received generally favorable comments on the 
base year issue from Friends of the Earth\6\ and the Rail Labor 
Organizations. The Chlorine Institute also urged the broadest 
application of PTC to the national rail network, and the American 
Chemistry Council submitted generally favorable comments without 
lingering on this specific issue. The Fertilizer Institute commented 
that limiting lines to the 2008 PIH network could restrict shipping 
options in the future and also advocated a broader mandate.
---------------------------------------------------------------------------

    \6\ Friends of the Earth also made detailed comments regarding 
administration of the Rail Route Analysis Rule that are beyond the 
scope of this proceeding.
---------------------------------------------------------------------------

    Final rule adjustments. FRA has further considered the need to 
optimize the risk reduction strategy captured in this final rule with 
respect to lines that may no longer carry PIH traffic as of some point 
(whether at filing of the PTCIP or thereafter). FRA has included a 
requirement that the subject line from which PIH has been removed would 
be required to be equipped with PTC only if the line's remaining 
traffic involves a level of risk that is above the average for lines 
that carry PIH traffic. As noted above, FRA would expect most lines 
from which PIH traffic might be legitimately removed, exclusive of 
those that carry intercity or commuter passenger traffic (which will 
need to be equipped in any event), to fall below the average risk level 
and be removed from the PTCIP. These will be primarily what are 
referred to as branch lines or secondary main lines, carrying moderate 
traffic volumes. However, if a line such as a very busy coal line with 
intermixed general freight (including, e.g., flammable compressed gas 
or halogenated organic compounds) were in question, FRA would expect 
that line to remain equipped. Further optimization of this approach is 
offered in the form of compensating risk reduction. That is, a railroad 
could offer up a line that was not included in 2008 traffic base for 
PTC implementation if it carries traffic that involves very substantial 
risk. Although this option is offered, FRA does not expect any such 
situation to arise. Based on FRA's review of known traffic flows and 
densities, FRA expects that most lines omitted from those reported in 
the PTCIP based on 2008 data will fall into a very low range of risk in 
relation to lines carrying PIH traffic. Further, FRA believes it is 
very unlikely that any legitimate consolidation of PIH traffic after 
2008 would have utilized a line that was not previously carrying at 
least some PIH traffic. In short, although the agency may not have 
taken the same approach, there is wisdom behind the congressional 
formulation based on conditions when the Congress acted.
    In summary, FRA has fashioned an approach to review of candidate 
track segments for PTC Implementation that seeks to uphold the letter 
and the intent of the RSIA08, that utilizes FRA discretionary authority 
sparingly but in a risk-informed manner, that it is administrable 
within the time allowed by law to review PTCIPs, that offers the best 
chance of creating some stability in deployment strategy by permitting 
the agency to focus on areas of greatest sensitivity early in the 
process (including, as necessary, a threshold evaluation of whether 
Rail Route Analysis Rule decisions require further evaluation), and 
that will ensure, to the extent possible, that safety alone is the 
governing criterion in determining where PTC will be required to be 
deployed.
    Paragraph (c) provides amplifying information regarding the 
installation and integration of hazard detectors into PTC systems. 
Paragraph (c)(1) reiterates FRA's position that any hazard detectors 
that are currently integrated into an existing signal and train control 
system must be integrated into mandatory PTC systems and that the PTC 
system will enforce as appropriate on receipt of a warning from the 
detector. Paragraph (c)(2) states that each PTCSP submitted by a 
railroad must identify any additional hazard detectors that will be 
used to provide warnings to the crew which a railroad may elect to 
install. If the PTCSP so provides, the PTCSP must clearly define the 
actions required by the crew upon receipt of the alarm or other warning 
or alert. FRA does not expect a railroad to install hazard detectors at 
every location where a hazard might possibly exist.
    Paragraph (c)(3) requires, in the case of high-speed service (as 
described in Sec.  236.1007 as any service operating at speeds greater 
than 90 miles per hour), that the hazard analysis address any hazards 
on the route and provide a reason why additional hazard detectors are 
not required to provide warning and enforcement for hazards not already 
protected by an existing hazard detector. The hazard analysis must 
clearly identify the risk associated with the hazard, and the 
mitigations taken if a hazard detector is not installed and interfacing 
with a PTC system. For instance, in the past, large motor vehicles with 
parallel or overhead structures have been left fouling active passenger 
rail lines. Depending upon the circumstances, such events can cause 
catastrophic train accidents. Although not every such event can be 
prevented, detection of such obstacles may make it more likely that the 
accident could be prevented.
    In its comments, Amtrak assumes that on those lines where FRA has 
previously approved such speeds (e.g., portions of Amtrak's Northeast 
Corridor (NEC) and Michigan line), a new hazard analysis, which would 
serve only to allow that which is already allowed, will not be 
required. If so, it asserts that the rule should make that explicit. 
FRA has done so in the final rule. No further changes were indicated by 
the comments.
    Under paragraph (d), the final rule requires that each lead 
locomotive operating with a PTC system be equipped with an operative 
event recorder that captures safety-critical data routed to the 
engineer's display that the engineer must obey, including all mandatory 
directives that have been electronically delivered to the train, 
maximum authorized speeds, warnings presented to the crew, including 
countdowns to braking enforcement and warnings indicating that braking 
enforcement is in effect, and the current system state (``ACTIVE'', 
``FAILED'', ``CUTIN'', ``CUTOUT'', etc.)
    FRA intends that this information be available in the event of an 
accident with a PTC-equipped system to determine root causes and the 
necessary actions that must be taken to prevent reoccurrence. Although 
FRA expects implemented PTC systems will prevent PTC-preventable 
accidents, in the event of system failure FRA believes it is necessary 
to capture available data relating to the event. Further, FRA sees 
value in capturing information regarding any accident that may occur 
outside of the control of a PTC system

[[Page 2625]]

as it is currently designed--including the prevention of collisions 
with trains not equipped with PTC systems--and accidents that could 
otherwise have been prevented by PTC technology, but were unanticipated 
by the system developers, the employing railroad, or FRA.
    The data may be captured in the locomotive event recorder, or a 
separate memory module. If the locomotive is placed in service on or 
after October 1, 2009, the event recorder and memory module, if used, 
shall be crashworthy, otherwise known as crash-hardened, in accordance 
with Sec.  229.135. For locomotives built prior to that period, the 
data shall be protected to the maximum extent possible within the 
limits of the technology being used in the event recorder and memory 
module.
    One commenter stated that paragraph (d) was not clear. The 
commenter is unsure if FRA is requiring that all of the operator's 
display be recorded and replicated upon playback. FRA only requires 
that the railroad capture the safety-critical data routed to the 
display which the engineer must obey. The choice of format to play back 
this data has been left to the railroad, keeping in mind that whatever 
format used for data playback needs to be available to FRA for accident 
investigations and other investigation activities.
    As required by the RSIA08 and by paragraph (a)(1)(iv), as noted 
above, a PTC system required by subpart I must be designed to prevent 
the movement of a train through a main line switch in the wrong 
position. Paragraph (e) provides amplifying information on switch point 
monitoring, indication, warning of misalignment, and associated 
enforcement. According to the statute, each PTC system must be designed 
to prevent ``the movement of a train through a switch left in the wrong 
position.'' FRA understands ``wrong position'' to mean not in the 
position for the intended movement of the train. FRA believes that 
Congress' use of the phrase ``left in the wrong position'' was 
primarily directed at switches in non-signaled (dark) territory such as 
the switch involved in the aforementioned accident at Graniteville, 
South Carolina. FRA also believes that, in order to prevent potential 
derailment or divergence to an unintended route, it is critical that 
all associated switches be monitored by a PTC system in some manner to 
detect whether they are in their proper position for train movements. 
If a switch is misaligned, the PTC system must provide an acceptable 
level of safety for train operations.
    Prior to the statute, PTC provided for positive train separation, 
speed enforcement, and work zone protection. The addition of switch 
point monitoring and run through prevention would have eliminated the 
Graniteville accident where a misaligned switch resulted in the 
unintended divergence of a train operating on the main track onto a 
siding track and the collision of that train with another parked train 
on the siding. The resulting release of chlorine gas caused nine deaths 
and required the evacuation of the entire town while remediation 
efforts were in progress.
    As discussed above, FRA considered requiring PTC systems to be 
interconnected with each main line switch and to individually monitor 
each switch's point position in such a manner as to provide for a 
positive stop short of any misalignment condition. However, after 
further consideration and discussion with the PTC Working Group, FRA 
believes that such an approach may be overly aggressive and terribly 
expensive in signaled territory.
    Under paragraph (e), FRA instead provides to treat switches 
differently, depending upon whether they are within a wayside or cab 
signal system--or are provided other similar safeguards (i.e., distant 
switch indicators and associated locking circuitry) required to meet 
the applicable switch position standards and requirements of subparts A 
through G--within non-signaled (dark) territory.
    While a PTC system in dark territory would be required to enforce a 
positive stop--as discussed in more detail below--a PTC system in 
signaled territory would require a train to operate at no more than the 
upper limit of restricted speed between the associated signal, over any 
switch in the block governed by the signal, and until reaching the next 
subsequent signal that is displaying a signal indication more 
permissive than proceed at restricted speed.
    Signaled territory includes various types of switches, including 
power-operated switches, hand-operated switches, spring switches, 
electrically-locked switches, electro-pneumatic switches, and hydra 
switches, to name the majority. Each type of switch poses different 
issues as it relates to PTC system enforcement. We will look at power- 
and hand-operated switches as examples.
    On a territory without a PTC system, if a power-operated switch at 
an interlocking or control point were in a condition resulting in the 
display of a stop indication by the signal system, an approaching train 
would generally have to stop only a few feet from the switch, and in 
the large majority of cases no more than several hundred feet away from 
it. In contrast, in PTC territory adhering to the aforementioned overly 
aggressive requirement, a train would have to stop at the signal, which 
may be in close proximity to its associated switch, and operate at no 
more than the upper limit of restricted speed to that switch, where it 
would have to stop again. FRA believes that, since the train would be 
required to stop at the signal, and must operate at no more than the 
upper limit of restricted speed until it completely passes the switch 
(with the crew by rule watching for and prepared to stop short of, 
among other concerns, an improperly lined switch), a secondary enforced 
stop at the switch would be unnecessarily redundant.
    Operations using hand-operated switches would provide different, 
and arguably greater, difficulties and potential risks. Generally, in 
between each successive interlocking and control point, signal spacing 
along the right of way can approximately be 1 to 3 miles or more apart, 
determined by the usual length of track circuits and the sufficient 
number of indications that would provide optimal use for train 
operations. Each signal governs the movement through the entire 
associated block up to the next signal. Thus, a train approaching a 
hand-operated switch may encounter further difficulties since its 
governing signal may be much further away than the governing signal for 
a power-operated switch. If within signaled territory a hand-operated 
switch outside of an interlocking or control point were in a condition 
resulting in the display of a restricted speed signal indication by the 
signal system, an approaching train may be required to stop before 
entering the block governed by the signal and proceed at restricted 
speed, or otherwise reduce its speed to restricted speed as it enters 
the block governed by the signal. The train must then be operated at 
restricted speed until the train reaches the next signal displaying an 
indication more permissive than proceed at restricted speed, while 
passing over any switch within the block. The governing signal, 
however, may be anywhere from a few feet to more than a mile from the 
hand-operated switch. For instance, if a signal governs a 3 mile long 
block, and there is a switch located 1.8 miles after passing the 
governing signal (stated in advance of the signal), and that switch is 
misaligned, the train would have to travel that 1.8 miles at restricted 
speed. Even if the train crew members were able to correct the 
misaligned switch,

[[Page 2626]]

they would need to remain at restricted speed at least until the next 
signal (absent an upgrade of a cab signal indication).
    In signaled territory, to require a PTC system to enforce a 
positive stop of an approaching train at each individual misaligned 
switch would be an unnecessary burden on the industry, particularly 
since movement beyond the governing signal would be enforced by the PTC 
system to a speed no more than the upper limit of restricted speed. 
Accordingly, in signaled territory, paragraph (e)(1) requires a PTC 
system to enforce the upper limit of restricted speed through the 
block. By definition, at restricted speed, the locomotive engineer must 
be prepared to stop within one-half the range of vision short of any 
misaligned switch or broken rail, etc., not to exceed 15 or 20 miles 
per hour depending on the operating rule of the railroad. Accordingly, 
if a PTC system is integrated with the signal system, and a train is 
enforced by the PTC system to move at restricted speed past a signal 
displaying a restricted speed indication, FRA feels comfortable that 
the PTC system will meet the statutory mandate of preventing the 
movement of the train through the switch left in the wrong position by 
continuously displaying the speed to be maintained (i.e., restricted 
speed) and by enforcing the upper limit of the railroads' restricted 
speed rule (but not to exceed 20 mph). While this solution would not 
completely eliminate human factors associated with movement through a 
misaligned switch, it would significantly mitigate the risk of a train 
moving through such a switch and would be much more cost effective.
    Moreover, it would be cost prohibitive to require the industry to 
individually equip each of the many thousands of hand-operated switches 
with a wayside interface unit (WIU) necessary to interconnect with a 
PTC system in order to provide a positive stop short of any such switch 
that may be misaligned. Currently each switch in signaled territory has 
its position monitored by a switch circuit controller (SCC). When a 
switch is not in its normal position, the SCC opens a signal control 
circuit to cause the signal governing movement over the switch location 
to display its most restrictive aspect (usually red). A train 
encountering a red signal at the entrance to a block will be required 
to operate at restricted speed through the entire block, which can be 
several miles in length depending on signal spacing. The signal system 
is not capable of informing the train crew which switch, if any, in the 
block may be in an improper position since none of switches are 
equipped with an independent WIU. There could be many switches within 
the same block in a city or other congested area. Thus, there is a 
possibility that one or more switches may be not in its proper position 
and the signal system would be unable to transmit which switch or 
switches are not in normal position. The governing signal could also be 
displaying a red aspect on account of a broken rail, broken bond wire, 
broken or wrapped line wire, bad insulated joint, bad insulated switch 
or gage rods, or other defective condition.
    FRA believes that requiring a PTC system to enforce the upper limit 
of restricted speed in the aforementioned situations is statutorily 
acceptable. The statute requires each PTC system to prevent ``the 
movement of a train through a switch left in the wrong position.'' 
Under this statutory language, the railroad's intended route must 
factor into the question of whether a switch is in the ``wrong'' 
position. In other words, in order to determine whether a switch is in 
the ``wrong position,'' we must know the switch's ``right position.'' 
The ``right position'' is determined by the intended route of the 
railroad. Thus, when determining whether a switch is in the wrong 
position, it is necessary to know the railroad's intended route and 
whether the switch is properly positioned to provide for the train to 
move through the switch to continue on that route. The intended route 
is normally determined by the dispatcher.
    Under the final rule, when a switch is in the wrong position, the 
PTC system must have knowledge of that information, must communicate 
that information to the railroad (e.g., the locomotive engineer or 
dispatcher), and must control the train accordingly. Once the PTC 
system or railroad has knowledge of the switch's position, FRA expects 
the position to be corrected in accordance with part 218 before the 
train operates through the switch. See, e.g., Sec. Sec.  218.93, 
218.103, 218.105, 218.107.
    If the PTC system forces the train to move at no more than the 
upper limit of restricted speed, the railroad will have knowledge that 
a misaligned switch may be within the subject block, and the railroad, 
by rule or dispatcher permission, will then make the decision to move 
through the switch (i.e., the railroad's intent has changed as 
indicated by rule or dispatcher instructions), so the switch will no 
longer be in the ``wrong position.'' The RSAC PTC Working Group was 
unanimous in concluding that these arrangements satisfy the safety 
objectives of RSIA08. Utilization of the signal system to detect 
misaligned switches and facilitate safe movements also provides an 
incentive to retain existing signal systems, with substantial 
additional benefits in the form of broken rail detection and detection 
of equipment fouling the main line.
    Paragraph (e)(2) addresses movements over switches in dark 
territory and under conditions of excessive risk, even within block 
signal territory. In dark territory, by definition, there are no 
signals available to provide any signal indication or to interconnect 
with the switches or PTC system. Without the benefit of a wayside or 
cab signal system, or other similar system of equivalent safety, the 
PTC system will have no signals to obey. In such a case, the PTC system 
may be designed to allow for virtual signals, which are waypoints in 
the track database that would correspond to the physical location of 
the signals had they existed without a switch point monitoring system. 
Accordingly, paragraph (e)(2)(i) requires that in dark territory where 
PTC systems are implemented and governed by this subpart, the PTC 
system must enforce a positive stop for each misaligned switch whereas 
the lead locomotive must be stopped short of the switch to preclude any 
fouling of the switch. Once the train stops, the railroad will have an 
opportunity to correct the switch's positioning and then continue its 
route as intended.
    Unlike in signaled territory, FRA expects that on lines requiring 
PTC in dark territory, each switch will be equipped with a WIU to 
monitor the switch's position. A WIU is a device that aggregates 
control and status information from one or more trackside devices for 
transmission to a central office and/or an approaching train's onboard 
PTC equipment, as well as disaggregating received requests for 
information, and promulgates that request to the appropriate wayside 
device. Most of the switches in dark territory are hand-operated with a 
much smaller number of them being spring and hydra switches. In dark 
territory, usually none of the switches have their position monitored 
by a SCC and railroads have relied on the proper handling of these 
switches by railroad personnel. When it is necessary to throw a main 
line switch from normal to reverse, an obligation arises under the 
railroad's rules to restore the switch upon completion of the 
authorized activity. Switch targets or banners are intended to provide 
minimal visual indication of the switch's position, but in the typical 
case trains are not required to operate at a speed permitting them to 
stop short of open switches. As

[[Page 2627]]

evidenced by the issuance of Emergency Order No. 24 and the subsequent 
Railroad Operating Rules Final Rule (73 FR 8,442 (Feb. 13, 2008)), 
proper handling of main line switches cannot be guaranteed in every 
case. However, now with the implementation and operation of PTC 
technology, if a switch is not in the normal position, that information 
will be transmitted to the locomotive. The PTC system will then know 
which switch is not in the normal position and require a positive stop 
at that switch location only.
    In the event that movement through a misaligned switch would result 
in an unacceptable risk, whether in dark or signaled territory, 
paragraph (e)(2)(ii) requires the PTC system to enforce a positive stop 
on each train before it crosses the switch in the same manner as 
described above for trains operating in dark, PTC territory. FRA 
acknowledges that regardless of a switch's position, and regardless of 
whether the switch is in dark or signaled territory, movement through 
certain misaligned switches--even at low speeds--may still create an 
unacceptable risk of collision with another train.
    FRA understands the term ``unacceptable risk'' to mean risk that 
cannot be tolerated by the railroad's management (and in this case FRA 
plays the role of ensuring consistency). It is a type of identified 
risk that must be eliminated or controlled. For instance, such an 
unacceptable risk may exist with a hand-operated crossover between two 
main tracks, between a main track and a siding or auxiliary track, or 
with a hand-operated switch providing access to another subdivision or 
branch line. The switches mentioned in paragraph (e)(2)(ii) are in 
locations where, if the switch is left lined in the wrong position, a 
train would be allowed to traverse through the crossover or turnout and 
potentially into the path of another train operating on an adjoining 
main track, siding, or other route. Even if such switches were located 
within a signaled territory, the signal governing movements over the 
switch locations, for both tracks as may be applicable, would be 
displaying their most restrictive aspect (usually red). This 
restrictive signal indication would in turn allow both trains to 
approach the location at restricted speed where one or both of the 
crossover switches are lined in the reverse position. Since the PTC 
system is not capable of actually enforcing restricted speed other than 
its upper limits, the PTC system would enforce a 15 or 20 mile per hour 
speed limit dependent upon the operating rules of the railroad. 
However, there is normally up to as much as a 5 mile per hour tolerance 
allowed for each speed limit before the PTC system will actually 
enforce the applicable required speed. Thus, in reality, the PTC system 
would not enforce the restricted speed condition until each train 
obtained a speed of up to 25 miles per hour. In this scenario, it is 
conceivable that two trains both operating at a speed of up to 25 miles 
per hour could collide with each other at a combined impact speed 
(closing speed) of up to 50 miles per hour. While these examples are 
provided in the rule text, they are merely illustrative and do not 
limit the universe of what FRA may consider an unacceptable risk for 
the purpose of paragraph (e). FRA emphasizes that FRA maintains the 
final determination as to what constitutes acceptable or unacceptable 
risk in accordance with paragraph (e)(2)(ii).
    Caltrain submitted a comment recommending the removal of the 
following text from this section: ``Unacceptable risk includes 
conditions when traversing the switch, even at low speeds, could result 
in direct conflict with the movement of another train (including a 
hand-operated crossover between main track, a hand-operated crossover 
between main track and an adjoining siding or auxiliary track, or a 
hand-operated switch providing access to another subdivision or branch 
line, etc.)'' Caltrain asserted that the PTC Safety Plan is required 
to, and will address, whether a particular configuration is an 
acceptable risk. The examples cited can include a non-signaled siding 
or auxiliary track several feet below the grade of the mainline track. 
The possibility of the equipment on the auxiliary track conflicting 
with movement on the main line track is no greater at a crossover than 
if it is a single switch and turnout. Main to main crossovers are 
another topic that will be addressed in the risk analysis.
    FRA believes it to be important to identify the requirement that a 
PTC system must enforce a positive stop short of any main line switch, 
and any switch on a siding where the allowable speed is in excess of 20 
miles per hour, if movement of a train over such a switch not in its 
proper position could create an unacceptable risk. FRA is providing 
within the language of the rule example of movements through an 
improperly lined switch that FRA believes would result in unacceptable 
risk. This unacceptable risk is not related to the potential ``roll-
out'' of equipment from another track onto the main track, which was 
referenced in the comment submitted by Caltrain, but constitutes any 
situation where a movement may diverge from one track onto an adjacent 
track potentially directly in front of a proceeding movement of a 
separate train on that track.
    Furthermore, FRA provides in paragraph (e)(3) that a railroad may 
submit, with justification, alternative PTC system enforcement 
associated with unacceptable risk of train movements through improperly 
aligned switches in their applicable PTCDP or PTCSP for FRA approval. 
FRA therefore elects to leave the rule text of paragraph (e)(2)(ii) as 
it was written in the proposed rule.
    The PTC system must also enforce a positive stop short of any 
misaligned switch on a PTC controlled siding in dark territory where 
the allowable track speed is in excess of 20 miles per hour. Sidings 
are used for meeting and passing trains and where those siding 
movements are governed by the PTC system, safety necessitates the 
position of the switches located on sidings to be monitored in order to 
protect train movements operating on them. Conversely, on signaled 
sidings, train movements are governed and protected by the associated 
signal indications, track circuits, and monitored switches, none of 
which are present in dark territory.
    Paragraph (e)(3) notes that while switch position detection and 
enforcement must be accomplished, the PTCSP may include a safety 
analysis for alternative means of PTC system enforcement associated 
with switch position. Moreover, an identification and justification of 
any alternate means of protection other than that provided in this 
section shall be identified and justified. FRA recognizes that, in 
certain circumstances, this flexibility may allow the reasonable use of 
a track circuit in lieu of individually monitored switches (addressing 
rail integrity as well as identification of open switches).
    Paragraph (e)(4) provides amplifying information regarding existing 
standards of subparts A through G of this part related to switches, 
movable-point frogs, and derails in the route governed that are equally 
applicable to PTC systems unless otherwise provided in a PTCSP approved 
under this subpart. This paragraph explains that the FRA required and 
accepted railroad industry standard types of components used to 
monitored switch point position and how those devices are required to 
function. This paragraph allows for some alternative method to be used 
to accomplish the same level of protection if it is identified and 
justified in a PTCSP approved under this subpart.

[[Page 2628]]

    The AAR submitted comment that the language within paragraph 
(e)(4), which was presumably derived from subpart C of this part, 
prescribes conditions under which ``movement authorities can only be 
provided.'' (emphasis added). The AAR contends that, in the context of 
PTC design, this paragraph seems to prescribe a specific method (the 
withholding of movement authorities) to provide switch position 
protection per the requirements identified by paragraphs (e)(1) through 
(e)(3). The AAR asserts that paragraph (e)(4) should be clarified or 
revised to allow for PTC systems that may meet these requirements by 
methods other than, or in addition to, those methods prescribed by 
paragraph (e)(4). Thus, the AAR suggests rewording paragraph (e)(4) to 
include the language: ``unrestricted movement authorities can only be 
provided''.
    FRA agrees with the principle of the AAR's comment. The intention 
appears to be that the permissiveness of all movement authorities over 
any switches, movable-point frogs, or derails must be determined by 
control circuits or their electronic equivalent selected through a 
circuit controller or functionally equivalent device that is operated 
directly by the switch points, derail, or switch locking mechanism, or 
through relay or electronic device controlled by such circuit 
controller or functionally equivalent device. Unrestricted movement 
authorities can only be provided when each switch, movable-point frog, 
or derail in the route governed is in proper position. FRA has 
therefore revised paragraph (e)(4) to read as follows: ``The control 
circuit or electronic equivalent for all movement authorities over any 
switches, movable-point frogs, or derails shall be selected through 
circuit controller or functionally equivalent device operated directly 
by switch points, derail, or by switch locking mechanism, or through 
relay or electronic device controlled by such circuit controller or 
functionally equivalent device, for each switch, movable-point frog, or 
derail in the route governed. Circuits or electronic equivalents shall 
be arranged so that any movement authorities less restrictive than 
those prescribed in paragraphs (e)(1) and (e)(2) of this section can 
only be provided when each switch, movable-point frog, or derail in the 
route governed is in proper position, and shall be in accordance with 
subparts A through G of this part, unless it is otherwise provided in a 
PTCSP approved under this subpart.''
    Paragraph (f) provides amplifying information for determining 
whether a PTC system is considered to be configured to prevent train-
to-train collisions, as required under paragraph (a). FRA will consider 
the PTC system as providing the required protection if the PTC system 
enforces the upper limits of restricted speed. These criteria will 
allow following trains to pass intermediate signals displaying a 
restricting aspect and will allow for the issuance of joint mandatory 
directives.
    Where a wayside signal displays a ``Stop,'' ``Stop and Proceed,'' 
or ``Restricted Proceed'' indication, paragraph (f)(1)(i) requires the 
PTC system to enforce the signal indication accordingly. In the case of 
a ``Stop'' or ``Stop and Proceed'' indication, operating rules require 
that the train will be brought to a stop prior to passing the signal 
displaying the indication. The train may then proceed at 15 or 20 miles 
per hour, as applicable according to the host railroad's operating 
rule(s) for restricted speed. In the case of a ``Restricted Proceed'' 
indication, the train would be allowed to pass the signal at 15 or 20 
miles per hour. Some existing PTC systems do not enforce the stop 
indication under these circumstances, and FRA believes that this is 
acceptable. However, in either event, the speed restriction would be 
enforced until the train passes a more favorable signal indication. NJ 
Transit asserted, and FRA agrees, that in dark territory where trains 
operate by mandatory directive, the PTC system would be expected to 
enforce the upper limit of restricted speed on a train when the train 
was allowed into a block already occupied by another preceding train 
traveling in the same direction. In freight operations, there may be 
situations where, in order to accomplish local switching, further 
latitude would be necessary, so long as the upper limit of restricted 
speed is enforced.
    NJ Transit suggests that the FRA consider modifying the verbiage to 
more clearly define the expectation of the operating rules and 
enforcement requirements associated with the Stop and Proceed 
indication.
    FRA fully understands the concern presented by NJ Transit, but 
suggests that the recommended modification to verbiage is already 
provided for in the language of paragraph (f)(1)(ii). FRA has therefore 
elected to retain the language of paragraph (f) in the final rule.
    Paragraphs (g) through (k) all concern situations where temporary 
rerouting may be necessary and would affect application of the 
operational rules under subpart I. While the final rule attempts to 
reduce the opportunity for PTC and non-PTC trains to co-exist on the 
same track, FRA recognizes that this may not always be possible, 
especially when a track segment is out of service and a train must be 
rerouted in order to continue to destination. Accordingly, paragraph 
(g) allows for temporary rerouting of traffic between PTC equipped 
lines and lines not equipped with PTC systems. FRA anticipates two 
situations--emergencies and planned maintenance--that would justify 
such rerouting.
    Paragraph (g) provides the preconditions and procedural rules to 
allow or otherwise effectuate a temporary rerouting in the event of an 
emergency or planned maintenance that would prevent usage of the 
regularly used track. Historically, FRA has dealt with temporary 
rerouting on an ad hoc basis. For instance, on November 12, 1996, FRA 
granted UP, under its application RS&I-AP-No. 1099, conditional 
approval for relief from the requirements of Sec.  236.566, which 
required equipping controlling locomotives with an operative apparatus 
responsive to all automatic train stop, train control, or cab signal 
territory equipment. The conditional approval provided for ``detour 
train movements necessitated by catastrophic occurrence such as 
derailment, flood, fire, or hurricane'' on certain listed UP 
territories configured with automatic cab signals (ACS) or automatic 
train stop (ATS). Ultimately, the relief would allow trains not 
equipped with the apparatus required under Sec.  236.566 to enter those 
ACS and ATS territories. However, the relief was conditional upon 
establishing an absolute block in advance of each train movement--as 
prescribed by General Code of Operating Rules (GCOR) 11.1 and 11.2--and 
notifying the applicable FRA Regional Headquarters. The detour would 
only be permissible for up to seven days and FRA could modify or 
rescind the relief for railroad non-compliance.
    On February 7, 2006, that relief was temporarily extended to 
include defined territory where approximately two months of extensive 
track improvements were necessary. Additional conditions for this 
relief included a maximum train speed of 65 miles per hour and 
notification to the FRA Region 8 Headquarters within 24 hours of the 
beginning of the non-equipped detour train movements and immediately 
upon any accident or incident. On February 27, 2007, FRA provided 
similar temporary relief for another three months on the same 
territory.
    While the aforementioned conditional relief was provided on an ad 
hoc basis, FRA feels that codifying rules regulating temporary 
rerouting involving PTC system track or locomotive equipment is

[[Page 2629]]

necessary due to the potential dangers of allowing mixed PTC and non-
PTC traffic on the same track and the inevitable increased presence of 
PTC and PTC-like technologies. Moreover, FRA believes that the subject 
railroads and FRA would benefit from more regulatory flexibility to 
work more quickly and efficiently to provide for temporary rerouting to 
mitigate the problems associated with emergency situations and 
infrastructure maintenance.
    Under the final rule, FRA is providing for temporary rerouting of 
non-PTC trains onto PTC track and PTC trains onto non-PTC track. A 
train will not be considered rerouted for purposes of the conditions 
set forth in this section if it operates on a PTC line that is other 
than its ``normal route,'' which is equipped and functionally 
responsive to the PTC system over which it is subsequently operated, or 
if it is a non-PTC train (not a passenger train or a freight train 
having any PIH materials) operating on a non-PTC line that is other 
than its ``normal route.''
    Paragraph (g) effectively provides temporary civil penalty immunity 
from various applicable requirements of this subpart, including 
provisions under subpart I relating to controlling locomotives, similar 
to how waivers from FRA have provided certain railroads immunity from 
Sec.  236.566.
    FRA expects that emergency rerouting will require some flexibility 
in order to respond to circumstances outside of the railroad's 
control--most notably changes in the weather, vandalism, and other 
unexpected occurrences--that would result in potential loss of life or 
property or prevent the train from continuing on its normal route. 
While paragraph (g) lists a number of possible emergency circumstances, 
they are primarily included for illustrative purposes and are not a 
limiting factor in determining whether an event rises to an emergency. 
For instance, FRA would also consider allowing rerouting in the event 
use of the track is prevented by vandalism or terrorism. While these 
events are not the primary reasons for which paragraph (g) would allow 
rerouting, FRA recognizes that they may fall outside of the railroad's 
control.
    In the event of an emergency that would prevent usage of the track, 
temporary rerouting may occur instantly by the railroad without 
immediate FRA notice or approval. By contrast, the vast majority of 
maintenance activities can be predicted by railroad operators. While 
the final rule provides for temporary rerouting for such activities, 
the lack of exigent circumstances does not require the allowance of 
instantaneous rerouting without an appropriate request and, in cases 
where the request is for rerouting to exceed 30 days, FRA approval. 
Accordingly, under paragraph (g), procedurally speaking, temporary 
rerouting for emergency circumstances will be treated differently than 
temporary rerouting for planned maintenance. While FRA continues to 
have an interest in monitoring all temporary rerouting to ensure that 
it is occurring as contemplated by FRA and within the confines of the 
rule, the timing of FRA notification, and the approval procedures, 
reflects the aforementioned differences.
    When an emergency circumstance occurs that would prevent usage of 
the regularly used track, and would require temporary rerouting, the 
subject railroad must notify FRA within one business day after the 
rerouting commences. To provide for communicative flexibility in 
emergency situations, the final rule provides for such notification to 
be made in writing or by telephone. FRA provides that written 
notification may be accomplished via overnight mail, e-mail, or 
facsimile. In any event, the railroad should take the steps necessary 
for the method of notification selected to include confirmation that an 
appropriate person actually on duty with FRA receives the notification 
and FRA is duly aware of the situation.
    While telephone notification may provide for easy communications by 
the railroad, a mere phone call would not provide for documentation of 
information required under paragraph (g). Moreover, if for some reason 
the phone call is made at a time when the designated telephone operator 
is not on duty or if the caller is only able to leave a message with 
the FRA voice mail system, the possibility exists that the applicable 
FRA personnel would not be timely notified of the communication and its 
contents.
    Emergency rerouting can only occur without FRA approval for 
fourteen (14) consecutive calendar days. If the railroad requires more 
time, it must make a request to the Associate Administrator. The 
request must be made directly to the Associate Administrator and 
separately from the initial notification sometime before the 14-day 
emergency rerouting period expires. Unless the Associate Administrator 
notifies the railroad of his or her approval before the end of the 
allowable emergency rerouting timeframe, the relief provided by 
paragraph (g) will expire at the end of that timeframe.
    While a mere notification is necessary to commence emergency 
rerouting, a request must be made, with subsequent FRA approval, to 
perform planned maintenance rerouting. The relative predictability of 
planned maintenance activities allows railroads to provide FRA with 
much more advanced request of any necessary rerouting and allows FRA to 
review that request. FRA requires that the request be made at least 10 
calendar days before the planned maintenance rerouting commences.
    To ensure a retrievable record, the request must be made in 
writing. It may be submitted to FRA by fax, e-mail, or courier. Because 
of security protocols placed in effect after the terrorist attacks of 
September 11, 2001, regular mail undergoes irradiation to ensure that 
any pathogens have been destroyed prior to delivery. The irradiation 
process adds significant delay to FRA's receipt of the document, and 
the submitted document may be damaged due to the irradiation process. 
Thus, FRA implores those making a rerouting request in writing to 
deliver the request through other, more acceptable, means.
    The lack of emergency circumstances makes telephonic communication 
less necessary, since the communication need not be immediate, and less 
preferable, since it may not be accurately documented for subsequent 
reference and review. Like notifications for emergency rerouting, the 
request for planned rerouting must include the number of days that the 
rerouting should occur. If the planned maintenance will require 
rerouting up to 30 days, then the request must be made with the 
Regional Administrator. If it will require rerouting for more than 30 
days, then the request must be made with the Associate Administrator. 
These longer time periods reflects FRA's opportunity to review and 
approve the request. In other words, since FRA expects that the review 
and approval process will provide more confidence that a higher level 
of safety will be maintained, the rerouting period for planned 
maintenance activities may be more than the 14 days allotted for 
emergency rerouting.
    Regardless of whether the temporary rerouting is the result of an 
emergency situation or planned maintenance, the communication to FRA 
required under paragraph (g) must include the information listed under 
paragraph (i). This information is necessary to provide FRA with 
context and details of the rerouting. To attempt to provide railroads 
with the flexibility intended under paragraph (g), and to attempt to 
prevent enforcement of the rules from which the railroad should be 
receiving relief, FRA must be able to coordinate with its inspectors 
and other personnel.

[[Page 2630]]

This information may also eventually be important to FRA in developing 
statistical analyses and models, reevaluating its rules, and 
determining the actual level of danger inherent in mixing PTC and non-
PTC traffic on the same tracks.
    For emergency rerouting purposes, the information is also necessary 
for FRA to determine whether it should order the railroad or railroads 
to cease rerouting or provide additional conditions that differ from 
the standard conditions specified in paragraph (i). FRA recognizes the 
importance of allowing temporary rerouting to occur automatically in 
emergency circumstances. However, FRA must also maintain its 
responsibility of ensuring that such rerouting occurs lawfully and as 
intended by the rules. Accordingly, the final rule provides the 
opportunity for FRA to review the information required by paragraph (g) 
to be submitted in accordance with paragraph (i) and order the railroad 
or railroads to cease rerouting if FRA finds that such rerouting is not 
appropriate or permissible in accordance with the requirements of 
paragraphs (g) through (i), and as may be so directed in accordance 
with paragraph (k), as discussed further below.
    For rerouting due to planned maintenance, the information required 
under paragraph (i) is equally applicable and will be used to determine 
whether the railroad should not reroute at all. If the request for 
planned maintenance is for a period of up to 30 days, then the request 
and information must be sent in writing to the Regional Administrator 
of the region in which the temporary rerouting will occur. While such a 
request is self-executing--meaning that it will automatically be 
considered permissible if not otherwise responded to--the Regional 
Administrator may prevent the temporary rerouting from starting by 
simply notifying the railroad or railroads that its request is not 
approved. The Regional Administrator may otherwise provide conditional 
approval, request that further information be supplied to the Regional 
Administrator or Associate Administrator, or disapprove the request 
altogether. If the railroad still seeks to reroute due to planned 
maintenance activities, it must provide the Regional Administrator or 
Associate Administrator, as applicable, the requested information. If 
the Regional Administrator requests further information, no planned 
maintenance rerouting may occur until the information is received and 
reviewed and the Regional Administrator provides his or her approval. 
Likewise, no planned maintenance rerouting may occur if the Regional 
Administrator disapproves of the request. If the Regional Administrator 
does not provide notice preventing the temporary rerouting, then the 
planned maintenance rerouting may begin and occur as requested. 
However, once the planned maintenance rerouting begins, the Regional 
Administrator may at any time order the railroad or railroads to cease 
the rerouting in accordance with paragraph (k).
    Requests for planned maintenance rerouting exceeding 30 days, 
however, must be made to the Associate Administrator and are not self-
executing. No such rerouting may occur without Associate Administrator 
approval, even if the date passes on which the planned maintenance was 
scheduled to commence. Under paragraph (h), like the Regional 
Administrator, the Associate Administrator may provide conditional 
approval, request further information, or disapprove of the request to 
reroute. Once approved rerouting commences, the Associate Administrator 
may also order the rerouting to cease in accordance with paragraph (k).
    Where a train rerouted onto a track equipped with a PTC system is, 
for whatever reason, not compatible and functionally responsive to that 
PTC system (e.g., an unequipped controlling locomotive, or one equipped 
but not compatible with the associated wayside, office, or 
communications system), such train must be operated in accordance with 
Sec.  236.1029. Where any train is rerouted onto a track segment that 
is not equipped with a PTC system, such train must be operated in 
accordance with the operating rules applicable to the track segment on 
which the train is being rerouted.
    Moreover, as referenced in paragraph (g) as it applies to both 
emergency and planned maintenance circumstances, the track upon which 
FRA expects the rerouting to occur would require certain mitigating 
protections listed under paragraph (j) in light of the mixed PTC and 
non-PTC traffic. While FRA purposefully intends paragraph (j) to apply 
similarly to Sec.  236.567, FRA recognizes that Sec.  236.567 does not 
account for the statutory mandates of interoperability and the core PTC 
safety functions. Accordingly, paragraph (j) must be more restrictive.
    Section 236.567, which applies to territories where ``an automatic 
train stop, train control, or cab signal device fails and/or is cut out 
en route,'' requires trains to proceed at either restricted speed or, 
if an automatic block signal system is in operation according to signal 
indication, at no more than 40 miles per hour to the next available 
point of communication where report must be made to a designated 
officer. Where no automatic block signal system is in use, the train 
shall be permitted to proceed at restricted speed or where an automatic 
block signal system is in operation according to signal indication but 
not to exceed medium speed to a point where absolute block can be 
established. Where an absolute block is established in advance of the 
train on which the device is inoperative, the train may proceed at not 
to exceed 79 miles per hour. Paragraph (j) utilizes that absolute block 
condition, which more actively engages the train dispatcher in managing 
movement of the train over the territory (in both signaled and non-
signaled territory). Recognizing that re-routes under this section will 
occur in non-signaled territory, the maximum authorized speeds 
associated with such territory are used as limitations on the speed of 
re-routed trains. FRA agrees with the comments of labor representatives 
in the PTC Working Group who contend that the statutory mandate alters 
to some extent what would otherwise be considered reasonable for these 
circumstances.
    It should be noted that this paragraph (j) was added by FRA after 
further consideration of this issue and was not part of the PTC Working 
Group consensus. FRA received several comments associated with the 
temporary rerouting requirements and the restrictive operational 
conditions imposed by paragraphs (j)(1) and (j)(2) as being overly 
burdensome, unsupported and inappropriate. Specifically, the idea that 
a train rerouted from a PTC line to a non-PTC line should be treated 
differently than the existing traffic on the non-PTC line is 
unjustified. The commenters suggest current FRA operational 
requirements contained in Sec. Sec.  236.0(c) and (d) providing for 
speeds greater than 49 miles per hour for freight and 59 miles per hour 
for passenger trains where a block signal system and/or an automatic 
cab signal, automatic train stop, or automatic train control system is 
in place, is applied safely today and should continue as the applicable 
regulation for this reroute scenario. Thus, the commenters suggest 
rewording paragraph (j)(2) to read as follows: ``Each rerouted train 
movement shall operate in accordance with Sec.  236.0.''
    When the PTC Working Group was reconvened following the public 
hearing and the NPRM comment period, the PTC Working Group formed three

[[Page 2631]]

separate task forces for the purpose of discussing and resolving 
several specific issues. One such task force, deemed the Operational 
Conditions Task Force, was assigned the task of resolving the issues 
associated with operational limitations presented in the proposed rule 
associated with temporary rerouting within Sec.  236.1005, unequipped 
trains operating within a PTC system within Sec.  236.1006, and en 
route failures within Sec.  236.1029.
    Following significant discussion of these issues, a PTC Working 
Group task force recommended rule text changes that would maintain the 
intended level of safety in an acceptable manner while recognizing the 
impractical nature and perhaps even resultant increase in risk 
associated with restricting the operation of a rerouted train from a 
PTC-equipped line onto a non-PTC equipped line more than other 
similarly equipped trains that normally operated on the non-PTC 
equipped line. Therefore, the task force recommended that paragraph (j) 
be revised to read as follows: ``(j) Rerouting conditions. Rerouting of 
operations under paragraph (g) of this section may occur according to 
the following: (1) Where a train not equipped with a PTC system is 
rerouted onto a track equipped with a PTC system, it shall be operated 
in accordance with Sec.  236.1029; (2) Where any train is rerouted onto 
a track not equipped with a PTC system, it shall be operated in 
accordance with the operating rules applicable to the line on which it 
is routed.''
    This recommended revision to paragraph (j) was presented to the PTC 
Working Group and gained consensus from the group. However, upon 
further consideration, FRA has decided to adopt a slight variation of 
the recommended revised rule text in order to provide additional 
clarification regarding the applicability of paragraph (j)(1) to either 
a train not equipped with a PTC system, or one not equipped with a PTC 
system that is compatible and functionally responsive to the PTC system 
utilized on the line on which the train is rerouted. Therefore, 
paragraph (j) has been revised in the final rule to read as follows: 
``(j) Rerouting conditions. Rerouting of operations under paragraph (g) 
of this section may occur under the following conditions: (1) Where a 
train not equipped with a PTC system is rerouted onto a track equipped 
with a PTC system, or a train not equipped with a PTC system that is 
compatible and functionally responsive to the PTC system utilized on 
the line to which the train is being rerouted, the train shall be 
operated in accordance with Sec.  236.1029; or (2) Where any train is 
rerouted onto a track not equipped with a PTC system, the train shall 
be operated in accordance with the operating rules applicable to the 
line on which the train is rerouted.''
    Paragraph (k), as previously noted, provides the Regional 
Administrator with the ability to order the railroad or railroads to 
cease rerouting operations that were requested for up to 30 days. The 
Associate Administrator may order a railroad or railroads to cease 
rerouting operations regardless of the length of planned maintenance 
rerouting requested. FRA believes this is an important measure 
necessary to prevent rerouting performed not in accordance with the 
rules and FRA's expectations based on the railroad's communications and 
to ensure the protection of train crews and the public. However, FRA is 
confident that in the vast majority of cases railroads will utilize the 
afforded latitude reasonably and only under necessary circumstances.
    FRA expects each host railroad to develop a plan to govern 
operations in the event temporary rerouting is performed in accordance 
with this section. Thus, as noted further below in Sec.  236.1015, this 
final rule requires that each PTCSP include a plan accounting for such 
rerouted operations.
Section 236.1006 Equipping Locomotives Operating in PTC Territory
    As reflected by Sec.  236.566, the basic rule for train control 
operations is that all trains will be equipped with responsive onboard 
apparatus. Paragraph (a) so provided in the NPRM, and the language is 
continued in the final rule. Paragraph (a) requires that, as a general 
rule, all trains operating over PTC territory must be PTC-equipped. In 
other words, paragraph (a) requires that each controlling locomotive be 
operated with a PTC onboard apparatus if it is controlling a train 
operating on a track equipped with a PTC system in accordance with 
subpart I. The PTC onboard apparatus should operate and function in 
accordance with the PTCSP governing the particular territory. 
Accordingly, it must successfully and sufficiently interoperate with 
the host railroad's PTC system.
    In the NPRM, FRA recognized the possibility of controlling 
locomotives not necessarily being placed in a train's lead position and 
sought comments on this issue. Comments were filed indicating that the 
lead locomotive is not always necessarily the controlling locomotive. 
In light of this information, the final rule reflects a change from 
``lead locomotive'' to ``controlling locomotive'' as necessary. FRA's 
understanding of a ``controlling locomotive'' is the same understanding 
as it is used in part 232 and as defined in Sec.  232.5. Hence, a 
definition has been added to Sec.  236.1003 merely cross-referencing to 
Sec.  232.5.
    First, it is understood that during the time PTC technology is 
being deployed to meet the statutory deadline of December 31, 2015, 
there will be movements over PTC lines by trains with controlling 
locomotives not equipped with a PTC onboard apparatus. In general, 
Class I railroad locomotives are used throughout the owning railroad's 
system and, under shared power agreements, on other railroads 
nationally. FRA anticipates that the gradual equipping of locomotives--
which will occur at a relatively small number of specialized facilities 
and which will require a day or two of out of service time as well as 
time in transit--will extend well into the implementation period that 
ends on December 31, 2015. It will not be feasible to tie locomotives 
down to PTC lines, and the RSAC stakeholders fully understood that 
point. The RLO did urge that railroads make every effort to use 
equipped locomotives as controlling units, and FRA believes that, in 
general, railroads will do so in order to obtain the benefits of their 
investment.
    The debate on this point has dealt with the possibility of 
exceptions, which was addressed in paragraph (b) in the NPRM. The 
discussion below pertains to the issue of temporary and permanent 
exceptions to the rule.
    The first issue arose under proposed paragraphs (b)(1) and (b)(2), 
which endeavored to set out the rules for the transitional period 
during which PTC will be deployed. It is well understood and accepted 
that it is not feasible to require all trains operating on a PTC line 
to be PTC-equipped and operative from the first day the system is 
turned on. Locomotive fleets will be equipped over a multi-year period, 
and deployment of locomotives will be driven by many factors, of which 
PTC status is only one. Efficient use of locomotives requires them to 
be available for use on multiple routes and even under ``shared power'' 
agreements with other railroads. In some cases, even when a PTC-
equipped locomotive is placed in a consist destined for a PTC line 
there may be legitimate reasons why it is not placed in the controlling 
position.
    Accordingly, the NPRM provided what FRA thought was a very modest 
proposal that equipped locomotives placed in the lead on trains bound 
for PTC territory have their PTC equipment turned on. FRA even made 
allowance for a declining percentage of such locomotives being 
dispatched into PTC

[[Page 2632]]

territory after having failed ``initialization.'' The reaction from 
Class I railroad commenters was startling, to say the least.
    The AAR stated that the proposal was beyond FRA's authority and 
that FRA has no ability to require use of PTC before December 31, 2015. 
According to AAR, railroads will be required to use PTC-equipped 
locomotives on PTC routes come December 31, 2015, and AAR does not 
understand how this obligation could be addressed in the implementation 
plan other than to state PTC-equipped locomotives would be used on PTC 
routes. In the AAR's view, requiring PTC-equipped locomotives to be 
turned on would create a disincentive to equip locomotives early. 
Limiting the ability of railroads to operate trains with locomotives 
that fail initialization could result in railroads attempting to avoid 
rail system congestion by delaying the equipping of locomotives. To 
avoid such a disincentive for equipping locomotives, AAR believes that 
FRA should permit, without limitation, the operation of locomotives 
that fail initialization before December 31, 2015.
    CSXT asserted that the requirements contained in paragraph 
(b)(2)(iii) with respect to the allowable percentage of controlling 
locomotives operating out of each railroad's initial terminals with 
failed systems over track segments equipped with PTC will deter early 
implementation efforts and unfairly punish railroads that are 
diligently working to implement PTC on designated tracks. In addition, 
CSXT questioned the usefulness of such a provision, as CSXT argued that 
there is no meaningful difference between a locomotive that is not 
equipped with PTC and a locomotive that is equipped with a PTC system 
that is not fully functioning.
    Recognizing that matching PTC lines with PTC-equipped controlling 
locomotives will be a key factor in obtaining the benefits of this 
technology in the period up to December 31, 2015, FRA requested 
comments on whether PTCIPs should be required to include power 
management elements describing how this will be accomplished to the 
degree feasible. In response, NJ Transit asserted that the PTCIP does 
require both the lines risk assessment (to establish the track segment 
order of PTC commissioning) and the schedule to equip rolling stock and 
suggests that these schedules can and should indicate the effort of a 
railroad to assure that vehicles are equipped and available for the PTC 
equipped lines. According to NJ Transit, inclusion of a power 
management plan as well within the PTCIP provides an additional effort 
that has a high probability of requiring updates during the PTC 
implementation period, while the schedules and a good faith effort 
alone may serve the purpose most efficiently, especially for the short 
time period anticipated (this should be recognized as 2012 through 2015 
at worst). NJ Transit suggests that FRA should not include this plan as 
a PTCIP requirement, but require the best good faith effort by each 
railroad for providing equipped vehicles during the short interim 
period subject to this concern.
    The AAR also stated that, for trains in long-haul service, the 
train's point of origin or location where the locomotive was added to 
the train may be many crew districts or hundreds or thousands of miles 
prior to the location where the locomotive's onboard PTC apparatus is 
initialized for operation in PTC-equipped territory. In this case, the 
paragraph is overly restrictive and should be modified to be predicated 
on the location prior to entering PTC-equipped territory where 
initialization failed. Accordingly, AAR suggests that paragraph 
(b)(2)(i) be revised to read: ``The subject locomotive failed 
initialization at the point of crew origin for the train or at the 
location where the locomotive was added to the PTC initialized train.''
    The RLO also urges FRA to adopt a requirement that railroads place 
equipped engines in the lead or controlling position whenever such 
equipped engines are in the engine consist during the implementation 
period. The RLO states that implementing such consist management 
initiatives will help identify any problems in the interface of the 
onboard and wayside systems. In the future, states the RLO, railroad 
operations will come to rely heavily upon the proper function of these 
PTC systems. According to the RLO, requiring railroads to adopt this 
approach would require the minor operational maneuver of switching a 
trailing unit to the train's lead position. Since technical anomalies 
that go undetected can be catastrophic, the RLO asserts that FRA should 
not squander the opportunity for discovering them during the 
implementation period.
    During the public hearing conducted on August 13, 2009, FRA 
specifically asked how the RLO expected a railroad to handle the 
situation where an engine that is PTC-equipped may be positioned with 
long hood forward or may have a broken air conditioning system. In its 
comments dated August 20, 2009, the RLO responded by stating that it is 
broadly accepted industry practice to operate trains with the short 
hood in the direction of movement. Operating trains with the long hood 
forward presents safety concerns because the engineer has a limited 
view of the track with that configuration. However, if any safety 
feature or safe practice is impaired, altered, or compromised in any 
locomotive, it should not be in the lead or operating position of the 
train. Therefore, if the engine is not equipped with air conditioning 
or if the long hood is facing forward, the railroad would have three 
choices: grant the crew the right to switch a fully-compliant 
locomotive to the lead at the first location where this can be 
accomplished, do not operate at all, or remove the engine from the 
engine consist entirely. The RLO asserts that this approach would 
create the safest possible working environment, as the safest 
locomotive is the one with PTC, AC, and the short hood forward.
    GE asserts that, by using emerging technology, it is possible to 
operate a PTC system from the lead controlling locomotive using at 
least some parts of a PTC system on trailing locomotives in the consist 
if the onboard network is extended through the locomotive consist. 
According to GE, this can provide a useful contingent operation if some 
component fails in the locomotive and a backup component on a trailing 
unit is linked over the network, providing higher overall PTC 
availability. For example, should the data radio fail on the lead 
locomotive, PTC could continue to operate through a working radio on 
the second or third locomotive unit.
    FRA agrees that PTC-equipped locomotives should be utilized when 
available on PTC territory during the implementation period, and it is 
recognized that it is possible for a unit to serve as the controlling 
locomotive when not positioned first in the consist. FRA believes that 
railroads have strong incentives to take advantage of their investments 
in PTC, but also includes in the final rule a requirement that the 
PTCIP include goals for PTC-equipped locomotives in PTC territory.
    This issue was discussed further in the PTC Working Group during 
the review of the comments, but no formal resolution was achieved. FRA 
is not obligated to provide any exception here whatsoever, and the 
contention that FRA may not require use of PTC prior to December 31, 
2015, is utterly without merit. Nevertheless, FRA does not wish to 
proceed in such a manner as to create even a temporary disincentive to 
deploy PTC locomotives on PTC-equipped lines. However, clearly leaving 
the carriers to their own devices without

[[Page 2633]]

accountability or oversight appears unwarranted given the tenor of 
their comments and the known conflicts among departments of the 
railroad that can arise during any implementation of new technology. 
Leaving the use of available PTC technology wholly unregulated until 
December 31, 2015, would not only open the possibility that safety 
gains would not be made during the period, it would also increase the 
possibility that PTC systems would not be sufficiently stable and 
reliable as of the statutory completion date.
    Accordingly, FRA has included in the final rule, in lieu of the 
language initially proposed, a requirement that each railroad include 
in its PTCIP specific goals for progressively effective use of its 
equipped locomotives on PTC lines that have been made operational. FRA 
would review the goals and stated justification as part of its review 
of the PTCIP. The railroad would then be required to report annually 
its progress toward achieving its goals, including any adjustments 
required to remedy shortfalls. Although FRA does not intend to second 
guess details of power management, FRA does believe it is reasonable to 
expect results in the form of steadily declining PTC-preventable 
accidents during the implementation period. The only way to accomplish 
that is to ensure that PTC onboard apparatus is deployed on PTC lines 
in reasonable proportion to its deployment elsewhere and that, when so 
deployed, it is utilized as intended.
    The second major issue arose under paragraph (b)(4), which proposed 
limited exceptions for movements of Class II and III trains over PTC 
lines of the Class I railroads. The disagreements attendant to that 
proposal warrant more detailed treatment.
    New PTC systems will be like existing train control systems in the 
sense that they are comprised of onboard and wayside components. They 
will also involve a more substantial centralized ``office'' function. 
The railroad that has the right to control movements over a line of 
railroad (generally the entity providing or contracting for the 
dispatching function) will provide for equipping of the wayside and 
appropriate links to and interface with the office. In preparing the 
recommendations that led to the NPRM, the PTC Working Group discussed 
at great length the issues related to operation of PTC-equipped 
locomotives, and locomotives not equipped with PTC onboard apparatus, 
over lines equipped with PTC. As explained above, the PTC Working Group 
recognized that the typical rule with respect to train control 
territory is that all controlling locomotives must be equipped and 
operative (see Sec.  236.566). It was also noted in the discussion that 
the Interstate Commerce Commission (FRA's predecessor agency in the 
regulation of this subject matter) and FRA have provided some relief 
from this requirement in discrete circumstances where safety exposure 
was considered relatively low and the hardship associated with 
equipping additional locomotives was considered substantial. (For 
instance, in the case of intermittent automatic train stop installed 
many years ago on the former Atchison, Topeka and Santa Fe Railroad 
(now BNSF Railway), only passenger trains were subject to the 
requirement for onboard apparatus. That arrangement continues to the 
present day, and it is particularly unusual since none of the host 
railroad's locomotives are equipped, while all Amtrak locomotives 
operating over the territory must be equipped.)
    The ASLRRA noted that its member railroads conduct limited 
operations over Class I railroad lines that will be required to be 
equipped with PTC systems in a substantial number of locations. These 
operations are principally related to the receipt and delivery of 
carload traffic in interchange. The small railroad service extends onto 
the Class I railroad track in order to hold down costs and permit both 
the small railroad and the Class I railroad to retain traffic that 
might be priced off the railroad if the Class I had to dispatch a crew 
to pick up or place the cars. This, in turn, supports competitive 
transportation options for small businesses, including marginal small 
businesses in rural areas.
    The ASLRRA advocated an exception that would permit the trains of 
its members and other small railroads to continue use of existing 
trackage rights and agreements without the necessity for equipping 
their locomotives with PTC technology. They suggested that any 
incremental risk be mitigated by requiring that such trains proceed 
subject to the requirement for an absolute block in advance (similar to 
operating rules consistent with Sec.  236.567 applicable to trains with 
failed onboard train control systems). This position was consistently 
opposed both by the rail labor organizations and the Class I railroads. 
These organizations took the position that all trains should be 
equipped with PTC in order to gain the benefits sought by the 
congressional mandate and to provide the host railroad the full benefit 
of its investment in safety. Informal discussions suggested that Class 
I railroads might offer technical or financial assistance to certain 
small railroads in equipping their locomotives, but that this would, of 
course, be done based on the corporate interest of the Class I 
railroad. Although, in general, market forces and the public interest 
can be expected to correspond over time, this is not always the case. 
So, for instance, there is a risk that requiring all Class II and Class 
III railroads operating on Class I PTC lines to be equipped with PTC 
could be financially unsustainable absent a more generous division of 
the rate or other assistance (technical or otherwise) from the Class I 
interchange partner. A Class I railroad might respond to such 
situations based exclusively on the value of the traffic interchanged 
with respect to the transportation charge recovered for the long haul 
less costs. Although that might be a good market decision for the Class 
I railroad, the result could be loss of rail service for a rural 
community and diversion of the traffic to the highway--a result that 
might not be in the public interest. Over the past several decades the 
federal government and many of the states have made investments in 
light density rail service (through grants, loans, or tax concessions) 
that could be undermined should this occur.
    In the PTC Working Group and in informal discussions around its 
activities, Class I railroads indicated that they intended to take a 
strong position against non-equipped trains operating on their PTC 
lines, and that in order to enforce this restriction fairly, they 
understood that they would need to equip their own locomotives, 
including older road switchers that might venture onto PTC-equipped 
lines only occasionally. However, during these discussions, FRA was not 
able to develop a clear understanding regarding the extent to which the 
Class I railroads, under previously executed private agreements or 
because of a senior position derived from a prior transaction, enjoy 
the effective ability to enforce a requirement that all trains be 
equipped.
    Proposed rule. On this question of non-equipped trains on PTC 
lines, the proposed rule represented a compromise position between the 
requests of the Class II and III railroads and the Class I railroads 
and labor organizations. It proposed to permit the practice only on 
territory where there was no scheduled intercity or commuter passenger 
service. On any given subject track segment, a particular Class II or 
III railroad could operate up to 4 trains per day (2 round trips) for 
up to 20 miles in perpetuity. For hauls in excess of 20

[[Page 2634]]

miles, the practice could continue until the end of 2020.
    FRA offered this proposal in order to limit the burden on small 
entities and to avoid costs that were both avoidable and more greatly 
disproportionate to anticipated benefits than the basic requirements of 
the congressional mandate. FRA noted that the exceptions would 
constitute a small portion of the movements over the PTC-equipped line. 
FRA asserted that the accident/incident data show that the risk 
attendant upon these movements is small. As reflected in the NPRM, a 
review of the last seven years of accident data covering 3,312 
accidents that were potentially preventable by PTC showed that there 
were only two of those accidents that involved a Class I railroad's 
train and a Class II or III railroad's train. (Left unstated in the 
NPRM was the fact that the presence of PTC would have prevented one of 
the accidents even absent equipping of the tenant train, while the 
other would not be prevented due to limitations of PTC architectures 
with respect to low-speed rear-end collisions.) FRA believed that the 
low level of risk revealed by these statistics justified an exception 
for Class II and III railroad trains traversing a PTC-equipped line for 
a relatively short distance. FRA noted that the cost of equipping those 
trains would be high when viewed in the context of the financial 
strength of the Class II or III railroad and the marginal safety 
benefits would be relatively low in those cases where a small volume of 
traffic is moved over the PTC-equipped line.
    Comments on the NPRM exceptions; FRA response. None of the 
commenters responded directly to FRA's safety analysis, but they did 
take strong and disparate stands. The RLO filed joint comments that 
protested allowing an unequipped train owned by a Class II or III 
railroad to move on PTC-required track with only minor restrictions. 
The RLO believed that there are alternatives that are consistent with 
safety and the intent of RSIA08, including temporal separation or using 
the host railroad's equipped locomotives. According to the RLO, simply 
limiting the number of moves and miles of unequipped locomotives on 
PTC-required track would not eliminate the risk associated with the 
hazard or provide compliance with the intent of RSIA08.
    The AAR has also expressed concerns with the proposal, stating that 
``[s]urely Congress did not enact a requirement for the Class I 
railroads to spend billions of dollars on PTC systems only to permit 
Class II and III railroads to operate trains unequipped with PTC 
technology on the PTC routes. AAR asserts that FRA has not shown that 
there would actually be a financial strain on Class II and III 
railroads. According to AAR, a Class II or III railroad would not have 
to equip a locomotive with PTC technology until December 31, 2015. In 
any event, states AAR, the statute makes no distinction among Class I, 
II, or III operations on a PTC route.
    CSXT disagreed with FRA's interpretation of RSIA08, stating that 
the statute, on its face, does not exempt Class II and III railroads 
from the PTC requirements. To the contrary, asserted CSXT, the statute 
appears to contemplate that Class II and III railroads traveling on PTC 
lines would be subject to the PTC requirements since each PTCIP for 
those lines ``must provide for interoperability of the system with 
movements of trains of other railroad carriers,'' (emphasis original) 
which presumably includes Class II and III railroads. CSXT also 
questioned whether entities that carry a wide variety of commodities, 
including PIH traffic, but without the financial wherewithal to adopt 
PTC technologies, should be permitted to impose an arguably increased 
safety risk on the public and other railroads. In any event, stated 
CSXT, the Class II and III railroads would only be responsible for 
outfitting their locomotives, and not wayside units, with PTC 
technologies.
    Moreover, according to CSXT, the exemption under proposed paragraph 
(b)(4)(B)(ii) was unclear as to its application This section allowed 
Class II and III railroads to operate on PTC operated track segments to 
the extent that any single railroad is allowed ``less than four such 
unequipped trains'' over any given track segment. CSXT questions 
whether the number of trains is limited per a common holding company or 
each railroad subsidiary. (The intent is that the limit will be applied 
to each separate railroad company, regardless of common ownership.)
    Recognizing FRA's concerns with imposing the costs of PTC 
implementation on Class II and III railroads, AAR believes FRA is 
mixing up Congress' concern about the ability of Class II and III 
railroads to finance installation of PTC on their own routes with the 
ability of Class II and III railroads to operate locomotives equipped 
with PTC technology over Class I track. The AAR notes that FRA's own 
analysis shows that the cost of equipping locomotives with PTC 
technology amounts to less than a third of total PTC development and 
installation costs. According to AAR, a Class II or III railroad 
qualifying for the proposed exception likely would only need to equip 
only one or two locomotives with PTC technology by sometime after 2015.
    In any event, AAR asserts that this proposed exemption for Class II 
and III railroads is inconsistent with the plain language of the 
statute, which does not distinguish between Class I, II, or III 
operations on a main line with PIH materials. Congress determined that 
PTC should be required on Class I routes meeting the statutory criteria 
regardless of any cost-benefit analysis. The AAR believes that it is 
inconceivable that Congress intended unequipped locomotives be 
permitted to operate routinely where PTC is required, thus undercutting 
the benefit of equipping a PTC route with PTC technology.
    The AAR also challenges FRA's conclusion about the ``marginal 
safety benefit,'' which seems premised on its analysis of train-to-
train collisions, questioning whether FRA has concluded that a train 
operated by a Class II or III railroad poses less of a risk with 
respect to each of the core PTC functions than a train operated by a 
Class I railroad. Leaving aside AAR's objection to any exception 
permitting Class II and III railroads to conduct routine operations 
over PTC routes with unequipped locomotives, AAR does not agree with 
the proposal to wait until December 31, 2020, to impose the twenty-mile 
limitation. According to AAR, FRA has no factual basis for its concern 
that Class II and III railroads will be unable to obtain the technology 
as suppliers seek to equip their bigger Class I customers first. In 
fact, states AAR, it is more likely that Class I railroads will work 
with their Class II and III partners to prepare for the 2015 
implementation deadline.
    The Canadian Pacific Railway does not support the operation of 
unequipped locomotives on PTC equipped lines after December 31, 2015. 
It is CP's position that all trains operating on PTC territory after 
December 31, 2015, must be controlled by a locomotive equipped for PTC 
operation, regardless of whether or not the locomotive in the 
controlling position is considered ``historic.''
    NYSMTA, the parent organization for the Long Island Rail Road and 
Metro-North Railroad, asserted that subpart I of this part should 
require all operators on the same trackage as commuter railroads to be 
fully equipped, as is the case in the existing FRA regulation, and that 
all trains (including those of all Class II and Class III tenant 
railroads) operating in cab signal/train control territory must have 
operative cab signal and ATC. Thus, NYSMTA suggested that subpart

[[Page 2635]]

I should not permit any trains to enter or operate in PTC territory 
that are not equipped with operative PTC systems except where en route 
failures occur within PTC territory. NYSMTA suggested that the 
definition of ``equipped'' for paragraphs (a) through (b)(3) be 
clarified to mean the onboard PTC system equipment has been fully 
commissioned, has passed all acceptance tests and has met reliability 
and availability demonstration tests. In the final rule, FRA continues 
to make clear that all trains operating on intercity/commuter passenger 
territory must be equipped.
    FRA received a number of comments regarding the operation of 
historic locomotives over rail lines that will need to be equipped with 
a PTC system, from commenters such as the San Bernardino Railway 
Historical Society, the Pacific Southwest Railway Museum, the Railroad 
Passenger Car Alliance, and J.L. Patterson & Associates. These 
commenters requested that FRA provide clarification that a historic 
locomotive, as defined in 49 CFR 229.125(h), which is not equipped with 
PTC may be operated over rail lines equipped with PTC systems in 
limited excursion service, provided an excursion operating management 
plan is included in the PTC railroad's PTCIP that is consistent with 
the provisions of Sec.  236.1029(b) of this part.
    These locomotives might include steam locomotives many decades old. 
FRA notes that these operations are relatively infrequent, and they 
normally receive additional oversight by host railroads as a matter of 
course.
    Final rule. The final rule provides exceptions for trains operated 
by Class II and III railroads, including tourist or excursion 
railroads. The exceptions are limited to lines not carrying intercity 
or commuter passenger service, except where the host railroad and the 
passenger railroad (if different entities) have requested an exception 
in the PTC Implementation Plan, as further discussed below, and FRA has 
approved that element of the plan. Examples of potentially acceptable 
instances concerning non-equipped operations on an intercity/commuter 
route might include a weekend excursion operation during periods 
scheduled passenger service is very light or in terminal areas under 
circumstances where all trains will be operated at reduced speed and 
risk is otherwise very limited.
    FRA presumes for purposes of this final rule that there will be 
circumstances rooted in previously executed private agreements under 
which the Class I railroad would be entitled to require the small 
railroad to use a controlling locomotive equipped with PTC as a 
condition of operating onto the property. FRA wishes to emphasize that, 
in issuing this final rule, FRA does not intend to influence the 
exercise of private rights or to suggest that public policy would 
disfavor an otherwise legitimate restriction on the use of unequipped 
locomotives on PTC lines. FRA also notes that, in the absence of clear 
guidance on this issue, a substantial number of waiver requests could 
be expected that would have to be resolved without the benefit of 
decisional criteria previously examined and refined through the 
rulemaking process.
    With respect to limited operations of Class II or III railroads on 
Class I PTC lines, FRA continues to believe that the risk in question 
is very small in relation to the direct and indirect costs of equipping 
locomotives with PTC and maintaining those locomotives over time 
(including configuration management). FRA has also considered the 
issues required applicable statutes concerning the affect of 
regulations on small entities. (See also discussion of de minimis 
exceptions in the preamble to Sec.  236.1005.) Although FRA does expect 
that over time Class II and III railroads will participate more fully 
in the use of PTC technologies, both as tenants and hosts, the initial 
costs and logistical challenges of PTC system operation will be 
significantly greater than the costs and challenges after interoperable 
PTC systems have been demonstrated to be reliable and after the market 
for PTC equipment and services settles. Mandating that every locomotive 
leading a Class II or III train be PTC equipped during the initial roll 
out would create significant incentives to shed marginally profitable 
traffic with unpredictable societal effects. FRA does believe that, as 
the end of the initial implementation approaches, smaller railroads can 
begin the process of joining the PTC community by equipping locomotives 
used for longer hauls on PTC lines. FRA will also review the experience 
of Class I railroads as of that general time period (end of 2015, 
beginning of 2016) to evaluate what additional requirements might be 
appropriate and sustainable.
    FRA has adopted final language sufficiently flexible to permit 
occasional tourist, historic and excursion service on PTC lines. Much 
of the subject equipment is used very lightly and in fact may spend the 
great majority of its time on static display. Ending the educational 
and recreational role of occasional excursion service is no part of 
what the Congress was addressing through the mandate underlying this 
rule.
    Paragraph (b)(3) references the fact that operation of trains with 
failed onboard PTC apparatus is governed by the safeguards of Sec.  
236.1029, where applicable; and paragraph (c) applies the same 
principle to non-equipped trains operating on PTC territory.
Section 236.1007 Additional Requirements for High-Speed Service
    Since the early 1990's, there has been an interest centered around 
designated high-speed corridors for the introduction of high-speed 
rail, and a number of states have made progress in preparing rail 
corridors through safety improvements at highway-rail grade crossings, 
investments in track structure, and other areas. FRA has administered 
limited programs of assistance using appropriated funds. With the 
passage of ARRA, which provides $8 billion in capital assistance for 
high-speed rail corridors and intercity passenger rail service, and the 
President's announcement in April 2009 of a Vision for High-Speed Rail 
in America, FRA expects those efforts to increase considerably. FRA 
believes that railroads conducting high-speed operations in the United 
States can provide a world class service as safe as, or better than, 
any high-speed operations conducted elsewhere. In anticipation of such 
service, and to ensure public safety, FRA proposed three tiers of 
requirements for PTC systems operating in high-speed service. The 
proposed performance thresholds were intended to increase safety 
performance targets as the maximum speed limits increase to compensate 
for increased risks, including the potential frequency and adverse 
consequences of a collision or derailment. These thresholds were 
supported by AASHTO and are adopted as proposed.
    Section 236.1007 sets the intervals for the high-speed safety 
performance targets for operations with: maximum speeds at or greater 
than 60 and 50 miles per hour for passenger service and freight 
operations, respectively, under paragraph (a); maximum speeds greater 
than 90 miles per hour under paragraph (b); maximum speeds greater than 
125 miles per hour under paragraph (c); and maximum speeds greater than 
150 mph under paragraph (d). The reader should note that the 
requirements increase as speed rises. Thus, for instance, operations 
with trains moving above 125 miles per hour must, in addition to the 
requirements under paragraph (c), adhere to the requirements under 
paragraphs (a) and (b).

[[Page 2636]]

    Paragraph (a) addresses the PTC system requirements for territories 
where speeds are greater than 59 miles per hour for passenger service 
and 49 miles per hour for freight service. Under 49 CFR 236.0 as it 
existed directly previous to the issuance of this final rule, block 
signal systems were required at these speeds (unless a manual block 
system was in place, an option that this final rule phases out). The 
final rule expects covered operations moving at these speeds to have 
implemented a PTC system that provides, either directly or with another 
technology, all of the statutory PTC system functions along with the 
safety-critical functions of a block signal system as defined in the 
existing standards of subparts A through F of part 236. The safety-
critical functions of a block signal system include track circuits, 
which assist in broken rail detection and unintended track occupancies 
(equipment rolling out), and fouling circuits, which can identify 
equipment that is intruding on the clearance envelope and may prevent 
raking collisions. FRA recognizes that advances in technology may 
render current block signal, fouling, and broken rail detection systems 
obsolete and FRA does not want to preclude the introduction of suitable 
and appropriate advanced technologies. Accordingly, FRA believes that 
alternative mechanisms providing the same functionality are entirely 
acceptable and FRA encourages their development and use to the extent 
they do not have an adverse impact on the level of safety.
    Paragraph (b) addresses system requirements for territories where 
operating speeds are greater than 90 miles per hour, which is currently 
the maximum allowable operating speed for passenger trains on Class 5 
track. At these higher speeds, the implemented PTC system must not only 
comply with paragraph (a), but also be shown to be fail-safe (as 
defined in Appendix C) and at all times prevent unauthorized intrusion 
of rail traffic onto the higher speed line operating with a PTC system. 
FRA intends this concept of fail-safe application to be understood in 
its commonplace meaning; i.e., that insofar as feasible the system is 
designed to fail to a safe state, which normally means that each 
subject train will be brought to a stop. Further, FRA understands that 
there are aspects of current system design and operation that may 
create a remote opportunity for a ``wrong-side'' or unsafe failure and 
that these issues would be described in the PTCSP and mitigations would 
be provided. FRA recognizes that, as applied in the general freight 
system, this final rule could create a significant challenge related to 
interoperability of freight equipment operating over the same 
territory. Accordingly, FRA requested comment on whether, where 
operations do not exceed 125 miles per hour or some other value, the 
requirement for compliance with Appendix C safety assurance principles 
might be limited to the passenger trains involved, with ``non-vital'' 
onboard processing permitted for the intermingled freight trains. No 
comments were received on this issue, apart from the general concern of 
the RLO that very safe technology be employed in all PTC systems, and 
the restriction is adopted as proposed.
    As speed increases, it also becomes more important that inadvertent 
incursions on the PTC-equipped track be prevented at switch locations. 
In this final rule, FRA expects that this be done by effective means 
that might include use of split-point derails properly placed, 
equipping of tracks providing entry with PTC, or arrangement of tracks 
and switches in such a way as to divert an approaching movement which 
is not authorized to enter onto the PTC line. The protection mechanism 
on the slower speed line must be integrated with the PTC system on the 
higher speed line in a manner to provide appropriate control of trains 
operating on the higher speed line if a violation is not prevented for 
whatever reason.
    Paragraph (c) addresses high-speed rail operations exceeding 125 
miles per hour, which is the maximum speed for Class 7 track under 
Sec.  213.307. At these higher speeds, the consequences of a derailment 
or collision are significantly greater than at lower speeds due to the 
involved vehicle's increased kinetic energy. In such circumstances, in 
addition to meeting the requirements under paragraphs (a) and (b), 
including having a fail-safe PTC system, the entity operating above 125 
miles per hour must provide an additional safety analysis (the HSR-125) 
providing suitable evidence to the Associate Administrator that the PTC 
system can support a level of safety equivalent to, or better than, the 
best level of safety of comparable rail service in either the United 
States or a foreign country over the 5 year period preceding the 
submission of the PTCSP. Additionally, PTC systems on these high-speed 
lines must provide the capability, as appropriate, to detect incursion 
from outside the right of way and provide warnings to trains. Each 
subject railroad is free to suggest in its HSR-125 any method to the 
Associate Administrator that ensures that the subject high-speed lines 
are corridors effectively sealed and protected from such incursions 
(see Sec.  213.347 of this title), including such hazards as motor 
vehicles falling on the track structure from highway bridges.
    Paragraph (d) addresses the highest speeds existing or currently 
contemplated for rail operations exceeding 150 miles per hour. FRA 
expects these operations to be governed by a Rule of Particular 
Applicability and the HSR-125 required by paragraph (c) shall be 
developed as part of an overall system safety plan approved by the 
Associate Administrator. The quantitative risk showing required for 
operations above 125 miles per hour is not required to include 
consideration of acts of deliberate violence. The reason for this 
exclusion is simply to remove speculative or extraordinary 
considerations from the analysis. However, FRA and the Department of 
Homeland Security will certainly expect that security considerations 
are taken into account in system planning.
    AASHTO believed that the proposed rule appropriately addressed the 
PTC related safety levels for high-speed rail. According to AASHTO, the 
proposed rule text provided a clear position for the levels of safety 
required for high-speed rail at speeds that are achieved today, and for 
speeds that may be achieved in the future, allowing for benchmarking 
against precedent levels achieved in the U.S. and internationally. 
AASHTO also commented that, in PTC systems running over federally 
designated high-speed rail corridors, highway-rail grade crossings 
should either be eliminated or protected by hazard warning detection 
systems.
    Amtrak notes that it currently operates safely above 90 miles per 
hour on the Northeast Corridor and on its Michigan line, with the full 
knowledge, approval, and authorization of the FRA, based on past and 
remaining safety procedures and equipment. Amtrak also states that it 
currently operates above 125 mph on portions of the Northeast Corridor. 
Accordingly, Amtrak asserts that services above 90 and 125 miles per 
hour that existed as of October 16, 2008, the date of RSIA08, should be 
exempted or ``grandfathered'' from the requirements of this section.
    FRA agrees that Amtrak has been providing safe passenger service at 
speeds between 90 and 150 miles per hour on the Northeast Corridor as 
well as its Michigan line, and that the train control systems in use 
(ACSES with Cab Signals, and ITCS) have records of safe operations. 
Given the value of service experience and the extraordinary burden of 
review and decision making associated with this rule, FRA intends to 
give full credit to established safety

[[Page 2637]]

records in conducting these reviews, simplifying the task for all 
concerned.
Section 236.1009 Procedural Requirements
    Section 236.1009 establishes the regulatory procedures that must be 
followed by each Class I railroad carrier and each entity providing 
regularly scheduled intercity or commuter rail passenger transportation 
to obtain the required FRA certification of PTC systems prior to 
operating the system or component in revenue service. FRA is 
implementing these requirements to support more rapid FRA review and 
decision making, while reducing the administrative burden on the 
railroads.
    While the current subpart H of this part provides a technically 
sound procedure for obtaining FRA approval of various processor-based 
signal and train control systems, it was crafted with the presumption 
that PTC implementation was a strictly voluntary action on the part of 
railroads. Arguably FRA could have simply amended subpart H to include 
requirements relating to implementation plans and to modify the 
language to equate ``approval'' under subpart H with ``certification'' 
under the statute. However, FRA believes that such a resultant amended 
subpart H would still remain unsuitable to support the RSIA08 
implementation schedule. Accordingly FRA has developed the new 
procedures of this section to avoid redundancy, provide sufficient 
flexibility to accompany the varying needs of those seeking 
certification, and to mitigate the financial risk associated with 
technological investment necessary to comply with the regulatory 
requirements.
    Generally speaking, there are three documents associated with the 
new procedures of this section: the PTCIP, PTCDP, and PTCSP. The 
details of each document are set forth in Sec. Sec.  236.1011, 
236.1013, and 236.1015, respectively. To summarize these sections, the 
PTCIP is the written plan that defines the specific details of how and 
when the railroad will implement the PTC system. The PTCDP provides a 
detailed discussion of the proposed technology and product that will be 
implemented according to the PTCIP. The PTCSP provides the railroad-
specific information demonstrating that the PTC system, as implemented 
by the railroad, meets the required safety performance objectives. 
Certification of a PTC system by FRA for revenue operations is based on 
the review and approval of the information provided in these documents.
    Paragraph (a) requires that a PTCIP be filed by ``host'' railroads 
as defined in Sec.  236.1003 that are required to install a PTC system 
on one or more main lines in accordance with Sec.  236.1005(b). This 
generally is each Class I railroad and each entity providing regularly 
scheduled intercity or commuter rail passenger transportation as 
defined by statute. However, Class II and III railroads that host 
intercity or commuter rail service will also need to file 
implementation plans, whether or not they directly procure or manage 
installation of the PTC system.
    Intercity and commuter railroads that are tenants on Class I, II, 
or III freight lines must also join with their host railroad in filing 
these plans. FRA believes that the railroad that maintains operational 
control over a particular track segment is generally in the best 
position to develop and submit the PTCIP, since that railroad is more 
knowledgeable of the conditions of, and operations over, its track. FRA 
recognizes that, in cases where a tenant passenger railroad operates 
over a Class II or III railroad, the passenger railroad may be required 
to take a more active role in planning the PTC system deployment by 
working with the host railroad. In the case of an intercity or commuter 
railroad providing service over a Class I railroad, it may be 
sufficient for the passenger railroad to file a letter associating 
itself with the Class I railroad's plan to the extent it impacts the 
passenger service. AAR also expressed some confusion whether the 
requirement to file joint plans was only required when freight and 
passenger railroads conduct operations over the same route. The final 
rule does not levy any requirement for joint filing in the case where 
another railroad has freight trackage rights over a Class I railroad's 
PTC line. FRA expects that the host Class I railroad will address these 
types of operations and discuss the issue of interoperability in its 
PTCIP as required by law.
    The Class I railroads generally opposed the requirement for a host 
railroad and tenant passenger railroad to file a joint PTCIP as being 
excessively burdensome and unnecessary because it merely appears to be 
intended to address interoperability issues. Beyond possibly addressing 
the interoperability issue, the AAR maintained that nothing further 
would be gained by requiring the joint filing of a PTCIP.
    FRA has taken note of these objections. However, FRA believes that 
the joint filing requirement provides motivation for the proactive 
involvement by both parties in the decision-making process, especially 
with regards to interoperable equipment requirements and operating 
procedures. This joint filing requirement reflects FRA's position that 
communication between all parties involved in establishing 
interoperability is absolutely essential to ensure the implementation 
of timely, cost effective solutions.
    Some railroads have also expressed concern that they will be 
required to support installation of PTC over Class II and III railroads 
that would otherwise not be required to implement PTC, were it not for 
the passenger/commuter railroad presence. Amtrak noted that the 
requirement for joint filings would, as a practical manner, require 
Amtrak to take a dominant role in the development and preparation of 
the required documentation.
    While FRA appreciates the difficulties that both the passenger/
commuter railroad, as well as the Class II or III railroad may 
experience, FRA believes that this is essentially a commercial matter 
between the parties involved, which would be best resolved with 
government participation only as a last resort. This position is 
consistent with the underlying philosophy of sections 151 through 188 
of title 45 of the United States Code.
    Although FRA believes that the resolution of differences between 
host and tenant railroads is a commercial issue, provisions have been 
made if a host freight railroad and tenant passenger railroad cannot 
come to an agreement to jointly file a PTCIP by April 16, 2010. In this 
situation, each railroad must file an individual PTCIP, together with a 
notification to the Associate Administrator, indicating that a joint 
filing was not possible and an explanation of why the subject railroads 
could not agree upon a final PTCIP for joint filing.
    Both the freight and passenger/commuter railroads have strenuously 
objected to the assessment of civil penalties in the event that 
agreement cannot be reached. Amtrak claimed that failure to come to 
agreement did not rise to the level of an act that warranted penalty. 
AAR asserted that imposition of penalties would not be an appropriate 
way to resolve good faith disputes over the implementation of PTC. 
Concern has also been raised that, in the event of a dispute, the 
resolution process does not appear to have any established milestones. 
NYSMTA expressed concern related to the ability of railroads to fairly 
and quickly resolve disputes related to the development of host/tenant 
interoperability agreements required by RSIA08. NYSMTA asserted that, 
even though FRA provides for dispute resolution in Sec.  236.1009, 
there are no time limits or standards to ensure

[[Page 2638]]

that disputes are resolved fairly and in a manner that does not affect 
railroads' ability to comply with the statutory/mandatory 
implementation of PTC by December 31, 2015.
    FRA has taken note of these objections and concerns. FRA believes 
that the milestones are self-evident. Railroads are required to file 
implementation plans by April 16, 2010. Thus, failure to file an 
implementation plan (either jointly or individually) by April 16, 2010, 
constitutes a violation of the RSIA08. Railroads are also required to 
complete implementation by December 31, 2015. FRA does not intend to 
set any specific deadline for completion of mediation or arbitration 
other than to state that the mediation or arbitration must be resolved 
in time to allow both parties to complete the timely submission of 
their PTCIP by April 16, 2010, and to complete PTC installation by 
December 31, 2015.
    FRA will exercise its prosecutorial discretion if railroads have 
unresolved conflicts, but have filed individual implementation plans in 
accordance with paragraph (a)(4) of this section and are engaged in 
good faith mediation or arbitration.
    Caltrain requested clarification of the meaning of the term 
``confer,'' as used in paragraph (a)(4)(iv) of this section. During the 
conference process, FRA will request that all parties to the dispute 
advise FRA of where their differences arise, so that FRA can evaluate 
the potential impact on completion of the statutorily-required build 
out and understand the nature and extent of their disagreement. FRA may 
propose alternative solutions for consideration by both parties in the 
dispute. FRA is not, however, obligated to act as either a mediator or 
arbitrator of essentially commercial disputes. FRA expects that the 
disputing parties will submit such issues to a mutually acceptable 
mediator or arbitrator. If the disputing parties are unable to find a 
mutually agreeable private mediator or arbitrator, FRA may agree to 
mediate the dispute as a last resort. Otherwise, the disputing parties 
will need to seek judicial resolution of their issues.
    It was also commented that if a PTCIP or request for amendment 
(RFA), as provided in Sec.  236.1021, is submitted after April 16, 
2010, in accordance with this rule, paragraph (a) does not provide the 
subject railroads with an opportunity to file separately. FRA intends, 
in such a situation, that if a railroad wishes to use track that would 
require the installation of a PTC system, and the parties have 
difficulty reaching agreement, then such usage would be delayed until 
the parties jointly file a mutually acceptable PTCIP and the jointly-
filed PTCIP is approved by FRA.
    FRA notes that new passenger railroads are likely to begin 
operations during the period between issuance of this final rule and 
the end of the implementation period for PTC (December 31, 2015). 
Railroads that are required to install PTC, who intend to commence 
operations after April 16, 2010, but before December 31, 2015, would be 
expected to file a PTCIP that meets the requirements of paragraph (a) 
as soon as possible after the decision is made to commence operations. 
Any railroad commencing operations after December 31, 2015, that is 
required to install PTC, will not be authorized to commence revenue 
operations until the PTC installation is complete.
    During review of the NPRM, AAR noted that paragraph (a)(2)(i) had 
not been updated to reflect an RSAC agreement. FRA agrees and has 
updated paragraph (a)(2)(i) to include the language, ``[a] PTCIP if it 
becomes a host railroad of a main line track segment for which it is 
required to implement and operate a PTC system in accordance with Sec.  
236.1005(b).''
    Paragraph (b) in the proposed rule required the submission of a 
PTCDP when the PTCIP is submitted to FRA for approval. Some railroads, 
primarily those owned or operated by government agencies, who submitted 
comments on this issue indicated that, while they would be able to 
identify the general functional requirements of the PTC system, they 
expected public procurement regulations would preclude contract award 
and identification of a particular vendor or supplier and the 
associated product details in time to meet the statutory submission 
deadline. They requested that FRA not require submission of the PTCDP 
at the same time (or before) the PTCIP.
    NYSMTA submitted comments asserting that simultaneous submissions 
would be problematic for LIRR. In view of the complexities and unknown 
factors associated with developing PTC solutions for LIRR's dark and 
ABS territories, and in light of its unique signaling applications and 
operating rules, LIRR was identified as being at high risk of non-
compliance with the April 16, 2010, PTCDP submission deadline, despite 
its best efforts. Inasmuch as the RSIA08 does not explicitly stipulate 
a timeframe for a PTCDP, NYSMTA requested that the regulation be 
modified to allow for submission of a PTCDP after the April 16, 2010, 
deadline, at least with regard to dark territory and ABS territories.
    APTA submitted similar comments stating that the inclusion of the 
PTCDP or PTCSP in the April 2010 submission is problematic. Noting that 
submittal of these plans implies the selection of specific hardware and 
systems, APTA asserted that such submission is not possible given the 
current state of development of industry standards by the Railroad 
Electronics Standards Committee (RESC). Without available industry 
standards, APTA asserted that it would be impossible for the vast 
majority of public agencies that operate passenger rail systems to 
identify and contract with vendors or suppliers by the April 2010 
deadline. Even though the freight railroads may have selected a 
proprietary technology as a basis for their PTC implementation, the 
competition standards for publicly funded contracts limit the ability 
of public agencies to follow a similar procurement strategy. 
Additionally, the lack of specific hardware and system standards to 
support interoperability further limits the ability of public agencies 
to enter into contracts by April 2010. Thus, if required to submit 
PTCDP and PTCSP documents by April 16, 2010, the documents would, of 
necessity, be incomplete and unacceptable.
    APTA further claimed that the sole legislative requirement tied to 
April 2010 is for submission of the PTCIP. Thus, APTA believes FRA 
should allow submission of the PTCIP in a ``product neutral'' fashion 
to meet the statutory deadline and should defer submission of the PTCDP 
and PTCSP to allow flexibility and avoid incomplete submissions and the 
compilation and review of documents that cannot be approved.
    Amtrak similarly expressed concern with the inadequate amount of 
time necessary to prepare the PTCIPs for its own NEC and Michigan Line 
and for the Class II and III railroads over which Amtrak operates (to 
the extent that those lines are not found to constitute other than 
``main lines'') and to review those PTCIPs submitted by the Class I 
railroads and develop full PTCDPs. Because of the severe burden on 
Amtrak's resources, Amtrak recommended that the filing deadline for 
PTCDPs be extended at least 9 months beyond April 16, 2010.
    As a government agency, FRA clearly understands the position faced 
by these railroads. However, FRA believes that a meaningful 
implementation plan cannot be created if a railroad has not identified 
and does not understand the technology it proposes to implement. 
Without this knowledge, it is not possible to have any informed 
discourse on system

[[Page 2639]]

interoperability and implementation scheduling between railroads, 
vendors or suppliers, and FRA. Therefore, in this final rule, FRA has 
provided several mechanisms that eliminate the need for each railroad 
to submit a PTCDP for a proposed PTC system, while still providing FRA 
sufficient information to carry out its regulatory responsibilities.
    One such mechanism, as specified in paragraph (b) is through the 
use of a Type Approval. The Type Approval is a number assigned to a 
particular off-the-shelf or modified PTC system product--described in a 
PTCDP in accordance with Sec.  236.1013--indicating FRA's belief that 
the product could fulfill the requirements of subpart I. FRA's issuance 
of a Type Approval does not mean that the product will meet the 
requirements of subpart I. The Type Approval applies to the technology 
designed and developed, but not yet implemented, and does not bestow 
any ownership or other similar interests or rights to any railroad. 
Each Type Approval number remains under the control of the FRA, and can 
be issued or revoked in accordance with this subpart.
    FRA expects the Type Approval process to provide a variety of 
benefits to FRA and the industry. If a railroad submits a PTCDP 
describing a PTC system, and the PTC system receives a Type Approval, 
then other railroads intending to use the same PTC system without 
variances may, in accordance with paragraph (b)(1), simply rely on the 
Type Approval number without having to file a separate PTCDP. While the 
railroad filing the PTCDP must expend resources to develop and submit 
the PTCDP, all other railroads using the same PTC system would not. 
This should not only provide significant cost and time savings for a 
number of railroads, but should remove a significant level of 
redundancy from the approval process that is currently inherent in 
subpart H.
    If, however, a railroad intends to use a modified version of a PTC 
system that has already received a Type Approval number, and the 
variances between the two systems are of a safety-critical nature, the 
railroad must submit a new PTCDP. The railroad may submit a new PTCDP 
that fully complies with the content requirements under Sec.  236.1013 
or supply a Type Approval number for the other PTC system upon which 
the modified PTC system will rely and a document that fulfills the 
content requirements under Sec.  236.1013 with respect to the safety-
critical variances between the system described within the original 
PTCDP and the system as modified.
    This final rule does not preclude a railroad from submitting its 
PTCDP before its PTCIP for FRA review and approval. FRA encourages an 
earlier submission of the PTCDP to further reduce the required 
regulatory effort necessary to review the PTCIP and PTCDP if submitted 
together. More importantly, it would present an opportunity for FRA to 
issue a Type Approval for the proposed PTC system before April 16, 
2010, thus providing other railroads intending to use the same or 
similar PTC system the opportunity to leverage off of the work already 
performed by simply submitting the Type Approval and--in the event of 
any variances--a much less burdensome PTCDP. FRA also believes this 
regulatory procedure may incentivize railroads using the same or 
similar PTC system to jointly develop and submit a PTCDP, thus further 
reducing the paperwork burden on FRA and the industry as a whole and 
increasing confidence in the interoperability between systems.
    Vendors believe that FRA should type approve specific components, 
so the vendor may sell the type approved products. FRA believes that 
such a request may be based on the mistaken belief that FRA has adopted 
the FAA aviation model of type certifying aircraft frames, aircraft 
engines, and propellers (see 14 CFR part 21, subparts B-G). This is 
not, however, the case. FRA has adopted some elements of the FAA 
Airworthiness Certificate process (see 14 CFR part 21, subpart H), 
which addresses the suitability of an entire aircraft for a particular 
purpose. FRA will apply a similar standard and certify only complete 
PTC systems.
    Another mechanism FRA is adding that will enable railroads to meet 
their statutory obligations in preparing and submitting a PTCIP, while 
providing enough information to FRA to facilitate FRA's evaluation of 
the technical feasibility of the PTCIP, can be found in the provisions 
of paragraph (c).
    Paragraph (c) allows a railroad to file an abbreviated PTCDP, 
called a Notice of Product Intent (NPI), with their PTCIP. The NPI, 
detailed in Sec.  236.1013(e), is handled in a manner similar to a full 
PTCDP, with certain key exceptions. First, a PTCIP may be submitted 
with a NPI in lieu of either a complete PTCDP (or reference to an 
approved Type Approval). Any PTCIP submitted with an NPI and approved 
by FRA will only receive ``Provisional Approval.'' The Provisional 
Approval will only be valid for a maximum period of 270 days 
(approximately 9 months), by which time a railroad must resubmit its 
PTCIP with a complete PTCDP or reference to an approved Type Approval. 
If the railroad submits the updated PTCIP within that period, FRA will 
treat the updated filing in the same manner as FRA would have treated 
the original PTCIP submission. If the railroad fails to update the 
PTCIP before the end of that period, the Provisional Approval will 
automatically be revoked, and the revocation will be considered as 
retroactive to the original due date. FRA has no intention of extending 
any Provisional Approval beyond the 270 day period and will not 
entertain requests to that effect. Each railroad is expected to be 
capable of fully defining the product they intend to use within the 270 
day period. Use of an NPI by a railroad allows for incremental, albeit 
limited, submission of the PTCDP.
    Railroads would still be required to fully describe their plans for 
the use and completion of the PTCDP in their PTCIPs. Having the PTCDP 
development extend beyond the PTCIP due date may be beneficial to the 
entire industry, since it allows for practical development of PTC 
systems for railroads with unique technical requirements or financing 
restrictions while potentially increasing the number of viable 
suppliers, products, and systems. In addition to being practical, this 
approach would further the industry interests of having a more even 
distribution of the workload for commuter rail agencies and for FRA 
staff. Additionally, it enhances the ability of railroads to provide 
sufficient detail in the PTCDP, due to greater confidence in the 
overall design solution, thereby reducing the need for revision and the 
associated burden on FRA and railroad staff.
    FRA clearly recognizes, regardless of the approach taken, that a 
vendor or supplier to the railroad may prepare part, if not all, of the 
required documentation. Notwithstanding that fact, the railroad remains 
responsible for the completeness and accuracy of any documentation 
submitted. For instance, FRA may find that the PTCDP does not 
adequately conform to this subpart or otherwise has insufficient 
information to justify approval. FRA may also determine that there are 
issues raised by the PTCDP that would adversely affect the ability of 
FRA to eventually certify the system. If such a situation were to 
arise, the railroad would need to address the issues and resubmit the 
documentation for FRA approval.
    The third mechanism available to railroads is described in 
paragraph (d). This paragraph allows railroads the opportunity to file 
a Request for Expedited Certification (REC) in lieu of an approved 
PTCDP or a Type

[[Page 2640]]

Approval, and the subsequent PTCSP developed in accordance with Sec.  
236.1015 in order to receive PTC System Certification. A REC applies 
only to PTC systems that have already been in revenue service and meet 
the criteria of Sec.  236.1031(a). If a PTC system is not eligible for 
expedited certification, the railroad will be limited to the options 
presented in paragraphs (b) and (c).
    Paragraph (e) requires that each PTCIP, PTCDP, and PTCSP must 
comply with the content requirements in Sec. Sec.  236.1011, 236.1013, 
and 236.1015, respectively. If the submissions do not comply with their 
respective regulatory requirements, then they may not be approved. 
Without approval, a PTC system may not receive a Type Approval or PTC 
System Certification. Ultimately, PTC System Certification is FRA's 
formal recognition that the PTC system, as described and implemented, 
meets the statutory requirements and the provisions of subpart I. It 
does not imply FRA endorsement or approval of the PTC system itself.
    In the interest of an open market, FRA does not want to preclude 
the ability of PTC system suppliers outside of the United States from 
manufacturing PTC systems or selling them to the regulated railroads. 
However, in order to ensure the safety and reliability of those 
systems, FRA needs to be able to conduct an adequate review of the 
submitted plans. Accordingly, paragraph (e) requires that all materials 
submitted in accordance with this subpart be in the English language, 
or be translated into the English language and attested as true and 
correct.
    Under subpart H of this part, a railroad may seek confidential 
treatment for what it deems to be trade secrets, commercial, or 
financial information that is privileged or confidential under 
Exemption 4 of the Freedom of Information Act (FOIA), 5 U.S.C. 
552(b)(4), or the Trade Secrets Act, 18 U.S.C. 1905, and submit such 
requests in accordance with Sec.  209.11. A railroad may request 
similar confidential treatment under subpart I. As with subpart H, 
should a FOIA request be made for information submitted under this rule 
for which the submitting party has requested confidential treatment, 
the submitting company will be notified of the request in accordance 
with the submitter consultation provisions of the Department's FOIA 
regulations (Sec.  7.17) and will be afforded the opportunity to submit 
detailed written objections to the release of information as provided 
for in Sec.  7.17(a). FRA strongly encourages submitting parties to 
request confidential treatment only for those portions of documents 
that truly justify such treatment (i.e., trade secrets and security 
sensitive information).
    While FRA continues to believe that there is no need at this time 
to substantially revise Sec.  209.11, FRA will require an additional 
document to assist FRA in efficiently and correctly reviewing requests 
for confidentiality. Under Sec.  209.11, a redacted and an unredacted 
copy of the same document must be submitted. When FRA review is 
required to determine whether confidentiality should be afforded, FRA 
personnel must painstakingly compare side-by-side the two versions to 
determine what information has been redacted. This process may result 
in information for which exemption from disclosure is being requested 
to be misidentified. To reduce this burden, and ensure that the 
intellectual property of the railroad and their suppliers is 
appropriately guarded, FRA requires that any material submitted for 
confidential treatment under subpart I and Sec.  209.11 include a third 
version that would indicate, without fully obscuring, the redacted 
portions for which protection is requested. For instance, in order to 
indicate without obscuring the plan's redacted portions, the railroad 
may use the highlighting, underlining, or strikethrough functions of 
its word processing program. This document will also be treated as 
confidential under Sec.  209.11. FRA could amend Sec.  209.11 to 
include this requirement. However, FRA does not believe it to be 
necessary at this time.
    FRA is allowing the submission of an adequate GIS shapefile to 
fulfill some of the PTCIP content requirements under Sec.  236.1011. 
However, with respect to requesting confidential treatment of specific 
information contained in a GIS shapefile, which includes primarily map 
data, FRA recognizes that visually blocking out the information would 
defeat the purpose. For instance, a black dot over a particular map 
location, or a black line over a particular route, would actually 
reveal the location. Thus, FRA expects that a railroad seeking 
confidential treatment for portions of a GIS shapefile will submit 
three versions of the shapefile to comply with paragraph (e). 
Alternatively, a single shapefile can include three separate layers 
each representing the three levels of confidentiality, with specific 
instructions indicating which elements are being displayed and how to 
handle the file for confidentiality purposes. FRA also expects that the 
version for public consumption would not include the information for 
which the railroad is seeking confidential treatment.
    NICTD strongly urged FRA to only accept PTCIPs that provided full 
public disclosure of all the information needed to obtain components 
from multiple suppliers, including message interface standards, 
functional allocation for each subsystem, and safety allocation for 
each subsystem (e.g., identifying which hazards and safety-critical 
assumptions are made for each subsystem). NICTD asserted that it was 
not requesting proprietary information for any subsystems, but merely 
the ability to utilize alternative sources to fulfill the subsystem 
requirements within the overall PTC system. According to NICTD, this 
would substantially improve the likelihood of commuter railroads being 
able to obtain components from the multiple suppliers that are 
currently more than willing to develop components that will safely 
operate with other systems. Moreover, NICTD stated that this would 
facilitate compliance with interoperability requirements, as the 
knowledge gained would simplify development of interoperable systems 
and reduce procurement delays. Amtrak agrees on the need for full 
public disclosure and asserts that it should be able to review and 
comment on the PTCIPs of the Class I railroads. FRA understands these 
positions, but FRA will not make any flat pronouncements about the 
confidentiality of information it has not yet received.
    FRA expects that FRA-monitored laboratory or field testing or an 
independent third party assessment may be necessary to support 
conclusions made and included in a railroad's submitted PTCDP or PTCSP. 
This issue is addressed in paragraph (f). The procedural requirements 
to effectuate either of those requirements can be found in Sec. Sec.  
236.1035 and Sec.  236.1017, respectively.
    Paragraph (g) makes clear that FRA approval of a plan submitted 
under subpart I may be contingent upon any number of factors and that, 
once the plan is approved, FRA maintains the authority to modify or 
revoke the resulting Type Approval or PTC System Certification. Under 
paragraph (g)(1), FRA reserves the right to attach additional 
requirements as a condition for approval of a PTCIP, or issuance of a 
Type Approval or PTC System Certification. In the preparation of any of 
these plans, railroads may have inadvertently failed to fully address 
hazards and risks associated with all of these components.
    FRA believes that paragraph (g)(1) will make the regulatory process 
more efficient and stable. Rather than reject a railroad's plan 
completely, and

[[Page 2641]]

consequently delay the railroad's implementation of its PTC system, FRA 
would prefer to add additional conditions during the approval process 
to address these oversights. When determining whether to attach 
conditions to plan approval, FRA will consider whether: (1) The plan 
includes a well-defined and discrete technical or security issue that 
affects system safety; (2) the risk or safety significance of an issue 
can be adequately determined; (3) the issue affects public health and 
safety; (4) the issue is not already being processed under an existing 
program or process; and (5) the issue cannot be readily addressed 
through other regulatory programs and processes, existing regulations, 
policies, guidance, or voluntary industry initiatives.
    Paragraph (g)(2) provides FRA the right to reconsider an issued 
Type Approval or PTC System Certification as a consequence of the 
discovery of potential error, fraud or new information regarding system 
safety that was not previously identified. FRA issuance of each Type 
Approval or PTC System Certification under performance-based 
regulations assumes that the model of the train control system and its 
associated probabilistic data adequately accounts for the behavior of 
all design features of the system that could contribute to system risk. 
Different system design approaches may result in different levels of 
detail introducing different approximations or errors associated with 
the safety performance. There are some characteristics for which 
modeling methods may not fully capture the behavior of the system, or 
there may be elements of the system for which historical performance 
data may not be currently available. These potential inconsistencies in 
the failure analysis could introduce significant variations between the 
predicted and actual performances. Because of the design complexity 
associated with train control systems, FRA recognizes that these 
inconsistencies may not be the result of deliberate acts by any 
individuals or organizations, but simply reflect the level of 
analytical detail, the availability of comprehensive information, the 
qualification and experience of the analyst team, and the railroad's 
and FRA's resource limitations.
    In paragraph (g)(3), FRA indicates that the railroad may be allowed 
to continue operations using the system, although such continued 
operations may have special conditions attached to mitigate any adverse 
consequences. It is FRA's intent, to the maximum extent possible and 
when consistent with safety, to assist railroads in keeping the systems 
in operation. FRA expects that, if it places a condition on PTC system 
operations, each railroad will have a predefined process and procedure 
in place that would allow continued railroad operations, albeit under 
reduced capability, until appropriate mitigations are in place, and the 
system can be restored to full operation. In certain dire situations, 
FRA may actually order the suspension or discontinuation of operations 
until the root cause of the situation is understood and adequate 
mitigations are in place. FRA believes that suspending a Type Approval 
or a PTC System Certification pending a more detailed analysis of the 
situation may be appropriate, and that any such suspension must be done 
without prejudice. FRA expects to take such an action only in the most 
extreme circumstances and after consultation with the affected parties.
    After reconsidering its issuance of a Type Approval or PTC System 
Certification, under paragraph (g)(4), FRA may either dismiss its 
reconsideration and continue to recognize the existing FRA approved 
Type Approval or PTC System Certification, allow continued operations 
with certain conditions attached, or order the railroad to cease 
applicable operations by revoking its Type Approval or PTC System 
Certification. If FRA dismisses its reconsideration and continues to 
recognize the Type Approval, any conditions required during the 
reconsideration period would no longer be applicable. If FRA will allow 
continued operations, FRA may order the continuation of conditions that 
were required during the reconsideration period or impose additional 
conditions. FRA expects that revocation of a Type Approval or PTC 
System Certification would occur in very narrow circumstances, where 
the risks to safety appear insurmountable. Regrettably, there may be a 
few situations in which the inconsistencies are the result of 
deliberate fraudulent representations. In such situations, FRA may also 
seek criminal or civil penalties against the entities involved.
    APTA submitted comments asserting that the NPRM offered minimal 
guidance on what criteria FRA will use in accepting or rejecting a 
railroad's plan. Therefore, APTA asserted that FRA should draft and vet 
criteria that accomplishes the basic purposes of PTC, while allowing 
for innovation in meeting the performance requirements envisioned in 
the proposed regulation. FRA believes that this concern arises from the 
fact that this regulation, like subpart H of this part, is a 
performance-based rule. While performance-based rules provide maximum 
flexibility to railroads and vendors or suppliers, they also introduce 
a degree of ambiguity.
    FRA, in consultation with the RSAC PTC Working Group, has developed 
and vetted model templates for both the PTCIP and the risk 
prioritization scheme to provide some degree of specificity without 
unnecessary constraints. It should be carefully noted that these 
templates are, by necessity, general in nature and must be customized 
by the individual railroad to reflect its individual operations. What 
may be applicable for one railroad may not be applicable to another. 
FRA has also provided vetted guidance as to acceptable design, 
verification and validation, and human factors in the appendices to 
this part. Again, given the wide variety of potential solutions that 
may be adopted by various railroads, FRA is reluctant to provide more 
detailed guidance. However, if a PTCIP content requirement under Sec.  
236.1011 is fulfilled in a submitted GIS shapefile, then the written 
PTCIP should simply cross-reference appropriately.
    Paragraph (h) relates to FRA's authority to conduct inspections to 
ensure that a railroad is in compliance with subpart I. FRA inspections 
may be required to determine whether a particular railroad has 
implemented a PTC system where necessary. For instance, FRA may need to 
confirm whether a track segment is subject to five million gross tons 
or more of annual railroad traffic, PIH materials, or passenger 
traffic. FRA may also need to inspect locomotives to determine whether 
they are equipped with a PTC onboard apparatus or to review locomotive 
logs to determine whether the locomotive has entered PTC territory. 
Paragraph (h) simply reiterates FRA's statutory authority to inspect 
the railroads and gather information necessary to enforce its 
regulations.
    In order to maintain an open marketplace, this final rule has been 
drafted to allow domestic railroads to purchase PTC systems from 
outside of the United States. FRA recognizes that PTC systems have been 
used in revenue service across the globe and that acceptable products 
may be available in other countries. FRA also recognizes that such use 
may fall under the jurisdiction of a foreign regulatory entity much 
like FRA. Accordingly, under paragraph (i), in the event information 
relating to a particular PTC system has been certified under the 
auspices of a regulatory entity in a foreign government, FRA is willing 
to consider that information as independently Verified and Validated to 
support the

[[Page 2642]]

railroad's PTCSP development. The phrase ``under the auspices'' intends 
to reflect the possibility of certification contractually performed by 
a private entity on behalf of a foreign government agency. However, the 
foreign regulatory entity must be recognized by the Associate 
Administrator. A railroad seeking to enjoy the benefits of paragraph 
(i) must communicate that interest in its PTCSP, and is strongly 
encouraged to communicate such a desire well before submission of the 
PTCSP for approval.
    Finally, the AAR noted that, unlike the precedent set by subpart H 
and the RSIA08, FRA did not include time frames for the agency to 
respond to the submissions of the PTCDP or PTCSP. The AAR urged FRA to 
include specific deadlines for these filings to ensure a common 
understanding of the time allotted to carry out the regulatory 
responsibilities. Accordingly, AAR proposed that FRA agree to respond 
within 60 and 120 days of the submission of a PTCDP and PTCSP, 
respectively. This 180-day approval period for both the development and 
safety plans is consistent with existing subpart H, which allows 180 
days for approval of a product safety plan.
    FRA agrees that the railroads need, for their planning purposes, an 
estimated amount of time within which FRA will provide a response 
regarding the acceptability of their PTCSP submission. FRA also 
believes that this information would be appropriately placed in Sec.  
236.1009. Accordingly, FRA is adding paragraph (j) to this section, 
which contains target deadlines for FRA review. FRA will acknowledge 
receipt of a PTCDP or PTCSP submission within 30 days. Depending upon 
the complexity of the system and the amount of participation by FRA in 
the PTCDP or PTCSP development process, FRA will endeavor to approve, 
approve with conditions, or deny approval of the PTCDP and PTCSP within 
60 and 180 days, respectively. If FRA is unable to complete its review 
of the PTCDP or PTCSP within these estimated time periods, FRA will 
advise the submitter accordingly.
    When reviewing the procedural requirements contained in the 
proposed rule, the RLO expressed concern that this streamlined process 
may result in degradation of safety and significant concern with the 
ability of FRA to adequately staff the oversight process with a 
sufficient number of people with the requisite skill sets. FRA 
appreciates these concerns, and is undertaking plans to ensure that 
this new process does not result in any degradation of safety. FRA will 
continue to apply the same technical standards as used in earlier PTC 
system approvals. FRA has also taken steps to ensure that it has 
sufficient people, with the appropriate skills, to ensure proper safety 
oversight of this new process. A task analysis to determine the desired 
skills, as well as appropriate placement within the agency of 
additional staff members has been completed The RSIA08 authorizes an 
additional 200 full time positions to FRA, and FRA is ready to recruit 
the necessary technical staff as appropriations permit.
Section 236.1011 PTC Implementation Plan Content Requirements
    This section describes the minimum required contents of a PTC 
Implementation Plan. A PTCIP is a railroad's plan for complying with 
the installation of mandatory PTC systems required by RSIA08. The PTCIP 
consists of implementation schedules, narratives, rules, technical 
documentation, and relevant excerpts of agreements that an individual 
railroad will use to complete mandatory PTC implementation. FRA will 
measure the railroad's progress in meeting the required implementation 
date based on the schedule and other information in the PTCIP. While 
the final rule does not specify or mandate any specific organization 
for the PTCIP, it must at least clearly indicate which portions intend 
to address compliance with the various plan requirements under this 
section. The PTCIP must also clearly identify each referenced document 
and either include a copy of each document (or its applicable excerpt) 
or indicate where FRA and the public may view that document. Should FRA 
not be able to readily determine adequate response to the required 
information, FRA will assume that the information has not been 
submitted, and will handle the document accordingly. The lack of the 
required information may result in FRA's disapproval of a PTCIP. To 
facilitate timely and successful submittals, FRA, through assistance 
from a PTCIP Task Force drawn from the PTC Working Group, developed a 
template that can be used to format the documents that must be 
submitted. FRA, however, wishes to emphasize that the use of such a 
template is strictly voluntary, and encourages railroads to prepare and 
submit the documents in the structure most economical for the railroad. 
FRA does not believe it is necessary to require that the railroads 
expend their limited resources in reformatting documents when such an 
activity adds no real value. However, while the template may be a 
useful tool, in light of the various forms a PTCIP may be required to 
take and the type of system the railroad intends to implement, complete 
adherence to the template will not guarantee FRA approval of the 
submitted PTCIP.
    FRA expects each PTCIP to include various highly specific and 
descriptive elements relating to each railroad's infrastructure and 
operations. FRA recognizes manual assembly of each piece of data into a 
PTCIP may be exceptionally onerous and time consuming and may make the 
PTCIP prone to errors. In light of the foregoing, and due to the 
statutory requirement that Congress be apprised on the progress of the 
railroad carriers in implementing their PTC systems, FRA believes that 
electronic submission of much of this information may be warranted and 
preferred. To facilitate collection of this data, FRA will accept the 
submission of this data in electronic format.
    FRA believes that the preferred, least costly, and least error-
prone method to comply with this section is for railroads to submit an 
electronic geographic digital system map containing the aforementioned 
segment attribute information in shapefile format, which is a data 
format structure compatible with most Geographic Information System 
(GIS) software packages. Using GIS provides an efficient means for 
organizing basic transportation-related geographic data to facilitate 
the input, analysis, and display of transport networks. Railways around 
the world rely on GIS to manage key information for rail operations, 
maintenance, asset management, and decision support systems. FRA 
believes that the railroads may have already identified track segments, 
and their physical and operational characteristics, in shapefile 
format. Accordingly, each shapefile document must provide the following 
identifiable information for each track segment: Owning railroad(s); 
distance; signal system; track class; subdivision; number and location 
of sidings; maximum allowable speed; number and location of mainline 
tracks; annual volume of gross tonnage; annual number of cars carrying 
hazmat; annual number of cars carrying PIH; passenger traffic volume; 
average daily through trains; WIUs; switches; and at-grade rail-to-rail 
crossings.
    Paragraph (a) cites the minimum requirements that must be addressed 
in the PTCIP. However, given the wide diversity of railroads and their 
operating environments, FRA recognizes that additional factors may 
arise that reflect the unique operational characteristics of a 
particular railroad. It is beholden to each railroad to carefully 
analyze the

[[Page 2643]]

circumstances associated with its operations and address any of these 
elements that may affect implementation planning. During its review of 
a PTCIP, FRA will carefully evaluate the plan to determine if the 
submitting railroad(s) have indeed addressed unique railroad issues. 
FRA wishes to make clear that in those situations, where additional 
factors that are unique to a railroad have not been addressed, FRA will 
return the PTCIP unapproved.
    Paragraph (a)(1) requires that the railroad describe the functional 
requirements that the technology will employ in its PTC system. Here, 
FRA broadly defines the term ``technology'' to include all applicable 
tools, machines, methods, and techniques.
    Paragraph (a)(2) requires that the railroad describe how it will 
address fulfilling the requirements associated with the submittal of an 
NPI (see 49 CFR 236.1009(c)) temporarily in lieu of a PTCDP and the 
requirements associated with a PTCSP (see 49 CFR 236.1009(d)).
    In RSIA08, Sec.  20157(a)(2) requires that a railroad describe how 
it will ``provide for interoperability of the system with movements of 
trains of other railroad carriers over its lines.''
    Practically speaking, this means that each locomotive operating 
within PTC territory must be able to communicate with, and respond to, 
the PTC systems installed on each PTC territory's track and signal 
system, except in those limited situations established elsewhere in 
this final rule. For this reason, paragraph (a)(3) requires that the 
PTCIP describe how the PTC system will provide for interoperability of 
the system between the host and all tenant railroads on the lines 
required to be equipped with PTC systems under this subpart.
    Interoperability means the ability of diverse systems and 
organizations to work together (inter-operate), taking into account the 
technical, operational, and organizational factors that may impact 
system-to-system performance. FRA expects each PTC system required by 
subpart I to exhibit syntactic interoperability--so that it may 
successfully communicate and exchange data with other PTC systems--and 
semantic interoperability--so that it may automatically, accurately, 
and meaningfully interpret the exchanged information to prove useful to 
the end user of each communicating PTC system. To achieve semantic 
interoperability, both sides must defer to a common information 
exchange reference model. In other words, the content of the 
information sent must be the same as what is received and understood. 
Taking syntactic and semantic interoperability together, FRA expects 
each PTC system to provide services to, and accept services from, other 
PTC systems and to use those services exchanged to enable the PTC 
systems to operate effectively together and to provide the intended 
results. The degree of interoperability should be defined in the PTCIP 
when referring to specific cases.
    Interoperability is achieved through four interrelated means: 
Product testing, industry and community partnership, common technology 
and intellectual property, and standard implementation.
    Product testing includes conformance testing and product 
comparison. Conformance testing ensures that the product complies with 
an appropriate standard. FRA recognizes that certain standards attempt 
to create a framework that would result in the development of the same 
end product. However, many standards apply only to core elements and 
allow developers to enhance or otherwise modify products as long as 
they adhere to those core elements. Thus, if an end product is 
developed in different ways to conform to the same standard, there may 
still be discrepancies between each instantiation of the end product 
due to the existence of variables outside of the core elements. 
Accordingly, FRA believes that comparison testing must also occur to 
ensure that each instantiation of the same product, regardless of the 
means upon which it is created to meet the same standard, is ultimately 
identical. In regards to PTC systems, such comparison testing must 
occur on all portions that relate to each system's interoperability 
with other systems. Thus, it is also important that the PTC system be 
formally tested in a production scenario--as they will be finally 
implemented--to ensure that it will actually intercommunicate and 
interoperate with other PTC systems as advertised and intended.
    To reach interoperability between the various applicable PTC 
systems, each PTCDP must also show that the systems share common 
product engineering. Product engineering refers to the common standard, 
or a sub-profile thereof, as defined by the industry and community 
partnerships, specifically intended to achieve interoperability. 
Without common product engineering, the systems will be unable to 
intercommunicate or otherwise interact as necessary to comply with the 
proposed rule.
    FRA expects that each interoperability standard for PTC systems 
will be developed by a partnership between various industry 
participants. Industry and community partnerships, either domestic or 
international, usually sponsor standard workgroups to define a common 
standard to provide system intercommunications for a specific purpose. 
At times, an industry or community will sub-profile an existing 
standard produced by another organization to reduce options and thus 
making interoperability more achievable. Thus, in each PTCDP, the 
railroad must discuss how it developed or adopted a standard commonly 
accepted by that partnership.
    In the proposed rule, FRA noted that means of achieving 
interoperability include having the various entities involved using the 
same PTC system product or obtaining its components from the same 
developer. In its comments, NICTD expressed its belief that this 
conclusion does not meet RSIA08's interoperability requirements. 
According to NICTD, while the freight railroads are free to choose 
their own supplier, their essential monopoly power has the potential to 
force commuter railroads to use the same supplier and thereby prevent 
commuter railroads from meeting the requirement to use open competitive 
bids from multiple suppliers for a system. Since the quantity of units 
required from the commuter railroads is substantially less than those 
required for the freight railroads, NICTD asserts this greatly reduces 
the ability of the commuter railroads to obtain system components that 
meet their specific operating needs, as the single supplier will not 
have the resources available to support those needs. NICTD also 
believes that this is in direct contrast with the FRA statement 
relating to performance standards: ``FRA intends the proposed rule to 
accelerate the promotion of, and not hinder, cost effective 
technological innovation by encouraging an efficient utilization of 
resources, an increased level of competition, and more innovative user 
applications and technological developments.''
    Safetran also believes that each railroad should be free to choose 
a supplier. According to Safetran, the freight railroads through their 
implementation and development plans could specify a specific product 
or supplier preventing other railroads from using open competitive bids 
from multiple suppliers for a system and achieving the cost savings of 
competitive bidding. Safetran urges FRA to accept PTCIPs and PTCDPs 
that require public disclosure of all information needed to enable 
development of PTC components from multiple suppliers. This does not 
require disclosure of proprietary

[[Page 2644]]

information, but does require disclosure of interface specifications as 
well as required functional attributes, assigned safety attributes and 
stimulus/response attributes.
    While FRA does not necessarily require this approach--since the 
agency seeks to maintain an open and competitive marketplace--FRA 
believes that this is a suitable means to achieve interoperability. 
This technique may provide similar technical results when using PTC 
system products from different vendors or suppliers relying on the same 
intellectual property. FRA recognizes that certain developers with an 
intellectual property interest in a particular technology may provide a 
non-exclusive license of its intellectual property to another entity so 
that the licensee may introduce into the marketplace a substantially 
similar product reliant on that intellectual property. In such a case, 
FRA foresees that the use of a common PTC system technology--even if it 
is proprietary to a single or multiple entities and licensed to 
railroads--could reduce the variability between components, thus 
providing for a more efficient means to achieve interoperability.
    In order for interoperability to actually occur between multiple 
entities' PTC systems, there must be some standard to which they all 
adhere. Thus, FRA also expects that each PTCDP will provide assurances 
of a common interoperability standard agreed to between all entities 
using PTC systems that must interoperate.
    Since each of these interrelated means has an important role in 
reducing variability in intercommunication, each railroad's PTCIP must 
clearly describe the elements required under paragraph (a)(1)-(3).
    During review of the NPRM, AAR noted paragraph (a)(3)(i) had not 
been updated to reflect an RSAC agreement. FRA agrees and has revised 
paragraph (a)(3)(i) to include the language: ``include relevant 
provisions of agreements, executed by all applicable railroads, in 
place to achieve interoperability.''
    Much of the remaining information required in a PTCIP under this 
final rule relies on the location, length, and characteristics of each 
track segment. Therefore, a common understanding of a track segment is 
necessary. A track is the main designation for describing a physical 
linear portion of the network. Each line of railroad has a station 
location referencing system, which serves to locate inventory features 
and defects along the length of the track. Because some tracks can be 
very long, track or line segments are established to divide the track 
into smaller ``management units.'' Typically, segment's boundaries are 
established at point of switch (POS) locations, but may also be located 
at mile markers, grade crossings, or other readily identifiable 
locations. Inspection, condition assessment, and maintenance planning 
is performed individually on each segment. After the track network 
hierarchy is established, the attribute information associated with 
each track is defined. This attribute information describes the track 
layout (e.g., curves and grades), the track structure (e.g., rail 
weights and tie specifications), track clearance issues, and other 
track related items such as turnouts, rail-to-rail at-grade crossings, 
highway-rail grade crossings, drainage culverts, and bridges. Inventory 
information about these track attributes can be quite detailed. The 
benefits of a complete and accurate track inventory provides a record 
of the track network's properties and information about the existing 
track materials at the specific locations when maintenance or repair is 
necessary.
    Paragraphs (a)(4) and (a)(5) require the railroad to put its entire 
implementation plan into an understandable context, primarily as it 
relates to the sequence and schedule of track segment implementation 
events. Under RSIA08, 49 U.S.C. 20157(a)(2), Congress requires each 
subject railroad to describe in its PTCIP how it shall, to the extent 
practical, implement the PTC system in a manner that addresses areas of 
greater risk before areas of lesser risk. Accordingly, under paragraph 
(a)(4), the PTCIP must discuss the railroad's areas of risk and the 
criteria by which these risks were evaluated and prioritized for PTC 
system implementation. To this end, the railroad must clearly identify 
all track segments that must be equipped, the basis for that decision 
for each segment (which might be done by categories of segments), and, 
as provided in paragraph (a)(5), the dates that implementation of each 
segment will be completed, taking into account the time necessary to 
fulfill the procedural requirements related to PTCSP submission, 
review, and approval. At a minimum, the deployment decisions must be 
based on segment traffic characteristics such as passenger and freight 
traffic volumes, the quantity of PIH and other hazardous materials, 
current methods of operations, existence of block signals and other 
traditional train control technologies, the number and class of tracks, 
authorized and allowable speeds for each segment, and other unusual 
characteristics that may adversely impact safety, such as unusual 
ruling grades and other track geometries. In cases where deployment of 
the PTC system cannot be accomplished in order of areas with the 
greatest risk to areas with the least risk, paragraph (a)(9) requires 
that the railroad explain why such a deployment was not practical and 
the steps that will be taken to minimize adverse consequences to the 
public until the track segment can be equipped.
    Paragraphs (a)(6) and (a)(7) require the PTCIP to include 
information regarding the rolling stock and wayside devices that will 
be equipped with the appropriate PTC technology. For a PTC system to 
work as intended, PTC system components must be installed and operated 
in all applicable offices and on all applicable onboard and wayside 
subsystems. Accordingly, the PTCIP must identify which technologies 
will be installed on each subsystem and when they are scheduled to be 
installed.
    Under paragraph (a)(6), each host railroad filing the PTCIP must 
include a comprehensive list of all rolling stock upon which a PTC 
onboard apparatus must be operative. FRA understands that, in most 
situations, the rolling stock referenced in paragraph (a)(6) may only 
apply to controlling locomotives. However, in the interest of not 
hindering creative technological innovations, FRA presumes the 
possibility that PTC system technology may also be attached to 
additional rolling stock to provide other functions, including 
determining train capacity and length or providing certain acceptable 
and novel train controls. To be kept apprised of these possibilities, 
FRA is requiring in paragraph (a)(6) that each PTCIP include a list of 
all rolling stock equipped with PTC technology. FRA believes that the 
PTCIP should also identify any risks associated with trains operated by 
tenant railroads and not equipped with PTC system technology and the 
efforts that the host railroad has made to establish the extent of that 
risk. FRA understands that a host railroad may not receive cooperation 
from a tenant railroad in collecting the necessary rolling stock 
information. Nevertheless, FRA expects each host railroad to make a 
good faith effort. Identification of those tenant railroads from whom 
the host railroad attempted to obtain the requisite and applicable 
information from, but failed to address a host railroad's written 
request, may establish a good faith effort by the host railroad.
    One railroad has requested that FRA eliminate the requirement for a 
power (locomotive) equipage plan in the PTCIP to avoid the need for 
updates to the

[[Page 2645]]

PTCIP. Instead of requiring such a plan, the railroad recommends that 
FRA rely on railroad scheduling and good faith effort to drive 
installations during the period 2012 through 2015. FRA carefully 
considered this proposal, but has rejected it. Without an understanding 
of what portion of the locomotive fleet has been equipped and what 
portion remains to be equipped, FRA cannot accurately assess the extent 
to which PTC could be used in revenue service. FRA is required to make 
regular reports to Congress on the status of industry compliance and 
the operational capability of existing PTC systems. Since PTC is an 
integrated system, which requires both wayside and onboard equipment to 
be installed and operational, evaluation of the state of system 
deployment requires knowledge of the state of both subsystems.
    Furthermore, the elimination of the equipage plan does not appear 
to provide any significant advantages to the railroad. Regardless of 
whether the railroad is required to maintain an equipage schedule for 
the PTCIP, or rely on railroad scheduling and good faith efforts, the 
railroad will still need to maintain some type of schedule to ensure 
the completion of required PTC installations by 2015. FRA believes that 
formalizing the schedule provides a planning tool that should 
facilitate completion of the installation process. If the equipage plan 
were unalterable, FRA could understand the railroad's concerns about 
being locked into an unrealistic and unobtainable schedule. However, 
FRA believes these concerns are unfounded because any plan in the 
PTCIP, including the equipage plan, can be adjusted to reflect changing 
circumstances.
    Paragraph (a)(7) requires the railroad to provide the number of 
wayside devices required for each track segment in its PTCIP and an 
installation schedule for the completion of wayside equipment 
installation by December 31, 2015. The selection and identification of 
a technology discussed in the PTCIP will also, to a great extent, 
determine the distribution of the functional behaviors of each of the 
PTC subsystems (e.g., office, wayside, communications, and back 
office). The WIU is a type of remote terminal unit (RTU) that is part 
of a larger PTC system, which is a type of SCADA. As a whole, the safe 
and efficient operation of a SCADA--a centralized system that covers 
large areas, monitors and control systems, and passes status 
information from, and operational commands to, RTUs--is largely 
dependent on the ability of each of its RTUs to accurately receive and 
distribute the required information. As such, a PTC system cannot 
properly operate without properly functioning WIUs to provide and 
receive status information and react appropriately to control 
information.
    It is commonly understood that a WIU device is capable of 
communicating directly to the office, train, or other wayside unit. FRA 
recognizes that there may not be the same number of WIUs and devices 
that they monitor. Depending on the architecture and technology used, a 
single WIU may communicate the necessary information as it relates to 
multiple devices. FRA is comfortable with this type of consolidation 
provided that, in the event of a failure of any one of the devices 
being monitored, the most restrictive condition will be transmitted to 
the train or office, except where the system may uniquely identify the 
failed device in a manner that will provide safe movement of the train 
when it reaches the subject location.
    Because of the critical role that WIU's play in the proper and safe 
operation of PTC systems, paragraph (a)(7) requires that the railroad 
identify the number of WIU's required to be installed on any given 
track segment and the schedule for installing the WIU's associated with 
that segment. This information is necessary to fully and meaningfully 
fulfill the RSIA08 requirement that by December 31, 2012, Congress 
shall receive a report on the progress of the railroad carriers in 
implementing PTC systems. See 49 U.S.C. 20157(d). To comply with this 
statutory requirement, each railroad must determine the number of WIUs 
it will need to procure and the location--as defined by the applicable 
subdivision--where each WIU will be installed. FRA believes that, if a 
railroad does not perform these traditional engineering tasks, it will 
risk exceeding the statutory implementation deadline of December 31, 
2015. FRA considers this information an integral part of the PTCIP that 
must be submitted to FRA for approval.
    NYSMTA asserts that the requirement in paragraph (a)(7) to include 
the quantities of devices for each track segment in the PTCIP requires 
prior completion of the full design of the PTC system. However, NYSMTA 
asserts that it is not feasible to complete all of the survey and 
design necessary to meet this requirement by April 2010. Therefore, 
NYSMTA suggested that the requirement be reworded to read as follows: 
``Identification of each PTC subsystem and major assembly, and an 
estimated number of each required for each line segment.''
    FRA recognizes the potential for technological improvements that 
may modify the number and types of WIUs required. FRA also recognizes 
that during testing and installation, it may be discovered that 
additional WIU installations may be necessary. In either case, the 
railroad will be required to submit an RFA in accordance with Sec.  
236.1021 indicating how the railroad intends to appropriately revise 
its schedule to reflect the resulting necessary changes. Nevertheless, 
regardless of whether FRA approves or disapproves the RFA, if a 
railroad is required to submit its PTCIP by April 16, 2010, 
implementation must still be completed by the statutory deadline of 
December 31, 2015.
    One railroad recommended that paragraph (a)(7) should be revised to 
require railroads to identify each PTC subsystem and assembly and the 
estimated number of each subsystem required for each track segment. 
However, FRA does not believe that this change is required. First, FRA 
believes that the discussion of WIU requirements in paragraph (a)(7) is 
already generalized and implementation independent. Second, this final 
rule already provides for corrections in inventory count by submission 
of an RFA with the revised count. Therefore, FRA has not adopted this 
recommendation.
    Under paragraph (a)(8), each railroad must also identify in its 
PTCIP which of its track segments are either main line or not main 
line. This list must be made based solely on the statutory and 
regulatory definitions regardless of whether FRA may later deem a track 
segment as other than main line. If a railroad has a main line that it 
believes should be considered not main line, it may file with the PTCIP 
a main line track exception addendum (MTEA) in accordance with Sec.  
236.1019, as further discussed below. Each track segment included in 
the MTEA should be indicated on the list required under paragraph 
(a)(8), so that the PTCIP accounts for each track segment with an 
appropriate cross-reference to the subject MTEA.
    Paragraph (a)(9) requires that the plan call out the basis for a 
railroad's determination that risk-based prioritization required by 
paragraph (a)(4) of this section is not practical. FRA recognizes that 
there may be situations where risk is somewhat evenly distributed and 
where other factors related to practical considerations--such as the 
need to establish reliable operation of the system in less complex 
environments before installation in more complex

[[Page 2646]]

environments--may be the prudent course. However, the burden of 
establishing the reasonableness of this approach would be on the 
railroad, starting with a showing that risk does not vary substantially 
among the track segments in question.
    As mentioned elsewhere in this document, various railroads 
incorrectly asserted that they would not have to ``turn on'' their 
respective PTC systems until December 31, 2015. FRA recognizes that, 
although an approved PTCIP will include a progressive roll-out 
schedule, a PTC system cannot be operated in revenue service until it 
receives PTC System Certification. To avoid the possibility of a 
delayed plan submission that would frustrate the schedule, FRA has 
added paragraph (a)(10), which requires the railroad(s) to set its own 
due dates for such submissions. The ultimate due date, of course, is 
subject to FRA's approval of the PTCIP.
    Paragraph (b) of Sec.  236.1011 contains provisions related to 
further PTC deployment by the Class I railroads. As noted in the NPRM, 
the specific characteristics of the PTC route structure, with the focus 
on PIH traffic as an indicator of risk, was a late addition to the bill 
that would become RSIA08, not having appeared in either the House or 
Senate bills until the final package was assembled using consultations 
between the committee staffs in lieu of a formal committee of 
conference. Although the statutory construct (Class I rail line with 5 
million gross tons and some PIH materials) adequately defines most of 
the core of the national freight rail system, it is a construct that 
will introduce distortions at both ends of the spectrum of risk.
    On one hand, a line with a maximum speed limit of 25 miles per hour 
ending at a grain elevator that receives a few cars of anhydrous 
ammonia per year is a ``main line'' if it has at least 5 million gross 
tons of traffic (a very low threshold for a Class I railroad). This is 
not a line without risk, particularly if it lacks wayside signals, but 
FRA analysis shows that the potential for a catastrophic release from a 
pressure tank car is very low at an operating speed of 25 miles per 
hour, and the low tonnage is likely associated with relatively 
infrequent train movements--limiting the chance of a collision.
    On the other end of the spectrum, lines with greater risk may go 
unaddressed. For instance, a line carrying perhaps a much higher level 
of train traffic and significant volumes of other hazardous materials 
at higher speeds, without any PIH or passenger traffic, would not be 
equipped. This example is not likely to be present to any significant 
extent under current conditions. However, should the Class I railroads 
raise freight rates making rail transportation prohibitively expensive 
and accordingly eliminating PIH traffic, the issue would be presented 
as a substantial one. Most of the transportation risk--including 
hazards to train crews and roadway workers and exposure to other 
hazardous materials if released--would remain, but not the few carloads 
of PIH. FRA believes that the intent of Congress with respect to 
deployment of PTC might be defeated, even though the minimum 
requirements related to passenger and PIH traffic would be satisfied. 
Other lines carrying very heavy volumes of bulk commodities such as 
coal and intermodal traffic may or may not include PIH traffic. Putting 
aside the risk associated with PIH materials, significant risk exists 
to train crews and persons in the immediate vicinity of the right-of-
way if a collision or other PTC-preventable accident occurs. Any place 
on the national rail system is a potential roadway work zone, but 
special challenges are presented in providing for on-track safety where 
train movements are very frequent or operations are conducted on 
adjacent tracks.
    Risk on the larger Class II and III railroads' lines is also a 
matter of concern, and the presence of significant numbers of Class I 
railroad trains on some of those properties presents the opportunity 
for further risk reduction, since over the coming years virtually all 
Class I railroad locomotives will be equipped with PTC onboard 
apparatus'. Examples include trackage and haulage rights retained over 
Class II and III railroads following asset sales in which the Class I 
railroads divested the subject lines. Other prominent examples involve 
switching and terminal railroads, the largest of which are owned and 
controlled by two or more Class I railroads and function, in effect, as 
extensions of their systems. Conrail Shared Assets, a large regional 
switching railroad that is owned by NS and CSXT and is comprised of 
major segments of the former Conrail, then a Class I railroad, is 
perhaps the classic example.
    FRA notes that there has also been a trend, only recently and 
temporarily abated by the downturn in the economy, toward higher train 
counts on some non-signaled lines of the Class I railroads. On a train-
mile basis, these operations present about twice the risk as similar 
operations on signalized lines. These safety gaps need to be filled; 
and, while most will be filled due to the presence of PIH traffic, FRA 
cannot verify that this is the case in every instance.
    FRA concludes that the mandated deployment of PTC will leave some 
substantial gaps in the Class I route structure, including gaps in some 
major urban areas. FRA believes that these gaps will, over time, be 
``filled in'' by voluntary actions of the Class I railroads as they 
establish the reliability of their PTC systems, verify effective 
interoperability, and begin to enjoy the safety and other business 
benefits from use of these systems. FRA fully understands both the 
desire of the labor stakeholders in the PTC Working Group to see a 
broader build-out of PTC systems than that ``minimally'' required by 
RSIA08 and the concerns of the Class I railroads' representatives who 
noted the extreme challenge associated with equipping tends of 
thousands of wayside units, some 20,000 locomotives, and their 
dispatching centers' back offices within the statutory implementation 
period.
    The Congress recognized that all of these issues are legitimate 
concerns and so mandated the establishment of Risk Reduction Programs 
under the same legislation. Section 103 of RSIA08 specifically 
requires, within the Risk Reduction Program, a Technology 
Implementation Plan to address technology alternatives, including PTC. 
Accordingly, the PTC and Risk Reduction provisions in RSIA08 are 
clearly aligned in purpose; and there are also references in the 
technology plan elements of the Risk Reduction language that address 
installation of PTC by other railroads. Further, FRA has been charged 
with a separate rulemaking under section 406 of RSIA08 regarding risk 
in non-signaled (dark) territory that significantly overlaps the issue 
set in this rulemaking and the Risk Reduction section. Use of 
technologies that are integral to PTC systems constitute the best 
response to hazards associated with non-signaled lines. Switch position 
monitoring systems, track integrity circuits, digital data links and 
other technology used to address dark territory issues should be and, 
as presently conceived, are forward-compatible with PTC. In paragraph 
(b), FRA intends to dovetail these requirements by requiring that each 
Class I railroad include in its PTCIP deployment strategies indicating 
how it will approach the further build-out of full PTC, or partial 
implementation of PTC (e.g., using PTC technology to prevent train-to-
train collisions but perhaps not monitoring all switches in the 
territory; or using PTC to protect movements of the Class I over a

[[Page 2647]]

switching or terminal railroad without initially requiring all 
controlling locomotives of the switching or terminal railroad to be 
equipped). These railroads would then be required to include in the 
technology elements of their initial Risk Reduction plans a 
specification of which lines will be equipped and with what PTC system 
elements. Paragraph (b) makes clear that there would be no expectation 
regarding additional lines being equipped until those mandated by 
subpart I have been addressed. FRA shares the view of the Class I 
railroads and the passenger railroads that the December 31, 2015, 
deadline already presents a substantial challenge for railroads, 
suppliers, and the employees affected.
    One railroad objected to the requirement to describe the strategy 
and plan for complete build out and characterized it as premature, 
unwarranted, and inconsistent with the RSIA08. FRA strongly disagrees 
for the reasons previously set forth and has retained the requirement 
specified in paragraph (b).
    Paragraph (c) codifies in regulation the statutory mandate that FRA 
review the PTCIP and determine, within 90 days upon receipt of the 
plan, whether to provide its approval or disapproval. FRA believes that 
it is also important to provide procedural rules to communicate 
approval or disapproval. Thus, under paragraph (c), any approval or 
disapproval of a PTCIP by FRA will be communicated by written notice. 
In the event that FRA disapproves of the PTCIP, the notice will also 
include a narrative explaining the reasons for disapproval. Once the 
railroad receives notification that its PTCIP has been disapproved by 
FRA, it will have 30 days to resubmit its PTCIP for review and 
approval. While FRA may provide assistance to remedy a faulty PTCIP, it 
is ultimately the railroad's responsibility and burden to develop and 
submit a PTCIP worthy of FRA approval. FRA understands the railroads' 
desire to extend the period of time for corrections of any issues in 
the PTCIP, especially in circumstances that the railroad believes are 
out of its control. However, the 30-day period is a statutory 
requirement. FRA has little leeway in this regard. FRA will try to 
work, within the limits of available FRA resources, with railroads in 
reviewing draft versions of the PTCIP before April 16, 2010. Early 
identification of potential issues should reduce, and possibly 
eliminate, rework that a railroad might need to address during the 30-
day correction period. However, regardless of any early FRA 
participation in the document review cycle, the railroad is expected to 
submit a plan that requires little to no rework.
    A number of comments were submitted objecting to the potential 
assessment of civil penalties based on a railroad's failure to timely 
file a PTCIP. While FRA is unwilling to revise its position on this 
issue, FRA will exercise prosecutorial discretion in the assessment of 
civil penalties.
    APTA submitted comments suggesting that the language in paragraph 
(c) of this section be amended to allow at least 90 days--the time 
allotted for FRA plan review--for railroads to correct deficiencies and 
re-submit their plans. In a similar vein, NYSMTA submitted comments 
asserting that the amount of time allotted to correct deficiencies 
should be based on to the extent of the needed correction. On the other 
hand, NYSMTA proposed that penalties could be involved if railroads 
submit plans deemed to be superfluous. Again, the law requires that 
both the railroads and FRA work quickly to get plans in place. As the 
entity at the receiving end of multiple filings, FRA will no doubt have 
every reason to handle these matters with a spirit of cooperation where 
best efforts have been made to fulfill the statutory requirements.
    As noted previously, subpart I applies to each railroad that has 
been mandated by Congress and FRA to install a PTC system. A railroad 
that is not required to install a PTC system may still do so under its 
own volition. In such a case, it may either seek approval of its system 
under either subpart H or I. Paragraph (d) intends to make this choice 
clear.
    Paragraph (e) responds to comments by labor organizations in the 
PTC Working Group. These employee representatives sought the 
opportunity to comment on major PTC filings. Paragraph (e) provides 
that, upon receipt of a PTCIP, NPI, PTCDP, or PTCSP, FRA will post on 
its public Web site notice of receipt and reference to the public 
docket in which a copy of the filing has been placed. FRA may consider 
any public comment on these documents to the extent practicable within 
the time allowed by law and without delaying implementation of PTC 
systems. The version of any filing initially placed in the public 
docket, for which confidential treatment has been requested in 
accordance with Sec.  209.11, would be the redacted copy as filed by 
the railroad. If FRA later determined that additional material was not 
deserving of confidential treatment, that material would be 
subsequently added to the docket.
    Paragraph (f) has been added to this section in the final rule to 
require railroads to maintain their most recent PTC deployment plans in 
their PTCIPs until all PTC system deployments required under the RSIA08 
have been completed.
Section 236.1013 PTC Development Plan Content Requirements and Type 
Approval
    As noted in the discussion above regarding Sec.  236.1009, each 
PTCSP must be submitted with a Type Approval number identifying a PTC 
system that FRA believes could fulfill the requirements of subpart I. 
Under Sec.  236.1009, a railroad may submit an existing Type Approval 
number in lieu of a PTCDP if the PTC system it intends to implement and 
operate is identical to the one described in that Type Approval's 
associated PTCDP. In the event, however, that a railroad intends to 
install a system for which a Type Approval number has not yet been 
assigned, or to use a system with an assigned Type Approval number that 
may have certain variances to its safety-critical functions, then the 
railroad must submit a PTCDP to obtain a new Type Approval number.
    The PTCDP is the core document that provides the Associate 
Administrator sufficient information to determine whether the PTC 
system proposed for installation by the railroad could meet the 
statutory requirements for PTC systems specified by RSIA08 and the 
regulatory requirements under subpart I. Issuance of a system Type 
Approval number is contingent upon the approval of the PTCDP by the 
Associate Administrator. While filing of a PTCDP is optional in the 
sense that the railroad may proceed directly to submission of the PTCSP 
by the April 16, 2010, deadline (see Sec.  236.1009), FRA encourages 
railroads engaged in joint operations to file a PTCDP. Approval of the 
PTCDP, and issuance of a Type Approval, presents the opportunity for 
other railroads to reduce the effort required to obtain a PTC System 
Certification. If a Type Approval for a PTC system exists, another 
railroad may also use that Type Approval provided there are no 
variances in the system as described in the Type Approval's PTCDP. In 
such cases, the other railroad may avoid submitting its own PTCDP by 
simply incorporating by reference the supporting information in the 
Type Approval's PTCDP and certifying that no variances in the PTC 
system have been made.
    This section describes the contents of the PTCDP required to obtain 
FRA approval in the form of issuance of a Type Approval number. This 
section requires each PTCDP to include all the

[[Page 2648]]

elements and practices listed in this section to provide reasonable 
assurance that the subject PTC system will meet the statutory 
requirements and are developed consistent with generally-accepted 
principles and risk-oriented proof of safety methods surrounding this 
technology. FRA believes that it is necessary to include the provisions 
contained in this section in order to provide reasonable assurance that 
the PTC system, when developed and deployed, will have no adverse 
impact on the safety of railroad employees, the public, and the 
movement of trains.
    FRA recognizes that much of the information required by Sec.  
236.1013 normally resides with the PTC system's developer or supplier 
and not the client railroad. While FRA expects that each railroad and 
its PTC system supplier may jointly draft a PTCDP, the railroad has the 
primary responsibility for the safety of its operations and for 
submitting to FRA the information required under this section. 
Accordingly, each railroad required to submit a PTCDP under subpart I 
should make the necessary arrangements to ensure that the requisite 
information is readily available from the supplier for submission to 
the agency. FRA believes that suppliers and railroads will develop a 
PTCDP for most products that adequately address the requirements of the 
new subpart without substantial additional expense. As part of the 
design and evaluation process, it is essential to ensure that an 
adequate analysis of the features and capabilities is made to minimize 
the possibility of conflicts resulting from any use or feature, 
including a software fault. Since this analysis is a normal cost of 
software engineering development, FRA does not believe this requirement 
imposes any additional significant costs beyond what should already be 
done when developing safety-critical software.
    The passenger and public commuter railroads who submitted comments 
expressed significant concern that the Class I railroads' choice of a 
single vendor or supplier for the onboard components of the PTC 
systems, coupled with the RSIA08 requirement for interoperability, 
creates a de-facto monopoly, with associated adverse impacts on costs 
and schedule. These commenters recommended that FRA take positive steps 
to ensure that sufficient information is made available to allow the 
railroads to source components from multiple vendors or suppliers. The 
suggested actions ranged from disapproving any PTCIP/PTCDP that is not 
based on open standards to expediting Interoperable Train Control (ITC) 
specification documentation.
    FRA appreciates the concerns expressed regarding a de-facto 
monopoly and the possible adverse consequences on system deployments. 
FRA, however, must defer to the Departments of Justice and Commerce 
regarding issues of alleged monopolistic behavior.
    In subparts H and I, FRA has encouraged the use of publicly 
available standards in the design, implementation, and testing of PTC 
systems. FRA does not mandate the use of any particular standard by a 
railroad, vendor, or supplier, but rather has adopted a policy of 
allowing the marketplace to decide what standard(s) should be used, 
provided the end result--a suitable safe product--is obtained. 
Specification of government standards is only appropriate where there 
has been a failure of the marketplace. It has not yet been established 
that such marketplace failure has occurred. Even if such a marketplace 
failure were deemed to have occurred, it is extremely unlikely that FRA 
would be able to complete the development of appropriate standards 
before current industry efforts with the ITC specifications are 
finalized and made publicly available. FRA understands the railroads' 
concerns and will monitor the situation.
    FRA hastens to add that, since the publication of the NPRM, it has 
become clear that ITC standards may not be completed and validated 
prior to the end of 2010. FRA has requested that the ITC railroads 
accelerate this process in the interest of compliance with the law, and 
has added the Notice of Product Intent as a means of bridging to the 
point where standards are available. Looking forward to mid-2010, FRA 
will assess the situation with respect to delivery of open standards 
and their adoption by the AAR. Should it appear that a timely delivery 
will not be made, FRA reserves the right to take further regulatory 
action. That action could include a proposal for adoption of mandatory 
interoperability standards, likely in the form of existing American 
Railway Engineering and Maintenance Association standards that have 
already been developed through the leadership of the major 
international signal suppliers. FRA believes that such action should 
not be necessary and looks forward to the timely completion of ITC 
standards.
    One vendor pointed out that a significant portion of the work 
associated with PTC system is commercially sensitive. FRA is committed 
to appropriate protection of both railroad and vendor intellectual 
property. Its development is recognized as representing the expenditure 
of significant resources by the vendor, the railroad, or both. However, 
interoperability requirements between railroads require some disclosure 
of information between railroads and vendors or suppliers. This should 
not require disclosure of proprietary information, but does require 
disclosure of interface specifications, as well as required functional 
attributes, assigned safety attributes and stimulus/response 
attributes. FRA believes such disclosure of the latter is in the best 
interest of the railroad, vendor, and supplier communities and strongly 
encourages the free exchange of this information.
    In Sec. Sec.  236.1013 and 236.1015, various adjectives precede 
several of the requirements. For instance, certain paragraphs require 
``a complete description,'' ``a detailed description,'' or simply a 
``description.'' These phrases are inherited from subpart H of this 
part. Their inclusion in subpart I are similarly not to imply that any 
description should be more or less detailed or complete than any other 
description required. By contrast, they are included merely for the 
purposes of emphasis.
    Paragraph (a)(1) requires that the PTCDP include system 
specifications that describe the overall product and identify each 
component and its physical relationship in the system. FRA will not 
dictate specific product architectures, but will examine each PTC 
system to fully understand how its various parts interrelate. Safety-
critical functions in particular will be reviewed to determine whether 
they are designed to be fail-safe. FRA would like to emphasize that the 
PTCDP information provided in accordance with the requirements of this 
paragraph should be as railroad independent as possible. This will 
allow the product's PTCDP, and any associated Type Approval, to be 
shared by multiple railroads to the maximum extent possible. FRA 
believes that the PTCDP information provided in accordance with this 
provision will play an important role in FRA's determination as to 
whether safety will be maximized and if regulatory compliance of the 
system is obtainable.
    Paragraph (a)(2) requires a description of the operation where the 
product will be used. Upon receipt of this information within a PTCDP, 
FRA will have better contextual knowledge of the product as it applies 
to the type of operation on which it is designed to be used. Where 
operational behaviors are not applicable to a particular railroad, or 
the product design is not intended to address a particular operational 
behavior, FRA would expect a short

[[Page 2649]]

statement indicating which operational characteristics do not apply and 
why they are not applicable.
    Paragraph (a)(3) requires that the PTCDP include a concept of 
operations, a list of the product's functional characteristics, and a 
description explaining how various components within the system are 
controlled. FRA expects that the information provided under paragraphs 
(a)(2) and (a)(3) will together provide a thorough understanding of the 
PTC system. FRA will review this information--primarily by comparing 
the subject PTC system's functionalities with those underlying 
principles contained in standards for existing signal and train control 
systems--to determine whether the PTC system is designed to account for 
all relevant safety issues. While FRA does not intend to prescribe PTC 
system design standards, FRA does expect that each applicant will 
compare the concepts contained in existing standards to the operational 
concepts, functionalities, and controls contemplated for the PTC system 
in order to determine whether a sufficient level of safety will be 
achieved. For example, existing requirements prescribe that where a 
track relay is de-energized, a switch or derail is improperly lined, a 
rail is removed, or a control circuit is opened, each signal governing 
movements into the subject block occupied by a train, locomotive, or 
car must display its most restrictive aspect for the safety of train 
operations. The principle behind the requirement is that, when a 
condition exists in the operating environment, or with respect to the 
functioning of the system, that entails a potential hazard, the system 
will assume its most restrictive state to protect the safety of train 
operations.
    Paragraph (a)(4) requires that each PTCDP include a document that 
identifies and describes each safety-critical function of the subject 
PTC system. The product architecture includes both hardware and 
software aspects that identify the protection developed against random 
hardware faults and systematic errors. Further, the document should 
identify the extent to which the architecture is fault tolerant. FRA 
intends to use this information to determine whether appropriate safety 
concepts have been incorporated into the proposed PTC system. For 
example, existing regulations require that when a route has been 
cleared for a train movement, it cannot be changed until the governing 
signal has been caused to display its most restrictive indication and a 
predetermined time interval has expired, in those scenarios where time 
locking is used or where a train is in approach to the location where 
approach locking is used. FRA intends to use this information to 
determine whether all the safety-critical functions have been included. 
Where such functionalities are not clearly determined to exist as a 
result of technology development, FRA will expect the reasoning to be 
stated and a justification provided describing how that technology 
provides the required level of safety. Where FRA identifies a void in 
safety-critical functions, FRA may not approve the PTCDP until remedial 
action is taken to rectify the concern.
    FRA recognizes that the information required under paragraph (a)(4) 
may have already been provided pursuant to paragraph (a)(1). In such a 
case, the railroad shall cross reference where both paragraphs (a)(1) 
and (a)(4) have been jointly satisfied in the PTCDP.
    Paragraph (a)(4) requires that each PTCDP address the minimum 
requirements under Sec.  236.1005 for development of safety-critical 
PTC systems. FRA expects the information provided under paragraph 
(a)(4) to cover: identification of all safety requirements that govern 
the operation of a system; evaluation of the total system to identify 
known or potential safety hazards that may arise over the life-cycle of 
the system; identification of all safety issues during the design phase 
of the process; elimination or reduction of the risks posed by the 
hazards identified; resolution of safety issues presented; development 
of a process to track progress; and development of a program of testing 
and analysis to demonstrate that safety requirements are met.
    FRA has considered the railroads' concerns, and agrees that the 
selection of the safety assurance concepts that any particular railroad 
may impose on its vendor or supplier might possibly differ, based on 
the railroad's operational philosophy and tolerance for risk. 
Accordingly, FRA removed proposed paragraph (a)(5) from the final rule 
as an element of the PTCDP, and has made the requirement to describe 
the safety assurance concepts an element of the PTCSP (see Sec.  
236.1015(d)(2)).
    Paragraph (a)(5) requires a submission of a preliminary human 
factors analysis that addresses each applicable human-machine interface 
(HMI) and all proposed product functions to be performed by humans to 
enhance or preserve safety. FRA expects this analysis to place special 
emphasis on proposed human factors responses--and the result of any 
failure to perform such a response--to safety-critical hazards, 
including the consequences of human failure to perform. For each HMI, 
the PTCDP should address the proposed basis of assumptions used for 
selecting each such interface, its potential effect upon safety, and 
all potential hazards associated with each interface. Where more than 
one employee is expected to perform duties dependent upon HMI input or 
output, the analysis must address the consequences of failure by one or 
multiple employees. FRA intends to use this information to determine 
the proposed HMI's effect upon the safety of railroad operations. The 
preliminary human factors analysis must propose how the railroad or its 
PTC system supplier plans to address the HMI criteria listed in 
Appendix E to this part or any alternatives proposed by the railroad 
and deemed acceptable by the Associate Administrator. The design 
criteria for Appendix E were first developed and subsequently adopted 
by FRA as an element of subpart H of this part. As the criteria in 
Appendix E are generally technology neutral, FRA has adopted them with 
minor changes, for use with both subpart H of this part and these 
proceedings.
    Paragraph (a)(5) also requires that the PTCDP explain how the 
proposed HMI will affect interoperability. RSIA08 requires that each 
subject railroad explain how it intends to obtain system 
interoperability. The ability of a train crew member to operate another 
railroad's PTC system significantly depends upon a commonly understood 
HMI. The HMI provides the end user with a method of interacting with 
the underlying system and accessing the PTC functionality. FRA expects 
that each railroad will adopt an HMI standard that will ensure ease of 
use of the PTC system both within, and between, railroads.
    Paragraph (a)(6) requires an analysis regarding how subparts A 
through G of part 236 apply, or no longer apply, to the subject PTC 
system. FRA recognizes that, while a PTC system may be designed in 
accordance with the underlying safety concepts of subparts A through G, 
the specific existing requirements contained in those subparts are not 
necessarily applicable. In any event, the PTCDP must identify each 
pertinent requirement considered to be inapplicable, fully describe the 
alternative method used to fulfill that underlying safety concept, and 
explain how the proposed PTC system supports the underlying safety 
principle. FRA notes that certain sections in subparts A though G of 
this part may always be applicable to PTC systems certified under 
subpart I.
    FRA is concerned about all dimensions of system security. Thus,

[[Page 2650]]

paragraph (a)(7) requires the PTCDP to include a description of the 
security measures necessary to meet the specifications for each PTC 
system and the prioritized restoration and mitigation plan as required 
under Sec.  236.1033. Security is an important element in the design 
and development of PTC systems and covers issues such as developing 
measures to prevent hackers from gaining access to software and to 
preclude sudden system shutdown, mechanisms to provide message 
integrity, and means to authenticate the communicating parties. Safety 
and security are two closely related topics. Both are elements for 
ensuring that a subject is protected and without risk of harm. In the 
industrial marketplace, the goals of safety and security are to create 
an environment protecting assets from hazards or harm. While activities 
to ensure safety usually relate to the possibility of accidental harm, 
activities to ensure security usually relate to protecting a subject 
from intentional malicious acts such as espionage, theft, or attack. 
Since system performance may be affected by either inadvertent or 
deliberate hazards or harms, the safety and security involved in the 
implementation and operation of a PTC system must both be considered.
    Integrated security recognizes that optimum protection comes from 
three mutually supporting elements: Physical security measures, 
operational procedures, and procedural security measures. Today, the 
convergence of information and physical security is being driven by 
several powerful forces, including: interdependency, efficiency and 
organizational simplification, security awareness, regulations, 
directives, standards, and the evolving global communications 
infrastructure. Physical security describes measures that prevent or 
deter attackers from accessing a facility, resource, or information 
stored on physical media and guidance on how to design structures to 
resist various hostile acts. Communications security describes measures 
and controls taken to deny unauthorized persons information derived 
from telecommunications and ensure the authenticity of such 
telecommunications. Because of the integrated nature of security, FRA 
expects that each PTCDP will address security as a holistic concept, 
and not be restricted to limited or specific aspects.
    Paragraph (a)(8) requires documentation of assumptions concerning 
reliability and availability targets of mechanical, electrical, and 
electronic components. When building a PTC system, designers may make 
numerous assumptions that will directly impact specific implementation 
decisions. These fundamental assumptions usually come in the form of 
data (e.g., facts collected as the result of experience, observation or 
experiment, or processes, or premises) that can be randomly sampled. 
FRA does not expect to audit all of the fundamental assumptions on 
which a PTC system has been developed. Instead, FRA envisions sampling 
and reviewing fundamental assumptions prior to product implementation 
and after operation for some time. FRA expects that the data sampled 
may vary, depending upon the PTC system. It is not possible to provide 
a single set of quantitative numbers applicable to all systems, 
especially when systems have yet to be designed and for which the 
fundamental assumptions are yet to be determined. Quantification is 
part of the risk management process for each project. FRA believes that 
the actual performance of the system observed during the pre-
operational testing and post-implementation phases will provide 
indications of the validity of the fundamental assumptions. FRA 
requires that this review process occur for the life of the PTC system 
(i.e., as long as the product is kept in operation). The depth of 
details required will depend upon what FRA observes. The range of 
difference between a PTC system's predicted and actual performance may 
indicate to FRA the validity of the underlying fundamental assumptions. 
Generally, if the actual performance matches the predicted performance, 
FRA believes that it will not have to extensively review the 
fundamental assumptions. If the actual performance does not match 
predicted performance, FRA may need to more extensively review the 
fundamental assumptions.
    FRA expects each subject railroad to confirm the validity of 
initial assumptions by comparing them to actual in-service data. FRA is 
aware that mechanical and electronic component failure rates and times 
to repair are easily quantified data, and usually are kept as part of 
the logistical tracking and maintenance management of a railroad. FRA 
believes that this criterion will enhance the quality of risk 
assessments conducted pursuant to this subpart by forcing PTC system 
designers and users to consider the long-term effects of operation over 
the course of the PTC system's projected life-cycle. If a PTC system 
can be used beyond its design life-cycle, FRA expects that any 
continued use would only occur pursuant to a waiver provided in 
accordance with 49 CFR part 211 or a PTCDP or PTCSP amended in 
accordance with Sec.  236.1021. In its request for waiver or request 
for amendment, the railroad should address any new risks associated 
with the life-cycle extension.
    Paragraph (a)(8) also requires specification of the target safety 
levels. This includes the identity of each potential hazard and how the 
events leading to a hazard will be identified for each safety-critical 
subsystem; the proposed safety integrity level of each safety-critical 
subsystem, and the proposed means that accomplishment of these targets 
will be evaluated. This paragraph also requires identification of the 
proposed backup methods of operation and safety-critical assumptions 
regarding availability of the product. FRA believes this information is 
essential for making determinations about the safety of a product and 
both the immediate and long-term effect of its failure. FRA contends 
that availability is directly related to safety to the extent the 
backup means of controlling operations involves greater risk (either 
inherently or because it is infrequently practiced).
    Paragraph (a)(9) requires a complete description of how the PTC 
system will enforce all pertinent authorities and block signal, cab 
signal, or other signal related indications. FRA appreciates that not 
all PTC system architectures will seek to enforce the speed 
restrictions associated with intermediate signals directly, but 
nevertheless a clear description of these functions is necessary for 
clarity and evaluation.
    Paragraph (a)(10) requires that, if the railroad is seeking to 
deviate from the requirements of section 236.1029 with respect to 
movement of trains with onboard equipment that has failed en route 
using the flexibility provided by paragraph (c) of that section, a 
justification must be provided in the PTCDP. As proposed, paragraph (c) 
of Sec.  236.1029 provided that, in order for a PTC train that operates 
at a speed above 90 miles per hour to deviate from the operating 
limitations contained in paragraph (b) of that section, the deviation 
must be described and justified in the FRA approved PTCDP or PTCSP, or 
by reference to an Order of Particular Applicability, as applicable. 
For instance, if Amtrak wished to continue to operate at up to 125 
miles per hour with cab signals and automatic train control in the case 
of failure of onboard ACSES equipment, Amtrak would request to do so 
based on the applicable language of the Order of Particular 
Applicability that required installation of that system on portions of 
the Northeast Corridor. Similarly, a railroad wishing more liberal

[[Page 2651]]

requirements for a high-speed rail system on a dedicated right-of-way 
could request that latitude by explaining how the safety of all 
affected train movements would be maintained. During the comment period 
and PTC Working Group discussion, Amtrak continued to press its case 
for greater flexibility, noting the long routes prevalent on its 
intercity network and the trip time penalty that could be incurred with 
failed equipment. Paragraph (a)(10) has been revised in the final rule 
to reflect the fact that the development plan would contain 
justification for any requested deviation from the requirements of 
Sec.  236.1029, and that section has been further revised to permit the 
agency to receive and consider specific requests and supporting 
information regarding latitude such as that sought by Amtrak without 
regard to speed. Instead, paragraph (a)(10) requires the railroad to 
include a justification in its PTCDP, if the railroad is seeking to 
deviate from the requirements of Sec.  236.1029 with respect to 
movement of trains with onboard equipment that has failed en route.
    Paragraph (a)(11) requires a complete description of how the PTC 
system will appropriately and timely enforce all hazard detectors that 
are interconnected with the PTC system in accordance with Sec.  
236.1005(c)(3), as may be applicable.
    Paragraph (b) specifies the approval standard that will be employed 
by the Associate Administrator. APTA asserted that the NPRM offered 
minimal guidance on the criteria FRA will use to accept or reject a 
system. Thus, APTA suggested that FRA should draft and vet criteria 
that accomplishes the basic purposes of PTC while allowing for 
innovation in meeting the performance requirements envisioned in the 
regulation.
    The PTCDP is not expected to provide absolute assurance to the 
Associate Administrator that every potential hazard will be eliminated 
with complete certainty. It only needs to establish that the PTC system 
meets the appropriate statutory and regulatory requirements for a PTC 
system required under this subpart, and that there is a reasonable 
chance that once built, it will meet the required safety standards for 
its intended use. FRA emphasizes that approval of a PTCDP and issuance 
of a Type Approval does not constitute final approval to operate the 
product in revenue service. Such approval only comes when the Associate 
Administrator issues an applicable PTC System Certification.
    Paragraph (c) establishes a time limit on the validity of a Type 
Approval. Provided that at least one product is certified within the 5 
year period after issuance of the Type Approval, the Type Approval 
remains valid until final retirement of the system. The main purpose of 
this requirement is to incentivize installation, not just creation, of 
a PTC system. This paragraph would also allow FRA to periodically clean 
out its records relating to Type Approvals and PTCDPs for obsolete PTC 
systems.
    Former paragraphs (d) and (e) in this section have been moved to 
Sec.  236.1015 in the final rule. Therefore, former paragraph (f) has 
been redesignated as paragraph (d) in the final rule. Paragraph (d) 
discusses the Associate Administrator's ability to impose any 
conditions necessary to ensure the safety of the public, train crews, 
and train operations when approving the PTCDP and issuing a Type 
Approval. While FRA expects that adherence to the remainder of this 
section's requirements should justify issuance of a Type Approval, FRA 
also recognizes that there may be situations where other unaccounted 
for variables may reduce the Associate Administrator's confidence in 
the PTC system, its manufacturer, supplier, vendor, or operator.
    The required contents of the NPI are specified in paragraph (e). As 
stated earlier, FRA expects submission of an NPI temporarily in lieu of 
a PTCDP only when the railroad is unable to obtain all of the 
information required for a PTCDP. This will enable railroads to submit 
a PTCIP on or before the statutory deadline of April 16, 2010. FRA 
believes that, given the various options available to the railroads, 
there are few, if any, valid reasons for not meeting the April 16, 
2010, deadline for submission.
    The elements that make up the NPI were carefully chosen to strike a 
balance between the ability of a railroad that is unable to complete a 
full PTCDP and FRA's need to fully understand the railroad's proposed 
system and the reasonableness of the PTCIP contents. FRA believes that 
the NPI information would be required to have been identified by the 
railroad in order to develop requests for proposal from the vendor or 
supplier community. Paragraph (e)(1) requires a description of the 
proposed operating environment. Paragraph (e)(2) requires a description 
of the concept of operations for any PTC system that will be procured 
by the railroad. Paragraph (e)(3) requires a description of the target 
safety levels that the railroad expects the PTC system to meet, while 
paragraphs (e)(4) and (e)(5) require an explanation of how the proposed 
system will integrate with the existing signal and train control 
system.
Section 236.1015 PTC Safety Plan Content Requirements and PTC System 
Certification
    The PTCSP is the core document that provides the Associate 
Administrator the information necessary to certify that the as-built 
PTC system fulfills the required statutory PTC functions and is in 
compliance with the requirements of this subpart. Issuance of a PTC 
System Certification is contingent upon the approval of the PTCSP by 
the Associate Administrator. Under this final rule, the filing and 
approval of the PTCSP and issuance of a PTC System Certification is a 
mandatory prerequisite for PTC system operation in revenue service. 
Each PTCSP is unique to each railroad and must addresses railroad-
specific implementation issues associated with the PTC system 
identified by the submitted Type Approval. Paragraph (a) provides 
language explaining these meanings and limits.
    Paragraph (b), which reflects the contents of proposed paragraphs 
(d) and (e) in proposed Sec.  236.1013, establishes the conditions 
under which a Type Approval may be used by another railroad. Paragraph 
(b)(1) requires the railroad to maintain a continually updated PTC 
Product Vendor List (PTCPVL) pursuant to Sec.  236.1023 to enable the 
railroad and FRA to determine the appropriate vendor to contact in the 
unlikely event of a safety critical failure.
    The safety critical nature of PTC systems imposes strict quality 
control requirements on the design and manufacturer of the system. 
While FRA believes that in the vast majority of cases, the vendor or 
supplier community from whom the railroads will procure PTC system 
components have established the appropriate quality control systems, 
there will be a very small minority who have not. Paragraph (b)(2) is 
intended to mitigate against any such occurrence, to ensure that PTC 
system components meet the same, uniformly high, standards. FRA is 
requiring that the railroad ensure that any vendor from whom they 
purchase PTC system or components has an acceptable quality assurance 
program for both design and manufacturing processes.
    FRA has considered comments submitted by GE, in which GE suggested 
language to further clarify paragraph (b)(2) that the vendor quality 
control processes for PTC systems must include the process for the 
product supplier to promptly report any safety relevant failure and 
previously unidentified

[[Page 2652]]

hazards to each railroad using the product. FRA believes that this 
suggested language clearly specifies the importance of this requirement 
to suppliers who may not already have the appropriate quality control 
processes in place. Accordingly, FRA has added the recommended 
language.
    Paragraph (b)(3) requires the railroad to provide licensing 
information. The list should include all applicable vendors or 
suppliers. Through the requirements set forth in paragraph (b)(3), FRA 
intends to ensure implementation of the proper technology, as opposed 
to implementation of an orphan product that uses similar, yet 
different, technology. When a railroad submits a previously approved 
Type Approval for its PTC system, FRA expects that all the proper 
licensing agreements will provide for continued use and maintenance of 
the PTC system in place. To bolster FRA's confidence in this area, FRA 
will require each Type Approval submission to include the relevant 
licensing information. FRA recognizes that there may be various 
licensing arrangements available relating to the exclusivity and 
sublicensing of manufacturing or vending of a particular PTC system. 
There may be other intellectual property variables that may make 
arrangements even more complex. To adequately capture all applicable 
arrangements, FRA is requiring the submission of ``licensing 
information.'' A more specific request may preclude FRA's ability to 
collect information necessary to fulfill its intent. If any of this 
information were to change, either through any type of sale, transfer, 
or sublicense of any right or ownership, then FRA would expect the 
railroad to submit a request for amendment of its PTCDP in accordance 
with Sec.  236.1021. FRA recognizes that this may be difficult for a 
railroad to accomplish, given the fact that the railroad may not be 
privy to any intellectual property transactions that may occur outside 
its control. In any event, FRA would expect that a railroad will 
ensure, either through contractual obligation or otherwise, that its 
vendor or supplier will provide it with updated licensing information 
on a continuing basis.
    When filing a PTCSP, paragraph (c) requires each railroad to 
include the applicable and approved PTCDP or, if applicable, the FRA 
issued Type Approval. In addition, the railroad must describe any 
changes subsequently made to the PTC system that would require 
amendment of the PTCDP or assure FRA that the PTC system built is the 
same PTC system described in the PTCDP and PTCSP. Some elements of the 
PTCSP are the same elements as the PTCDP (and are described more fully 
in the section-by-section analysis of Sec.  236.1013). If the railroad 
has already submitted, and FRA has already approved, the PTCDP, then 
attachment of the PTCDP to the PTCSP should fulfill this requirement.
    FRA recognizes the possibility that between PTCIP or PTCDP 
approval, and prior to PTCSP submission, there may be changes to the 
former two documents. While such changes may only be made in accordance 
with Sec.  236.1021, documentation of those changes may not be readily 
apparent to the reader of the PTCSP. Further, changes in the PTCIP may 
impact the contents of the PTCDP and vice versa. Accordingly, paragraph 
(c)(1) requires the railroad to submit the approved PTCDP (or Type 
Approval) with the corresponding PTCSP.
    AAR asserted that the main purpose of the PTCIP is to document the 
deployment plan and that the PTCIP will be of little value once the 
implementation is complete. Accordingly, AAR asserts that there is no 
need to include the PTCIP when filing either a PTCDP or PTCSP. The AAR 
also asserted that since the PTCSP justifies that the PTC system was 
built in accordance with the PTCDP, submission of the PTCIP information 
should not be required.
    FRA agrees with AAR that the main purpose of the PTCIP is to 
document the deployment plan and that the PTCIP will essentially become 
a historical document when the railroad has completed its PTC 
implementation. Therefore, until all PTC system installations have been 
completed, FRA will require the PTCIP to be kept current with the 
railroad's deployment plan. However, in response to the AAR's comments, 
FRA has revised paragraph (c) by removing the proposed requirement to 
submit the PTCIP with the PTCDP and PTCSP.
    FRA expects that each PTCSP shall include a clear and complete 
description of any such changes by specifically and rigorously 
documenting each variance. Paragraph (c)(2) also requires that the 
PTCSP include an explanation of each variance's significance. To ensure 
that there are no other existing variances not documented in the PTCSP, 
the railroad must attest that there are no further variances. For the 
same reason, paragraph (c)(3) requires that, if there have been no 
changes to the plans or to the PTC system as intended, the railroad 
must attest that there are no such variances.
    The additional required railroad specific elements are as follows:
    Paragraph (d)(1) requires that the PTCSP include a hazard log 
comprehensively describing all hazards to be addressed during the life-
cycle of the product, including maximum threshold limits for each 
hazard. For unidentified hazards, the threshold shall be exceeded at 
one occurrence. In other words, if the hazard has not been predicted, 
then any single occurrence of that hazard is unacceptable. The hazard 
log addresses safety-relevant hazards, or incidents or failures that 
affect the safety and risk assumptions of the PTC system. Safety 
relevant hazards include events such as false proceed signal 
indications and false restrictive signal indications. If false 
restrictive signal indications occur with any type of frequency, they 
could influence train crew members, roadway workers, dispatchers, or 
other users to develop an apathetic attitude towards complying with 
signal indications or instructions from the PTC system, creating human 
factors problems.
    Incidents in which stop indications are inappropriately displayed 
may also necessitate sudden brake applications that may involve risk of 
derailment due to in-train forces. Other unsafe or wrong-side failures 
that affect the safety of the product will be recorded on the hazard 
log. The intent of this paragraph is to identify all possible safety-
relevant hazards that would have a negative effect on the safety of the 
product. Right-side failures, or product failures that have no adverse 
effect on the safety of the product (i.e., do not result in a hazard) 
would not be required to be recorded on the hazard log.
    Paragraph (d)(2), which has been added to the final rule, requires 
that each railroad identify the PTC system's safety assurance concepts. 
When identifying the safety assurance concepts used, FRA expects the 
information provided pursuant to paragraph (d)(2) will reflect the 
safety requirements that govern the operation of a system; the identify 
of known or potential safety hazards that may arise over the life-cycle 
of the system; safety issues that may arise during the design phase of 
the process; elimination or reduction of the risks posed by the hazards 
identified; resolution of safety issues presented; development of a 
process to track progress; and development of a program of testing and 
analysis to demonstrate that safety requirements are being met.
    In the proposed rule, this information was required as part of the 
PTCDP. One railroad recommended that this information requirement be 
completely eliminated as redundant because it is covered as part of the 
product safety

[[Page 2653]]

requirements. FRA agrees that this information should not be a required 
element of the PTCDP; this information should be provided as an element 
of the railroad specific PTCSP, since individual railroads may elect to 
require different safety assurance concepts from their vendors or 
suppliers. This very same information is an integral element of the 
railroad specific Product Safety Plan required by subpart H of this 
part. Accordingly, FRA has revised this requirement. However, FRA does 
not believe that this information is redundant. The safety assurance 
concepts imposed on the vendor or supplier are procedural requirements 
that drive vendor or supplier system design and mitigation strategies. 
FRA believes that the importance of the safety assurance concepts 
merits clear identification.
    Paragraph (d)(3) requires that a risk assessment be included in the 
PTCSP. FRA will use this information as a basis to confirm compliance 
with the appropriate performance standard. A performance standard 
specifies the outcome required, but leaves the specific measures to 
achieve that outcome up to the discretion of the regulated entity. In 
contrast to a design standard or a technology-based standard that 
specifies exactly how to achieve compliance, a performance standard 
sets a goal and lets each regulated entity decide how to meet that 
goal. An appropriate performance standard should provide reasonable 
assurance of safe and effective performance by making provision for: 
(1) Considering the construction, components, ingredients, and 
properties of the device and its compatibility with other systems and 
connections to such systems; (2) testing of the product on a sample 
basis or, if necessary, on an individual basis; (3) measurement of the 
performance characteristics; and (4) requiring that the results of each 
or of certain of the tests required show that the device is in 
conformity with the portions of the standard for which the test or 
tests were required. Typically, the specific process used to design, 
verify and validate the product is specified in a private or public 
standard. The Associate Administrator may recognize all or part of an 
appropriate standard established by a nationally or internationally 
recognized standard development organization.
    Labor expressed concern during this rulemaking regarding FRA's 
position on the treatment of wrong side failures. Wrong side failures, 
which occur when a PTC system fails to properly identify the track 
occupied by a train, should not be considered an acceptable risk. Such 
failures, which are completely avoidable using current technology, can 
result in unnecessary and risky penalty brake applications.
    FRA agrees that wrong side failures introduce an element of risk in 
the operation of a system. Therefore, the extent of that risk and the 
consequences of the failure must be identified and carefully analyzed. 
It is for that very reason that FRA is requiring that the hazard log 
identify all such potential failures. The hazard mitigation analysis 
required in paragraph (d)(4) must identify how each hazard in the 
hazard log will be mitigated. While FRA agrees the majority of wrong 
side failures can be eliminated through the application of technology, 
FRA believes that the generalization that all wrong side failures can 
be eliminated is not valid.
    Paragraph (d)(4) requires that the PTCSP include a hazard 
mitigation analysis. The hazard mitigation analysis must identify the 
techniques used to investigate the consequences of various hazards and 
list all hazards addressed in the system hardware and software 
including failure mode, possible cause, effect of failure, and remedial 
actions. A safety-critical system must satisfy certain specific safety 
requirements specified by the system designer or procuring entity. To 
determine whether these requirements are satisfied, the safety assessor 
must determine that: (1) Hazards associated with the system have been 
comprehensively identified; (2) hazards have been appropriately 
categorized according to risk (likelihood and severity); (3) 
appropriate techniques for mitigating the hazards have been identified; 
and (4) hazard mitigation techniques have been effectively applied. See 
Leveson, Nancy G., Safeware: System Safety and Computers, (Addison-
Wesley Publishing Company, 1995).
    FRA does not expect that the safety assessment will prove that a 
product is absolutely safe. However, the safety assessment should 
provide evidence that risks associated with the product have been 
carefully considered and that steps have been taken to eliminate or 
mitigate them. Hazards associated with product use need to be 
identified, with particular focus on those hazards found to have 
significant safety effects. The risk assessment provided under 
paragraph (d)(4) must include each hazard that cannot be mitigated by 
system designs (e.g., human over-reliance of the automated systems) no 
matter how low its probability may be. After the risk assessment, the 
designer must take steps to remove them or mitigate their effects. 
Hazard analysis methods are employed to identify, eliminate, and 
mitigate hazards. Under certain circumstances, FRA may require an 
independent third party assessment in accordance with proposed Sec.  
236.1017 to review these methods as a prerequisite to FRA approval.
    Paragraph (d)(5) also requires that the PTCSP address safety 
Verification and Validation procedures as defined under part 236. FRA 
believes that Verification and Validation for safety are vital parts of 
the PTC system development process. Verification and Validation require 
forward planning. Consequently, the PTCSP should identify the testing 
to be performed at each stage of development and the levels of rigor 
applied during the testing process. FRA will use this information to 
ensure that the adequacy and coverage of the tests are appropriate.
    Paragraph (d)(6) requires the railroad to include in its PTCSP the 
training, qualification, and designation program for workers regardless 
of whether those railroad employees will perform inspection, testing, 
and maintenance tasks involving the PTC system. FRA believes many 
benefits accrue from the investment in comprehensive training programs 
and are fundamental to creating a safe workforce. Effective training 
programs can result in fewer instances of human casualties and 
defective equipment, leading to increased operating efficiencies, less 
troubleshooting, and decreased costs. FRA expects any training program 
will include employees, supervisors, and contractors engaged in 
railroad operations, installation, repair, modification, testing, or 
maintenance of equipment and structures associated with the product.
    Paragraph (d)(7) requires the railroad to identify specific 
procedures and test equipment necessary to ensure the safe operation, 
installation, repair, modification and testing of the product in its 
PTCSP. Requirements for operation of the system must be succinct in 
every respect. The procedures must be specific about the methodology to 
be employed for each test to be performed that is required for 
installation, repair, or modification and the results thereof must be 
documented. FRA will review and compare the repair and test procedures 
for adequacy against existing similar requirements prescribed for 
signal and train control systems. FRA intends to use this information 
to ascertain whether the product will be properly installed, 
maintained, tested, and repaired.
    Paragraph (d)(8) requires that each railroad develop a manual 
covering the requirements for the installation, periodic maintenance 
and testing,

[[Page 2654]]

modification, and repair for its PTC system. The railroad's Operations 
and Maintenance Manual must address the issuance of warnings and 
describe the warning labels to be placed on each piece of PTC system 
equipment as necessary. Such warnings include, but are not limited to: 
Means to prevent unauthorized access to the system; warnings of 
electrical shock hazards; cautionary notices about improper usage, 
testing, or operation; and configuration management of memory and 
databases. The PTCSP should provide an explanation justifying each such 
warning and an explanation of why there are no alternatives that would 
mitigate or eliminate the hazard for which the warning will be given.
    Paragraph (d)(9) requires that the PTCSP identify the various 
configurable applications of the product, since this rule mandates use 
of the product only in the manner described in its PTCDP. Given the 
importance of proper configuration management in safety-critical 
systems, FRA believes it is essential that railroads learn of and take 
appropriate configuration control of hardware and software. FRA 
believes that a requirement for configuration management control will 
enhance the safety of these systems and ultimately provide other 
benefits to the railroad as well. Pursuant to this paragraph, railroads 
will be responsible--through its applicable Operations and Maintenance 
Plan and other supporting documentation maintained throughout the 
system's life-cycle--for all changes to configuration of their products 
in use, including both changes resulting from maintenance and 
engineering control changes, which result from manufacturer 
modifications to the product. Since not all railroads may experience 
the same software faults or hardware failures, the configuration 
management and fault reporting tracking system play a crucial role in 
the ability of the railroad and the FRA to determine and fully 
understand the risks and their implications. Without an effective 
configuration management tracking system in place, it is difficult, if 
not impossible, to fairly evaluate risks associated with a product over 
its life-cycle.
    Paragraph (d)(10) requires the railroad to develop comprehensive 
plans and procedures for product implementation. Implementation (field 
validation or cutover) procedures must be prepared in detail and 
identify the processes necessary to verify that the PTC system is 
properly installed and documented, including measures to provide for 
the safety of train operations during installation. FRA will use this 
information to ascertain whether the product will be properly 
installed, maintained, and tested. FRA also believes that configuration 
management should reduce disarrangement issues. Further, configuration 
management will reduce the cost of troubleshooting by reducing the 
number of variables and will be more effective in promoting safety.
    Paragraph (d)(11) requires the railroad to provide a complete 
description of the particulars concerning measures required to assure 
that the PTC system, once implemented, continues to provide the 
expected safety level without degradation or variation over its life-
cycle. The measures specifically provide the prescribed intervals and 
criteria for the following: testing; scheduled preventive maintenance 
requirements; procedures for configuration management; and procedures 
for modifications, repair, replacement and adjustment of equipment. FRA 
intends to use this information, among other data, to monitor the PTC 
system to assure it continually functions as intended.
    Paragraph (d)(12) requires that each PTCSP include a description of 
each record concerning safe operation. Recordkeeping requirements for 
each product are discussed in Sec.  236.1037 of this part.
    Paragraph (d)(13) requires a safety analysis of unintended 
incursions into a work zone. Measuring incursion risks is a key safety 
risk assumption. Failing to identify incursion risk can have the effect 
of making a system seem safer on paper than it actually is. The 
requirements set forth in this paragraph attempt to mandate design 
consideration of incursion protection at an early stage in the system 
development process. The totality of the arrangements made to prevent 
unintended incursions or operation at higher than authorized speed 
within the work zone must be analyzed. That is, in addition to the 
functions of the PTC system, the required actions for dispatchers, 
train crews, and roadway workers in charge must be evaluated. 
Regardless of whether a PTC system has been previously approved or 
recognized, FRA will not accept a system that allows a single point 
human failure to defeat the essential protection intended by the 
Congress. See NTSB Recommendations R-08-05 and R-08-06. FRA believes 
that exposure should be identified because increases in risk due to 
increased exposure could be easily distinguished from increases in risk 
due solely to implementation and use of the proposed PTC system.
    In the past, little attention was given to formalizing incursion 
protection procedures. Training for crews has also not been uniform 
among organizations, and has frequently received inadequate attention. 
As a result, a variety of procedures and techniques evolved based on 
what has been observed or what just seemed correct at the time. This 
lack of structure, standardization, and formal training is inconsistent 
with the goal of increasing safety and regulatory efficiency.
    As proposed, paragraph (d)(14) would have required a more detailed 
description of any alternative arrangements provided under Sec.  
236.1011(a)(10), pertaining to at grade rail-to-rail crossings. APTA 
noted that the reference in this paragraph should be revised, as 
section 236.1011(a)(10) does not exist. The correct reference is Sec.  
236.1005(a)(1)(i).
    As previously mentioned, Sec.  236.1005(a) requires each applicable 
PTC system to be designed to prevent train-to-train collisions. Under 
that section, FRA has established various requirements that would apply 
to at-grade rail-to-rail crossings, also known as diamond crossings. 
While the final rule text includes certain specific technical 
requirements, it also provides the opportunity for each subject 
railroad to submit an alternative arrangement providing an equivalent 
level of safety as specified in an FRA approved PTCSP. Accordingly, 
under paragraph (d)(14), if the railroad intends to utilize alternative 
arrangements providing an equivalent level of safety to that of the 
table provided under Sec.  236.1005(a)(1)(i), each PTCSP must identify 
those alternative arrangements and methods, with any associated risk 
reduction measures, in its PTCSP.
    Paragraph (d)(15) requires a complete description of how the PTC 
system will enforce mandatory directives and signal indications, unless 
already addressed in the PTCDP. Paragraph (d)(16) refers to the 
requirement of Sec.  236.1019(f) that the PTCSP is aligned with the 
PTCIP, including any amendments.
    Under Sec.  236.1007, FRA requires certain limitations on PTC 
trains operating over 90 miles per hour, including compliance with 
Sec.  236.1029(c). Under Sec.  236.1029(c), FRA provides railroads with 
an opportunity to deviate from those limitations if the railroad 
describes and justifies the deviation in its PTCDP, PTCSP, or by 
reference to an Order of Particular Applicability, as applicable. Thus, 
paragraph (d)(17) reminds railroads that this is one of the optional 
elements that may be included in a PTCSP. This need

[[Page 2655]]

may also be addressed through review of the PTCDP.
    Railroads are required under Sec.  236.1005(c) to submit a complete 
description of their compliance regarding hazard detector integration 
and under Sec. Sec.  236.1005(g)-(k) to submit a temporary rerouting 
plan in the event of emergencies and planned maintenance. Sections 
236.1007 and 236.1033 also require the submission of certain documents 
and information. Paragraphs (d)(18), (d)(19), and (d)(20) remind 
railroads that such requirements must be fulfilled with the submission 
of the PTCSP. For example, under paragraph (d)(19), FRA expects each 
temporary rerouting plan to explain the host railroad's procedure 
relating to detouring the applicable traffic. In other words, FRA 
expects that each temporary rerouting plan address how the host 
railroad will choose the track that traffic will be rerouted onto. The 
plan should explain the factors that will be considered in determining 
whether and how the railroad should take advantage of temporary 
rerouting. FRA remains concerned about the unnecessary commingling of 
PTC and non-PTC traffic on the same track and expects each temporary 
rerouting plan to address this possibility. More specifically, each 
plan should describe how the railroad expects to make decisions to 
reroute non-PTC train traffic onto a PTC line, especially where another 
non-PTC line may be available. While FRA recognizes each railroad may 
seek to use the most cost effective route, FRA expects the railroad to 
also consider the level of risk associated with that route.
    In paragraph (e), FRA states the criteria to which FRA will refer 
when evaluating the PTCSP, depending upon the underlying technical 
approach. Whereas in subpart H of this part, the safety case is 
evaluated to determine whether it demonstrates, with a high degree of 
confidence, that relevant risk will be no greater under the new product 
than previously, the statutory mandate for PTC calls for a different 
approach. In crafting this approach, FRA has attempted to limit 
requirements for quantitative risk assessment to those situations where 
the technique is truly needed. Regardless of the type of PTC system, 
the safety case for the system must demonstrate that it will reliably 
execute all of the functions required by this subpart (particularly 
those provided under proposed Sec. Sec.  236.1005 and 236.1007). With 
this foundation, the additional criteria that must be met depend upon 
the type of PTC technology to be employed.
    It is FRA's understanding that PTC systems may be categorized as 
one of the following four system types: non-vital overlay; vital 
overlay; stand-alone; and mixed. Initially, however, all PTC systems 
will have some features that are not fully fail-safe in nature, even if 
onboard processing and certain wayside functions are fully fail-safe. 
Common causes include surveying errors of the track database, errors in 
consist weight or makeup from the railroad information technology 
systems, and the crew input errors of critical operational data. To the 
extent computer-aided dispatching systems are the only check on 
potential dispatcher error in the creation or inappropriate 
cancellation of mandatory directives, some room for undetected wrong-
side failure will continue to exist in this function as well.
    Paragraph (e)(1) specifies the required behavior for non-vital 
overlay systems. Based on previous experience with non-vital systems, 
FRA believes it is well within the technical capability of the 
railroads to reduce the level of risk on any particular track segment 
to a level of risk 80% lower than the level of risk prior to 
installation of PTC on that segment. For subsequent PTC system 
installations on the same track segment, FRA recognizes that requiring 
an additional 80% improvement may not be technically or economically 
practical. Therefore, FRA is only requiring that an entity installing 
or a modifying an existing PTC system demonstrate that the level of 
safety is equal to, and preferably greater than, the level of safety of 
the prior PTC system. The risk that must be reduced is the risk against 
which the PTC functionalities are directed, assuming a high level of 
availability. Note that the required functionalities themselves do not 
call for elimination of all risk of mishaps. It is scope of risk 
reduction that the functionalities describe that becomes the 100% 
universe which is the basis of comparison. Although it is understood 
that the system will endeavor to eliminate 100% of this risk--meaning 
that if the system worked as intended every time and was always 
available, 100% of the target risk would be eliminated--the analysis 
will need to account for cases where wrong side failure of the 
technology is coincident with a human failure potentially induced by 
reliance on the technology. Since, within an appropriate conservative 
engineering analysis (i.e., pro forma analysis), non-vital processing 
has the theoretical potential to result in more failures than will 
typically be experienced, a 20% margin is provided. In preparing the 
PTCSP, the railroad should affirmatively address how training and 
oversight--including programs of operational testing under 49 CFR 
217.9--will reduce the potential for inappropriate reliance by those 
charged with functioning in accordance with the underlying method of 
operation.
    The 80% reduction in risk for PTC preventable accidents must be 
demonstrated by an appropriate risk analysis acceptable to the 
Associate Administrator and must address all intended track segments 
upon which the system will be installed. Again, FRA does not expect, or 
require, that these types of systems will prevent all wrong side 
failures. However, FRA expects that the systems will be designed to be 
robust, all pertinent risk factors (including human factors) will be 
fully addressed, and that no corners will be cut to ``take advantage'' 
of the nominal allowance provided for non-vital approaches. FRA also 
encourages those using non-vital approaches to preserve as much as 
possible the potential for a transition to vital processing.
    The Rail Labor Organizations believe that FRA's position is 
inconsistent with safety. Wrong side failures occur when a PTC system 
fails to properly identify the track occupied by a train. According to 
the RLO, such failures, which are completely avoidable using current 
technology, can result in unnecessary penalty braking applications that 
risk causing train handling derailments due to in-train forces and may 
also cause a PTC system to fail to enforce a necessary stop. As such, 
the RLO believe that wrong side failures should not be considered an 
acceptable risk. Again, FRA is sympathetic in principle to the RLO 
concern. However, no signal or train control system is wholly without 
the potential for a wrong side failure; and the key to limiting their 
occurrence is identifying the potential and crafting mitigations where 
possible. Built on the foundation of existing methods of operation, PTC 
systems will drastically reduce unsafe events by providing a safety net 
for occasional human errors. It would be unwise to defer the promise of 
PTC technologies by demanding perfection and thereby permit accidents 
and casualties to continue.
    Paragraph (e)(2) addresses vital overlays. Unlike a non-vital 
system, the vital system must be designed to address, at a minimum, the 
factors delineated in Appendix C. The railroad and their vendors or 
suppliers are encouraged to carry out a more thorough design analysis 
addressing any other potential product specific hazards. FRA cannot 
overemphasize that vital overlay system designs must be fully designed 
to address the factors contained in

[[Page 2656]]

Appendix C. The associated risk analysis supporting this design 
analysis demonstrating compliance may be accomplished using any of the 
risk analysis approaches in subpart H, including abbreviated risk 
analysis.
    Paragraph (e)(3) addresses stand-alone PTC systems that are used to 
replace existing methods of operations. The PTCSP design and risk 
analysis submitted to the Associate Administrator must show that the 
system does not introduce any new hazards that have not been acceptably 
mitigated, based upon all proposed changes in railroad operation. GE 
proffered the suggestion that when the stand-alone system is created 
using proven principles of vital signaling, assessing the system risk 
is straightforward and not significantly different than with the vital 
overlay system. The importance of system availability and risk under 
operations in contingent mode become more significant factors. FRA 
agrees, but believes that the one of the fundamental issues that the 
agency must reconcile is the value of appropriately capturing these 
principles in new systems and with new technologies without 
artificially restricting their use. FRA must accordingly exercise great 
care when evaluating the safety cases presented to it, regardless of 
the type (overlay, stand-alone, or mixed).
    While FRA believes that a comprehensive safety analysis will be 
required for all systems, since it must provide sufficient information 
to the Associate Administrator to make a decision with a high degree of 
confidence, the required analysis for stand-alone systems is much more 
comprehensive than that required for vital overlay systems because it 
must provide sufficient information to the Associate Administrator to 
make a decision with a high degree of confidence. FRA will therefore 
exercise greater oversight when it uniquely and separately considers 
each request for stand-alone operations, and will render decisions in 
the context of the proposed operation and the associated risks. FRA 
recognizes that application of this standard to a new rail system for 
which there is no clear North American antecedent could present a 
conceptual challenge.
    Paragraph (e)(4) addresses mixed systems (i.e., systems that 
include a combination of the systems identified in paragraphs (e)(1) 
through (e)(3). Because of the inherent complexity of these systems, 
FRA will determine an appropriate approach for demonstrating compliance 
after consultation with the railroad. Any approach will, of course, 
require that the system perform the PTC requirements set forth in 
Sec. Sec.  236.1005 and 236.1007.
    Paragraph (f) discusses the factors that the Associate 
Administrator will consider in reviewing the PTCSP. In general, PTC 
systems will have some features that are not fail-safe in nature. 
Examples include surveys of the track database, errors in consist data 
from the railroad such as weight and makeup, and crew input errors. FRA 
participation in the design and testing of the PTC system product helps 
FRA to better understand the strengths and weaknesses of the product 
for which approval is requested, and facilitates the approval process.
    The railroad must establish through safety analysis that its 
assertions are true. This standard places the burden on the railroad to 
demonstrate that the safety analysis is accurate and sufficiently 
supports certification of the PTC system. The FRA Associate 
Administrator will determine whether the railroad's case has been made. 
As provided in subpart H, FRA believes that final agency determinations 
under this new subpart I should also be made at the technical level, 
rather than the policy level, due to the complex and sometimes esoteric 
subject matters associated with risk analysis and evaluation. This is 
particularly appropriate in light of the RSIA08's designation of the 
Associate Administrator for Railroad Safety as the Chief Safety Officer 
of FRA. When considering the PTC system's compliance with recognized 
standards in product development, FRA will weigh appropriate factors, 
including: the use of recognized standards in system design and safety 
analyses; the acceptable methods in risk estimates; the proven safety 
records for proposed components; and the overall complexity and novelty 
of the product design. In those cases where the submission lacks 
information the Associate Administrator deems necessary to make an 
informed safety decision, FRA will solicit the data from the railroad. 
If the railroad does not provide the requested information, FRA may 
determine that a safety hazard exists. Depending upon the amount and 
scope of the missing data, PTCSP approval, and the subsequent system 
certification, may be denied.
    While paragraph (f) summarizes how FRA intends to evaluate the risk 
analysis, paragraph (g) applies specifically to cases where a PTC 
system has already been installed and the railroad subsequently wants 
to install in a new PTC system. Paragraph (g) re-emphasizes that FRA 
policy regarding the safety of PTC systems is not, and cannot expect to 
be, static. Rather, FRA policy may evolve as railroad operations 
evolve, operating rules are refined, related hazards are addressed 
(e.g., broken rails), and other readily available options for risk 
reduction emerge and become more affordable. FRA embraces the concept 
of progressive improvement and expects that when new systems are 
installed to replace existing systems that actual safety outcomes equal 
or exceed those for the existing systems.
    Finally, paragraph (h) emphasizes the need for the PTCSP to 
carefully document all potential sources of error that can be 
introduced into the system and their corresponding mitigation 
strategies. FRA reserves the right to require quantitative, as opposed 
to qualitative risk assessments, especially in cases where there is 
significant residual risk or changes to the method of operations.
Section 236.1017 Independent Third Party Review of Verification and 
Validation
    As previously noted in the discussion regarding Sec.  236.1009(e), 
FRA may require a railroad to engage in an independent assessment of 
its PTC system. In the event an independent assessment is required, 
this section describes the applicable rules and procedures.
    Paragraph (a) establishes factors considered by FRA when requiring 
a third-party assessment. FRA will attempt to make a determination of 
the necessary level of third party assessment as early as possible in 
the approval process. However, based on issues that may arise during 
the development and testing processes, or during the detailed technical 
reviews of the PTCDP and PTCSP, FRA may deem it necessary to require a 
third party assessment at any time during the review process.
    Paragraph (b) is intended to make it clear that it is FRA that will 
make the determination of the acceptability of the independence of the 
third party to avoid any potential issues downstream regarding the 
acceptability of the assessor's independence. If a third party 
assessment is required, then each railroad is encouraged to identify in 
writing what entity it proposes to utilize as its third party assessor. 
Compliance with paragraph (b) is not mandatory. However, if FRA 
determines that the railroad's choice of a third party does not meet 
the level of independence contemplated under paragraph (c), then the 
railroad will be obligated to have the assessment repeated, at its 
expense, until it has been completed by a third party suitable to FRA.

[[Page 2657]]

    Paragraph (c) provides a definition of the term ``independent third 
party'' as used in this section. It limits independent third parties to 
those that are compensated by the railroad or an association on behalf 
of one or more railroads that is independent of the PTC system 
supplier. FRA believes that requiring the railroad to compensate a 
third party will heighten the railroad's interest in obtaining a 
quality analysis and will avoid ambiguous relationships between 
suppliers and third parties that could indicate possible conflicts of 
interest.
    Paragraph (d) explains that the minimum requirements of a third 
party audit are outlined in Appendix F and that FRA has discretion to 
the limit the extent of the third party assessment. As the criteria in 
Appendix F are, for the most part, technology neutral, FRA has adopted 
them with minor changes, for use with both subparts H and I of this 
part. FRA intends to limit the scope of the assessment to areas of the 
safety Verification and Validation as much as possible, within the 
bounds of FRA's regulatory obligations. This will allow reviewers to 
focus on areas of greatest safety concern and eliminate any unnecessary 
expense to the railroad. In order to limit the number of third-party 
assessments, FRA first strives to inform the railroad as to what 
portions of a submittal could be amended to avoid the necessity and 
expense of a third-party assessment altogether. However, FRA wishes to 
make it clear that Appendix F represents minimum requirements and that, 
if circumstances warrant, FRA may expand upon the Appendix F 
requirements as necessary to enable FRA to render a decision that is in 
the public interest (i.e., if FRA is unable to certify the system 
without the additional information).
Section 236.1019 Main Line Track Exceptions
    The RSIA08 generally defines ``main line'' as ``a segment of 
railroad tracks over which 5,000,000 or more gross tons of railroad 
traffic is transported annually. See 49 U.S.C. 20157(i)(2). However, 
FRA may also define ``main line'' by regulation ``for intercity rail 
passenger transportation or commuter rail passenger transportation 
routes or segments over which limited or no freight railroad operations 
occur.'' See 49 U.S.C. 20157(i)(2)(B); 49 CFR 1.49(oo). FRA recognizes 
that there may be circumstances where certain statutory PTC system 
implementation and operation requirements are not practical and provide 
no significant safety benefits. In those circumstances, FRA will 
exercise its statutory discretion provided under 49 U.S.C. 
20157(i)(2)(B).
    In accordance with the authority provided by the statute and with 
carefully considered recommendations from the RSAC, FRA will consider 
requests for designation of track over which rail operations are 
conducted as ``other than main line track'' for passenger and commuter 
railroads, or freight railroads operating jointly with passenger or 
commuter railroads. Such relief may be granted only after request by 
the railroad or railroads filing a PTCIP and approval by the Associate 
Administrator.
    Paragraph (a), therefore, requires the submittal of a main line 
track exclusion addendum (MTEA) to any PTCIP filed by a railroad that 
seeks to have any particular track segment deemed as other than main 
line. Since the statute only provides for such regulatory flexibility 
as it applies to passenger transportation routes or segments where 
limited or no freight railroad operations occur, only a passenger 
railroad may file an MTEA as part of its PTCIP. This may include a 
PTCIP jointly filed by freight and passenger railroads. In fact, FRA 
expects that in the case of joint operations, only one MTEA should be 
agreed upon and submitted by the railroads filing the PTCIP. After 
reviewing a submitted MTEA, FRA may provide full or conditional 
approval for the requested exemptions.
    Each MTEA must clearly identify and define the physical boundaries, 
use, and characterization of the trackage for which exclusion is 
requested. When describing each track's use and characterization, FRA 
expects the requesting railroad or railroads to include copies of the 
applicable track and signal charts. Ultimately, FRA expects each MTEA 
to include information sufficiently specific to enable easy segregation 
between main line track and non-main line track. In the event the 
railroad subsequently requests additional track to be considered for 
exclusion, a well-defined MTEA should reduce the amount of future 
information required to be submitted to FRA. Moreover, if FRA decides 
to grant only certain requests in an MTEA, the portions of track for 
which FRA has determined should remain considered as main line track 
can be easily severed from the MTEA. Otherwise, the entire MTEA, and 
thus its concomitant PTCIP, may be entirely disapproved by FRA, 
increasing the risk of the railroad or railroads not meeting its 
statutory deadline for PTC implementation and operation.
    For each particular track segment, the MTEA must also provide a 
justification for such designation in accordance with paragraphs (b) or 
(c) of this section.
    Paragraph (b) specifically addresses the conditions for relief for 
passenger and commuter railroads with respect to passenger-only 
terminal areas. As noted previously in the analysis of Sec.  
236.1005(b), any track within a yard used exclusively by freight 
operations moving at restricted speed is excepted from the definition 
of main line. In those situations, operations are usually limited to 
preparing trains for transportation and do not usually include actual 
transportation. This automatic exclusion does not extend to yard or 
terminal tracks that include passenger operations. Such operations may 
also include the boarding and disembarking of passengers, heightening 
FRA's sensitivity to safety. Moreover, while FRA could not expend its 
limited resources to review whether a freight-only yard should be 
deemed other than main line track, FRA believes that the relatively 
lower number of passenger yards and terminals would allow for such 
review. Accordingly, FRA believes that it is appropriate to review 
these circumstances on a case-by-case basis.
    During the PTC Working Group discussions, the major passenger 
railroads requested an exception for tracks in passenger terminal areas 
because of the impracticability of installing PTC. These are locations 
where signal systems govern movements over very complex special track 
work divided into short signal blocks. Operating speeds are low (not to 
exceed 20 miles per hour), and locomotive engineers moving in this 
environment expect conflicting traffic and restrictive signals. 
Although low-speed collisions do occasionally occur in these 
environments, the consequences are low; and the rate of occurrence is 
very low in relation to the exposure. It is the nature of current-
generation PTC systems to use conservative braking algorithms. 
Requiring PTC to govern short blocks in congested terminals would add 
to congestion and frustrate efficient passenger service, in the 
judgment of those who operate these railroads. The density of wayside 
infrastructure required to effect PTC functions in these terminal areas 
would also be exceptionally costly in relation to the benefits 
obtained. FRA agrees that technical solutions to address these concerns 
are not presently available. FRA does believe that the appropriate role 
for PTC in this context is to enforce the maximum allowable speed 
(which is presently accomplished in cab signal territory through use of 
automatic speed control, a practice which could continue where already 
in place).

[[Page 2658]]

    If FRA grants relief, the conditions of paragraphs (b)(1), (b)(2), 
or (b)(3), as applicable, as well as conditions attached to the 
approval, must be strictly adhered to.
    Under paragraph (b)(1), relief under paragraph (b) is limited to 
operations that do not exceed 20 miles per hour. The PTC Working Group 
agreed upon the 20 miles per hour limitation, instead of requiring 
restricted speed, because the operations in question will be by signal 
indication in congested and complex terminals with short block lengths 
and numerous turnouts. FRA agrees with the PTC Working Group that the 
use of restricted speed in this environment would unnecessarily 
exacerbate congestion, delay trains, and diminish the quality of rail 
passenger service.
    Moreover, when trains on the excluded track are controlled by a 
locomotive with an operative PTC onboard apparatus that PTC system 
component must enforce the regulatory speed limit or actual maximum 
authorized speed, whichever is less. While the actual track may not be 
outfitted with a PTC system in light of an MTEA approval, FRA believes 
it is nevertheless prudent to require such enforcement when the 
technology is available on the operating locomotives. This can be 
accomplished in cab signal territory using existing automatic train 
stop technology and outside of cab signal territory by mapping the 
terminal and causing the onboard computer to enforce the maximum speed 
allowed.
    FRA also limits relief under paragraph (b)(2) to operations that 
enforce interlocking rules. Under interlocking rules, trains are 
prohibited from moving in reverse directions without dispatcher 
permission on track where there are no signal indications. FRA believes 
that such a restriction will minimize the potential for a head-on 
impact.
    Also, under paragraph (b)(3), such operations are only allowed in 
yard or terminal areas where no freight operations are permitted. While 
the definition of main line may not include yard tracks used solely by 
freight operations, FRA is not extending any relief or exception to 
tracks within yards or terminals shared by freight and passenger 
operations. The collision of a passenger train with a freight consist 
is typically a more severe condition because of the greater mass of the 
freight equipment. However, FRA did receive a comment suggesting some 
latitude within terminals when passenger trains are moving without 
passengers (e.g., to access repair and servicing areas). FRA agrees 
that low-speed operations under those conditions should be acceptable 
as trains are prepared for transportation. FRA has not included a 
request by Amtrak (discussed below) to allow movements within major 
terminals at up to 30 miles per hour in mixed passenger and freight 
service, which appears in FRA's judgment to fall outside of the 
authority to provide exclusions conferred on FRA by the law.
    Paragraph (c) provides the conditions under which joint limited 
passenger and freight operations may occur on defined track segments 
without the requirement for installation of PTC. Under Sec.  236.1003 
(Definitions), ``limited operations'' is defined as ``operations on 
main line track that have limited or no freight operations and are 
approved to be excepted from this subpart's PTC system implementation 
and operation requirements in accordance with Sec.  236.1019(c). This 
paragraph provides five alternative paths to the main line exception, 
three of which were contained in the proposed rule and a fourth and 
fifth that responds to comments on the proposed rule.
    The three alternatives derived from the NPRM are set forth in 
paragraph (c)(1). First, under paragraph (c)(1), an exception may be 
available where both the freight and passenger trains are limited to 
restricted speed. Such operations are feasible only for short 
distances, and FRA will examine the circumstances involved to ensure 
that the exposure is limited and that appropriate operating rules and 
training are in place.
    Second, under paragraph (c)(1)(ii), FRA will consider an exception 
where temporal separation of the freight and passenger operations can 
be ensured. A more complete definition of temporal separation is 
provided in paragraph (e). Temporal separation of passenger and freight 
services reduces risk because the likelihood of a collision is reduced 
(e.g., due to freight cars engaged in switching that are not properly 
secured) and the possibility of a relatively more severe collision 
between a passenger train and much heavier freight consist is obviated.
    Third, under paragraph (c)(1)(iii), FRA will consider commingled 
freight and passenger operations provided that a jointly agreed risk 
analysis is provided by the passenger and freight railroads, and the 
level of safety is the same as that which would be provided under one 
of the two prior options selected as the base case. FRA requested 
comments on whether FRA or the subject railroad should determine the 
appropriate base case, but received none. FRA recognizes that there may 
be situations where temporal separation may not be possible. In such 
situations, FRA may allow commingled operations provided the risk to 
the passenger operation is no greater than if the passenger and freight 
trains were operating under temporal separation or with all trains 
limited to restricted speed. For an exception to be made under 
paragraph (c)(3), FRA requires a risk analysis jointly agreed to and 
submitted by the applicable freight and passenger services. This 
ensures that the risks and consequences to both parties have been fully 
analyzed, understood, and mitigated to the extent practical. FRA would 
expect that the moving party would elect a base case offering the 
greatest clarity and justify the selection.
    Comments on the proposed rule generally supported the 
aforementioned exclusions or were silent.
    In its comments on the NPRM, Amtrak requested further relief 
relating to lines requiring the implementation and operation of a PTC 
system due solely to the presence of light-density passenger traffic. 
According to Amtrak, the defining characteristic of light-density lines 
is the nature of the train traffic; light-density patterns on these 
lines lead to a correspondingly low risk of collision. Amtrak also 
asserted that, due to relatively limited wear and tear from lower 
traffic densities, these lines often have fewer track workers on site, 
further reducing the chance of collisions and incursions into work 
zones. Thus, states Amtrak, one of the principal reasons for installing 
PTC--collision avoidance--is a relatively low risk on many light 
density lines. With only marginal safety benefits anticipated from PTC 
use in such applications, Amtrak believed that there may be minimal 
justification for installing PTC on certain light-density lines.
    Amtrak further noted that FRA itself had concluded that the costs 
of PTC generally exceed its benefits, and Amtrak urged that this may be 
even more so on light-density lines. Amtrak believed that Congress 
understood this issue and thus created the regulatory flexibility for 
the definition of ``main line'' for passenger routes found at 49 U.S.C. 
20157(i)(2)(B) as a means to allow the Secretary to exempt certain 
routes from the PTC mandate. According to Amtrak, this provision 
essentially allows the Secretary to define certain passenger routes 
with limited or no freight traffic as other than ``main line,'' thereby 
effectively exempting such lines from the reach of the PTC mandate 
because the mandate only applies to railroad operations over ``main 
line[s].'' Said another way, urged Amtrak, the provision allows the 
Secretary the freedom to decide in what circumstances such routes 
should be considered ``main lines'' and thus be

[[Page 2659]]

required to install PTC-pursuant to whatever factors the Secretary 
deems appropriate through the rulemaking process.
    Amtrak urged that the Secretary should use this flexibility to 
limit which passenger routes it defines as ``main lines'' to those 
deemed to warrant the use of PTC using the FRA's usual risk-based 
approach to safety regulation and traditional measures of 
reasonableness, costs, and benefits. Amtrak posited that such a risk-
based analysis by FRA would likely lead to the conclusion that PTC is 
simply not needed on many light-density lines over which passenger 
trains currently operate. Amtrak therefore asked that FRA exercise this 
authority by working with Amtrak and the rail industry to exempt 
certain light density freight lines which host passenger traffic from 
the obligation to install PTC where operating and safety conditions do 
not warrant an advanced signal system.
    Should FRA choose not to exempt some of these light density freight 
lines over which passenger trains operate, Amtrak felt that the high 
costs of full PTC systems will be passed on to the passenger and 
freight operators of these routes. According to Amtrak, this obligation 
could threaten the continuation of intercity passenger rail service on 
several routes, including lines in California, Colorado, Kansas, Maine, 
Massachusetts, Michigan, Missouri, New Hampshire, New Mexico, North 
Dakota, Vermont, and Virginia, on what are potentially light density 
lines. Additionally, states Amtrak, this obligation, where it can be 
financed, could force the diversion of significant capital dollars away 
from essential safety investments in track and other infrastructure 
improvements, which are typically the leading safety risks for such 
light-density operations. According to Amtrak, the cost of PTC 
installation on these lines may be so out of proportion to the benefit 
that Amtrak's service will need to be rerouted onto a different line 
(e.g., to a Class I line with PIH materials) if a reroute option 
exists, or eliminated entirely because there is no feasible alternate 
route and no party is willing or able to bear the cost of installing 
PTC on the existing route. The defining characteristic of light-density 
lines is the nature of the train traffic: Low density patterns on these 
lines lead to a correspondingly low risk of collision.
    According to the Amtrak testimony, the ``limited operations 
exception'' in subsection 236.1019(c) of the NPRM did not provide a 
practical solution to the problem created by defining all light-density 
routes and terminal areas with passenger service as ``main lines.'' 
Amtrak stated that this subsection would arguably require installation 
of PTC on most of the trackage and locomotives of the Terminal Railroad 
Association of St. Louis (TRRA) unless: (1) The entire terminal 
operates at restricted speed (which TRRA is unlikely to agree to); (2) 
passenger and freight trains are temporally separated (which would not 
be practical on TRRA, and is unlikely to be practical on any of the 
light-density lines over which Amtrak operates, due to the 24/7 nature 
of railroad operations); or (3) a risk mitigation plan can be effected 
that would achieve a level of safety not less than would pertain if all 
operations on TRRA were at restricted speed or subject to temporal 
separation. Accordingly, Amtrak recommended: (a) That the FRA adopt a 
risk analysis-based definition of ``main line'' passenger routes that 
excludes light-density lines on which the installation of PTC is not 
warranted; and (b) with respect to freight terminal areas in which 
passenger trains operate, that the FRA modify the limited operations 
exception in subsection 236.1019(c) to require that all trains be 
limited to 30 miles per hour rather than to restricted speed, or that 
non-PTC equipped freight terminals be deemed as other than ``main 
lines'' so long as all passenger operations are pursuant to signal 
indication and at speeds not greater than 30 miles per hour (with 
speeds reduced to not greater than restricted speed on unsignaled 
trackage or if the signals should fail).
    FRA believes that Amtrak's request is much broader than 
contemplated by the law. FRA notes that TRRA is a very busy terminal 
operation. FRA does not believe that the ``limited freight operations'' 
concept is in any way applicable under those circumstances. Nor is 
there any indication in law that FRA was expected to fall back to 
traditional cost-benefit principles in relation to PTC and scheduled 
passenger service. However, there are a number of Amtrak routes with 
limited freight operations that will not otherwise be equipped with PTC 
because they are operated by other than Class I railroads. Further, 
there are some Class I lines with less than 5 million gross tons, or no 
PIH, that also warrant individualized review to the extent Amtrak and 
the host railroad might elect to propose it.
    Accordingly, in response to the Amtrak comments, paragraphs (c)(2) 
and (c)(3) have been added to the final rule to provide an option by 
which certain additional types of limited passenger train operations 
may qualify for a main line track exception where freight operations 
are also suitably limited and the circumstances could lead to 
significant hardship and cost that might overwhelm the value of the 
passenger service provided. Paragraph (c)(2) deals with lines where the 
host is not a Class I freight railroad, describing characteristics of 
track segments that might warrant relief from the requirement to 
install PTC. Paragraph (c)(2)(i) pertains to passenger service 
involving up to four regularly scheduled passenger trains during a 
calendar day over a segment of unsignaled track on which less than 15 
million gross tons of freight traffic is transported annually. 
Paragraph (c)(2)(ii) pertains to passenger service involving up to 
twelve regularly scheduled passenger trains during a calendar day over 
a segment of signaled track on which less than 15 million gross tons of 
freight traffic is transported annually. In FRA's experience, four 
trains per day in unsignaled territory and twelve trains per day in 
signaled territory can be expected to be handled safely in combination 
with 15 million gross tons of freight traffic if the operations are 
carefully scrutinized and appropriate mitigation measures are taken to 
accommodate the particular operating environment in question. Paragraph 
(c)(2) derived indirectly from discussions in the RSAC in response to 
comments by Amtrak set forth above. The PTC Working Group proposed an 
exception that might have been available anywhere an intercity or 
commuter railroad operated over a line with 5 million gross tons of 
freight traffic, including Class I lines and the lines of the intercity 
or commuter railroad. This would have opened the potential for a 
considerable exception for lines with very light freight density under 
circumstances not thoroughly explored in the short time available to 
the working group (e.g., on commuter rail branch lines, low density 
track segments on Class I railroads, etc.).
    Subsequent to the RSAC activities, Amtrak notified FRA that its 
conversations with Class II and III railroads, whose lines have been at 
the root of the Amtrak comments, revealed that some of the situations 
involved freight traffic exceeding 5 million gross tons, potentially 
rendering the exception ineffective for this purpose. At the same time, 
FRA noted that the policy rationale behind the proposed additional 
exception was related as much to the inherent difficulty associated 
with PTC installation during the initial period defined by law, given 
that the railroads identified by Amtrak were for the most part very 
small operations with limited technical

[[Page 2660]]

capacity and limited safety exposure. It was clear that in these cases 
care would need to be taken to analyze collision risk and potentially 
require mitigations.\7\ Accordingly, FRA has endeavored to address the 
concern brought forward by Amtrak with a provision that is broad enough 
to permit consideration of actual circumstances, limit this particular 
exception to operations over railroads that would not otherwise need to 
install PTC (e.g., Class II and III freight railroads), provide for a 
thorough review process, and make explicit reference to the potential 
requirement for safety mitigations. In this regard, FRA has chosen 15 
million gross tons as a threshold that should accommodate situations 
where Amtrak trains will, in actuality, face few conflicts with freight 
movements (i.e., requiring trains to clear the main line for meets and 
passes or to wait at junctions) and where mitigations are in place or 
could be put in place to establish a high sense of confidence that 
operations will continue to be conducted safely. FRA believes that less 
than 15 million gross tons represents a fair test of ``limited freight 
operations'' for these purposes, with the further caveat that specific 
operating arrangements will be examined in each case. FRA emphasizes 
that this is not an entitlement, but an exclusion for which the 
affected railroads will need to make a suitable case.
---------------------------------------------------------------------------

    \7\ An example of an existing mitigation, which is provided to 
support service quality but also supports safety, is the practice of 
one Class III Amtrak host and its connecting freight partner to hold 
out fleeted empty coal trains off the Class III property during the 
period that Amtrak is running. While not constituting strict 
``temporal separation,'' it does significantly reduce collision risk 
over the route.
---------------------------------------------------------------------------

    Amtrak also provided to FRA a spreadsheet identifying each of its 
route segments with attributes such as route length, freight tonnage, 
number of Amtrak trains, and numbers of commuter trains. FRA further 
reviewed this information in light of Amtrak's request for main track 
exceptions. FRA noted a number of segments of the Amtrak system on 
Class I railroads where the number of Amtrak trains was low and the 
freight tonnage was also low (less than 15 million gross tons). Each of 
these lines, with the exception of one 33-mile segment, is signalized. 
FRA further noted that, with both Amtrak and Class I railroad 
locomotives equipped for PTC, use of partial PTC technology (e.g., 
monitoring of switches where trains frequently clear) should be 
available as a mitigation for collision risk. Accordingly, in paragraph 
(c)(3), FRA has provided a further narrow exception for Class I lines 
carrying no more than four intercity or commuter passenger trains per 
day and cumulative annual tonnage of less than 15 million gross tons, 
subject to FRA review. The limit of four trains takes into 
consideration that it is much less burdensome to equip the wayside of a 
Class I rail line than to install a full PTC system on a railroad that 
would not otherwise require one. Again, the exception is not automatic, 
and FRA's approval of a particular line segment would be discretionary. 
Any Class I line carrying both 5 million gross tons and PIH traffic 
would, of course, not be eligible for consideration.\8\
---------------------------------------------------------------------------

    \8\ Freight tonnage on Amtrak lines varies from zero on two 
segments to over 150 million gross tons. On a per-mile basis, 15 
million gross tons falls into the twenty-first percentile of Amtrak 
track miles. The candidate lines on the Class I system comprise 
about 6% of Amtrak's route structure.
---------------------------------------------------------------------------

    The new paragraph (d) makes clear that FRA will carefully review 
each proposed main track exception and may require that it be supported 
by appropriate hazard analysis and mitigations. FRA has previously 
vetted through the RSAC a Collision Hazard Analysis Guide that can be 
useful for this purpose. If FRA determines that freight operations are 
not ``limited'' as a matter of safety exposure or that proposed safety 
mitigations are inadequate, FRA will deny the exception.
    Paragraph (e) (formerly paragraph (d) in the proposed rule) 
provides the definition of temporal separation with respect to 
paragraph (c)(2). The temporal separation approach is currently used 
under the FRA-Federal Transit Administration Joint Policy on Shared 
Use, which permits co-existence of light rail passenger services 
(during the day) and local freight service (during the nighttime). See 
Joint Statement of Agency Policy Concerning Shared Use of the Tracks of 
the General Railroad System by Conventional Railroads and Light Rail 
Transit Systems, 65 FR 42,526 (July 10, 2000); FRA Statement of Agency 
Policy Concerning Jurisdiction Over the Safety of Railroad Passenger 
Operations and Waivers Related to Shared Use of the Tracks of the 
General Railroad System by Light Rail and Conventional Equipment, 65 FR 
42,529 (July 10, 2000). Conventional rail technology and secure 
procedures are used to ensure that these services do not commingle. 
Amtrak representatives in the PTC Working Group were confident that 
more refined temporal separation strategies could be employed on 
smaller railroads that carry light freight volumes and few Amtrak 
trains (e.g., one train per day or one train per day in each 
direction). The Passenger Task Force agreed. The UTA also supported the 
temporal separation exception under former paragraph (d), having stated 
that temporal separation is important in the operations of many 
commuter and intercity passenger railroad carriers.
    Paragraph (f) (paragraph (e) in the proposed rule) ensures that by 
the time the railroad submits its PTCSP, no unapproved changes have 
been made to the MTEA and that the PTC system, as implemented, reflects 
the PTCIP and its MTEA. Under this final rule, the PTCSP must reflect 
the PTCIP, including its MTEA, as it was approved or how it has been 
modified in accordance with Sec.  236.1021. FRA believes that it is 
also important that the railroad attest that no other changes to the 
documents or to the PTC system, as implemented, have been made.
    FRA understands that, as a railroad implements its PTC system in 
accordance with its PTCIP or even after it receives PTC System 
Certification, the railroad may decide to modify the scope of which 
tracks it believes to be other than main line. To effectuate such 
changes, paragraph (g) requires FRA review. In the case that the 
railroad believes that such relief is warranted, the railroad may file 
in accordance with Sec.  236.1021 a request for amendment of the PTCIP, 
which will eventually be incorporated into or referenced by the PTCSP 
upon PTCSP submission. Each request, however, must be fully justified 
to and approved by the Associate Administrator before the requested 
change can be made to the PTCIP. If such a RFA is submitted 
simultaneously with the PTCSP, the RFA may not be approved, even if the 
PTCSP is otherwise acceptable. A change made to an MTEA subsequent to 
FRA approval of its associated PTCIP that involves removal or reduction 
in functionality of the PTC system will be treated as a material 
modification. In keeping with traditional signaling principles, such 
requests must be formally submitted for review and approval by FRA.
Section 236.1021 Discontinuances, Material Modifications, and 
Amendments
    FRA recognizes that, after submittal of a plan or implementation of 
a train control system, the subject railroad may have legitimate 
reasons for making changes in the system design and the locations where 
the system is installed. In light of the statutory and regulatory 
mandates, however, FRA believes that the railroad should be required to 
request FRA approval prior to effectuating certain changes. Section 
236.1021 provides the scope and

[[Page 2661]]

procedure for requesting and approving those changes. For example, all 
requests for covered changes must be made in a request for amendment 
(RFA) of the subject PTC system or plan. While Sec.  236.1021 includes 
lengthy descriptions of what changes may, or may not, require FRA 
approval, there are various places elsewhere in subpart I that also 
require the filing of a RFA.
    Paragraph (a) requires FRA approval prior to certain PTC system 
changes. FRA expects that if a railroad wants to make a PTC system 
change covered by subpart I, then any such change would result in 
noncompliance with one of the railroad's plans approved under this 
subpart. For instance, if a railroad seeks to modify the geographical 
limits of its PTC implementation, such changes would not be reflected 
in the PTCIP. Accordingly, under paragraph (a), after a plan is 
approved by FRA and before any change is made to the PTC system's 
development, implementation, or operation, the railroad must file a RFA 
to the subject plan.
    FRA considers an amendment to be a formal or official change made 
to the PTC system or its associated PTCIP, PTCDP, or PTCSP. Amendments 
can add, remove, or update parts of these documents, which may reflect 
proposed changes to the development, implementation, or operation of 
its PTC system. FRA believes that an amending procedure provides a 
simpler and cleaner option than requiring the railroad to file an 
entirely new plan.
    While the railroad may develop a RFA without FRA input or 
involvement, FRA believes that it is more advantageous for the railroad 
to informally confer with FRA before formally submitting its RFA. If 
FRA is not involved in the drafting process, FRA may not have a 
complete understanding of the system, making it difficult for FRA to 
evaluate the impact of the proposed changes on public safety. After RFA 
submission, all applicable correspondence between FRA and the railroad 
must be made formally in the associated docket, as further discussed 
below. In such a situation, FRA's review may take a significantly 
longer time than usual. If FRA continues to not understand the impact, 
it may request a third party audit, which would only further delay a 
decision on the request. Accordingly, FRA believes it is more 
advantageous for the railroad drafting an RFA to informally confer with 
FRA before its formal submission of the change request. The railroad 
would then be provided an opportunity to discuss the details of the 
change and to assure FRA's understanding of what the railroad wishes to 
change and of the change's potential impact.
    Under paragraph (b), once the RFA is approved, the railroad shall 
adopt those changes into the subject plan and immediately ensure that 
its PTC complies with the plan, as amended. FRA expects that each PTC 
system accurately reflects the information in its associated approved 
plans. FRA believes that this requirement will also incentivize 
railroads to make approved changes as quickly as possible. Otherwise, 
if a railroad delays in implementing the changes reflected in an 
approved RFA, FRA may find it difficult to enforce its regulations 
until implementation is completed, since the plans and PTC system do 
not accurately and adequately reflect each other. In such 
circumstances, a railroad may be assessed a civil penalty for violating 
its plan or for falsifying records.
    Any change to a PTCIP, PTCDP, or PTCSP, which may include removal 
or discontinuance of any signal system, may not take effect until after 
FRA has approved the corresponding submitted or amended PTCIP, PTCDP, 
or PTCSP. FRA may provide partial or conditional approval. Until FRA 
has granted appropriate relief or approval, the railroad may not make 
the change, and once a requested change has been made, the railroad 
must comply with requested change.
    FRA recognizes that a railroad may wish to remove an existing train 
control system due to new and appropriate PTC system implementation. 
For train control systems existing prior to promulgation of subpart I, 
any request for a material modification or discontinuance must be made 
pursuant to part 235. Paragraph (c), however, provides the railroads 
with an opportunity to instead request such changes in accordance with 
proposed Sec.  236.1021. FRA believes that this requirement will reduce 
the number of required filings and would otherwise simplify the process 
requesting material modifications or discontinuances.
    Paragraph (d) provides the minimum information required to be 
submitted to FRA when requesting an amendment. While the procedural 
rules here are different than those in part 235, FRA expects that the 
same or similar information be provided. Accordingly, under paragraph 
(d)(1), the RFA must contain the information required in 235.10. 
Paragraph (d)(1) also requires the railroad to submit, upon FRA 
request, certain additional information, including the information 
referenced in Sec.  235.12. Paragraphs (d)(2) through (d)(7) provide 
further examples of such information. While such information may only 
be required upon request, FRA urges each railroad to include this 
information in its RFA to help expedite the review process.
    FRA believes that paragraphs (d)(2) through (d)(6) are self-
explanatory. However, according to paragraph (d)(7), FRA may require 
with each RFA an explanation of whether each change to the PTCSP is 
planned or unplanned. Planned changes are those that the system 
developer and the railroad have included in the safety analysis 
associated with the PTC system, but have not yet implemented. These 
changes provide enhanced functionality to the system, and FRA strongly 
encourages railroads to include PTC system improvements that further 
increase safety. A planned change may require FRA approved regression 
testing to demonstrate that its implementation has not had an adverse 
affect on the system it is augmenting. Each planned change must be 
clearly identified as part of the PTCSP, and the PTCSP safety analysis 
must show the affect that its implementation will have on safety.
    Unplanned changes are those either not foreseen by the railroad or 
developer, but nevertheless necessary to ensure system safety, or are 
unplanned functional enhancements from the original core system. The 
scope of any additional work necessary to ensure safety may depend upon 
when in the development cycle phase the changes are introduced. For 
instance, if the PTCDP has not yet been submitted to FRA, no FRA 
involvement is required. However, if the PTCDP has been submitted to 
FRA, or if the change impacts the safety functionality of the system 
once a Type Approval has been issued, and a PTCSP has not yet been 
submitted, the railroad must submit a RFA requesting and documenting 
that change. Once FRA approves that RFA, FRA expects the subsequently 
filed PTCSP to account for the change in analysis.
    If the change is made after approval of the PTCSP and the system 
has been certified by FRA, a RFA must be submitted to FRA for approval. 
Because this requires significant effort by FRA and the railroad, FRA 
expects that every effort will be made to eliminate the need for 
unplanned changes. If the railroad and the vendor or supplier submit 
unplanned safety related changes that FRA believes are a significant 
amount or inordinately complex, FRA may revoke any approvals previously 
granted and disallow the use of the product until such time the 
railroad demonstrates the product is sufficiently mature.
    Paragraph (e) provides that if a RFA is submitted for a 
discontinuance or a

[[Page 2662]]

material modification to a portion or all of its PTC system, a notice 
of its submission shall be published in the Federal Register. 
Interested parties will be provided an opportunity to comment on the 
RFA, which will be located in an identified docket.
    Paragraph (f) makes it clear that FRA will consider all impacts on 
public safety prior to approval or disapproval of any request for 
discontinuance, modification, or amendment of a PTC system and any 
associated changes in the existing signal system that may have been 
concurrently submitted. While the economic impact to the affected 
parties may be considered by FRA, the primary and final deciding factor 
on any FRA decision is safety. FRA will consider not only how safety is 
affected by installation of the system, but how safety is impacted by 
the failure modes of the system.
    The Southern California Regional Rail Authority submitted comments 
requesting ``easy streamlined approval'' of incremental changes and 
additions to the plans based on procurement and type approval of vendor 
or supplier products. However, FRA would like to point out that, where 
lines change during or subsequent to the railroad's submission of its 
PTCIP, the railroad merely needs to identify its plan for 
implementation on such lines in its RFA. This does not appear to be an 
overly burdensome task.
    The purpose of paragraph (g) is to emphasize the right of FRA to 
unilaterally issue a new Type Approval, with whatever conditions are 
necessary to ensure safety based on the impact of the proposed changes.
    In paragraph (h), FRA makes clear that it considers any implemented 
PTC system to be a safety device. Accordingly, the discontinuance, 
modification, or other change of the implemented system or its 
geographical limits will not be authorized without prior FRA approval. 
While this requirement primarily applies to safety critical changes, 
FRA believes that they should also apply to all changes that will 
affect interoperability. The principles expressed in the paragraph 
parallel those embodied in part 235, which implements 49 U.S.C. 
20502(a). Railroads may need to review Sec.  236.1005(b)(4) and supply 
the required information in an RFA submission.
    That said, FRA recognizes that there are a limited number of 
situations where changes of the PTC system may not have an adverse 
impact upon public safety. Specific situations where prior FRA approval 
is required are provided in paragraphs (h)(1) through (h)(4).
    Paragraph (i) provides the exceptions from the requirement for 
prior approval in cases where the discontinuance of a system or system 
element will be treated as pre-approved, as when a line of railroad is 
abandoned.
    Paragraph (j) provides exceptions for certain lesser changes that 
are not expected to materially affect system risk, such as removal of 
an electric lock from a switch where speed is low and trains are not 
allowed to clear.
    The AAR submitted comment that paragraphs (j)(2) and (j)(3) should 
be revised to recognize the allowance for removal of a signal used in 
lieu of an electric or mechanical lock in the same manner as removal of 
the electric or mechanical lock. These two paragraphs are intended to 
recognize that where train speed over the switch does not exceed 20 
miles per hour, or where trains are not permitted to clear the main 
track at the switch, removal of the devices intended to provide the 
necessary protection should not require the submission of a filing for 
FRA approval.
    The regulation requiring the installation of an electric or 
mechanical lock identifies the allowance for a signal used in lieu 
thereof (see Sec.  236.410). FRA agrees with the AAR that when the 
requirement for an electric or mechanical lock, or a signal used in 
lieu thereof, are eliminated, the removal of any of these devices in 
their entirety without filing for approval is appropriate. FRA has 
therefore revised paragraphs (j)(2) and (j)(3) to clarify these 
allowances.
    Paragraph (k) provides additional exceptions consisting of 
modifications associated with changes in the track structure or 
temporary construction. FRA notes that only temporary removal of the 
PTC system without prior FRA approval is allowed to support highway 
rail separation construction or damage to the PTC system by 
catastrophic events. In both cases, the PTC system must be restored to 
operation no later than 6 months after completion of the event.
    Caltrain submitted comments stating that proposed paragraph (k)(6) 
and Sec.  236.1009(a)(2)(ii)(B) appear to address the installation of 
new track in an inconsistent manner. While proposed paragraph (k)(6) 
states that it will not be necessary to file an RFA for the 
installation of new track, Sec.  236.1009(a)(2)(ii)(B) states that an 
RFA must be filed if railroad intends to add, subtract, or otherwise 
materially modify one or more lines of railroad for which installation 
of a PTC system is required.
    FRA agrees that there appears to have been a conflict between the 
provisions contained in paragraph (k)(6) and Sec.  
236.1009(a)(2)(ii)(B). In light of the fact that FRA considers it 
necessary to file an RFA if the railroad intends to install new track 
for which installation of a PTC system is required, FRA has not 
included proposed paragraph (k)(6) in the final rule.
Section 236.1023 Errors and Malfunctions
    Often it is only after the product has been placed in field service 
for an extended period of time before the accuracy of the assumptions 
regarding errors and malfunctions can be validated. Accordingly, the 
reporting and recording of errors and malfunctions takes on critical 
importance. If the number of errors and malfunctions exceeds those 
originally anticipated in the design, or errors and malfunctions that 
were not predicted are observed to occur, the validity of the system 
design assumptions and the accuracy of the performance predictions 
becomes suspect. The requirements of this section provide the process 
and procedures for tracking, reporting, and correction of errors and 
malfunctions. The final rule reflects the requirements of the NPRM, but 
has been reorganized for greater clarity.
    Paragraph (a) of this section contains the requirement for all 
railroads operating a PTC system to establish and maintain a PTCPVL. 
The PTCPVL list ensures that the railroad can quickly determine the 
vendor of the product that has experienced an error or malfunctioned, 
and then be able to report the occurrence of the error or malfunction 
in a timely and accurate manner to the appropriate entity responsible 
for the design and manufacture of the product. FRA access to the PTCPVL 
of each railroad enables FRA to quickly identify all railroads that may 
potentially be affected by the error malfunction, thereby allowing FRA 
to better understand the implications of the condition on the industry. 
Not all railroads using the same product or processes may experience 
the same software errors or hardware failures, even if the cause of the 
error or failure is systemic to the design, and an individual railroad 
may not have the resources to determine if there are any industry-wide 
implications. The requirement for creating and maintaining the PTCPVL 
was originally proposed in paragraph (c) of the NPRM.
    Paragraph (b)(1) establishes a requirement that the railroad 
specify in its PTCSP all contractual arrangements with their vendors or 
suppliers for immediate notification of safety-critical upgrades made 
to the product by the

[[Page 2663]]

vendors or suppliers. FRA is not interested in the commercial terms of 
any such contractual arrangement, only that the contractual arrangement 
is in place for notification and provision of safety-critical changes 
from a vendor or supplier to the railroad. Paragraph (b)(2) levies the 
requirement on the vendor or supplier to report to all railroads using 
the product any safety-critical failures reported. Paragraph (b)(3) 
levies a requirement on the vendor or supplier to provide accurate and 
adequate information of the circumstances surrounding the reported 
failure to any potentially affected railroad, as well as recommended 
mitigating actions that should be taken until the situation is 
resolved. The text of paragraph (b) has been modified slightly from 
that of the NPRM to more accurately reflect FRA's expectation in this 
regard.
    Paragraph (c)(1) levies the requirement on the railroad to specify 
in its PTCSP the process and procedures the railroad will implement 
when a safety-critical upgrade or failure notification is received from 
the vendor or supplier. This requirement is necessary regardless of 
whether the railroad itself discovers the problem or the vendor or 
supplier notifies the railroad of the problem. Paragraph (c)(2) 
requires the railroads to identify the associated configuration 
management process they will use to identify safety-critical failures 
and mitigations. FRA believes it to be essential, given the potential 
impact on safety of a safety-critical failure, that the railroads have 
the necessary planning and mechanisms in place to promptly address the 
situation. Each railroad's and vendor's or supplier's development 
processes, configuration management programs, and fault reporting 
tracking systems play a crucial role in the ability of both parties and 
the FRA to determine and fully understand the risks and implications. 
Without an effective configuration management tracking system in place, 
it is difficult, if not impossible, to fairly evaluate PTC system risks 
during the system's life-cycle.
    Paragraph (d) requires that the railroad provide to its vendor or 
supplier the railroad's processes and procedures for addressing safety-
critical failure, malfunction, and fault issues. FRA believes that by 
providing this information to the vendor or supplier, the vendor or 
supplier will be able to more efficiently and effectively provide 
notification to the appropriate railroad personnel. The net result FRA 
is seeking is that potential delays in identifying or correcting 
safety-critical faults will be minimized.
    Paragraph (e) requires the railroad to maintain a database of all 
safety-relevant hazards identified in its PTCSP, as well as all safety-
relevant hazards that were not previously identified. FRA believes that 
the requirement to report any safety-relevant hazard that was not 
previously identified in the PTCSP is self evident, in that it clearly 
represents an unknown and unplanned failure mode. Without this 
database, a railroad will be unable to determine if the number of 
particular failures has risen to a level above the thresholds set forth 
in the PTCSP. If the frequency of the safety-relevant hazards exceeds 
the thresholds set forth in the PTCSP, the railroads shall take the 
following specific actions as prescribed in this section: Notify the 
applicable vendor or supplier and the FRA; keep the applicable vendor 
or supplier and the FRA apprised of the status of any and all 
subsequent failures; and, take prompt countermeasures to eliminate or 
reduce the frequency below the threshold identified. Until the 
corrective action is complete, the railroad is required to take 
measures to ensure the safety of train operations, roadway workers, on 
track equipment, and the general public.
    While the preceding paragraphs dealt with the establishment of a 
framework to address errors and malfunctions, paragraphs (f) through 
(g) deal with the actual handling and reporting of errors and 
malfunctions within that framework. Paragraph (f) establishes time 
limits for reporting failures and malfunctions to the product vendor or 
supplier and the FRA as well as minimum reporting requirements. The 
period for notification has been lengthened from that proposed in the 
NPRM to 15 days. FRA wishes to emphasize that it is more interested in 
timely notifications, and accordingly, has not established a specific 
format for the reports. FRA will accept any report format, provided it 
contains at least the minimal information required by this section. FRA 
will accept delivery of these reports by commercial courier, fax, and 
e-mail. However, with respect to information that is not immediately 
available, paragraph (f) has been amended to require railroads to 
submit supplemental reports with the previously unavailable 
information. FRA requires this information to determine the full impact 
of the problem, and to determine if any additional restrictions or 
limitations on the use of the PTC system may be warranted to ensure the 
safety of the general public and the railroad personnel. If the 
correcting or mitigating action were to take a significant amount of 
time, FRA would expect the railroad to provide FRA with periodic 
frequent progress reports.
    Paragraph (g) establishes a reporting requirement for railroads and 
vendors or suppliers to provide to the Associate Administrator on 
request the results of any investigation of an accident or service 
difficulty report that shows the PTC system, subsystem, or component is 
unsafe because of a manufacturing or design defect. In addition, the 
railroad and its vendor or supplier may be required to report on any 
action taken or proposed to correct the defect.
    Paragraph (h) imposes a direct obligation on suppliers to report 
safety-relevant failures or defective conditions, previously 
unidentified hazards, and recommended mitigation actions in their PTC 
system, subsystem, or component to each railroad using its product. 
Each applicable supplier is also required to notify FRA of the safety-
relevant failure, defective condition, or previously unidentified 
hazard discovered by the vendor or supplier and the identity of each 
affected and notified railroad. FRA believes that it should be informed 
to ensure public safety in any case where a commercial dispute (e.g., 
over liability) might disrupt communication between a railroad and 
supplier.
    GE submitted a comment on this section, in which it raised an 
objection to the direct imposition by FRA of a reporting obligation on 
PTC suppliers. GE believes this requirement is unwarranted for three 
reasons. First, the railroad is the primary entity having knowledge of 
such a failure and already has the obligation to report a failure 
within strict guidelines. Second, even if the PTC supplier becomes 
aware of a failure, the PTC supplier may not have sufficient 
understanding of the failure to determine whether it is truly safety-
related in nature without talking to the railroad. Third, there already 
exist sufficient legal incentives for a supplier to quickly resolve any 
safety-related failure that might occur. GE believes that railroads' 
regulatory compliance responsibilities should not be delegated to 
suppliers. Ultimately, GE asserts that this requirement unnecessarily 
complicates the task of deploying PTC and is unwarranted.
    GE proposed alternative language at the RSAC PTC Working Group 
meeting held August 31-September 2, 2009, that removed the supplier's 
obligation to directly report to FRA by deleting proposed paragraphs 
(a) and (f) of this section and adding language to Sec.  
236.1015(b)(2). In this proposed alternative language, GE recommended

[[Page 2664]]

that FRA require suppliers to include a process for promptly reporting 
any safety relevant failure and previously unidentified hazard to each 
railroad using the product in the quality control systems maintained by 
suppliers for PTC system design and manufacturing.
    FRA carefully considered GE's recommendation. In Sec.  236.907(d), 
FRA has previously established for PTC systems that are voluntarily 
implemented by railroads, under the provisions of subpart H of this 
part, a requirement that the vendor/supplier and railroads establish 
mutual reporting relationships for promptly reporting any safety-
relevant failures and previously unidentified hazards. FRA seeks to 
continue this relationship requirement for mandatory PTC system 
installations under the provisions of this subpart.
    As noted in the preamble discussion of Sec.  236.907(d), FRA 
clearly indicated that if there was ``a breakdown in communications 
that could adversely affect public safety'', FRA would take appropriate 
action as necessary. See 70 FR 11,052, 11,074. FRA also noted that the 
language of Sec.  236.907 ``place[d] a direct obligation on suppliers 
to report safety-relevant failures, which would include `wrong-side 
failures' and failures significantly impacting on availability where 
the Product Safety Plan indicates availability to be a material issue 
in the safety performance of the larger railroad system.'' 70 FR 
11,052, 11,074. This provision was necessary to ensure public safety in 
the event where a commercial dispute (e.g., over liability) might 
disrupt communications between a railroad and its supplier.
    FRA believes that the requirement that a product supplier notify 
FRA, in addition to the affected railroads, of safety-relevant failures 
of the PTC product discovered by the supplier does not add to the 
complexity or cost of PTC system deployment. The addition of FRA to the 
list of entities that must be notified in the unlikely event of a 
product failure that has been identified by the product supplier adds 
only marginally to the level of effort required of the product 
supplier. As a condition of providing PTC systems pursuant to subpart H 
of this part, the product supplier must already maintain a list of 
parties that require such notification. As GE noted, even if there were 
no regulatory requirement for a mutual reporting relationship between 
product suppliers and railroads, there are already legal incentives for 
a supplier to quickly resolve any safety related failure. FRA believes 
that these legal incentives should motivate the product supplier to 
promptly notify product users of safety-related issues and, therefore, 
to maintain a list of product users.
    FRA has also considered GE's argument that the railroad is the 
primary entity having knowledge of safety-related failures and already 
has an obligation to report the failure within strict guidelines. Thus, 
even if the PTC supplier becomes aware of the failure, the supplier may 
not have sufficient understanding of the failure to determine whether 
it is safety-related in nature without talking to the railroad. GE's 
assertion that the supplier may not recognize that a failure is safety 
related without talking to the railroad also applies equally to the 
converse situation. A railroad may report a failure to the vendor or 
supplier that the railroad may not recognize as safety critical, and it 
is only the vendor's or supplier's detailed knowledge of the product 
that enables recognition of the failure as safety critical.
    FRA is consequently unmoved by the assertion that the imposition of 
a requirement that a vendor or supplier notify FRA upon discovery of a 
safety critical problem would be unduly burdensome.
    In view of the preceding, FRA has left this paragraph unchanged in 
principle. FRA has, however, made editorial changes to more clearly 
define the responsibilities of the parties involved and to clearly 
indicate the acceptability of incremental reporting as more information 
becomes available.
    RSI made many statements similar to those of GE and also asserts 
that the notification requirement on suppliers would not enhance 
safety, but would create the potential for redundant, premature, 
potentially misleading, and burdensome reports to FRA. RSI cites 
various statutes and regulations, including RSIA08 and the existing 
part 236, that apply ``exclusively'' to ``railroads'' and ``railroad 
carriers.'' However, according to 49 U.S.C. 20103, which continues to 
be referenced in part 236's Authorities section:

    (a) Regulations and orders.--The Secretary of Transportation, as 
necessary, shall prescribe regulations and issue orders for every 
area of railroad safety supplementing laws and regulations in effect 
on October 16, 1970. When prescribing a security regulation or 
issuing a security order that affects the safety of railroad 
operations, the Secretary of Homeland Security shall consult with 
the Secretary.

Thus, FRA has jurisdiction ``for every area of railroad safety.'' 
Subpart I supplements the laws and regulations in effect on October 16, 
1970. Moreover, while the U.S.C. provisions cited by RSI apply to 
railroads and railroad carriers, there is nothing in those provisions 
restricting FRA's jurisdiction over other entities or persons.
    FRA has previously applied its jurisdiction over suppliers. Under 
Sec.  236.907(d), suppliers must perform certain notification 
responsibilities. While that paragraph concerns notification by the 
supplier to the railroad, there is nothing preventing FRA from 
requiring the supplier to also notify FRA. In fact, as a practical 
matter, FRA believes that reporting failures directly to FRA is 
necessary here. Under subpart H, the absence of direct and timely 
access to product notices has continued to be an issue for FRA. This 
concern will only become greater as the subject technology becomes more 
complex.
    RSI also noted that, ``the scope of the signal and train control 
provision at Part 236 explains that this entire part, which will 
include the proposed regulations for Sec.  236.1023, applies only to 
the railroads.'' Indeed, Sec.  236.0(a) currently states, ``Except as 
provided in paragraph (b) of this section, this part applies to all 
railroads.'' While that paragraph indicates that the part applies to 
all railroads, it does not limit application to ``only'' railroads, as 
misstated by RSI. In any event, to avoid confusion, FRA is modifying 
Sec.  236.0(a) to apply to all railroads and persons as indicated in 
this part. For instance, ``person'' is defined in Sec.  236.0(f) when 
referencing 1 U.S.C. 1 (which includes manufacturers and independent 
contractors) and railroad is defined in subpart G of part 236.
    Paragraph (i) addresses situations which are clearly not the result 
of a design or manufacturing issue, and limits unnecessary reporting. 
If the failure, malfunction, or defective condition was the result of 
improper operation of the PTC system outside of the design parameters 
or of non-compliance with the applicable operating instructions, FRA 
believes that compliance with paragraph (e) is not necessary. Instead, 
FRA expects and requires the railroad to engage in more narrow remedial 
measures, including remedial training by the railroad in the proper 
operation of the PTC system. Similarly, once a problem has been 
identified to all stakeholders, FRA does not believe it is necessary 
for a manufacturer to repeatedly submit a formal report in accordance 
with paragraph (h). In either situation, however, FRA expects that all 
users of the equipment will be proactively and timely notified of the 
misuse that occurred and the corrective actions taken.

[[Page 2665]]

    Such reports, however, do not have to be made within fifteen days 
of occurrence, as required for other notifications under paragraph (f), 
but within a reasonable time appropriate to the nature and extent of 
the problem.
    Paragraph (j) has been added to the final rule to require that, 
when any safety-critical PTC system, subsystem, or component fails to 
perform its intended function, the railroad is required to determine 
the cause and perform necessary adjustment, repair, or replacement of 
any faulty product without undue delay. Paragraph (j) also reminds 
railroads that, until corrective action has been completed, a railroad 
is required to take appropriate action to ensure safety and reliability 
as specified within its PTCSP.
    In paragraph (k) of the final rule, FRA intends to make it 
absolutely clear that the reporting requirements of part 233 are not a 
substitute for the reporting requirements of this subpart, nor are the 
reporting requirements of this subpart considered to be a substitute 
for the reporting requirements of part 233. Both sets of reporting 
requirements apply. FRA would like to clarify that both requirements 
apply. In the case of a failure meeting the criteria described in Sec.  
233.7, FRA would not expect the railroad to wait for the frequency of 
such occurrences to exceed the threshold reporting level assigned in 
the hazard log of the PTCSP, but will expect the railroad to report the 
occurrence as required by Sec.  233.7.
Section 236.1027 PTC System Exclusions
    This section retains similarities to, but also establishes 
contrasts with, Sec.  236.911, which deals with exclusions from subpart 
H. In particular, Sec.  236.911(c) offers reassurance that a stand-
alone computer aided dispatching (CAD) system would not be considered a 
safety-critical processor-based system within the purview of subpart H. 
CADs have long been used by large and small railroads to assist 
dispatchers in managing their workload, tracking information required 
to be kept by regulation, and--most importantly--providing a conflict 
checking function designed to alert dispatchers to incipient errors 
before authorities are delivered. Even Sec.  236.911, however, states 
that ``a subsystem or component of an office system must comply with 
the requirements of this subpart if it performs safety-critical 
functions within, or affects the safety performance of, a new or next-
generation train control system.'' FRA continues to work with a vendor 
or supplier on a simple CAD that provides authorities in an automated 
fashion, without the direct involvement of a dispatcher.
    For subpart I, FRA intends to retain the exception referred to in 
Sec.  236.911 for CAD systems not associated with a PTC system. Many 
smaller railroads use CAD systems to good effect, and there is no 
reason to impose additional regulations where dispatchers 
contemporaneously retain the function of issuing mandatory directives. 
However, in the present context, it is necessary to recognize that PTC 
systems utilize CAD systems as the ``front end'' of the logic chain 
that defines authorities enforced by the PTC system, particularly in 
non-signaled territory.
    Accordingly, paragraph (a) provides for the potential exclusion of 
certain office systems technologies from subpart I compliance. These 
existing systems have been implemented voluntarily to enhance 
productivity and have proven to provide a reasonably high level of 
safety, reliability, and functionality. FRA recognizes that full 
application of subpart I to these systems would present the rail 
industry with a tremendous burden. The burdens of subpart I may 
discourage voluntary PTC implementation and operation by the smaller 
railroads.
    However, subpart I applies to those subsystems or components that 
perform safety critical functions or affect the safety performance of 
the associated PTC system. The level and extent of safety analysis and 
review of the office systems will vary depending upon the type of PTC 
system with which the office system interfaces. For example, to prevent 
the issuance of overlapping and inconsistent authorities, FRA expects 
that each PTC system demonstrate sufficient credible evidence that the 
requisite safety-critical, conflict resolution (although not 
necessarily vital) hardware and software functions of the system will 
work as intended. FRA also expects that the applicable PTCDP's and 
PTCSP's risk analysis will identify the associated hazards and describe 
how they have been mitigated. Particularly where mandatory directives 
and work authorities are evaluated for use in a PTC system without 
separate oral transmission from the dispatcher to the train crew or 
employee in charge--with the opportunity for receiving personnel to 
evaluate and confirm the integrity of the directive or authority 
received and the potential for others overhearing the transmission to 
note conflicting actions by the dispatching center--FRA will insist on 
explanations sufficient to provide reasonable confidence that 
additional errors will not be introduced.
    Paragraph (b) provides requirements for modifications of excluded 
PTC systems. At some point when a change results in degradation of 
safety or in a material increase in safety-critical functionality, 
changes to excluded PTC systems or subsystems may be significant enough 
to require application of subpart I's safety assurance processes. FRA 
believes that all modifications caused by unforeseen implementation 
factors will not necessarily cause the product to become subject to 
subpart I. These types of implementation modifications will be minor in 
nature and be the result of site specific physical constraints. 
However, FRA expects that implementation modifications that will result 
in a degradation of safety or a material increase in safety-critical 
functionality, such as a change in executive software, will cause the 
PTC system or subsystem to be subject to subpart I and its 
requirements. FRA is concerned, however, that a series of incremental 
changes, while each individually not meeting the threshold for 
compliance with this subpart, may when aggregated result in a product 
which differs sufficiently so as to be considered a new product. 
Therefore, FRA reserves the right to require products that have been 
incrementally changed in this manner to comply with the requirements of 
this subpart. Prior to FRA making such a determination, the affected 
railroad will be allowed to present detailed technical evidence why 
such a determination should not be made. This provision mirrors 
paragraph (d) of existing Sec.  236.911.
    Paragraph (c) addresses the integration of train control systems 
with other locomotive electronic control systems. The earliest train 
control systems were electro-mechanical systems that were independent 
of the discrete pneumatic and mechanical control systems used by the 
locomotive engineer for normal throttle and braking functions. Examples 
of these train control systems included cab signals and ACS/ATC 
appliances. These systems included a separate antenna for interfacing 
with the track circuit or inductive devices on the wayside. Their power 
supply and control logic were separate from other locomotive functions, 
and the cab signals were displayed from a separate special-purpose 
unit. Penalty brake applications by the train control system bypassed 
the locomotive pneumatic and mechanical control systems to directly 
operate a valve that accomplished a service reduction of brake pipe 
pressure and application of the brakes as well as

[[Page 2666]]

reduction in locomotive tractive power. In keeping with this physical 
and functional separation, train control equipment on board a 
locomotive came under part 236, rather than the locomotive inspection 
requirements of part 229.
    Advances in hardware and software technology have allowed the 
various PTC systems' and components' original equipment manufacturers 
(OEMs) to repackage individual components, eliminating parts and system 
function control points access. Access to control functions became 
increasingly restricted to the processor interfaces using proprietary 
software. While this resulted in significant simplification of the 
previously complex discrete pneumatic and mechanical control train and 
locomotive control systems into fewer, more compact and reliable 
devices, it also creates significant challenges with respect to 
compatibility of the application programs and configuration management.
    FRA encourages such enhancements, and believes that, if properly 
done, they can result in significant safety, as well as operational, 
improvements. Locomotive manufacturers can certainly provide secure 
locomotive and train controls, and it is important that they do so if 
locomotives are to function safely in their normal service environment. 
FRA highly encourages the long-term goal of common platform 
integration. However, when such integration occurs, it must not be done 
at the expense of decreasing the safe and reliable operation of the 
train control system. Accordingly, FRA expects that the complete 
integrated system will be shown to have been designed to fail-safe 
principles, and then demonstrated that the system operates in a fail-
safe mode. Any commingled system must have a manual fail-safe fall back 
up that allows the engineer to be brought to be a safe stop in the 
event of an electronic system failure. This analysis must be provided 
to FRA for approval in the PTCDP and PTCSP as appropriate. This 
provision mirrors the heightened scrutiny called for by Sec.  
236.913(c) of subpart H for commingled systems, but is more explicit 
with respect to FRA's expectations. The provision in general accords 
with the requirements for locomotive systems that are currently under 
development in the RSAC's Locomotive Safety Standards Working Group.
    GE generally agreed with the preceding discussion about separate 
regulatory treatment of PTC and the locomotive control systems. 
However, they strongly disagree with any implication, if the two 
systems were interfaced or commingled, that PTC requirements could be 
extended into the locomotive control system. They assert non-safety-
critical data can be passed between the systems using appropriate 
interfaces without any impact on safety and without triggering a need 
to extend PTC requirements into the control system.
    FRA agrees that there are implementation techniques that allow for 
locomotive control systems to passively receive information from a 
train control system, and the train control and locomotive control 
systems are not tightly coupled. FRA expects that in such situations 
the safety case for the train control system clearly and unequivocally 
demonstrates that the train control system is not tightly coupled with 
the locomotive control system, and that failures in the locomotive 
control system have absolutely no adverse consequences on the safe 
operation of the train control system. Likewise, FRA expects that the 
safety analysis for the locomotive control system clearly and 
unequivocally demonstrates that the train control system is not tightly 
coupled with the locomotive control system, and that failures in the 
train control system have absolutely no adverse consequences on the 
safe operation of the locomotive control system. If the safety analysis 
cannot convincingly demonstrate to FRA that the train control and 
locomotive control systems are loosely coupled, then FRA will require 
that the safety analysis for the PTC system include the applicable 
elements of the locomotive control system, and vice versa.
    Finally, paragraph (d) clarifies the application of subparts A 
through H to products excluded from compliance with subpart I. These 
products are excluded from the requirements of subpart I, but FRA 
expects that the developing activity demonstrates compliance of 
products with subparts A through H. FRA believes that railroads not 
mandated to implement PTC, or that are implementing other non-PTC 
related processor based products, should be given the option to have 
those products approved under subpart H by submitting a PSP and 
otherwise complying with subpart H or by voluntarily complying with 
subpart I. This provision mirrors Sec.  236.911(e) of subpart H.
Section 236.1029 PTC System Use and En Route Failures
    This section provides minimum requirements, in addition to those 
found in the PTC system's plans, for each PTC system with a PTC System 
Certification. Railroads are allowed, and encouraged, to adopt more 
restrictive rules that increase safety.
    Paragraph (a) requires that, in the event of the failure of a 
component essential to the safety of a PTC system to perform as 
intended, the cause be identified and corrective action taken without 
undue delay. The paragraph also states that until the corrective action 
is completed, the railroad is required, at a minimum, to take 
appropriate measures, including those specified in the PTCSP, to ensure 
the safety of train movements, roadway workers, and on-track equipment. 
This requirement mirrors the current requirements of Sec.  236.11, 
which applies to all signal and train control system components. Under 
paragraph (a), FRA intends to apply to PTC systems provided PTC System 
Certification under subpart I the same standard in current Sec.  
236.11.
    Paragraph (b) provides the circumstance where a PTC onboard 
apparatus on a controlling locomotive that is operating in or is to be 
operated within a PTC system fails or is otherwise cut-out while en 
route. Under paragraph (b), the subject train may only continue such 
operations in accordance with specific limitations. An en route failure 
is applicable only in instances after the subject train has departed 
its initial terminal, having had a successful initialization, and 
subsequently rendering it no longer responsive to the PTC system. For 
example, FRA believes that an en route failure may occur when the PTC 
onboard apparatus incurs an onboard fault or is otherwise cut out.
    Under subpart H, existing Sec.  236.567 provides specific 
limitations on each train failing en route in relation to its 
applicable automatic cab signal, train stop, and train control system. 
FRA believes that it would be desirable to impose somewhat more 
restrictive conditions given the statutory mandate and the desire to 
have an appropriate incentive to properly maintain the equipment and to 
timely respond to en route failures. For instance, FRA recognizes that 
the limitations of Sec.  236.567 do not account for the statutory 
mandates of the core PTC safety functions.
    During the PTC Working Group meetings prior to issuance of the 
NPRM, no consensus was reached on how to regulate en route failures on 
PTC territory. However, FRA subsequently received several comments that 
the en route failure requirements and the restrictive operational 
conditions imposed by paragraph (b) are burdensome and overly 
restrictive. When the PTC Working Group was

[[Page 2667]]

reconvened following the Public Hearing and the NPRM comment period, 
the PTC Working Group formed three separate task forces for the purpose 
of discussing and resolving several specific issues. One such task 
force, deemed the Operational Conditions Task Force, was assigned the 
task of resolving the issues associated with operational limitations 
presented in the proposed rule associated with temporary rerouting 
within Sec.  236.1005, unequipped trains operating within a PTC system 
within Sec.  236.1006, and en route failures within Sec.  236.1029.
    The proposed rule provided allowances for deviations from the 
restrictions of operations exceeding 90 miles per hour if such 
deviations were presented and justified in an FRA approved plan. At the 
PTC Working Group meeting, it was recommended that the procedure 
allowing for such deviations equally apply to all other operations, 
regardless of the speed of the operations.
    Upon presentation of these recommended revisions to the PTC Working 
Group, Amtrak and NJ Transit withheld consensus, requesting rather to 
state on the record that they believed the requirement for the 
establishment of an absolute block was overly burdensome and 
unnecessary, and the operational limitations were too restrictive in 
areas where an underlying block signal system and/or cab signal system 
with train stop/train control functions remained in place. They further 
suggested that the operational restrictions for en route failures 
should be solely presented and described within a railroad's PTCDP and 
PTCSP, which would then be applicable to a particular PTC system.
    FRA appreciates the concerns presented. However, FRA remains 
convinced that the rule text must provide a ``baseline'' for 
operational restrictions associated with en route failures within all 
PTC systems, with the recognition of the allowance for a railroad to 
submit a request for deviation from those requirements, with 
justification, within their PTCDP and PTCSP for FRA approval. 
Accordingly, FRA has substantially adopted into paragraphs (b) and (c) 
the text proposed at the PTC Working Group meeting.
    Section 236.1029, and in particular paragraph (b), purposefully 
parallels the limitations contained in Sec.  236.567. In other words, 
FRA intends that Sec.  236.567 and paragraph (b) of this section will 
share the common purpose of maintaining a level of safety generally in 
accord with that expected with the train control system fully 
functional. This is accomplished by requiring supplementary procedures 
to heighten awareness and provide operational control (limiting the 
frequency of unsafe events) and by restricting the speed of the failed 
train (reducing the potential severity of any unsafe event).
    Paragraph (b)(1) allows the subject train to proceed at restricted 
speed--or at medium speed if a block signal system is in operation 
according to signal indication--to the next available point where 
communication of a report can be made to a designated railroad officer 
of the host railroad. The intent of this requirement is to ensure that 
the occurrence of an en route failure may be appropriately recorded and 
that the necessary alternative protection of absolute block is 
established.
    NYSMTA provided comments recommending that paragraph (b)(1) of this 
section cite 40 miles per hour as the maximum permissible speed within 
a failed PTC system where a block signal system is in operation because 
some railroads, such as the LIRR and Metro-North, have defined medium 
speed lower than what the FRA regulation would permit. FRA defines 
medium speed in Sec.  236.811 as ``A speed not exceeding 40 miles per 
hour.'' Thus, we believe the rule is clear in terms of the applicable 
maximum speed limit and consistent with the suggestions made by NYSMTA. 
While a particular railroad may internally define ``medium speed'' 
differently, the definitions contained in part 236 control the meaning 
of the terms used therein.
    After a report is made in accordance with paragraph (b)(1), or made 
electronically and immediately by the PTC system itself, paragraph 
(b)(2) allows the train to continue to a point where an absolute block 
can be established in advance of the train in accordance with the 
limitations that follow in paragraphs (b)(2)(i) and (ii). Paragraph 
(b)(2)(i) requires that where no block signal system is in use, the 
train may proceed at restricted speed. Alternatively, under paragraph 
(b)(2)(ii), the train may proceed at a speed not to exceed medium speed 
where a block signal system is in operation according to signal 
indication.
    Paragraph (b)(3) requires that, upon the subject train reaching the 
location where an absolute block has been established in advance of the 
train, the train may proceed in accordance with the limitations that 
follow in paragraphs (b)(3)(i), (ii), or (iii). Paragraph (b)(3)(i) 
requires that where no block signal system is in use, the train may 
proceed at medium speed; however, if the involved train is a train 
which is that of the criteria requiring the PTC system installation 
(i.e., a passenger train or a train hauling any amount of PIH 
material), it may only proceed at a speed not to exceed 30 miles per 
hour. Paragraph (b)(3)(ii) requires that where a block signal system is 
in use, a passenger train may proceed at a speed not to exceed 59 miles 
per hour and a freight train may proceed at a speed not to exceed 49 
miles per hour. Paragraph (b)(3)(iii) requires that, except as provided 
in paragraph (c), where a cab signal system with an automatic train 
control system is in operation, the train may proceed at a speed not to 
exceed 79 miles per hour.
    The Rail Labor Organizations believe that the rule is too 
permissive for en route failures of a PTC system where an underlying 
signal system is not governing train movements, as they assert that any 
train invisible to the PTC system in PTC territory presents an 
unacceptable risk. Instead, asserts the RLO, treatment of en route 
failures should parallel the restrictions required when a train 
experiences a signal failure, such as a switch position that is unknown 
or when a route is not known to be clear. While the NPRM proposed to 
allow a passenger or PIH PTC train in dark territory to traverse a 
switch in an unknown position at medium speed or 30 miles per hour, the 
RLO asserts that such trains should be limited to restricted speed or 
other methods, such as temporal separation.
    FRA appreciates the RLO's concerns. However, FRA believes that the 
proposal to limit operations to restricted speed, or employ other 
protective methods such as temporal separation, would be too burdensome 
and unwarranted. FRA has elected to keep the language of the NPRM in 
this final rule for several reasons. First, it is expected that 
failures en route addressed by this rule, as well as temporary 
rerouting that could result in its application, will not occur on any 
frequent basis. Experience and requirements of other portions of this 
subpart would preclude this from being the case. Second, the assertion 
that ``any train invisible to the PTC system in PTC territory presents 
an unacceptable risk'' is inaccurate. Such a train would not in fact be 
``invisible'' to the PTC system as there remains in place some type of 
authority for the train's movement, and all authorities of other trains 
that would be PTC-equipped would be enforced by the system. 
Additionally, the maximum speed of 30 miles per hour established by FRA 
for these situations is based on extensive analysis of past accident 
and incidence data, which has shown that train accidents at or below 30 
miles per hour have not resulted in breach or compromise of cars 
carrying hazardous

[[Page 2668]]

materials. FRA has elected to keep this language of the NPRM in this 
final rule.
    Paragraph (c) requires that, in order for a PTC train to deviate 
from the operating limitations contained in paragraph (b) of this 
section, the deviation must be described and justified in the FRA 
approved PTCDP or PTCSP. Amtrak had presented comments regarding the 
NPRM, as well as within the PTC Working Group task force assigned to 
address comments received regarding this section, asserting that the 
operational limitations of failure en route were too restricting and 
unwarranted. Directly in response to those comments, FRA may allow for 
deviation from the identified limitations of the rule if that deviation 
is described and justified in the applicable and FRA approved PTCDP, 
PTCSP, or Order of Particular Applicability. Furthermore, the speed 
threshold of 90 miles per hour proposed in the NPRM has been removed. 
FRA will consider deviation proposals for conventional operations, as 
well as high-speed operations. FRA continues to anticipate that 
existing operations on the Northeast Corridor will not be adversely 
impacted, since failure of one component of the onboard train control 
system will permit the remaining portion to function and provide for a 
reasonable level of safety.
    Paragraph (d) requires that the railroad operate its PTC system 
within the design and operational parameters specified in the PTCDP and 
PTCSP. Railroads will not exceed maximum volumes, speeds, or any other 
parameter provided for in the PTCDP or PTCSP. On the other hand, a 
PTCDP or PTCSP could be based upon speed or volume parameters that are 
broader than the intended initial application, so long as the full 
range of sensitivity analyses is included in the supporting risk 
assessment. FRA feels this requirement will help ensure that 
comprehensive product risk assessments are performed before products 
are implemented.
    Paragraph (e) sets forth the requirement that any testing of the 
PTC system must not interfere with its normal safety-critical 
functioning, unless an exception is obtained pursuant to 49 CFR Sec.  
236.1035, where special conditions have been established to protect the 
safety of the public and the train crew. Otherwise, paragraph (e) 
requires that each railroad ensure that the integrity of the PTC system 
not be compromised, by prohibiting the normal functioning of such 
system to be interfered with by testing or otherwise without first 
taking measures to provide for the safety of train movements, roadway 
workers, and on-track equipment that depend on the normal safety-
critical functioning of the system. This provision parallels current 
Sec.  236.4, which applies to all systems. By requiring this paragraph, 
FRA also intends to clarify that the standard in current Sec.  236.4 
also applies to subpart I PTC systems.
    Paragraph (f) requires that each member of the operating crew has 
appropriate access to the information and functions necessary to 
perform his or her job safely when products are implemented and used in 
revenue service. FRA expects paragraph (f) to automatically require 
each engineer operating the controlling locomotive to have access to 
the PTC display providing such information. Paragraph (f) also applies 
to other crew members assigned duties in the locomotive cab. The rule 
is a performance standard which can be met in several different ways.
    Train crews perform as a team and are required by railroad and FRA 
rules to do so. The importance of having assigned crew members fully 
involved in train operations is also clearly the intent of Congress in 
the RSIA. The Congress mandated the certification of the conductor to 
work in concert with the already federally-certified locomotive 
engineer. For the conductor and engineer to fulfill the expectations of 
Congress, it is necessary for both crewmembers to have sufficient 
information to perform their duties. For the conductor to be able to 
fulfill the assigned obligations, the conductor must have ready access 
to certain information, including the authority information being 
received from the dispatcher. As described below, FRA believes that 
safety would be materially diminished if the conductor in freight 
operations were denied access to the same information in the same 
format as the engineer.
    For instance, under the operating rules or special instructions of 
the major freight railroads, each train crew member in the performance 
of his or her duties receives copies of a fair amount of paperwork that 
includes the train consist, which provides the number, loading, 
locations, and hazardous materials contents of cars, the length and 
weight of the train, General Orders, which provide loose footing 
issues, the safety rules of the day or week, security reminders, 
temporary speed restrictions, and the locations of maintenance of way 
crews performing track repairs. This paperwork provides the train crew 
with the work plan necessary to operate the assigned train during their 
tour of duty. Once the crew is underway, the conductor receives from 
the dispatcher, via radio, updates to the above information (and 
provides acknowledgment back to the dispatcher), transcribes hand 
written copies, and provides those copies to the engineer and other 
crew members (in lieu of stopping if engineer only). Each crew member 
keeps these copies in front of them (usually on a desk) for ready 
reference to approaching speed restrictions and working limits of 
roadway workers. Upon these documents, crew members make hand written 
notes and are required to write ``void'' across superseded or expired 
movement authorities. In case any questions pertaining to crew 
performance arise later, each crewmember keeps these copies. 
Particularly, in a PTC overlay system, which by definition depends upon 
continued performance of all of the safety-related functions of the 
underlying system of operation, all of these functions must continue to 
be performed either as they are now or in an equivalent manner. 
Removing or impairing any of those functions will diminish safety.
    The conductor is responsible for determining the train consist and 
for ensuring compliance with hazardous materials train placement 
requirements. The conductor is also responsible for determining whether 
one or more cars in the train is restricted (e.g., requirement 
regarding appropriate placement in the train or speed restriction 
limiting the train's speed to avoid a derailment hazard).\9\ Conductors 
are regularly disciplined in certain situations, including when the 
limits of authorities are violated or maximum speed limits are 
exceeded.
---------------------------------------------------------------------------

    \9\ Enforcement of a speed restriction associated with a 
particular car is not a mandated PTC function, but is an important 
function that will be provided within the Interoperable Train 
Control architecture for the general freight system.
---------------------------------------------------------------------------

    Moreover, in present cab signal territory, multiple crew members 
rely on the information provided by the cab signal display, typically 
mounted in the center of the cab or other conspicuous location. ACSES 
displays have also been centrally mounted in passenger and freight cabs 
for clear visibility.\10\ Under this final rule, cab signals may 
continue to operate independently of the PTC display of the locomotive 
cab. However, based upon RSAC discussions, FRA is confident that PTC 
displays may (and

[[Page 2669]]

probably will) supplant current cab signal displays and utilize the cab 
signal code as an input to the PTC display.\11\ Section 236.515 has 
long provided that ``The cab signals shall be plainly visible to a 
member or members of the locomotive crew from their stations in the 
cab.'' Positive train control systems will play a role very similar to, 
but in fact even more important than, automatic cab signals have played 
in the territories where installed. In addition to providing current 
displays (or ``targets'') for signal indications, FRA expects that PTC 
will also display in graphic form slow orders and other mandatory 
directives.
---------------------------------------------------------------------------

    \10\ ITCS displays in freight locomotives have not been mounted 
so as to be clearly visible to freight crews. The subject line is 
principally used for passenger service, and the number of freight 
locomotives involved has been very small. ITCS has been permitted to 
operate under waiver, and FRA freely concedes that the issue of 
freight crew display visibility had not been clearly joined to this 
point.
    \11\ In vital applications, reliance on these displays will be 
authorized and required. Although initially in-block signal upgrades 
may not be permitted to be acted upon, except in cab signal 
territory, FRA has no doubt that the ability to upgrade between 
wayside signals will be requested as the technology is proven 
reliable. According to the major railroads involved in the 
Interoperable Train Control effort, most Class I locomotives will 
need to be configured to operate essentially in any territory on the 
system.
---------------------------------------------------------------------------

    FRA recognizes that PTC systems are being designed to move much of 
this information into an electronic format. The intent of utilizing 
electronic transmission of authorities is to reduce human error 
associated with listening, copying, and reading back of updates over 
voice channels while the train crew is en route. Regardless if the 
information is transmitted digitally or verbally, the goal is to 
prevent the train from occupying the main track without authority, to 
prevent most over-speed issues, and to stop short of misaligned 
switches if the crew fails to follow the rules. While FRA supports this 
transition to digital communications, this final rule does not require 
it.
    In the event that a certified PTC system does use digital 
transmissions to provide communications and acknowledgement of 
mandatory directives between the dispatcher and conductor, to allow the 
conductor to electronically input the train consist into the PTC 
system, or otherwise similarly modify a crew member's responsibilities, 
FRA expects under paragraph (f) that the subject crew member will be 
afforded appropriate access to the PTC system display to fulfill those 
responsibilities.
    In its comments, the AAR also indicated that railroads have been 
planning to put a single display in locomotive cabs for the engineer in 
systems which FRA has already approved and that this requirement was 
redundant and excessive, referring to the BNSF ETMS system. The AAR 
questioned the need for a conductor to have access to a PTC display. 
The Class I railroads have attempted to present the case that FRA had 
previously blessed the implementation of PTC technology that would 
permit electronic delivery of mandatory directives while discontinuing 
the delivery of printed or voice transmitted directives. However, that 
is not the case.
    The system to which AAR refers--BNSF's ETMS I configuration--was 
qualified under subpart H, which only requires that the system be at 
least as safe as existing systems and the approval was limited in 
material ways the AAR failed to mention. Subpart I, however, requires 
that non-vital overlay systems reduce the likelihood of PTC preventable 
accidents by at least 80%. Subpart H does not address or require 
interoperability, but subpart I requires interoperability.
    The BNSF ETMS I configuration concept of operations was a pure non-
vital overlay on the existing method of operations. The safety analysis 
for that system assumed that the conductor would continue to receive 
mandatory directives in the normal manner. BNSF, the only railroad to 
obtain authority for use of a first-generation freight PTC system, very 
heavily justified its safety case on the assumption that crewmembers 
would intervene should the PTC system experience a wrong-side failure 
(which could occur due to a software error, hardware malfunction, 
database error, or combination of these factors). This system was 
justified as an ``overlay'' on the existing method of operations; while 
there would be only one PTC display screen, it was contended that most 
wrong-side errors would be caught by crewmembers holding mandatory 
directives in paper form. This type of existing PTC system, which has 
only been deployed by BNSF on a few lines and with very few locomotives 
equipped, precludes one-half of the train crew from having any access 
to the information for which they are held accountable. This has been 
tolerable only because both crew members do have a full set of printed 
or written directives.
    Note that basic interoperability is potentially a concern with 
respect to the human-machine interface and the means by which FRA 
addresses it. To the extent a locomotive from a railroad which uses 
only voice transmission of mandatory directives were to travel on a 
railroad using electronic transmission of mandatory directives, it 
would need to be equipped for the other railroad. Yet none of the major 
freight railroads has conducted a revenue demonstration of a system 
that relies exclusively on electronic transmission of authorities; and, 
after more than two decades of development and demonstrations, the 
major freight railroads have still not issued interoperability 
standards. Even if FRA were able to accept some of the arguments 
proffered in regard to the need for access to PTC information, 
addressing this issue through review of individual railroad plans would 
not be feasible. This issue needs to be settled ``up front'' in order 
to support an orderly implementation.
    The testimony and written filings in this docket reflected a 
serious misunderstanding regard the distinctions noted above and the 
posture of the BNSF Product Safety Plan review. The AAR and CSXT both 
asserted that FRA has approved use of a single screen in the form of 
BNSF ETMS I configuration. More remarkably, BNSF itself testified at 
the public hearing that, ``As approved by FRA, our locomotive cab 
configuration includes one display screen, which is positioned on the 
dashboard of the engineer.'' Comment of BNSF Railway Company, Docket 
FRA-2008-0132.0011.1 (Aug. 19, 2009); Positive Train Control Systems: 
Hearing Before the Fed. Railroad Admin. (Aug. 13, 2009) (statement of 
Mark Schulze, Vice President, BNSF Railway Company).
    In fact, FRA's decision letter for that system stated as follows:
    7. Prior to any further ETMS Configuration I operations, BNSF must 
either comply with 49 CFR Sec.  236.515 (Visibility of cab signals), or 
submit a risk-based justification as to why the requirements of this 
rule should be waived. The justification shall be submitted in 
accordance with the PSP amendment procedures in 49 CFR Sec.  236.913. 
(FRA Docket No. 2006-23687, Document No. 0021.)

The subject approval remains contingent as of the date of preparation 
of this final rule, since the railroad has not submitted the required 
justification.\12\
---------------------------------------------------------------------------

    \12\ Prior to enactment of the RSIA08, FRA had taken significant 
steps to encourage voluntary PTC deployment, including offering the 
inducement of exceptions from traditional train control 
requirements. Had BNSF submitted a detailed justification for the 
single display visible only to the locomotive engineer, it is 
entirely possible that it would have been approved, since the 
performance standard under subpart H presents a very low bar for a 
reasonably competent train control system when applied in non-
signaled or traffic control territory and since under the ETMS PSP 
the conductor would either continue to receive mandatory directives 
in writing or would copy mandatory directives transmitted verbally 
by the dispatcher via radio. 49 CFR 236.909(a). The point here is 
that, if the railroad had indeed conducted adequate human factors 
analysis, it had not been submitted to FRA; and no implications 
should be drawn with respect to this very different context, wherein 
interline operation of locomotives is at stake and several major 
railroads clearly wish to abandon traditional means of delivering 
authorities.

---------------------------------------------------------------------------

[[Page 2670]]

    The AAR also misstates the extent of the Volpe Center's review of 
ETMS. From the Volpe Center's review: ``The purpose of the analysis was 
to assess the extent to which the ETMS system follows accepted human 
factors design guidelines that are likely to catch and correct 
potential human performance problems.'' Volpe did not perform a 
``thorough human factors analysis'' as posited by AAR. Rather, Volpe 
focused on the user interface for locomotive engineers, identifying 
issues within the existing design (which was still under development) 
and within the concept of operations as defined by the railroad.
    Once all of the paperwork is moved into electronic transmissions 
(which has been neither formally requested nor in any way justified 
under existing regulations), in the absence of an available display 
one-half of the train crew would not have the ability to review and 
receive updates while en-route, or keep records of the movement 
authorities and restrictions for future use. PTC is currently an 
imperfect technology fed by databases that can be corrupted. Mandatory 
directives will continue to be issued by dispatchers with limited 
conflict checking using non-vital computer-aided dispatching systems. 
As the point paper orders are no longer provided, and mandatory 
directives are issued electronically en route, there would be no 
general broadcast on the ``road channel'' that could lead to other 
train crews or roadway workers identifying a defective authority (e.g., 
a mandatory directive to traverse a track segment already occupied by 
another train). None of the freight railroads has yet demonstrated how 
the transition to full electronic delivery of mandatory directives will 
be accomplished. FRA believes that the transition will eventually be 
made, but in the initial period it is critical that existing provisions 
for safety--which work very well a very high percentage of the time--
not be prematurely abandoned; these provisions include appropriate 
access to the PTC system display. Although FRA agrees that transmission 
of valid authorities should be more secure, and thus the trade-off is 
likely to be favorable, FRA sees no reason at this time to take a 
second or third crew member out of the loop or to load on the engineer 
the responsibility for both receiving mandatory directives and briefing 
the second or third crew member who will be expected under the 
railroad's rules to comply.
    FRA believes it is important to the risk assessment process that 
the engineer and conductor perform at a level no less safe than they 
would have had there not been a PTC system. The PTC systems proposed 
for freight railroads are overlay systems. In an overlay system, the 
railroad adds a layer of safety to the existing operation. The risk 
assessment then is relatively easy, because it is easy to show that the 
new system adds safety, reducing the risk of certain accidents, while 
not adding any new risk. The key assumption of the risk assessment is 
no degradation of the underlying safety system, and the performance of 
crewmembers is a key element of that safety system.
    It is impossible at present to quantify the additional risk 
associated with adding a task which compromises the safe operation of 
the train by the engineer or conductor, even if only for a short time. 
Engineers and conductors have an excellent record of avoiding 
accidents. PTC seeks to improve upon that excellent record. The 
existing human factors literature leads one to believe that entering 
complex acknowledgements into a PTC system while the train is in motion 
is a very significant risk. To quantify that risk, one would have to 
put it into the context of comparative safety using a human factors 
model far more complex and accurate than any of which FRA is aware. 
Also note that PTC does not address all accident scenarios, many of 
which are often avoided by timely locomotive engineer intervention. The 
timeliness of such intervention is dependent on situational awareness, 
which would be negatively impacted if the engineer were distracted. 
Reading text on a PTC screen appears to be as distracting as reading 
text on a cell phone or PDA and texting in reply. In order for FRA to 
accept the diversion of the engineer's attention which would come from 
having the engineer review and accept the mandatory directives while 
the train is motion, FRA would need a process different from the 
current risk assessment methodology. That in turn would require FRA to 
impose a specification standard, instead of a performance standard. 
Were FRA issuing only a specification standard, FRA would require the 
second display and input unit.
    In short, the rule as it stands relies on comparing system risk, 
which is easy if the engineer is not distracted by the system, but 
impossible if the engineer might be distracted. What we do know with 
certainty is that having the engineer read and respond to lengthy 
written messages on the PTC screen would be a distraction resulting in 
greater risk exposure which would offset to some extent the risk 
reduction resulting from PTC systems.
    AAR argues that the requirement in Sec.  236.1029(f) pertaining to 
distraction of the locomotive engineer should be deleted. The AAR 
claims that FRA does not offer any study showing that safety is 
jeopardized by assigning the engineer PTC-related duties. FRA has 
directly observed engineers exceeding authorities while attempting to 
respond to PTC system requirements on tests of existing PTC systems. In 
those cases, the engineer was attempting to respond to digitally 
transmitted authority while the train was in motion and was plainly 
distracted from safety-critical duties. FRA does not need a study to 
verify the possibility of that which it has observed directly.
    The AAR also raises an issue of accuracy in transmitting and 
receiving mandatory directives, and appears to make the argument that 
because electronic transmission of mandatory directives is likely to be 
much more accurate than voice communication of mandatory directives, 
that all will be safer if mandatory directives are transmitted 
electronically. FRA agrees that the electronic transmission is likely 
to be more accurate, but does not agree that accurate transmission is 
the only safety issue. FRA is concerned with procedures which might 
distract the engineer from his duties. There is no problem if the 
railroad intends to have engineers receive, review, and acknowledge 
mandatory directives, unless the railroad wants the engineer to perform 
that task with the train in motion, and provided the engineer can take 
the time to brief other crew members, who under current railroad 
operating rules would need to copy and retain the orders.
    All systems of which FRA is aware will require the crew to 
acknowledge the mandatory directives. FRA has seen system designs that 
would permit acknowledgement by simply pressing a button. There is no 
reason to believe that simply pressing a button demonstrates 
understanding of a mandatory directive, and FRA does not intend to 
approve such systems because they will not provide an adequate level of 
safety. Simply pressing a button does not provide the evidence of 
comprehension and mutual understanding currently provided by the 
practice of reading mandatory directives back to the dispatcher over 
the radio. Even if this means of acknowledgment is elected and approved 
by FRA, it would be necessary for an engineer receiving such a 
directive to read it and consider its relevance to the current 
situation. This

[[Page 2671]]

could distract the engineer from actions needed to address other 
restrictions or an emerging situation on the railroad (e.g., need to 
warn equipment or personnel unexpectedly fouling the track ahead, 
requirement to manage a train over undulating terrain to avoid 
excessive in-train forces, emergency use of the train horn because of 
vehicle storage on the tracks in a quiet zone).
    FRA believes that simply referencing the default PTC display screen 
will be consistent with good situational awareness and should not 
present a problem. However, excessive engagement with the PTC onboard 
computer while underway can distract a locomotive engineer from current 
duties. While acknowledgment by use of a single soft key may limit the 
distraction associated with manipulation of the device, it does not 
address whether the directive was understood. It is also possible to 
create greater interaction with the onboard computer while causing 
distraction and yet still not ensure that the directive is understood. 
For instance, a system tested by one railroad required an eight digit 
acknowledgment code to confirm receipt of a mandatory directive. In 
prototype testing locomotive engineers attempting to enter the code 
have exceeded their authority, because entering a code is a distraction 
similar to text messaging (a prohibited practice).\13\
---------------------------------------------------------------------------

    \13\ The response to this kind of concern is typically that the 
PTC system will enforce, which was its purpose to start with. 
However, even vital electronics sometimes fail in other than a safe 
mode, and in that case the crew performance is relied upon to 
backstop the system (rather than the opposite)--assuming that the 
crew has information that it needs to do so. Further, if the 
engineer is distracted even for relatively few seconds the danger 
exists that the engineer will not take other necessary actions 
(sounding the horn at a crossing, monitoring the condition of the 
brake pipe and setting the train up for an upcoming slow order to 
avoid excessive in-train forces, etc.).
---------------------------------------------------------------------------

    In those cases where train consist information needs to be adjusted 
and confirmed in the PTC system, having that done by the conductor will 
eliminate a potential source of error. (Provision of input capability 
on the conductor's terminal will also (if so elected) avoid delays in 
train starts associated with multiple crews attempting to work out 
consist information over the radio or a cell phone link to the central 
office.) Having the conductor observe displayed PTC system data should 
also provide an additional opportunity for early identification of 
problems with mandatory directives and displayed information that may 
derive from corrupted databases, computational errors, or erroneous 
mandatory directives.
    The purpose of paragraph (f) is to ensure that those assigned tasks 
in the cab are able to perform those tasks, including constructive 
engagement with the PTC system. Furthermore, while the train is moving, 
the locomotive engineer would be prohibited from performing functions 
related to the PTC system that have the potential to distract the 
locomotive engineer from performance of other safety-critical duties. 
According to the public comments, that would make it impractical for 
certain freight railroads not to equip its locomotives with a second, 
interactive, display.
    AAR says that FRA cannot point to any computer-related activities 
that could result in distraction of the engineer. The 2009 FRA report 
entitled Technology Implications of a Cognitive Task Analysis for 
Locomotive Engineers touches on this. For example, the report states: 
``Sources of new cognitive demands include constraints imposed by the 
PTC braking profile that require locomotive engineers to modify train 
handling strategies; increases in information and alerts provided by 
the in-cab displays that require locomotive engineers to focus more 
attention on in-cab displays versus out the window, and requirements 
for extensive interaction with the PTC systems (e.g., to initialize 
it--to acknowledge messages and alerts) that impose new sources of 
workload.'' This suggests that, unless task sequencing is managed 
wisely, interaction with PTC can distract the engineer from looking 
outside the cab and attending to other duties important in train 
operation safety.
    Over the years, FRA has conducted significant human factors 
research related to supervisory train control systems such as PTC. In 
the course of that research, it has been noted that the human-machine 
interface (HMI) should be configured to avoid task overload and to 
permit the locomotive engineer to attend to the safe movement of the 
train during all times when it is in motion. This may require 
responding to obstacles on the railroad ahead (e.g., vandalism, cars 
stored on grade crossings, unsecured equipment that has rolled out, 
personnel in the foul without prior notice to train crews), without 
regard to risk of collision with other trains. Further, FRA has noted 
from its experience with the initial freight implementations of PTC 
systems that having the second crew member, where applicable, directly 
interact with the PTC system may offer the best likelihood of its safe 
functioning. For instance, train consist information (number of 
locomotives and cars, tonnage, length of train) is provided in ETMS 
from the company's management information system). That information is 
essential to the braking computation onboard. But this is often the 
intended consist, and the actual consist may vary. Having the crew 
member responsible for the accuracy of the consist enter or confirm the 
consist in the PTC system will avoid one opportunity for error each 
time this is accomplished (which, in the case of a road switching 
assignment, may be several times during a duty tour).
    The NPRM proposed, and the final rule requires, that the onboard 
apparatus be arranged so that each crew member assigned to perform 
duties in the locomotive cab could view a PTC display and execute any 
functions necessary to that crew member's duties. This provision does 
not require multiple screens, per se, nor does it require that more 
than one employee must be assigned to a crew. In fact, the proposed and 
final rules are technology neutral.
    FRA is aware of multiple ways that paragraph (f) may be satisfied 
in the event multiple crew members are in the cab and need access to 
the information provided by the PTC system. Each alternative has its 
own advantages and difficulties. FRA is ultimately concerned that the 
crew members receive the same information displayed in the same manner. 
I.e., if an engineer is looking at a graphic on a screen, a conductor 
in the same cab should be looking at the same graphic on whatever 
device the conductor is using.
    For instance, there can be a single large display placed in a 
location within the cab making it accessible to all crew members in the 
cab (as is done by Amtrak in the ACSES system used on the Northeast 
Corridor). A single display (similar to traditional cab signals) could 
be used if sufficiently large to provide adequate resolution of 
details. If the railroad opts to use a PTC system that includes the 
added functionality of digital transmissions for these purposes, a 
single screen placed between the crew members may be appropriate.
    A configuration may also include two fixed screens; one for the 
locomotive engineer and another for other crew members. In providing 
cost estimates for this rulemaking, the Class I railroads have assumed 
that this approach would be employed and that the display would be 
associated with an interactive terminal. FRA does not question the 
rationale in this manner and has approached costs estimates in the 
Regulatory Impact Analysis with this assumption.

[[Page 2672]]

    The railroads have also discussed the possibility that, where the 
locomotive engineer may have his or her own fixed screen, the other 
crew members could make use of individual ``heads-up'' displays or 
personal hand-held or portable wired or wireless devices with train 
control software, which could be set up as an interactive terminal. 
Through its Office of Research and Development, FRA has developed 
personal digital assistant (PDA) software for management of roadway 
worker authorities at a reasonable cost (at approximately one-quarter 
of the cost of a second dash-mounted display), and doing the same for a 
crew remote terminal should be just as practical. The vendor for the 
on-board portion of the ITC system already provides a router port, and 
routers are inexpensive. FRA assumes that there would be some 
additional costs related to replacement of misplaced or damaged devices 
and changing of batteries, but those costs should be reasonable. Under 
paragraph (f), hand-held or portable devices could be implemented and 
would have the same advantages as a fixed terminal. FRA does not 
require that the display be permanently affixed to the locomotive. The 
advantage of this approach would be a lesser initial cost, likely about 
one-fourth of the fixed terminal. Disadvantages include logistics of 
handling (loss, damage).
    The major freight railroads point to passenger service as evidence 
that a ``second display'' is not required, but their arguments are 
inapposite. Crew responsibilities and interactions on passenger trains 
are historically different than is the case with freight crews, and 
thus crew resource management will not be undercut by use of a single 
display. For instance, in the case of a passenger train with a single 
locomotive engineer, the engineer will have the opportunity to 
initialize the system at the point of departure by making a relatively 
easy selection for class of train (if this is not done automatically). 
Moreover, unlike in freight operations, crew members for passenger 
operations do not need to enter or confirm detailed consist information 
for a heavy train that may have a wide variety of loaded and empty 
cars. If it is necessary for the locomotive engineer to take a 
mandatory directive through the PTC terminal, that can be done with the 
train stopped at a passenger station, as is the case today using the 
voice radio. Passenger railroads will almost certainly elect to use 
vital on-board processing, so the relative chance of an on-board 
computer error will be less.
    For all of the systems proposed thus far, crewmembers must actively 
review and acknowledge mandatory directives in order for the system to 
provide the required level of safety. Where mandatory directives are 
transmitted by voice over the radio, which is the current practice for 
freight railroads, the conductor would typically be able to copy and 
acknowledge the transmission while the train is in motion. Passenger 
train engineers would have to be stopped (e.g., at a station) in order 
to copy and acknowledge the mandatory directive. See 49 CFR 
220.61(b)(2).
    FRA is aware of three ways to receive, safely review, and 
acknowledge mandatory directives. First, the engineer could receive, 
review, and acknowledge authorities while the train is stopped. Second, 
the conductor could receive, review, and acknowledge voice 
transmissions of mandatory directives, whether or not the train is 
moving. Third, the conductor could receive, review, and acknowledge 
authorities through a device which combines display and data entry 
capabilities, whether or not the train is moving. The first option is 
likely how passenger railroads will comply with the requirements. Such 
railroads have only one crewmember in most cabs. This is likely not to 
be extremely burdensome on most passenger trains, as the engineer can 
receive, review, and acknowledge mandatory directives at passenger 
station stops. Thus, FRA is not being illogical, as AAR asserts, by 
permitting passenger operations with a single cab occupant. What would 
be illogical would be to require a second display where only one 
crewmember is present. Freight locomotives with only one crewmember 
present would also be likely to use the first option, although the cab 
may be equipped with a second display. The second option would only 
require a display be within a conductor's view, but would be much lower 
cost. The third option, which FRA believes may be the norm for freight 
locomotives, may require the aforementioned second fixed screen, heads-
up display, or handheld or portable device. FRA does not believe it 
would be practical for one terminal to serve both crewmembers if both 
may be required to enter or access data.
    It should be noted that employing a fourth option, implied in 
railroad testimony, would be problematic on many fronts. That option 
would presumably involve a single display in front of the locomotive 
engineer. The train would receive electronic authorities exclusively 
through that device, and the engineer would acknowledge receipt using a 
simple procedure (e.g., pressing a single soft key) that was designed 
to hasten the task and limit distraction. The problem with such a 
procedure is that (i) there is no assurance that the engineer would 
understand what was being received, (ii) there is little chance that 
the engineer would identify any authority or slow order that was not 
appropriate to the situation, and (iii) there would be no reasonable 
way to convey the mandatory directive to the other crew member without 
stopping the train and copying it off the screen. This would be a 
perfect prescription for exclusive reliance on technology, which is 
ill-advised and which the railroads claim will not be done (i.e., these 
are said to be ``overlay'' systems that cannot detract from the 
underlying methods of operation).
    Again, the railroads are perhaps correct that safety might still be 
improved under this fourth option, at least as to the operations under 
PTC control, but that is not the question here. The question is whether 
technology will be employed that primarily protects against human error 
on board, or whether technology will be employed that protects most of 
the time but induces human error on other occasions. Every day in the 
United States there are thousands of train starts and hundreds of 
thousands of opportunities for human error in train operations. Yet 
well-trained crews rise to these challenges, and as a result each year 
there are approximately 50 to 60 train collisions on the main lines, a 
small number of overspeed derailments and work zone violations, and a 
handful of movements through misaligned main track switches. 
Accordingly, a relatively small number of wrong-side errors in the 
operation of the PTC system accompanied by any diminishing of vigilance 
on the part of train crew members could easily cause results from PTC 
implementation to fall short of the risk reduction identified in FRA's 
analysis. With time and refinement of technology and databases, there 
may be significant adjustments that can be made in current operating 
rules and procedures. But existing PTC technology for the general 
freight system has not yet been proven at that level, and it will be 
some years before that will be the case. In the meantime, it will be 
crucial that informed and well coordinated crews maintain engagement in 
the management of mandatory directives and compliance with wayside or 
cab-displayed signal indications.
    Accordingly, FRA remains convinced that each crew member should 
have access to, and engagement with, information and requirements 
pertinent

[[Page 2673]]

to the operations for which they are responsible. This third option, 
combined with electronic transmission of mandatory directives, would 
pay for itself in a very short time. Assuming that a train has to be 
stopped twice each day for the engineer to acknowledge a directive, and 
that such a stop results in a cost of at least, and probably a lot more 
than, $80 to account for additional braking and trip time as well as 
missed opportunity for meets and passes, the cost of implementing this 
option would surpass the cost of installing a second terminal in just 
50 days of service as the controlling locomotive. Assuming the 
locomotive is in the lead one-fourth of the time it is in service, the 
avoided cost of stopping would be $8,000, the cost of an additional 
terminal, in 200 days. In other words, the device will return its cost 
in much less than a year.
    Of course, the business benefits of a second terminal are not as 
great if the railroad does not adopt electronic transmission of 
mandatory directives. However, FRA believes that railroads will adopt 
electronic transmission of mandatory directives as rapidly as possible. 
They would benefit from being able to give roadway workers much more 
rapid access to track, as well as by being able to reduce the 
dispatchers' workload. Further, the business benefits envisioned in 
Appendix A require more efficient dispatching, which would rely on 
electronic transmission of mandatory directives, as well as managerial 
directives related to train pacing and meet-pass planning.
    The railroads have made no convincing argument that providing a 
second display would be harmful, as such. Rather, they argue that the 
cost is excessive in relation to any expected benefits. The AAR and 
several Class I freight railroads commented that the cost to install a 
second display in the locomotive would be approximately $8,000 per 
locomotive. According to AAR estimates, 29,461 locomotives would need 
to be equipped. This would translate into an initial installation cost 
of $235,688,000. However, AAR overestimated the number of locomotives, 
based on the document it cites. In that document, FRA estimated that 
27,598 freight locomotives would be equipped with VTMS technology only, 
and an additional 100 freight locomotives would be equipped with both 
VTMS and ACSES technology, for a total of 27,698 locomotives, which, at 
a unit cost of $8,000 per terminal type display, implies a total cost 
of $221,584,000. AAR did not include the locomotives which would have 
both VTMS and ACSES installed, and included passenger locomotives that 
will likely not require additional hardware to meet the requirement due 
to the nature of their operations. FRA does not disagree with the AAR 
and railroad unit cost estimates, as long as what AAR refers to is the 
type of unit that has input capabilities. FRA recognizes that the cost 
is actually for an additional ``terminal'' versus simply a display and 
that it must be made rugged for the locomotive cab operating 
environment. The AAR and other railroads objecting to these 
requirements maintain that there will be little safety benefit to the 
requirements, and that the benefits would be far less than the costs. 
However, in the long run, FRA believes that the additional cost for 
installing a second terminal would be justified by the aforementioned 
business benefits as well as the safety assurance.
    FRA is not altering the cost estimates for PTC from those in the 
analysis of the NPRM, because the costs of the second terminal were 
already reflected.
    FRA notes that estimated cost of the second display will be about 
4% of the total initial costs of PTC deployment. FRA has narrowly 
construed the PTC mandate to avoid separate monitoring of switches in 
signal territory, to avoid significant costs and potential delay 
related to following train collisions at low speed, and to provide 
generous exceptions where allowed by law (restricted speed in yards and 
terminals, passenger exceptions, Class II/III locomotives in limited 
operations on PTC lines, etc.)--actions that will save one or more 
billions of dollars during this initial implementation. If FRA believed 
a deviation from historic train control practice was warranted here to 
save 4% of the initial cost, we would happily provide it. We do not. 
FRA believes that the PTC systems contemplated today will, at some 
point in the future, all accept electronic transmission of mandatory 
directives. The cost of providing a terminal to the second crewmember, 
where applicable, reflects that reality. Were railroads not planning to 
have conductors acknowledge mandatory directives, the railroad could 
provide the conductor with a screen without input devices, or a clearer 
view of the engineer's screen, which have a much lower unit cost.
    FRA has placed in the docket of this rulemaking a document prepared 
by FRA's Office of Research and Development, referencing available 
human factors literature. Although FRA has addressed this issue from 
the point of view of whether the cost is justified, FRA wishes to 
emphasize that, at bottom, it is most crucial whether it would be 
possible to responsibly implement PTC on the national rail system 
without engaging the participation of each assigned crew member. We 
conclude that no such possibility has been demonstrated. Further, based 
upon FRA's knowledge of railroad operations and experience with 
oversight of existing and emerging train control technologies, FRA 
determines that it is essential for safety that each assigned crew 
member be provided the information and access to system inputs required 
to fulfill the crew member's respective duties.
    AAR again raises the issue of single occupant cabs as an issue of 
``crew resource management'' best left to the railroads. FRA maintains 
that these operators will only be authorized to receive, review, and 
acknowledge mandatory directives or similarly interact with the PTC 
systems when their trains are not in motion.
    In the NPRM, FRA noted:

    [T]he principles of crew resource management and current crew 
briefing practices in the railroad industry require that all members 
of a functioning team (e.g., engineer, conductor, dispatcher, 
roadway worker in charge) have all relevant information available to 
facilitate constructive interactions and permit incipient errors to 
be caught and corrected. Retaining and reinforcing this level of 
cooperation will be particularly crucial during the early PTC 
implementation as errors in train consist information, errors 
generated in onboard processing, delays in delivery of safety 
warnings due to radio frequency congestion, and occasional errors in 
dispatching challenge the integrity of PTC systems even as the 
normal reliability of day-to-day functioning supports reductions in 
vigilance. Loss of crew cooperation could easily spill over to other 
functions, including switching operations and management of 
emergency situations.

    Commenters generally made scant reference to this point. The AAR 
did include an attachment to its testimony captioned with reference to 
this point, but it begins with a summary task analysis to the effect 
that ``the conductor is responsible for assisting in the operation.'' 
How the conductor will assist without a copy of the requisite orders 
available, when the duty to copy mandatory directives is eliminated (as 
the AAR assumes it will be), is left unexplained.
    This is a ``far cry'' from section 402 of the RSIA08, which 
requires that FRA adopt regulations for the certification of train 
conductors. In FRA's experience as the agency responsible for oversight 
of railroad operating rules and practices, the conductor plays a key 
role in rail freight over-the-road operations by, inter alia, 
determining the train consist, ensuring compliance with hazardous 
materials placement and documentation

[[Page 2674]]

requirement, calling or acknowledging signals, receiving mandatory 
directives, conducting frequent briefings with the locomotive engineer 
to ensure compliance with movement restrictions, and intervening 
through use of the conductor's brake valve if the engineer is 
unresponsive or incapacitated. A conductor may be disciplined with the 
locomotive engineer if a signal is violated or if a slow order or other 
mandatory directive is disobeyed, and this regularly occurs. The 
conductor plays the determinative role in switching operations, issuing 
the directions for operation of the locomotive(s) so as to accomplish 
safely the placement or pick-up of rail cars at customer locations, the 
making up and breaking up of trains, and the conduct of brake tests 
when mechanical personnel are not available.
    Again, the major freight railroads have said that their PTC systems 
will ``overlay'' existing methods of operations. Those existing methods 
are defined in their books of rules, timetables and special 
instructions. The General Code of Operating Rules, applicable to most 
railroad operations in the western U.S., provides at section 1.47 that 
``The conductor and engineer are responsible for the safety and 
protection of their train and observance of the rules.'' It further 
provides that ``The conductor supervises the operation and 
administration of the train.'' ``The conductor must remind the engineer 
that the train is approaching an area restricted by:
     Limits of authority.
     Track warrant.
     Track bulletin.
 or
     Radio speed restriction.''

The rule continues: ``To ensure the train is operated safely and rules 
are observed, all crew members must act responsibly to prevent 
accidents or rule violations. Crew members in the engine control 
compartment must communicate to each other any restrictions or other 
known conditions that affect the safety operation of their train 
sufficiently in advance of such condition to allow the engineer to take 
proper action.'' The rule further requires communication of signals and 
enjoins crew members to ``take action to ensure safety, using the 
emergency brake valve to stop the train, if necessary.''
    The NORAC Operating Rules, applicable to a number of eastern U.S. 
railroads, provides at Rule 94 for general crew responsibilities 
similar to those quoted above. In addition, Rule 941 provides that 
``Conductors have general charge of the train to which they are 
assigned, and all persons employed thereon are subject to their 
instructions.''
    Each railroad is free, within the constraints of the Railway Labor 
Act as to staffing, and subject to oversight by FRA with respect to 
safety, to determine its operating rules and assignment of 
responsibilities to its personnel. Nevertheless, FRA remains concerned 
that railroad operating crews function as a team, discharging their 
responsibilities on the basis of adequate information and using their 
knowledge of the operating situation to identify safety concerns and 
resolve them. Within this framework, each crew member must remain able 
to respectfully and helpfully question a judgment by another crew 
member. This general approach is known as ``crew resource management'' 
(CRM), a concept perfected in aviation and urgently pressed on the 
railroad industry by the National Transportation Safety Board and the 
FRA. See NTSB Recommendation R-99-13 (July 29, 1999). Major railroads 
have included CRM in their training programs.
    The fear with respect to a diminution of crew integrity and 
efficiency associated with asymmetrical distribution of current 
operational data is that, not only may opportunities be lost to correct 
errors within PTC operations, but also that the conductor's lack of 
engagement will transfer to operations on lines not equipped with PTC. 
Further, any reduction in ability to function as a team could transfer, 
as well, to road and yard switching operations. Should this occur, the 
price paid for PTC would include additional casualties and property 
damage where PTC is not available as a safety net. A substantial 
portion of the Class I freight network, and much of the switching and 
terminal railroad mileage over which Class I crews also operate, will 
not be equipped under the current mandate and perhaps not for many 
years. How crews are conditioned to function together will influence 
their behavior both within and outside of the PTC-equipped network. In 
summary, FRA believes that maintaining the involvement of all assigned 
crew members in operating and responding to the PTC system is necessary 
to achieve the desired risk reduction expected of PTC systems and is 
also necessary to avoid degrading crew performance outside of PTC 
territory and during switching operations.
    NYSMTA requested clarification that in a multiple unit passenger 
train consist: (a) A second PTC display in every train operator 
compartment is not required inasmuch as only the train operator 
occupies the compartment, and; (b) the PTC operator displays in train 
operator compartments in a consist, other than those from which the 
train is operated from, are not to display PTC information while the 
train is en route. The MTA railroads have been repeatedly reassured on 
this point, and we are pleased to do so once again here.
    As previously noted, on September 25, 2009, FRA entered into the 
docket to this rulemaking a compendium of human factors literature 
relevant to the HMI regulations and compiled by FRA's Office of 
Research and Development. AAR then submitted late-filed supplemental 
comments--which posted to the docket on October 20, 2009, approximately 
two months after the closing of the comment period and three weeks 
after FRA entered the compendium into the docket--addressing various 
portions of the compendium. FRA believes that this final rule already 
addresses each one of AAR's substantial concerns in its supplemental 
comments. AAR also states that it ``has been deprived of the 
opportunity to consider its comments in a deliberative fashion.'' 
Supplemental Comment of the Association of American Railroads, Docket 
FRA-2008-0132-0055.1, at 3 (Oct. 20, 2009). However, contrary to AAR's 
suggestion, the Administrative Procedure Act (APA) does not require 
that FRA provide additional time to comment on the compendium. See, 
e.g., Credit Union Nat. Ass'n v. National Credit Union Admin., 57 
F.Supp.2d 294, 302 (E.D. Va. 1995) (agency complied with the APA's 
notice and comment requirements, despite not disclosing certain data 
related to the rulemaking, because the agency had provided a reasonable 
opportunity to participate in the rulemaking process); see also 
Appalachian Power Co. v. E.P.A., 579 F.2d 846, 853 (4th Cir. 1978) 
(despite agency's failure to provide notice of certain data in advance 
of public hearings, interested parties were sufficiently advised of the 
scope and basis of the rulemaking to enable them to comment 
intelligently and meaningfully). Instead, the APA simply states that an 
agency must publish ``the terms or substance of the proposed rule or a 
description of the subjects or issues involved.'' 5 U.S.C. 553(b)(3). 
To meet the requirements of section 553, an agency ``must provide 
sufficient factual detail and rationale for the rule to permit 
interested parties to comment meaningfully.'' Florida Power & Light Co. 
v. United States, 846 F.2d 765, 771 (DC Cir. 1988), cert. denied, 490 
U.S. 1045 (1989).

[[Page 2675]]

    FRA has provided that opportunity in this proceeding. The research 
recited in the compendium simply provided for the benefit of interested 
parties additional information that had previously been made public, 
FRA's views on the import of the research were aired during RSAC 
meetings and are expressed at various points in the NPRM, and the 
railroads obviously had sufficient time to prepare 16 pages of comments 
on the compendium itself. Clearly, the commenters were not prejudiced 
by the inclusion of the compendium in the docket.
Section 236.1031 Previously Approved PTC Systems
    FRA recognizes that substantial effort has been voluntarily 
undertaken by the railroads to develop, test, and deploy PTC systems 
prior to the passage of the RSIA08, and that some of the PTC systems 
have accumulated a significant history of safe and reliable operations. 
In order to facilitate the ability of the railroads to leverage the 
results of PTC design, development, and implementation efforts that 
have been previously approved or recognized by FRA prior to the 
adoption of this subpart, FRA is proposing an expedited certification 
process in this section.
    Under paragraph (a), each railroad that has a PTC system that may 
qualify for expedited treatment would have to submit a Request for 
Expedited Certification (REC) letter. Products that have not received 
approval under the subpart H, or have that have not been previously 
recognized by FRA, would be ineligible. The REC letter may be jointly 
submitted by PTC railroads and suppliers as long as there is at least 
one PTC railroad. A PTC system may qualify for expedited certification 
if it fulfills at least one of the descriptions proposed in paragraphs 
(a)(1) through (a)(3). While these descriptions are objective in 
nature, FRA intends them to cover ETMS, ITCS, and ACSES, respectively. 
The versions or configurations recognized would depend upon the status 
at the time of the request.
    Paragraph (a)(1) applies to systems that have been recognized or 
approved by FRA after submission of a PSP in accordance with subpart H. 
Subpart I generally reflects the same criteria required for a PSP under 
subpart H. Thus, FRA believes that most of the PTCDP and PTCSP 
requirements in subpart I can be fulfilled with the submission of the 
existing and approved PSP. However, FRA notes that the subject railroad 
will also need to submit the information required in a PTCDP and PTCSP 
that is not in the current PSP.
    FRA also recognizes that certain PTC systems may currently operate 
in revenue service with FRA approval through the issuance of a waiver 
or order. Paragraphs (a)(2) and (a)(3) intend to cover those systems.
    If a PTC system complying with paragraph (a)(1) is provided 
expedited certification, the system plans should ultimately match the 
criteria required for each PTCDP and PTCSP. As previously noted, a 
railroad may seek to use a PTC system that has already received a Type 
Approval. To extend this benefit as it applies to previously used 
systems for which expedited certification is provided, paragraph (b) 
gives the Associate Administrator the ability to provide a Type 
Approval to systems receiving expedited certification in accordance 
with paragraph (a)(1).
    FRA recognizes that certain systems eligible for expedited 
certification may not entirely comply with the subsequently issued 
statutory mandate. Accordingly, under paragraph (c), FRA is compelled 
to require that before any Type Approval or expedited certification may 
be provided, the PTC system must be shown to reliably execute the same 
functionalities of every other PTC system required by subpart I. 
Nothing in this abbreviated process should be construed as implying the 
automatic granting by FRA of a Type Approval or PTC System 
Certification. Each expedited request for a Type Approval or PTC System 
Certification must be submitted by the railroad under this abbreviated 
process and, as required under subpart I, must demonstrate that the 
system reliably enforces positive train separation and prevents 
overspeed derailments, incursions into roadway worker zones, and 
movements through misaligned switches.
    Under paragraph (d), FRA encourages railroads, to the maximum 
extent possible, to use proven service history data to support their 
requests for Type Approval and PTC System Certification. While proven 
service history cannot be considered a complete replacement for an 
engineering analysis of the risks and mitigations associated with a PTC 
product, it provides great creditability for the accuracy of the 
engineering analysis. Testing and operation can only show the absence 
or mitigation of a particular failure mode, and FRA believes that there 
will always be some failure modes that may only be determined through 
analysis. Due to this inherent limitation associated with testing and 
operation, FRA also strongly encourages the railroads to also submit 
any available analysis or information.
    Paragraph (e) requires that, to the extent that the PTC system 
proposed for implementation under this subpart is different in 
significant detail from the system previously approved or recognized, 
the changes shall be fully analyzed in the PTCDP or PTCSP as would be 
the case absent prior approval or recognition. FRA understands that the 
PTC product for which expedited Type Approval and PTC System 
Certification is sought may differ in terms of functionality or 
implementation from the PTC product previously approved or recognized 
by FRA. In such a case, the service history and analysis may not align 
directly with the new variant of the product. Similarly, the available 
service history and analysis associated with a PTC product may be 
inconclusive about the reliability of a particular function. It is 
because of these possible situations that FRA can not unequivocally 
promise that all requests for expedited Type Approval and PTC System 
Certification submitted by a railroad under this subpart will be 
automatically granted. FRA will, however, apply the available service 
history and analytical data as credible evidence to the maximum extent 
possible. FRA believes that this still greatly simplifies each 
railroad's task in making its safety case, since the additional testing 
and analysis required need only address those areas for which credible 
evidence is insufficient. To reduce the overall level of financial 
resources and effort necessary to obtain sufficient credible evidence 
to support the claims being made for the safety performance of the 
product, FRA also encourages each railroad to share with other 
railroads a system's service history and the results of any analysis, 
even in the case where the shared information does not fully support a 
particular railroad's safety analysis.
    Paragraph (f) defines terms used only in this section. ``Approved'' 
refers to approval of a PSP under subpart H. As this final rule was 
being prepared, only BNSF ETMS I configuration had been so approved, 
but other systems were under development. ``Recognized'' refers to 
official action permitting a system to be implemented for control of 
train operations under an order or waiver, after review of safety case 
documentation for the implementation. As this NPRM was being prepared, 
only ACSES I had been recognized under an order of particular 
applicability, and ACSES II was under review for potential approval. 
Only one system, the ITCS in place on Amtrak's Michigan line, had been 
approved for unrestricted revenue service under waiver.

[[Page 2676]]

    FRA was unable to fashion an outright ``grandfathering'' of 
equipment previously used in transit and foreign service. FRA does not 
have the same degree of direct access to the service history of these 
systems. Transit systems--except those that are connected to the 
general railroad system--are not directly regulated by FRA. FRA has had 
limited positive experience eliciting safety documentation from foreign 
authorities, particularly given the influence of national industrial 
policies.
    However, FRA believes that, while complete exclusion may not be 
available in those circumstances, procedural simplification may be 
possible. FRA is considering a procedure under which the railroad and 
supplier could establish safety performance at the highest level of 
analysis for the particular product, relying in part on experience in 
the other service environments and showing why similar performance 
should be expected in the U.S. environment. Foreign signal suppliers 
should be in a good position to marshal service histories for these 
products and present them as part of the railroad's PTCSP. For any 
change, the applicant must provide additional information that will 
enable FRA to make an informed decision regarding the potential impact 
of the change on safety. This information must include, but is not 
limited to, the following: (1) A detailed description of the change; 
(2) a detailed description of the hardware and software impacted by the 
change; (3) a detailed description of any new functional data flows 
resulting from the change; (4) the results of the analysis used to 
verify that the change did not introduce any new safety risks or, if 
the change did introduce any new safety risks, a detailed description 
of the new safety risks and the associated risk mitigation actions 
taken; (5) the results of the tests used to verify and validate the 
correct functionality of the product after the change has been made; 
(6) a detailed description of any required modifications in the 
railroad training plan that are necessary for continued safe operation 
of the product after the change; and (7) a detailed description of any 
new test equipment and maintenance procedures required for the 
continued safe operation of the product.
    In the same vein, paragraph (g) encourages re-use of safety case 
documentation previously reviewed, whether under subpart H or subpart 
I.
Section 236.1033 Communications and Security Requirements
    Subpart I provides specific communications security requirements 
for PTC system messages. Section 236.1033 originated from the radio and 
communications task force within the PTC Working Group. The objectives 
of the requirements are to ensure data integrity and authentication for 
communications with and within a PTC system.
    In data communications, ``cleartext'' is a message or data in a 
form that is immediately comprehensible to a human being without 
additional processing. In particular, it implies that this message is 
transferred or stored without cryptographic protection. It is related 
to, but not entirely equivalent to, the term ``plaintext.'' Formally, 
plaintext is information that is fed as an input to a cryptographic 
process, while ``ciphertext'' is what comes out of that process. 
Plaintext might be compressed, encrypted, or otherwise manipulated 
before the cryptographic process is applied, so it is quite common to 
find plaintext that is not cleartext. Cleartext material is sometimes 
in plain text form, meaning a sequence of characters without 
formatting, but this is not strictly required. The security 
requirements are consistent with the Department of Homeland Security 
(DHS) guidance for SCADA systems and the National Institute of 
Standards and Technology guidance. FRA has coordinated this final rule 
with DHS.
    Paragraph (a) establishes the requirement for message integrity and 
authentication. Integrity is the assurance that data is consistent and 
correct. Generally speaking, in cryptography and information security, 
integrity refers to the validity of data. Integrity can be compromised 
through malicious altering--such as an attacker altering an account 
number in a bank transaction, or forgery of an identity document--or 
accidental altering--such as a transmission error, or a hard disk 
crash. A level of data integrity can be achieved by mechanisms such as 
parity bits and cyclic redundancy codes. Such techniques, however, are 
designed only to detect some proportion of accidental bit errors; they 
are powerless to thwart deliberate data manipulation by a determined 
adversary whose goal is to modify the content of the data for his or 
her own gain. To protect data against this sort of attack, 
cryptographic techniques are required. Thus, appropriate algorithms and 
keys must be employed and commonly understood between the entity 
wanting to provide data integrity and the entity wanting to be assured 
of data integrity.
    Authentication is the act of establishing or confirming something 
(or someone) as authentic. Various systems have been invented to 
provide a means for readers to reliably authenticate the sender. In any 
event, the communication must be properly protected; otherwise, an 
eavesdropper can simply copy the relevant data and later replay it, 
thereby successfully masquerading as the original, legitimate entity.
    Sender authentication typically finds application in two primary 
contexts. Entity identification serves simply to identify the specific 
entity involved, essentially in isolation from any other activity that 
the entity might want to perform. The second context is data origin 
identification, which identifies a specific entity as the source or 
origin of a given piece of data. This is not entity identification in 
isolation, nor is it entity identification for the explicit purpose of 
enabling some other activity. Rather, this is identification with the 
intent of statically and irrevocably binding the identified entity to 
some particular data, regardless of any subsequent activities in which 
the entity might engage. Cryptographically based signatures provide 
nearly irrefutable evidence that can be used subsequently to prove to a 
third party that this entity did originate--or at least possess--the 
data.
    Paragraph (b)(1) requires that cryptographic algorithms and keys 
used to establish integrity and authenticity be approved by either the 
National Institute of Standards & Technology (NIST) or a similar 
standards organization acceptable to FRA. As a practical matter, 
cryptographic algorithms can be believed secure by competent, 
experienced, and practicing cryptographers. This requires that the 
algorithms be publicly known and have been seriously studied by working 
cryptographers. Algorithms that have been approved by NIST (or similar 
standards bodies) can be assured of being both publicly known and 
seriously studied.
    Paragraph (b)(2) allows the use of either manual or automated means 
to distribute keys. Key distribution is the most important component in 
secure transmissions. The general key distribution problem refers to 
the task of distributing keys between communicating parties to provide 
the required security properties. Frequent key changes are usually 
desirable to limit the amount of data compromised if an attacker learns 
the key. Therefore, the strength of any cryptographic system

[[Page 2677]]

results with the key distribution technique, a term that refers to the 
means of delivering a key to two parties that wish to exchange data 
without allowing others to see the key. Key distribution can be 
achieved in a number of ways. There are various combinations by which a 
key can be selected manually or in automation amongst one or multiple 
parties.
    Paragraph (b)(3) establishes the conditions under which 
cryptographic keys must be revoked. Paragraph (b)(3)(i) addresses the 
situation when a key has actually been found to have been compromised 
and when the possibility of key compromise exists. Cryptographic 
algorithms are part of the foundations of the security house, and any 
house with weak foundations will collapse. Adequate procedures should 
be foreseen to take an algorithm out of service or to upgrade an 
algorithm which has been used beyond its lifetime.
    Paragraph (d) addresses physical protection as applied to 
cryptographic equipment. Compliance does not necessitate locking 
devices within mechanical safes or enclosing their electronics within 
thick steel or concrete shields (i.e., making them tamper-proof). 
Compliance does, however, involve using sound design practices to 
construct a system capable of attack detection by a comprehensive range 
of sensors (i.e., tamper resistant). The level of physical security 
suggested should be such that unauthorized attempts at access or use 
will either be unsuccessful or will have a high probability of being 
detected during or after the event. Additionally, the cryptographic 
equipment should be prominently situated in operation so that its 
condition (outward appearance, indicators, controls, etc.) is easily 
visible to minimize the possibility of undetected penetration. In any 
system containing detection and destruction methods as described here, 
there is naturally a cost penalty for providing very high levels of 
tamper resistance, due to construction and test requirements by the 
manufacturer. It is naturally important to analyze the risks of key 
disclosure against cost of protection and specify a suitable 
implementation.
    Confidentiality has been defined by the International Organization 
for Standardization (ISO) as ``ensuring that information is accessible 
only to those authorized to have access.'' Confidentiality, integrity, 
and authentication all rely on the same basic cryptographic 
primitives--algorithms with basic cryptographic properties--and their 
relationship to other cryptographic problems. These primitives provide 
fundamental properties, which guarantee one or more of the high-level 
security properties. In paragraph (e)(1), FRA makes it clear that while 
providing for confidentiality of message data is not a regulatory 
requirement, if confidentiality is elected to be implemented by a 
railroad, that the same protection mechanisms applicable to the 
cryptographic primitives that support integrity and authentication must 
also be provided for the cryptographic primitives that support 
confidentiality.
    It is only the difficulty of obtaining the key that determines 
security of the system, provided that there is no analytic attack 
(i.e., a ``structural weakness'' in the algorithms or protocols used), 
and assuming that the key is not otherwise available (such as via 
theft, extortion, or compromise of computer systems). A key should 
therefore be large enough that a brute force attack (possible against 
any encryption algorithm) is infeasible, whereas the attack would take 
too long to execute. Under information theory, to achieve perfect 
secrecy, it is necessary for the key length to be at least as large as 
the message to be transmitted and only used once (this algorithm is 
called the one-time pad). In light of this, and the practical 
difficulty of managing such long keys, modern cryptographic practice 
has discarded the notion of perfect secrecy as a requirement for 
encryption, and instead focuses on computational security. Under this 
definition, the computational requirements of breaking an encrypted 
text must be infeasible for an attacker. Paragraph (e)(2) requires that 
in the event that a railroad elects to implement confidentiality, the 
chosen key length should provide the appropriate level of computational 
complexity to protect the information being protected, and that this 
information be included in the PTCSP. Both academic and private 
organizations provide recommendations and mathematical formulas to 
approximate the minimum key size requirement for security based on 
mathematic attacks; they generally do not take algorithmic attacks, 
hardware flaws, or other such issues into account. Paragraph (e)(2) has 
been revised in the final rule to correct an erroneous cross-reference 
to the security requirements set forth in Sec.  236.1013(a)(7).
    Key management--the process of handling and controlling 
cryptographic keys and associated material during their life cycle in a 
cryptographic system--includes ordering, generating, distributing, 
storing, loading, escrowing, archiving, auditing, and destroying the 
different types of material. Paragraph (e) requires that cleartext 
stored cryptographic keys be protected from unauthorized disclosure, 
modification, or substitution. During key management, however, it may 
be necessary to validate the accuracy of the key being entered, 
especially in cases where the key management process is being done 
manually. During the key entry process, keys not encrypted to protect 
against disclosures may be temporarily displayed to allow visual 
verification. However, if the key has been encrypted to protect against 
disclosure, then the cleartext version of the key may not be displayed. 
This does not, however, preclude the display of the encrypted version 
of the key.
    In paragraph (f), FRA requires that each railroad implement a 
service restoration and mitigation plan to address restoral of 
communications services in the event of their loss or disruption and to 
make this plan available to FRA. Loss of communications services 
reduces or eliminates the effectiveness of a PTC system and FRA 
requires that these critical safety systems, once implemented, are 
restored to operation as soon as practical. FRA believes that the 
restoration plan must include testing and validating the plan, 
communicating the plan, and validating backup and restoration 
operations.
    To ensure that these or any other procedures work in the railroad's 
operational environment, the railroad must validate each procedure 
intended for implementation. The backup and restoration plan should 
clearly describe who is to implement procedures and how they are to do 
it. The primary information to be communicated includes: The team or 
person (specified as an individual or a role) that is responsible for 
determining when restoration of service is required and the procedures 
to be used to restore service, as well as the team or person 
responsible for implementing procedures for each restoration scenario; 
the criteria for determining which restoration procedures are most 
appropriate for a specific situation; the time estimates for 
restoration of service in each restoration scenario; the restoration 
procedures to be used, including the tools required to complete each 
procedure; and the information required to restore data and settings.
    Finally, paragraph (g) makes clear that railroads are permitted to 
implement more restrictive security requirements provided the 
requirements do not adversely impact the interoperability.

[[Page 2678]]

    FRA has received no comments on Sec.  236.1033 and has adopted it 
as proposed.
Section 236.1035 Field Testing Requirements
    Initial field or subsequent regression testing of a PTC product on 
the general rail system is often required before the product has been 
certified in order to obtain data to support the safety case presented 
in the PTCSP. To ensure the safety of the public and train crews, prior 
FRA approval is required to conduct test operations on the general rail 
system. This paragraph provides an alternative to the waiver process 
when only part 236 regulations are involved. When regulations 
concerning track safety grade crossing safety or when operational rules 
are involved, however, this process would not be available. Such 
testing may also implicate other safety issues, including adequacy of 
warning at highway-rail crossings (including part 234 compliance), 
qualification of passenger equipment (part 238), sufficiency of the 
track structure to support higher speeds or unbalance (part 213), and a 
variety of other safety issues, not all of which can be anticipated in 
any special approval procedure. Approval under this part for testing 
does not grant relief from other parts of this title and the railroads 
must still apply for relief from the non-part 236 regulations under the 
discrete special approval sections of those regulations, the provisions 
of part 211 related to waivers, or both.
    The information required for this filing is described in paragraphs 
236.1035(a)(1) through (a)(7). This information is necessary in order 
for FRA to make informed decisions regarding the safety of testing 
operations. FRA would prefer that the informational filings to test 
under this part be accompanied by any requests for relief from non-part 
236 regulations so that they may be considered as a whole.
    Paragraph (b) provides notification that FRA may--based on the 
results of the review of the information provided in paragraph (a) and 
in order to provide additional oversight to ensure the safety of rail 
operations--impose special conditions on the execution of the testing, 
including the appointment of an FRA test monitor. When a test monitor 
is appointed, he or she has the authority to stop testing if unsafe 
conditions arise, require additional tests as necessary to demonstrate 
the safe operation of the system, or have tests rerun when the results 
are in question.
    Paragraph (c) reemphasizes the earlier discussion that either 
temporary or permanent requests for relief for other than requirements 
of part 236 must be submitted in accordance with the waiver processes 
specified by part 211.
    FRA has received no comments on Sec.  236.1035 and has adopted it 
as proposed.
Sections 236.1037 Through 236.1049
    In subpart H, Sec. Sec.  236.917 through 236.929 contain various 
requirements that involve PSPs. FRA believes that these requirements 
should apply equally to PTC systems governed by subpart I. FRA has 
included Sec. Sec.  236.1037 to 236.1049 to inform interested parties 
how these elements would apply. FRA intends that the meanings of those 
sections in subpart H, as described in the preamble to its proposed and 
final rules, would also apply equally in the context of this final 
rule. While FRA has considered amending these sections in subpart H to 
incorporate references to subpart I, FRA believes such an attempt and 
its results would be cumbersome and awkward. Thus, FRA has included the 
provisions in subpart I for clarity.
    The Rail Labor Organizations have expressed support for the 
training and qualification provisions in Sec. Sec.  236.1041, 236.1045, 
236.1047, and 236.1049 and support an expansion of PTC personnel 
training requirements, as necessary, based upon experience gained and 
any training deficiencies identified during operations of these 
systems. The RLO states that training on the PTC system is essential 
for all employees who will interface with this technology. While the 
RLO supports the requirement that employees must maintain the skill 
level necessary to safely operate trains, they urge FRA to consider 
that the ``4 hour work period'' of manual operation of a train should 
be conducted not less often than once in any given tour of duty. 
Considering that the maximum workday (except in extreme emergencies) is 
12 hours, the locomotive engineer will then be manually operating the 
train at least 33% of the time. FRA has considered this suggestion for 
a change in the approach from subpart H. However, FRA believes that 
this is an issue that should be more specifically addressed in the 
PTCSP for the system, should automatic operation ever be proposed.
Appendix A to Part 236--Civil Penalties
    Appendix A to part 236 contains a schedule of civil penalties for 
use in connection with this part. FRA is revising this schedule of 
civil penalties through issuance of the final rule to reflect the 
addition of subpart I to this part.
Appendix B to Part 236--Risk Assessment Criteria
    FRA hereby modifies Appendix B of part 236 to enhance the language 
for risk assessment criteria in light of the experience gained during 
the initial stage of PTC system implementation under subpart H and to 
accommodate the requirements of subpart I regulating the use of 
mandatory PTC systems. As modified, Appendix B includes certain 
headings and new language in paragraphs (a) through (h).
    Paragraph (a) reflects the change in the required length of time 
over which the system's risk must be computed. FRA replaces the 
requirement to assess risk for the system ``over the life-cycle of 25 
years or greater'' with the requirement to assess risk ``over the 
designed life-cycle of the product.'' FRA believes that the language is 
consistent with the preamble discussion of the subpart H final rule 
inasmuch that they do not specify the length of a system's life cycle, 
thereby providing flexibility for new processor-based systems to have a 
life cycle other than 25 years.
    FRA hereby modifies paragraph (b) only to clarify FRA's intent.
    FRA hereby modifies the heading and content of paragraph (c) to 
better identify the main purpose of this requirement and to ensure its 
consistency with the associated requirements of Sec. Sec.  236.909(c) 
and (d). FRA believes that previous paragraph (c) and its heading did 
not fully support or clarify the main intent of subpart H, which 
requires that the total cost of hazardous events should be the risk 
measure for a full risk assessment and that the mean time to hazardous 
event (MTTHE) calculations for all hazardous events should be the risk 
measure for the abbreviated risk assessment. The existing subpart H 
text asks for both the base case and the proposed case to be expressed 
in the same metrics. Paragraph (c) of this appendix, as written prior 
to the issuance of this final rule, did not fully reflect FRA's intent 
that the same risk metric is to be used in the risk assessment for both 
the previous and current conditions (see Sec.  236.913(g)(2)(vii)). FRA 
believes that the revised title of this paragraph poses the right 
question and that its new language provides better guidance on how to 
perform risk assessment for previous and current conditions.
    FRA hereby modifies the heading and text of paragraph (d) to create 
a comprehensive and detailed list of system characteristics that must 
be included in the risk assessment for each proposed PTC system subject 
to requirements of subpart H or subpart I,

[[Page 2679]]

or both, as applicable. FRA believes that the extended description of 
system characteristics better suits the risk assessment requirements of 
subpart H and subpart I. For example, the revisions clarify that the 
risk assessment must account for the total volume of traffic, the type 
of transported freight materials (PIH, TIH), and any additional 
requirements for PTC systems with trains operating at certain speeds.
    FRA hereby modifies paragraph (e) to clarify its intent and reflect 
the industry's experience in risk assessment techniques gained during 
the initial stage of PTC system implementation under subpart H. In the 
language of paragraph (e), FRA provides more specific guidance on how 
to derive the main risk characteristics, MTTHE, and what role 
reliability and availability parameters, such as mean time to failure 
(MTTF) or mean time between failures (MTBF), for different system 
components can play while assessing risk for vital and non-vital 
hardware or software components of the system. FRA emphasizes that it 
is critical that each railroad and its vendors or suppliers include the 
software failure rates into risk assessments for the system. FRA also 
finds it necessary to advise each railroad and its vendors or suppliers 
to include reliability and availability characteristics, such as MTTF 
or MTBF, into its risk assessment to account for potential system 
exposure to hazards during system failures or malfunctioning when the 
system operates in its fall back mode--the back-up operation, as 
described in the PTCSP, when the PTC system fails to operate.
    FRA believes that the modifications to paragraph (e) more 
accurately address the industry's need for clarity in interpretation 
and execution of the requirements related to risk assessment. FRA 
received comments from HCRQ/CGI noting that the phrases ``frequency of 
hazardous events'' and ``failure frequency'', which were contained in 
paragraph (e) of the proposed rule, are equivalent. HCRQ/CGI therefore 
recommended that FRA revise the second sentence in paragraph (e) to 
read as follows: ``The MTTHE is to be derived for both fail-safe and 
non-fail-safe subsystems or components.'' FRA agrees with this 
recommendation and has therefore revised the second sentence of 
paragraph (e) accordingly.
    Several commenters questioned whether additional guidance on 
acceptable methods for calculating MTTHE values for processor-based 
subsystems and components can be given by FRA. FRA believes it is 
inappropriate to provide this guidance in the text of the final rule, 
especially counting the fact that FRA is not to be involved in all 
aspects of the design and engineering associated with a product. Any 
guidance that FRA could provide would not reflect the level of 
understanding that the vendor(s) or supplier(s) and system integrators 
of the product should have gained throughout the design and 
implementation process that would enable them to specify, evaluate and 
determine such critical measures as MTTF, MTBF, and MTTHE. There is a 
large body of publicly available work from the research and engineering 
community that addresses various perspectives on determination of 
appropriate methods of determining MTTHE and other related parameters. 
Upon receipt of the risk assessment documentation in the PTCSP, FRA 
will provide feedback on the appropriateness of a vendor, supplier, or 
railroad selected methodology for determining MTTHE and the 
acceptability of the results of calculations based on that methodology 
with respect to regulatory acceptability. However FRA views the 
specification and determination of appropriate MTTHE and other design 
parameters as a fundamental responsibility of the system integrator, 
vendor, or supplier that neither can nor should be abrogated.
    FRA received comments on the last sentence in paragraph (f)(1) from 
HCRQ/CGI, in which HCRQ/CGI asserted that ``permanent'' faults would 
result in an MTTHE of zero. In addition, HCRQ/CGI asserted that 
``transient'' by definition is something that comes and then goes away, 
which may never be detected. Thus, HCRQ/CGI questioned how one could 
determine the rate of its occurrence. In order to address these 
concerns, HCRQ/CGI recommended that FRA revise the last sentence in 
paragraph (f)(1) to read as follows: ``The MTTHE calculation must 
consider the rates of failures caused by contributory faults accounting 
for the fault coverage of the integrated hardware/software subsystem or 
component, phased interval maintenance, and restoration of the detected 
failures.''
    In response to this comment, FRA would like to reiterate that the 
main intent of the requirement specified in paragraph (f)(1) was to 
request that the statistics on subsystem or component failures 
available for MTTHE calculation must be used in its entirety. This 
means that all types of failures (faults) observed during subsystem or 
component operation should be accounted for, regardless of the types of 
failures by their appearance to the observer (permanent, transient or 
intermittent), and regardless of whether the failure was caused by the 
fault of the subsystem or component itself or by errors of the 
operating agent (human factor associated with operation, maintenance or 
restoration of the subsystem). FRA feels that replacing the enumerated 
in the original text types of faults ``permanent, transient, and 
intermittent'' with the term ``contributory faults'' will not assure 
that all types of faults will be accounted for. FRA also notes that the 
derivation of MTTHE for the operating system, subsystem or component 
for which the risk assessment is to be performed is a complex process 
which may require the use of Fault Tree Analysis or other relevant 
techniques. These techniques will use the probabilities of single point 
component failures identified for the system. This process cannot lead 
to MTTHE of zero value. Neither can this process result in MTTHE being 
equal to infinity. The calculated probability of accidents (the inverse 
value of MTTHE) may be infinitely small to the extent that the safety 
requirement of this Part is met (i.e., during the entire life time of 
the system it is very unlikely for the accident to occur), but rarely 
will the probability of such events be zero in a practical world. Based 
on this reasoning, FRA retains the text in proposed paragraph (f)(1).
    FRA hereby modifies paragraph (f)(2) to reflect FRA's understanding 
that a software failure analysis may not necessarily be based on MTTHE 
``Verification and Validation'' processes and that MTTHE 
characteristics cannot be easily obtained for the system software 
components. The modification intends to outline the significance of 
detailed software fault/failure analysis and software testing to 
demonstrate repeatable predictive results that all software defects are 
identified and corrected.
    FRA received comments from HCRQ/CGI on paragraph (f)(2), in which 
HCRQ/CGI asserted that ``proper'' assessment is open to interpretation, 
while Real Time Operating System (RTOS) ``evaluation'' is possible. 
HCRQ/CGI also asserted that the assessment of device driver software 
would require the source code, which is usually proprietary. Thus, 
HCRQ/CGI recommended that the assessment should include Commercial Off-
The-Shelf (COTS) software, if incorporated, other than the operating 
system. HCRQ/CGI asserted that FRA could make this change by revising 
the first sentence in paragraph (f)(2) to read as follows: ``Software 
fault/failure analysis must be based on the assessment of the design 
and implementation of the application code, an evaluation of the 
operating/

[[Page 2680]]

executive program and other COTS software components.'' HCRQ/CGI also 
commented that it is not possible to demonstrate that all software 
defects have been identified with a high degree of confidence. HCRQ/CGI 
quotes a famous statement made years ago (author unknown): ``It is 
common in industry to find a piece of software, which has been 
subjected to a thorough and disciplined testing regime, has serious 
flaws.'' HCRQ/CGI asserted that it is not clear what ``high degree of 
confidence'' implies. Therefore, HCRQ/CGI recommended that the last 
sentence in paragraph (f)(2) be revised to read as follows: ``The 
software assessment process must demonstrate, through repeatable 
predictive results, that the software operates as specified without 
error.''
    In response to this comment, FRA revises paragraph (f)(2) to 
replace the phrase ``proper assessment'' with the word ``assessment,'' 
and to specify that ``all safety-related software'' should be included 
in the software fault/failure analysis including COTS software.
    However, FRA disagrees with the commenter that, in the requirement 
for the software defects to be identified and corrected with the ``high 
degree of confidence,'' the term ``high degree of confidence'' requires 
further clarification. The definition of this term is already given in 
the preamble discussion for Sec.  236.903 in subpart H of this part. 
See 70 FR 11,052, 11,067 (Mar. 7, 2005). This term is widely issued in 
sections of this part related to safety and risk assessment. Therefore, 
FRA leaves the last sentence of paragraph (f)(2) unchanged.
    FRA hereby modifies paragraph (g) to clarify that MMTHE 
calculations should account for the restoration time after system or 
component failure and that the system design must be assessed for 
adequacy through the Verification and Validation process.
    HCRQ/CG, in reference to paragraph (g)(1), repeated its comment 
given for the last sentence in paragraph (f)(1) that relates to the 
types of faults (permanent, transient).
    FRA notes that the explanations provided in FRA's response to this 
comment for paragraph (f)(1) are also applicable for this paragraph and 
therefore includes the text of proposed (g)(1) in the final rule.
    FRA hereby modifies paragraph (h) to emphasize the need to document 
all assumptions made during the risk assessment process. FRA believes 
that the assumptions should be documented while deriving the total cost 
of potential accident consequences for full risk assessment or MTTHE 
values for abbreviated risk assessment, rather than only documenting 
assumptions for other intermediate parameters, such as MTTF and Mean 
Time To Repair (MTTR), as currently required. These two referenced 
parameters may or may not be relevant for the risk assessment.
    FRA received comments from HCRQ/CGI on paragraph (h)(1), in which 
HCRQ/CGI asserted that the first sentence should be its own paragraph. 
However, HCRQ/CGI also asserted that the proposed rule text was unclear 
as to how the railroad would be expected to comply with this 
requirement.
    FRA disagrees with the commenter that the paragraph (h)(1) should 
be restructured and that further clarification is required for the 
process of documenting all assumptions made while deriving the risk 
metrics that are to be used in the risk assessment for the product. In 
order for FRA to assess the validity of risk assessment done by 
railroads for their particular products, all assumptions made by the 
railroad in regards of deriving chosen risk metrics shall be presented 
along with the risk assessment. This is critical for the further 
confirmation that the assumptions made were correct based on the 
following in-service experience. Documenting assumptions made in the 
process of risk analysis is rather common procedure recommended by 
various studies in safety and reliability engineering.
    In its comments, HCRQ/CGI also asserted that there is no need to 
specify an ``automated'' process for comparing risk assessment 
assumptions with actual experience. This comment also was made for the 
similar text in paragraph (h)(3). Thus, HCRQ/CGI recommended that FRA 
revise the last sentence of paragraph (h)(1) to read as follows: ``The 
railroad shall document these assumptions in such a form as to permit 
later comparisons with in-service experience.'' FRA agrees with this 
comment and has therefore revised the last sentences of paragraphs 
(h)(1) and (h)(3) accordingly.
    HCRQ/CGI also submitted comments on paragraph (h)(4), asserting 
that the language in this paragraph seems to imply that a detailed 
document, separate from the fault trees themselves, is required, which 
would be very costly. Therefore, HCGI/CGI recommended that FRA revise 
paragraph (h)(4) to read as follows: ``The railroad shall document all 
of the identified safety critical fault paths to a mishap.''
    FRA does not see the need to eliminate the clause in the first 
sentence ``as predicted by the safety analysis methodology,'' but finds 
it necessary to clarify that no additional tool to that chosen by the 
railroad for the risk assessment is required by this paragraph.
Appendix C to Part 236--Safety Assurance Criteria and Processes
    FRA hereby modifies Appendix C to part 236 to enhance and clarify 
its language, reorganize the existing list of safe system design 
principles in accordance with the well established models of system 
safety engineering, and augment the list of safe system design 
principles with the principles related to safe system software design. 
A safe state is a system state that the system defaults to in the event 
of a fault or failure or when unacceptable or dangerous conditions are 
detected. The safe state is a state when the hazardous event cannot 
occur. This final rule revises proposed paragraph (a) to reflect the 
main purpose of this appendix in clear, accurate, and consistent 
language that will be repeatedly used throughout the appendix. It also 
outlines that the requirements of this appendix will be applicable to 
each railroad's PTCIP and PTCSP, as required by subpart I.
    This final rule modifies and restructures paragraph (b) to 
consistently present a complete list of safety assurance principles 
properly classified or categorized in accordance with well established 
system safety engineering principles that need to be followed by the 
designer of the system to assure that all system components perform 
safely under normal operating conditions and under failures, accounting 
for human factor impacts, external influencing, and procedures and 
policies related to maintenance, repair, and modification of the 
system. FRA also adds language indicating that these principles must 
also be applicable to PTC systems designed and implemented under the 
requirements of subpart I. FRA's intent in initially promulgating 
Appendix C was to ensure that safety principles are followed during the 
design stage and that Verification and Validation methods are used to 
assure that the product meets the safety criteria established in Sec.  
236.909. The heading of this paragraph and its subparagraphs are 
changed to more adequately and precisely capture this paragraph's 
purpose. For instance, FRA hereby modifies the heading of paragraph 
(b)(1) to better suit the chosen base of classification for all safety 
principles under paragraph (b).
    HCRQ/CGI submitted comments asserting that the third sentence of 
paragraph (b)(1) implies that the system will operate safely in the 
presence of human error. Questioning whether this

[[Page 2681]]

would be possible, HCRQ/CGI recommended deletion of this sentence.
    In order to avoid ambiguity in interpreting the important 
requirement spelled out in the third sentence of this paragraph, FRA 
revises it to read as follows: ``The system shall operate safely even 
in the absence of prescribed operator actions or procedures.''
    With respect to the fifth sentence in paragraph (b)(1), HCRQ/CGI 
asserted that it is a rare situation when hazards can be 
``eliminated.'' Therefore, HCRQ/CGI recommended that FRA revise the 
fifth and sixth sentences of proposed paragraph (b)(1) to read as 
follows: ``The safety order of precedence is to eliminate hazards 
categorized as unacceptable or undesirable. If this is not possible or 
practical, these hazards should be mitigated to acceptable levels as 
required by this part.''
    FRA agrees with the commenter that the last clause in this 
paragraph discussing elimination of unacceptable and undesirable 
hazards requires modification and revises this clause by adding extra 
clarifying sentence in the final rule for the entire clause to read as 
follows: ``Hazards categorized as unacceptable, which is determined by 
hazard analysis, must be eliminated by design. Best effort must be made 
by the designer to also eliminate by design the hazards categorized as 
undesirable. Those undesirable hazards that cannot be eliminated should 
be mitigated to the acceptable level as required by this part.''
    HCRQ/CGI submitted comments on the first and second sentences of 
paragraph (b)(2)(ii), asserting that it is not possible to implement a 
system that would continue to operate safely in the presence of 
multiple hardware failures. Therefore, HCRQ/CGI recommended that FRA 
revise the first and second sentences of paragraph (b)(2)(ii) to read 
as follows: ``The product must be shown to operate safely under 
conditions of random hardware failure. This includes single failures 
and multiple hardware failures where one or more failures.''
    FRA agrees with the commenter that the paragraph requires 
modification and revises the first two sentences to read as follows: 
``The product must be shown to operate safely under conditions of 
random hardware failures. This includes single hardware failures as 
well as multiple hardware failures that may occur at different times 
but remain undetected (latent) and react in combination with a 
subsequent failure as a later time to cause an unsafe operating 
situation.''
    HCRQ/CGI asserted that the meaning of each of the last sentences in 
paragraphs (b)(2)(iii) and (b)(2)(iv) was unclear. In order to address 
this concern, HCRQ/CGI recommended that the last sentence in paragraph 
(b)(2)(iii) be revised to read as follows: ``Occurrence of credible 
single point failures that can result in hazards must be detected and 
the product must achieve a known safe state before inadvertently 
activating any physical appliance.'' Similarly, HCRQ/CGI recommended 
that the last sentence in paragraph (b)(2)(iv) be revised to read as 
follows: ``If one non-self-revealing failure combined with a second 
failure can cause a hazard that is categorized as unacceptable or 
undesirable, then the second failure must be detected and the product 
must achieve a known safe state before inadvertently activating any 
physical appliance.''
    FRA agrees with the commenter and revises the referenced sentences 
in paragraphs (b)(2)(iii) and (b)(2)(iv) for the sentences to end with 
the following clause: ``* * * the product must achieve a known safe 
state that eliminates the possibility of false activation of any 
physical appliance.''
    Under paragraph (b)(3), FRA amends the definition of Closed Loop 
Principle to reflect its industry accepted definition provided by the 
AREMA Manual. FRA believes that the previous definition was too general 
and did not reflect the essence of the most significant principles of 
safe signaling system design.
    HCRQ/CGI submitted comments on the last sentence of paragraph 
(b)(3), asserting that the sentence is confusing because all system 
operation is a product of actions and decisions. In order to provide 
clarification, HCRQ/CGI recommended that FRA revise the last sentence 
of paragraph (b)(3) to read as follows: ``In addition, closed loop 
design requires that failure to perform a single logical operation, or 
absence of a single logical input, output or decision shall not cause 
an unsafe condition, i.e. system safety does not depend upon the 
occurrence of a single action or logical decision.''
    FRA has made an effort to perfect the definition of close loop 
principle in the NPRM and found it satisfactory to adopt the definition 
given in the 2009 issue of AREMA Communication and Signal Manual of 
Recommended Practices. FRA does not see the need for further 
enhancement of this definition.
    Under paragraph (b)(4), FRA adds a list of Safety Assurance 
Concepts that the designer may consider for implementation to assure 
sail-safe system design and operation. These principles are 
predominantly applicable for the safe system software design and quoted 
from the IEEE-1483 standard. Based on this amendment, FRA also 
renumbers some of the remaining subparagraphs of paragraph (b) to 
follow the chosen scheme for the proper classification and sequence of 
safety principles.
    GE asserts that more detail is required for the Human Factor 
Engineering Principle in paragraph (b)(5), which is part of the section 
on ``safety principles during product development.'' There are two 
components to applied Human Factor engineering in system safety: The 
component of ergonomic design and the system risk contribution of the 
human interaction with the system, along with the degree of dependency 
on the operator for safety coverage. According to GE, the latter is 
missing from the discussion and is most relevant to the safety 
principles section.
    In response to this comment, FRA would like to emphasize that the 
main purpose of Appendix C is to provide safety criteria and processes 
for design of safe systems, or fail-safe, or vital signaling systems 
that by definition must exclude any hazards associated with human 
errors. The ``reliance factor'' or, in other words, the possibility of 
hazards arising due to overreliance of the operator on the proper 
functioning of the system itself, which the commenter is referring to, 
is an issue solely relevant to the non-vital overlays complementing 
existing method of operation. For non-vital signaling systems the 
designer must adhere to the safety principles of Appendix C only to the 
extent necessary to satisfy the safety requirements of this part. 
Therefore FRA does not see a need for further modification of paragraph 
(b)(5).
    This final rule amends paragraph (c) to reflect the changes in 
recommended standards. For instance, the standard ``EN50126: 1999, 
Railway Applications: Specification and Demonstration of Reliability, 
Availability, Maintainability and Safety'' (RAMS) is superseded by the 
standard IEC62278: 2002 under the same title. The standard ``EN50128 
(May 2001), Railway Applications: Software for Railway Control and 
Protection Systems'' is superseded by the Standard IEC62279: 2002 under 
the same title.
    HCRQ/CGI submitted comments asserting that the U.S. Department of 
Defense Military Standard (MIL-STD) 882C, ``System Safety Program 
Requirements'' (January 19, 1993) has been superseded by U.S. 
Department of Defense Military Standard (MIL-STD) 882C, ``System Safety 
Program Requirements'', Notice 1 (January 19, 1996)''.
    In the NPRM, FRA suggested that railroads follow recommendations of 
MIL-STD-882C of January 19, 1993

[[Page 2682]]

issuance specifically. The notice issued on January 19, 1996 does not 
contain material necessary for the risk analysis, verification and 
validation processes. Therefore FRA retains the former reference to 
MIL-STD-882C of January 19, 1993.
    Under paragraph (c)(3)(i), FRA references additional IEEE standards 
that have become available and will support the designs of PTC systems 
that are widely using communications as their main component. In 
addition to existing reference under paragraph (c)(3)(i)(A) for IEEE-
1483 Standard, the following standards are added to paragraph 
(c)(3)(i): IEEE 1474.2-2003, Standard for user interface requirements 
in communications based train control (CBTC) systems; and IEEE 1474.1-
2004, Standard for Communications-Based Train Control (CBTC) 
Performance and Functional Requirements.
    After an analysis of the current applicability of ATCS 
Specification 130 and 140, FRA believes that they are not being used. 
Thus, FRA hereby removes these standards from the list of referenced 
standards. However, FRA also adds the ATCS 200, Data Communication 
standard that remains relevant for communication segment of PTC system 
designs.
    FRA also considers it necessary to reference several additional 
sections of the current AREMA 2009 Communications and Signal Manual of 
Recommended Practices. In addition to Section 17 of this manual 
referenced in a previous version of Appendix C, FRA hereby adds to the 
list of references Section 16 Vital Circuit and Software Design; 
Section 21 Data Transmission; and Section 23 Communication-Based 
Signaling.
Appendix D to Part 236--Independent Review of Verification and 
Validation
    There has been no change in the underlying engineering principles 
associated with Appendix D. The changes made in this final rule are 
cosmetic, simply updating the Appendix so that it is applicable to both 
subpart H and I, and reducing the workload on the vendor or supplier, 
the railroad, and FRA. FRA determined that it would have been more 
burdensome to refer to different Appendices that are functionally 
identical, and whose only practical difference would be that one 
referred only to subpart H, and the other to subpart I of this part.
    Paragraph (a) discusses the purpose of an independent third-party 
assessment of product Verification and Validation. FRA's position that 
the requirement for an independent third-party assessment is reasonably 
common in the field of safety-critical systems remains unchanged. FRA's 
recent experience confirms that this approach can enhance the quality 
of decision making by railroads and FRA. The potential for undergoing a 
third party audit provides incentives to those who design and produce 
safety-critical systems to more rigorously create and maintain safety 
documentation for their systems. FRA acknowledges that documentation, 
by itself, will not ensure a safe system. However, the absence of 
documentation will make it virtually impossible to ensure the safety of 
the system throughout its life-cycle. The third party also brings a 
level of technical expertise, and a perspective that may not be 
available on the staff of the railroad (or FRA)--effectively permitting 
the railroad (and thus FRA) to look behind claims of the vendor or 
supplier to actual engineering practice. This may be especially 
appropriate where the system in question utilizes a novel architecture 
or relies heavily on COTS hardware and software.
    Paragraph (b) establishes the requirements for independence of the 
third-party auditor. The text associated with the underlying principle 
of independence has simply been clarified to indicate that there must 
be independence at all levels of the product design and manufacture. 
This situation has arisen where a third party wished to provide 
independent safety assessments of the system, but also provide 
technical support for the design of a component that would be used in 
the system being reviewed. FRA maintains that such practices, even if 
the entity in question attempts to firewall the parts of the 
organization doing the respective tasks, represents a conflict of 
interest and is unacceptable.
    Paragraphs (c) through (f) discuss the substance of the third-party 
assessment. This assessment should be performed on the system as it is 
finally configured, before revenue operations commence. The assessor 
should review the supplier's processes as set forth in the applicable 
documentation and provide comments to the supplier. The reviewer should 
be able to determine vulnerabilities in the supplier's processes and 
the adequacy of the safety analysis (be it in an RSPP and PSP or in a 
PTCDP and PTCSP) as they apply to the product. ``Acceptable 
methodology'' is intended to mean standard industry practice, for 
example, as contained in MIL-STD-882C. FRA is aware of many other 
acceptable industry standards, but usage of a less common one in an 
analysis would most likely require a higher level of FRA scrutiny. In 
addition, the reviewer considers the completeness and adequacy of the 
required safety documents.
    Paragraph (d) discusses the reviewer's tasks at the functional 
level. Here, the reviewer will analyze the supplier's methods to 
establish that they are complete and correct. First, a Preliminary 
Safety Analysis is performed in the design stage of a product. In 
addition to describing system requirements within the context of the 
concept of operations, it attempts, in an early stage, to classify the 
severity of the hazards and to assign an integrity level requirement to 
each major function (in conventional terms, a preliminary hazard 
analysis). Again there are many practices widely accepted within 
industry such as: Hazard Analysis (HA), Fault Tree Analysis (FTA), 
Failure Mode and Effects Analysis (FMEA), and Failure Modes, Effects, 
and Criticality Analysis (FMECA). Other simulation methods may also be 
used in conjunction with the preceding methods, or by themselves when 
appropriate. Commonly practiced techniques and methods include fault 
injection, a technique that evaluates performance by injecting known 
faults at random times during a simulation period; Markov modeling, a 
modeling technique that consists of states and transitions that control 
events; Monte Carlo model, a simulation technique based on randomly-
occurring events; and Petri-net, an abstract, formal model of 
information flow that shows static and dynamic properties of a system.
    Paragraphs (e) and (f) address what must be performed at the 
implementation level. At this stage, the product is beginning to take 
form. The reviewer typically evaluates the software and, if appropriate 
or required, the hardware. In the case of software, the software will 
most likely be in modular form, such that software modules are produced 
in accordance to a particular function. In the case of hardware, this 
may be at the component or line replaceable unit level. The reviewer 
must select a significant number of modules to be able to establish 
that the product is being developed in a safe manner.
    Paragraph (g) discusses the reviewer's tasks at closure. The 
reviewer's primary task at this stage is to prepare a final report 
where all product deficiencies are noted in detail. This final report 
may include material previously presented to the supplier during 
earlier development stages.
    FRA received several comments on Appendix D related to the proper 
documentation to be reviewed by the third-party reviewer according to

[[Page 2683]]

paragraph (d)(1), the scope of hazard analysis required to be reviewed 
by paragraph (d)(2), and the methods of software development techniques 
to be reviewed according to paragraph (f)(2)(vii). These comments are 
the same as those submitted by the commenter on the text of Appendix F. 
Due to the wider applicability of these comments to the material 
presented in Appendix F, FRA has provided a response to these comments 
in the section-by-section analysis for Appendix F.
Appendix E to Part 236--Human-Machine Interface (HMI) Design
    Appendix E provides human factors design criteria. Paragraphs (a) 
through (f) cover the same material as was previously contained in 
Appendix E. See 70 FR 11,107 (March 7, 2005). However, Appendix E has 
been reformatted to support its use for subparts H and I of this part 
and, with a few exceptions, is textually the same. This Appendix still 
addresses the basic human factors principles for the design and 
operation of displays, controls, supporting software functions, and 
other components in processor-based signal or train control systems and 
subsystems regardless if they are voluntarily implemented (as is the 
case with systems qualified under subpart H of this part) or 
mandatorily implemented (as is the case with systems developed under 
subpart I of this part). The HMI requirements in this Appendix attempt 
to capture the lessons learned from the research, design, and 
implementation of similar technology in other modes of transportation 
and other industries. The rationale for each of the requirements 
associated with paragraphs (a) through (f) remains the same as was 
presented in the former version of Appendix E. See 70 FR 11,107, 
11,090-11,091 (Mar. 7, 2005).
    FRA has noted that products implemented under the requirements of 
subpart H of this part, or proposed products that will be developed 
under subpart I of this part, all have been capable of generating 
electromagnetic radiation. Such emissions are strictly regulated by the 
Federal Communications Commission for public safety and health, as well 
as to ensure that the limited electromagnetic spectrum is optimally 
utilized. FRA is therefore adding a new paragraph (h) to Appendix E, 
which requires that as part of the HMI design process, the designer 
must ensure that the product has the appropriate FCC Equipment 
Authorization, and that the product meets FCC requirements for Maximum 
Permissible Exposure limits for field strength and power density. 
Paragraph (g) does not levy any new regulatory requirements. The 
requirements cited are mandatory FCC requirements for any device that 
emits electromagnetic radiation that the system designer must comply 
with. FRA is simply identifying these requirements, as not all railroad 
product developers may be aware of them.
Appendix F to Part 236--Minimum Requirements of FRA Directed 
Independent Third-Party Assessment of PTC System Safety Verification 
and Validation
    FRA has revised the title of Appendix F in response to comments 
submitted by GE, in which GE noted that, while FRA may require a 
railroad to engage in an independent assessment of its PTC system based 
on the criteria set forth in Sec.  236.913, FRA is not requiring an 
independent assessment of every PTCSP.
    FRA received several comments from HCRQ/CGI on paragraphs (d), (e), 
(f), and (i) of Appendix F.
    The commenter asserted that the term ``acceptable methodology'' 
used in the second sentence of paragraph (d) is not clear and suggested 
that it be replaced with the term ``methodologies typical to safety-
critical systems.'' If revised in accordance with this recommendation, 
the second sentence of paragraph (d) would read as follows: ``At a 
minimum, the reviewer shall compare the supplier processes with 
methodologies typical of safety-critical systems and employ any other 
such tests or comparisons if they have been agreed to previously with 
FRA.'' In response to this comment, FRA notes that the term 
``acceptable methodologies,'' by its very nature, includes 
methodologies typical of safety-critical systems. FRA believes that the 
proposed modification may artificially limit the use of the atypical 
analysis methodologies that may provide an equivalent, or better, 
analytical results. Therefore, FRA did not incorporate the proposed 
change. However, in the interest of providing clarification to reflect 
the main intent of this paragraph, FRA has modified the second and 
third sentences in paragraph (d) to read as follows: ``At a minimum, 
the reviewer shall evaluate the supplier design and development process 
regarding the use of an appropriate design methodology. The reviewer 
may use the comparison processes and test procedures that have been 
previously agreed to with FRA.''
    The commenter also asserted that, with respect to paragraph (e), 
the reviewer will be required to analyze a ``Hazard Log,'' as opposed 
to a ``Preliminary Hazard Analysis'' document, since the Hazard Log 
will supersede the Preliminary Hazard Analysis on the final stage of 
the system development process.
    FRA agrees with the commenter that the Hazard Log more accurately 
reflects the perceived risk in the as-built condition and, therefore, 
has modified paragraph (e) to read as follows: ``The reviewer shall 
analyze the Hazard Log and/or any other hazard analysis documents for 
comprehensiveness and compliance with applicable railroad, vendor, 
supplier, industry, national, and international standards.'' The 
commenter also suggested that this comment is equally applicable to 
former paragraph (d)(1) in the prior version of Appendix D. FRA agrees 
and has modified the various applicable phrases in Appendices D and F 
accordingly. The commenter further suggested that in paragraph (f) the 
reviewer should be required to analyze samples of the hazard analyses 
``for completeness, correctness, and compliance with industry, 
national, or international standards,'' as opposed to the proposed 
requirement to analyze ``all'' hazard analyses such as Fault Tree 
Analyses (FTA), Failure Mode and Effects Criticality Analysis (FMECA). 
The commenter asserted that it will be ``difficult and prohibitive'' 
for both the supplier and the reviewer to analyze ``all'' of these 
documents in their entire length. The commenter also noted that these 
comments are applicable to existing Appendix D, paragraph (d)(2).
    In response to this comment, FRA notes that there does not appear 
to be a need for additional clarification on the depth of the quoted 
documents analysis by the reviewer. As FRA has already indicated in the 
section-by-section analysis of Sec.  236.1017, ``FRA has the discretion 
to limit the extent of the third party assessment.'' Moreover, the 
section-by-section analysis of Sec.  236.1017 goes on to state that 
``Appendix F represents minimum requirements and that if circumstances 
warrant, FRA may expand upon the Appendix F requirements as necessary 
to render a decision that is in the public interest.'' FRA will, if 
appropriate, limit the scope of analysis. FRA notes the comment, and 
will execute its regulatory discretion in this matter.
    With respect to paragraph (i)(7), HCRQ/CGI points out that the text 
of NPRM, while discussing methods of safety-critical software 
development by the manufacturer, enumerates examples that, according to 
the commenter, are not particular to the safety-critical systems, which 
appears to be contrary to the intent of this paragraph. The commenter 
recommends that FRA

[[Page 2684]]

include in the text of the final rule an extended list of examples for 
methods of software development instead of those cited in NPRM, for 
example, such methods as ``system requirement analysis, requirements 
traceability to functional and derived safety requirements, design 
analysis, documented peer review,'' etc. The commenter also noted that 
this comment is equally applicable to Appendix D, paragraph 
(f)(2)(vii).
    FRA understands the commenter's concern. FRA believes that the 
review should include any documentation associated with the software 
development that may reflect on, or address, the safety of the system. 
To address the commenter's concern and to more accurately reflect FRA's 
position, paragraph (i)(7) has been revised by deleting the list of 
examples of methods of software development previously proposed in the 
NPRM. FRA modifies the text of this paragraph to emphasize that the 
review on any documentation that may reflect on the safety of software 
design is required. As with the preceding comment, FRA will exercise 
its regulatory discretion with regards to the specific documentation 
based on the system in question and public safety. FRA has also 
modified paragraph (i)(7) in Appendix D that discusses the same issue.

VIII. Regulatory Impact and Notices

A. Executive Order 12866 and DOT Regulatory Policies and Procedures

    This final rule has been evaluated in accordance with existing 
policies and procedures, and determined to be significant under both 
Executive Order 12866 and DOT policies and procedures. 44 FR 11,034 
(Feb. 26, 1979). We have prepared and placed in the docket a regulatory 
impact analysis (RIA) addressing the economic impact of this final 
rule.
    The costs anticipated to accrue from adopting this final rule would 
include: (1) Costs associated with developing implementation plans and 
administrative functions related to the implementation and operation of 
PTC systems, including the information technology and communication 
systems that make up the central office; (2) hardware costs for onboard 
locomotive system components, including installation; (3) hardware 
costs for wayside system components, including installation; and (4) 
maintenance costs for all system components.
    Two types of benefits are expected to result from the 
implementation of this final rule--benefits from railroad accident 
reduction and business benefits from efficiency gains. The first type 
would include safety benefits or savings expected to accrue from the 
reduction in the number and severity of casualties arising from train 
accidents that would occur on lines equipped with PTC systems. Casualty 
mitigation estimates are based on a value of statistical life of $6 
million. In addition, benefits related to accident preventions would 
accrue from a decrease in damages to property such as: Locomotives, 
railroad cars, and track; equipment cleanup; environmental damage; 
train delay resulting from track closures; road closures; emergency 
response; and evacuations. Benefits more difficult to monetize--such as 
the avoidance of hazmat accident related costs incurred by federal, 
state, and local governments and impacts to local businesses--will also 
result. FRA also expects that once PTC systems are refined, there would 
likely be substantial additional business benefits resulting from more 
efficient transportation service; however, such benefits are not 
included because of significant uncertainties regarding whether and 
when individual elements will be achieved and given the complicating 
factor that some benefits might, absent deployment of PTC, be captured 
using alternative technologies at lower cost. In the NPRM, FRA 
requested comments on whether the proposed regulation exercised the 
appropriate level of discretion and flexibility to comply with RSIA08 
in the most cost effective and beneficial manner. The FRA received 
comments, discussed above in the section-by-section analysis, that FRA 
had exceeded its discretion, in general, in not creating a de minimis 
exception, in Sec.  236.1005, by designating that the railroad base its 
system designation on 2008 base year traffic patterns; in Sec.  
236.1029, by requiring that each crewmember assigned to a cab have 
access to a display adequate to perform assigned duties safely, which 
the railroads claimed meant that they have to install a second display; 
and in Sec.  236.1006 (b)(4) in permitting Class II and Class III 
railroads to operate locomotives unequipped with PTC on Class I 
railroad lines under certain conditions. FRA believes that the agency 
interpreted RSIA08 correctly in not granting AAR's very broad request 
for a de minimis exception (however, FRA did craft a new de minimis 
exception in Sec.  236.1006(b)(4)(ii), discussed above in the section-
by-section analysis), in using the 2008 traffic patterns as a basis for 
designating the system and in requiring that each crewmember in the 
locomotive cab have access to a display adequate to perform assigned 
safety-related duties. FRA also believes that it acted with an 
appropriate level of discretion and flexibility in permitting some 
operations of unequipped locomotives on PTC equipped routes. All of 
these responses are discussed in detail above, in the Section-by-
Section analysis.
    The RIA presents a 20-year analysis of the costs and benefits 
associated with this rule, using both 7 percent and 3 percent discount 
rates, and two types of sensitivity analyses. The first is associated 
with varying cost assumptions used for estimating PTC implementation 
costs. The second takes into account potential business benefits from 
realizing service efficiencies and related additional societal benefits 
from attainment of environmental goals and an overall reduction in 
transportation risk from modal diversion.
    The 20-year total cost estimates are $9.55 billion (PV, 7%) and 
$13.21 billion (PV, 3%). Annualized costs are $0.87 billion (PV, 7%) 
and $0.88 billion (PV, 3%). Using high-cost assumptions, the 20-year 
total cost estimates would be $16.25 billion (PV, 7%) and $22.54 
billion (PV, 3%). Using low-cost assumptions, the 20-year cost 
estimates would be $6.73 billion (PV, 7%) and $9.34 billion (PV, 3%). 
The later the expenditures are made, the lower the discounted cost 
impact, which in any event is a very small portion of the total PTC 
costs. This estimate is lower than the cost estimate presented in the 
NPRM. It reflects the low freight traffic volume exception for 
passenger train routes and the de minimis exception for freight 
railroads. These exceptions result in lower wayside costs than 
estimated in the NPRM RIA. FRA has not revised its locomotive cost 
estimates to reflect reduced burden resulting from the additional 
flexibility granted because the magnitude of the reduction is very 
small relative to the overall system cost.
    Twenty-year railroad safety (railroad accident reduction) benefit 
estimates associated with implementation of the rule are $440 million 
(PV, 7%) and $674 million (PV, 3%). Annualized benefits are $42 million 
(PV, 7%), and $45 million (PV, 3%). This estimate is lower than that 
estimated at the NPRM stage of the rulemaking. The estimate was lowered 
as a result of revisions made to a study performed by Volpe Center 
regarding the cost of PTC-preventable accidents. Some forecasts predict 
significant growth of both passenger and freight transportation 
demands, and it is thus possible that greater activity on the system 
could present the potential for

[[Page 2685]]

larger safety benefits than estimated in this analysis. The presence of 
a very large PTC-equipped freight locomotive fleet also supports the 
opportunity for introduction of new passenger services of higher 
quality at less cost to the sponsor of that service. Information is not 
currently available to quantify that benefit.
    The table below presents cost and benefit estimates by element 
using a 3% discount rate as well as a 7% discount rate.

         Total 20-Year Discounted Costs and Discounted Benefits
                             [At 3% and 7%]
------------------------------------------------------------------------
          Discount rate                  3.00%               7.00%
------------------------------------------------------------------------
Costs by Category:
    Central Office and                  $283,025,904        $263,232,675
     Development................
    Wayside Equipment...........      2,902, 751,825       2,414,794,033
    On-Board Equipment..........       1,613,568,678       1,390,618,364
    Maintenance.................       8,406,267,684       5,478,877,649
                                 ---------------------------------------
        Total...................      13,205,614,091       9,547,522,721
                                 =======================================
Benefits by Category:
    Fatalities..................         268,999,278         175,541,848
    Injuries....................         203,984,196         133,114,717
    Train Delay.................          24,530,630          16,008,043
    Property Damage.............         159,149,846         103,857,000
    Emergency Response..........             431,143             281,353
    Equipment Clean Up..........           2,509,576           1,637,683
    Road Closure................             580,664             378,926
    Environmental Cleanup.......           6,486,888           4,233,172
    Evacuations.................           7,129,699           4,652,654
                                 ---------------------------------------
        Total Railroad Safety            673,801,919         439,705,397
         Benefits...............
------------------------------------------------------------------------

    The Port Authority Trans Hudson (PATH), a commuter railroad, is 
apparently considering the system used by the New York City Transit 
Authority on the Canarsie line. This system, which is known as 
Communication-Based Train Control, is not similar in concept to any of 
the other PTC systems (including the CSX CBTC, with which its name 
might easily be confused), and would not be suitable, as FRA 
understands the system, except on a railroad with operating 
characteristics similar to a heavy rail mass transit system. FRA 
believes that, in absence of the statutory mandate or this rulemaking, 
PATH would have adopted PTC for business reasons.
    Although costs associated with implementation of the final rule are 
significant and such costs would far exceed the benefits, FRA is 
constrained by the requirements of RSIA08, which do not provide 
latitude for implementing PTC differently. Nevertheless, FRA has taken 
several steps to avoid triggering unnecessary costs in the proposed 
rule. For instance, FRA is not requiring use of separate monitoring of 
switch position in signal territory or that the system be designed to 
determine the position of the end of the train. FRA has also minimized 
costs, such as by requiring the monitoring of derails protecting the 
mainline, but limiting it to derails connected to the signal system; 
and by requiring the monitoring of hazard detectors protecting the 
mainline, but limiting it to hazard detectors connected to the signal 
system. FRA has also minimized costs related to diamond crossings, 
where a PTC equipped railroad crosses a non-PTC equipped railroad at 
grade; included exceptions to main track for passenger train 
operations, and provisions that would permit some Class III railroad 
operation of trains not equipped with PTC over Class I railroad freight 
lines equipped with PTC. FRA has also added provisions to the final 
rule which will permit passenger railroads to exclude up to roughly 
1,900 miles of track from the requirements to install PTC. Finally, FRA 
has provided for de minimis exceptions for Class I freight lines with 
not passenger service and negligible risk, avoiding any expenses for 
right-of-way modifications on about 300 miles, saving about $15 
million, and reducing costs by about 80% on about 3,200 additional 
miles, saving about $127 million.
    RSIA08 requires the railroads to have all mandatory PTC systems 
operational on or before December 31, 2015. Members of the PTC Working 
Group, especially railroad and supplier representatives, said that the 
timeframe was very tight, and that the scheduled implementation dates 
would be difficult to meet. In general, the faster a government agency 
requires a regulated entity to adopt new equipment of procedures, the 
more expensive compliance becomes. In part, this is due to supply 
elasticity being less over shorter time periods.
    FRA is unable to estimate the potential savings if Congress 
provided a longer implementation schedule or provided incentives, 
rather than mandates, for PTC system installation. In order to estimate 
the likely reduction in costs in such situations, FRA would need to 
develop some other schedule for implementation. The element least 
sensitive to an implementation's schedule appears to be onboard costs. 
Each PTC system's onboard equipment seems similar and is not very 
different from existing onboard systems. Further, the 2015 deadline is 
not so restrictive that it would cause railroads to pull locomotives 
out of service just to install on board PTC equipment. Locomotives must 
be inspected thoroughly every 90 and more extensively every 360 days. 
The inspections can last from one to several days. Railroads usually 
bring locomotives into their shops to perform these inspections, during 
which time a skilled and experienced team could install the on board 
equipment for PTC. System development is much less certain, and more 
time would enable vendors or suppliers to develop, test, and implement 
the software at a more reasonable cost. Wayside costs are also 
sensitive to the installation timetable, as the wayside must be mapped 
and

[[Page 2686]]

measured, and then the railroads must install wayside interface units 
(WIUs). Wayside mapping and measurement takes a highly skilled 
workforce. A larger workforce is necessary to timely implement the 
required PTC systems in a shorter amount of time. WIU installation is 
likely similar to existing signal or communication systems 
installation, and is likely to involve use of existing railroad skilled 
workers. The shorter the installation time period, the more work will 
be done at overtime rates, which are, of course, higher.
    FRA believes that lower costs could result from a longer 
installation period, but FRA also believes that the differences in 
costs would be within the range of the low costs provided in the main 
analysis of the proposed rule. The 2004 report included some lower cost 
estimates, but, in light of current discussions with railroads, the 
cost estimates in the 1998 report seem more accurate. The lower 
estimates FRA received in preparing the 2004 report were both overly 
optimistic, and excluded installation costs, as well as higher costs 
which stem from meeting the performance standards.
    Some of the costs of PTC implementation, operation, and maintenance 
may be offset by business benefits, especially in the long run, 
although there is uncertainty regarding the timing and level of those 
benefits. Economic and technical feasibility of the necessary system 
refinements and modifications to yield the potential business benefits 
has not yet been demonstrated. FRA analyzed business benefits 
associated with PTC system implementation and presented its findings in 
the 2004 Report. Due to the aggressive implementation schedule for PTC 
and the resulting need to issue a rule promptly, FRA has not formally 
updated this study. Nevertheless, FRA believes that there is 
opportunity for significant business benefits to accrue several years 
after implementation once the systems have been refined to the degree 
necessary. Thus, FRA conducted a sensitivity analysis of potential 
business benefits based on the 2004 Report.
    The 2004 Report included business benefits from improved or 
enhanced locomotive diagnostics, fuel savings attributable to train 
pacing, precision dispatching, and capacity enhancement. Although 
railroads are enhancing locomotive diagnostics using other 
technologies, FRA believes that PTC could provide the basis for 
significant gains in the other three areas.
    In the years since the 2004 Report, developing technology and 
rising fuel costs have caused the rail supply industry and the 
railroads to focus on additional means of conserving diesel fuel while 
minimizing in-train forces that can lead to derailments and delays from 
train separations (usually broken coupler knuckles). Software programs 
exist that can translate information concerning throttle position and 
brake use, together with consist information and route characteristics, 
to produce advice for prospective manipulation of the locomotive 
controls to limit in-train forces. Programs are also being conceived 
that project arrival at meet points and other locations on the 
railroad. These types of tools can be consolidated into programs that 
either coach the locomotive engineer regarding how to handle the train 
or even take over the controls of the locomotive under the engineer's 
supervision. The ultimate purpose of integrating this technology is to 
conserve fuel use while handling the train properly and arriving at a 
designated location ``just in time'' (e.g., to meet or pass a train or 
enter a terminal area in sequence ahead of or behind other traffic). 
Further integrating this technology with PTC communications platforms 
and traffic planning capabilities could permit transmittal of ``train 
pacing'' information to the locomotive cab in order to conserve fuel. 
Like the communications backbone, survey data concerning route 
characteristics can be shared by both systems. The cost of diesel fuel 
for road operations to the Class I railroads is approximately $3.5 
billion annually and is gradually rising. If PTC technology helps to 
spur the growth and effective use of train pacing, fuel savings of 5% 
($175,000,000 annually) or greater could very likely be achieved. 
Clearly, if the railroads are able to conserve use of fuel, they will 
also reduce emissions and contribute to attainment of environmental 
goals, even before modal diversion occurs.
    The improvements in dispatch and capacity have further 
implications. With those improvements, railroads could improve the 
reliability of shipment arrival time and, thus, dramatically increase 
the value of rail transportation to shippers, who in turn would divert 
certain shipments from highway to rail. Such diversion would yield 
greater overall transportation safety benefits, since railroads have 
much lower accident risk than highways, on a point-to-point ton-mile 
basis. The total societal benefits of PTC system implementation and 
operation, following the analysis, would be much greater than total 
societal costs, although the costs would fall disproportionately more 
heavily on the railroads.
    At present, the PTC systems contemplated by the railroads, with the 
possible exception of PATH, would not increase capacity, at least not 
for some time. If the locomotive braking algorithms need to be made 
more conservative in order to ensure that each train does not exceed 
the limits of its authority, PTC system operation may actually decrease 
rail capacity where applied in the early years. Further investment 
would be required to bring about the synergy that would result in 
capacity gains. A more significant business benefit of PTC system 
operation would be derived from precision dispatching, which decreases 
the variance of arrival times of delivered freight. To avoid the risk 
of running out of stock, shippers often overstock their inventory at an 
annual cost of approximately 25% of its inventory value, regardless of 
the material being stored. This estimate accounts for shrinkage, 
borrowing costs, and storage costs. Of course, freight with more value 
per unit of mass or volume tends to have greater storage costs per 
unit. At present, no rail precision dispatch system exists. However, if 
a shipper would take advantage of precision dispatching, thus 
increasing freight arrival time accuracy, then it could reduce its 
overstock inventory. Accurate train data is a necessary, but not a 
sufficient condition, for precision dispatch. At least two of the Class 
I railroads have unsuccessfully attempted to develop precision dispatch 
systems. The mandatory installation of PTC systems is likely to divert 
any resources that might have been devoted to precision dispatch, so 
these benefits are unlikely during the first several years of this 
rule.
    Applying current factors to the variables used in the 2004 Report 
to Congress, the resulting analysis indicates that diversion could 
result in highway annual safety benefits of $744 million by 2022, and 
$1,148 million by 2032. Of course, these benefits require that the 
productivity enhancing systems be added to PTC, and are heavily 
dependent on the underlying assumptions of the 2004 model.
    Modal diversion would also yield environmental benefits. The 2004 
Report estimated that reduced air pollution costs would have been 
between $68 million and $132 million in 2010 (assuming PTC would be 
implemented by 2010), and between $103 million and $198 million in 
2020. This benefit would have accrued to the general public. FRA has 
not broken out the pollution cost benefit of the current

[[Page 2687]]

rule, but offers the estimates from the 2004 Report as a guide to the 
order of magnitude of such benefits.
    While railroads argued that many of the benefits identified in 
FRA's 2004 report were exaggerated, shortly after the publication of 
the report, several railroads began developing strategies for PTC 
system development and implementation. This investment by the railroads 
would seem to illustrate that they believe that there is some potential 
for PTC to provide a boost to railroad profits, beyond providing any of 
the aforementioned societal benefits.
    Modal diversion is highly sensitive to service quality. Problems 
with terminal congestion and lengthy dwell times might overwhelm the 
benefits of PTC or other initiatives which the railroads have been 
pursuing (reconfiguration of yards, pre-blocking of trains, shared 
power arrangements, car scheduling, Automatic Equipment Identification, 
etc.) that might actually work in synergy with PTC. It should also be 
noted that, in the years since the 2004 Report was developed, the Class 
I railroads have shown an increased ability to retain operating revenue 
as profit, rather than surrendering it in the form of reduced rates. 
This was particularly true during the period prior to the current 
recession, when strained highway capacity favored the growth of rail 
traffic. The sensitivity analysis performed by FRA indicates that 
realization of business benefits could yield benefits sufficient to 
close the gap between PTC implementation costs and rail accident 
reduction benefits within the first 18 years of the rule, applying a 3% 
discount rate, and by year 24 of the rule, applying a discount rate of 
7%. Accordingly, the precise partition of business and societal 
benefits cannot be estimated with any certainty.
    FRA recognizes that the likelihood of business benefits is 
uncertain and that the cost-to-benefit comparison of this rule, 
excluding any business benefits, is not favorable. However, FRA has 
taken measures to minimize the rule's adverse impacts and to provide as 
much flexibility as FRA is authorized to grant under RSIA08.

B. Regulatory Flexibility Act and Executive Order 13272

    To ensure potential impacts of rules on small entities are properly 
considered, we developed this rule in accordance with Executive Order 
13272 (``Proper Consideration of Small Entities in Agency Rulemaking'') 
and DOT's procedures and policies to promote compliance with the 
Regulatory Flexibility Act (5 U.S.C. 601 et seq.).
    The Regulatory Flexibility Act requires an agency to review 
regulations to assess their impact on small entities. An agency must 
conduct a Final Regulatory Flexibility Analysis (FRFA) unless it 
determines and certifies that a rule is not expected to have a 
significant impact on a substantial number of small entities.
    In the NPRM, we published an Initial Regulatory Flexibility 
Assessment (IRFA) to aid the public in commenting on the potential 
small business impacts of the proposals. FRA has considered all 
comments submitted to the docket and at public hearings in response to 
the NPRM. FRA also worked with the PTC Working Group and its task 
forces in developing many of the facets of the final rule. We 
appreciate the information provided by the various parties. The 
proposed rule, and consequently the IRFA, included as part of the NPRM, 
have been modified as a result, as described above. Due to the 
uncertainties associated with new product development and deployment, 
FRA has prepared a FRFA and will issue a Small Entity Guidance document 
soon.
    In accordance with the Regulatory Flexibility Act, a FRFA must 
contain:
    (1) A succinct statement of the need for, and objectives of the 
rule;
    (2) A summary of the significant issues raised by the public 
comments in response to the IRFA, a summary of the assessment of the 
agency of such issues, and a statement of any changes made in the 
proposed rule as a result of such comments.
    (3) A description and an estimate of the number of small entities 
to which the rule will apply or an explanation of why no such estimate 
is available;
    (4) A description of the projected reporting, recordkeeping and 
other compliance requirements of the final rule, including an estimate 
of the classes of small entities that will be subject to the 
requirement and the type of professional skills necessary for 
preparation of the report or record; and
    (5) A description of the steps the agency has taken to minimize the 
significant adverse economic impact on small entities consistent with 
the stated objectives of applicable statutes, including a statement of 
the factual, policy, and legal reasons for selecting the alternative 
adopted in the final rule and why each of the other significant 
alternatives to the rule considered by the agency was rejected. 5 
U.S.C. 604(a)(1)-(5).
1. Need for, and Objectives of the Rule
    PTC systems will be designed to prevent train-to-train collisions, 
overspeed derailments, incursions into established work zone limits, 
and the movement of a train through a switch left in the wrong 
position.
    As discussed in more detail in section I of the preamble, the 
RSIA08 mandates that widespread implementation of PTC across a major 
portion of the U.S. rail industry be accomplished by December 31, 2015. 
RSIA08 requires each Class I carrier and each entity providing 
regularly scheduled intercity or commuter rail passenger transportation 
to develop a plan for implementing PTC by April 16, 2010. The Secretary 
of Transportation is responsible for reviewing and approving or 
disapproving such plans. The Secretary has delegated this 
responsibility to FRA. This final rule details the process and 
procedure for obtaining FRA approval of the plans.
    As discussed earlier in the preamble, FRA is issuing this final 
rule to provide regulatory guidance and performance standards for the 
development, testing, implementation, and use of Positive Train Control 
(PTC) systems for railroads mandated by the Rail Safety Improvement Act 
of 2008 Sec.  104, Public Law 110-432, 122 Stat. 4848, 4856, (Oct. 16, 
2008) (codified at 49 U.S.C. 20157).
2. Significant Issues Raised by Public Comment in Response to the IRFA
    The only comment which directly referred to the IRFA was a comment 
from Class I railroad representatives noting that the IRFA implied that 
Class I railroads would pay for installation of split point derails at 
railroad-railroad crossings where a PTC equipped line crosses a line 
not equipped with PTC. FRA agrees with commenters that costs will be 
borne according to preexisting agreements and any other laws or 
regulations that might affect which party is responsible for the costs 
incurred and has modified its analysis accordingly.
    Other comments which affect the IRFA related to definition of main 
track for intercity and commuter operations where freight densities are 
relatively low. These comments, primarily from Amtrak, not a small 
entity, directly referred to the proposed rule, and not to the IRFA. In 
response, FRA provided significant relief to Amtrak for operations over 
Class II and Class III railroads, thus indirectly providing relief to 
some of the Class II and III railroads, potentially allowing one or 
more to avoid PTC system installation. The RSIA08 generally defines 
``main line'' as ``a segment of railroad tracks over which 5,000,000 or 
more gross tons of railroad traffic is transported

[[Page 2688]]

annually. See 49 U.S.C. 20157(i)(2). However, FRA may also define 
``main line'' by regulation ``for intercity rail passenger 
transportation or commuter rail passenger transportation routes or 
segments over which limited or no freight railroad operations occur.'' 
See 49 U.S.C. 20157(i)(2)(B); 49 CFR 1.49(oo). FRA recognizes that 
there may be circumstances where certain statutory PTC system 
implementation and operation requirements are not practical and provide 
no significant safety benefits. In those circumstances, FRA will 
exercise its statutory discretion provided under 49 U.S.C. 
20157(i)(2)(B).
    In accordance with the authority provided by the statute and with 
carefully considered recommendations from the RSAC, FRA will consider 
requests for designation of track over which rail operations are 
conducted as ``other than main line track'' for passenger and commuter 
railroads, or freight railroads operating jointly with passenger or 
commuter railroads. Such relief may be granted only after request by 
the railroad or railroads filing a PTCIP and approval by the Associate 
Administrator.
    In Sec.  236.1019(a), FRA requires the submittal of a main line 
track exclusion addendum (MTEA) to any PTCIP filed by a railroad that 
seeks to have any particular track segment deemed as other than main 
line. Since the statute only provides for such regulatory flexibility 
as it applies to passenger transportation routes or segments over which 
limited or no freight railroad operations occur, only a passenger 
railroad may file an MTEA as part of its PTCIP. This may include a 
PTCIP jointly filed by freight and passenger railroads. In fact, FRA 
expects that, in the case of joint operations, only one MTEA should be 
agreed upon and submitted by the railroads filing the PTCIP. After 
reviewing a submitted MTEA, FRA may provide full or conditional 
approval for the requested exemptions.
    Each MTEA must clearly identify and define the physical boundaries, 
use, and characterization of the trackage for which exclusion is 
requested. When describing each track's use and characterization, FRA 
expects the requesting railroad or railroads to include copies of the 
applicable track and signal charts. Ultimately, FRA expects each MTEA 
to include information sufficiently specific to enable easy segregation 
between main line track and non-main line track. In the event the 
railroad subsequently requests additional track to be considered for 
exclusion, a well-defined MTEA should reduce the amount of future 
information required to be submitted to FRA. Moreover, if FRA decides 
to grant only certain requests in an MTEA, the portions of track for 
which FRA has determined should remain considered as main line track 
can be easily severed from the MTEA. Otherwise, the entire MTEA, and 
thus its concomitant PTCIP, may be entirely disapproved by FRA, 
increasing the risk of the railroad or railroads not meeting its 
statutory deadline for PTC implementation and operation.
    For each particular track segment, the MTEA must also provide a 
justification for such designation in accordance with paragraphs (b) or 
(c) of this section.
    In Sec.  236.1019(b), FRA specifically addresses the conditions for 
relief for passenger and commuter railroads with respect to passenger-
only terminal areas. As noted previously in the analysis of Sec.  
236.1005(b), any track within a yard used exclusively by freight 
operations moving at restricted speed is excepted from the definition 
of main line. In those situations, operations are usually limited to 
preparing trains for transportation and do not usually include actual 
transportation. This automatic exclusion does not extend to yard or 
terminal tracks that include passenger operations. Such operations may 
also include the boarding and disembarking of passengers, heightening 
FRA's sensitivity to safety. Moreover, while FRA could not expend its 
resources to review whether a freight-only yard should be deemed other 
than main line track, FRA believes that the relatively lower number of 
passenger yards and terminals would allow for such review. Accordingly, 
FRA believes that it is appropriate to review these circumstances on a 
case-by-case basis.
    During the PTC Working Group discussions, the major passenger 
railroads requested an exception for tracks in passenger terminal areas 
because of the impracticability of installing PTC. These are locations 
where signal systems govern movements over very complex special track 
work divided into short signal blocks. Operating speeds are low (not to 
exceed 20 miles per hour), and locomotive engineers moving in this 
environment expect conflicting traffic and restrictive signals. 
Although low-speed collisions do occasionally occur in these 
environments, the consequences are low; and the rate of occurrence is 
very low in relation to the exposure. It is the nature of current-
generation PTC systems that they use conservative braking algorithms. 
Requiring PTC to short blocks in congested terminals would add to 
congestion and frustrate efficient passenger service, in the judgment 
of those who operate these railroads. The density of wayside 
infrastructure required to effect PTC functions in these terminal areas 
would also be exceptionally costly in relation to the benefits 
obtained. FRA agrees that technical solutions to address these concerns 
are not presently available. FRA does believe that the appropriate role 
for PTC in this context is to enforce the maximum allowable speed 
(which is presently accomplished in cab signal territory through use of 
automatic speed control, a practice which could continue where already 
in place).
    If FRA grants relief, the conditions of paragraphs (b)(1), (b)(2), 
or (b)(3), as applicable, as well as conditions attached to the 
approval, must be strictly adhered to.
    In Sec.  236.1019(b)(1), FRA specifies that relief under paragraph 
(b) is limited to operations that do not exceed 20 miles per hour. The 
PTC Working Group agreed upon the 20 miles per hour limitation, instead 
of requiring restricted speed, because the operations in question will 
be by signal indication in congested and complex terminals with short 
block lengths and numerous turnouts. FRA agrees with the PTC Working 
Group that the use of restricted speed in this environment would 
unnecessarily exacerbate congestion, delay trains, and diminish the 
quality of rail passenger service.
    Moreover, when trains on the excluded track are controlled by a 
locomotive with an operative PTC onboard apparatus that PTC system 
component must enforce the regulatory speed limit or actual maximum 
authorized speed, whichever is less. While the actual track may not be 
outfitted with a PTC system in light of a MTEA approval, FRA believes 
it is nevertheless prudent to require such enforcement when the 
technology is available on the operating locomotives. This can be 
accomplished in cab signal territory using existing automatic train 
stop technology and outside of cab signal territory by mapping the 
terminal and causing the onboard computer to enforce the maximum speed 
allowed.
    FRA also limits relief under Sec.  236.1019(b)(2) to operations 
that enforce interlocking rules. Under interlocking rules, trains are 
prohibited from moving in reverse directions without dispatcher 
permission on track where there are no signal indications. FRA believes 
that such a restriction will minimize the potential for a head-on 
impact.
    Also, under Sec.  236.1019(b)(3), such operations are only allowed 
in yard or terminal areas where no freight

[[Page 2689]]

operations are permitted. While the definition of main line may not 
include yard tracks used solely by freight operations, FRA is not 
extending any relief or exception to tracks within yards or terminals 
shared by freight and passenger operations. The collision of a 
passenger train with a freight consist is typically a more severe 
condition because of the greater mass of the freight equipment. 
However, FRA did receive a comment suggesting some latitude within 
terminals when passenger trains are moving without passengers (e.g., to 
access repair and servicing areas). FRA agrees that low-speed 
operations under those conditions should be acceptable as trains are 
prepared for transportation. FRA has not included a request by Amtrak 
(discussed below) to allow movements within major terminals at up to 30 
miles per hour in mixed passenger and freight service, which appears in 
FRA's judgment to fall outside of the authority to provide exclusions 
conferred on FRA by the law.
    In Sec.  236.1019(c), FRA provides the conditions under which joint 
limited passenger and freight operations may occur on defined track 
segments without the requirement for installation of PTC. Under Sec.  
236.1003 (Definitions), ``limited operations'' is defined as 
``operations on main line track that have limited or no freight 
operations and are approved to be excepted from this subpart's PTC 
system implementation and operation requirements in accordance with 
Sec.  236.1019(c).'' This paragraph provides five alternative paths to 
the main line exception, three of which were contained in the proposed 
rule and a fourth and fifth that respond to comments on the proposed 
rule.
    The three alternatives derived from the NPRM are set forth in Sec.  
236.1019(c)(1). First, an exception may be available where both the 
freight and passenger trains are limited to restricted speed. Such 
operations are feasible only for short distances, and FRA will examine 
the circumstances involved to ensure that the exposure is limited and 
that appropriate operating rules and training are in place.
    Second, under Sec.  236.1019(c)(1)(ii), FRA notes that it will 
consider an exception where temporal separation of the freight and 
passenger operations can be ensured. A more complete definition of 
temporal separation is provided in Sec.  236.1019(e). Temporal 
separation of passenger and freight services reduces risk because the 
likelihood of a collision is reduced (e.g., due to freight cars engaged 
in switching that are not properly secured) and the possibility of a 
relatively more severe collision between a passenger train and much 
heavier freight consist is obviated.
    Third, under Sec.  236.1019(c)(1)(iii), FRA notes that it will 
consider commingled freight and passenger operations provided that a 
jointly agreed risk analysis is provided by the passenger and freight 
railroads, and the level of safety is the same as that which would be 
provided under one of the two prior options selected as the base case. 
FRA requested comments on whether FRA or the subject railroad should 
determine the appropriate base case, but received none. FRA recognizes 
that there may be situations where temporal separation may not be 
possible. In such situations, FRA may allow commingled operations 
provided the risk to the passenger operation is no greater than if the 
passenger and freight trains were operating under temporal separation 
or with all trains limited to restricted speed. For an exception to be 
made under Sec.  236.1019(c)(3), FRA requires a risk analysis jointly 
agreed to and submitted by the applicable freight and passenger 
services. This ensures that the risks and consequences to both parties 
have been fully analyzed, understood, and mitigated to the extent 
practical. FRA would expect that the moving party would elect a base 
case offering the greatest clarity and justify the selection.
    Comments on the proposed rule generally supported the 
aforementioned exclusions or were silent.
    In its comments on the NPRM, Amtrak requested further relief 
relating to lines requiring the implementation and operation of a PTC 
system due solely to the presence of light-density passenger traffic. 
According to Amtrak, the defining characteristic of light-density lines 
is the nature of the train traffic; low-density patterns on these lines 
lead to a correspondingly low risk of collision. Amtrak also asserted 
that, due to relatively limited wear and tear from lower traffic 
densities, these lines often have fewer track workers on site, further 
reducing the chance of collisions and incursions into work zones. Thus, 
states Amtrak, one of the principal reasons for installing PTC--
collision avoidance--is a relatively low risk on many light density 
lines. With only marginal safety benefits anticipated from PTC use in 
such applications, Amtrak believed that there may be minimal 
justification for installing PTC on certain light-density lines.
    Amtrak further noted that FRA itself had concluded that the costs 
of PTC generally exceed its benefits, and Amtrak urged that this may be 
even more so on light-density lines. Amtrak believed that Congress 
understood this issue and thus created the regulatory flexibility for 
the definition of ``main line'' for passenger routes found at 49 U.S.C. 
20157(i)(2)(B) as a means to allow the Secretary to exempt certain 
routes from the PTC mandate. According to Amtrak, this provision 
essentially allows the Secretary to define certain passenger routes 
with limited or no freight traffic as other than ``main line,'' thereby 
effectively exempting such lines from the reach of the PTC mandate 
because the mandate only applies to railroad operations over ``main 
line[s].'' Said another way, urged Amtrak, the provision allows the 
Secretary the freedom to decide in what circumstances such routes 
should be considered ``main lines'' and thus be required to install 
PTC--pursuant to whatever factors the Secretary deems appropriate 
through the rulemaking process.
    Amtrak urged that the Secretary should use this flexibility to 
limit which passenger routes it defines as ``main lines'' to those 
deemed to warrant the use of PTC using the FRA's usual risk-based 
approach to safety regulation and traditional measures of 
reasonableness, costs, and benefits. Amtrak posited that such a risk-
based analysis by FRA would likely lead to the conclusion that PTC is 
simply not needed on many light-density lines over which passenger 
trains currently operate. Amtrak therefore asked that FRA exercise this 
authority by working with Amtrak and the rail industry to exempt 
certain light density freight lines which host passenger traffic from 
the obligation to install PTC where operating and safety conditions do 
not warrant an advanced signal system.
    Should FRA choose not to exempt some of these light density freight 
lines over which passenger trains operate, Amtrak felt that the high 
costs of full PTC systems will be passed on to the passenger and 
freight operators of these routes. According to Amtrak, this obligation 
could threaten the continuation of intercity passenger rail service on 
several routes, including lines in California, Colorado, Kansas, Maine, 
Massachusetts, Michigan, Missouri, New Hampshire, New Mexico, North 
Dakota, Vermont, and Virginia, on what are potentially light density 
lines. Additionally, states Amtrak, this obligation, where it can be 
financed, could force the diversion of significant capital dollars away 
from essential safety investments in track and other infrastructure 
improvements, which are typically the leading safety risks for such 
light-density operations. According to Amtrak, the cost of PTC 
installation on these lines may be so out

[[Page 2690]]

of proportion to the benefit that Amtrak's service will need to be 
rerouted onto a different line (e.g., to a Class I line with PIH 
materials) if a reroute option exists, or eliminated entirely because 
there is no feasible alternate route and no party is willing or able to 
bear the cost of installing PTC on the existing route. The defining 
characteristic of light-density lines is the nature of the train 
traffic: low density patterns on these lines lead to a correspondingly 
low risk of collision. In its filing, Amtrak noted that it was 
currently assembling the details (e.g., annual freight tonnage, 
frequency of freight train operations) ``for those lines that it 
believes may qualify as light-density, and will submit as a supplement 
to these Comments a recommendation as to what criteria the FRA should 
adopt in determining what light-density lines are other than `main 
lines.' '' Amtrak did subsequently file data referred to below, but did 
not propose criteria.
    According to the Amtrak testimony, the ``limited operations 
exception'' in subsection 236.1019(c) of the NPRM did not provide a 
practical solution to the problem created by defining all light-density 
routes and terminal areas with passenger service as ``main lines.'' 
Amtrak stated that this subsection would arguably require installation 
of PTC on most of the trackage and locomotives of the Terminal Railroad 
Association of St Louis (TRRA) unless: (1) The entire terminal operates 
at restricted speed (which TRRA is unlikely to agree to), (2) passenger 
and freight trains are temporally separated (which would not be 
practical on TRRA, and is unlikely to be practical on any of the light-
density lines over which Amtrak operates, due to the 24/7 nature of 
railroad operations), or (3) a risk mitigation plan can be effected 
that would achieve a level of safety not less than would pertain if all 
operations on TRRA were at restricted speed or subject to temporal 
separation. Accordingly, Amtrak recommended: (a) That the FRA adopt a 
risk analysis-based definition of ``main line'' passenger routes that 
excludes light-density lines on which the installation of PTC is not 
warranted; and (b) with respect to freight terminal areas in which 
passenger trains operate, that FRA modify the limited operations 
exception in subsection 236.1019(c) to require that all trains be 
limited to 30 miles per hour rather than to restricted speed, or that 
non-PTC equipped freight terminals be deemed as other than ``main 
lines'' so long as all passenger operations are pursuant to signal 
indication and at speeds not greater than 30 miles per hour (with 
speeds reduced to not greater than restricted speed on unsignaled 
trackage or if the signals should fail).
    FRA believes that Amtrak's request is much broader than 
contemplated by the law. FRA notes that TRRA is a very busy terminal 
operation. FRA does not believe that the ``limited freight operations'' 
concept is in any way applicable under those circumstances. Nor is 
there any indication in law that FRA was expected to fall back to 
traditional cost-benefit principles in relation to PTC and scheduled 
passenger service. However, there are a number of Amtrak routes with 
limited freight operations that will not otherwise be equipped with PTC 
because they are operated by other than Class I railroads. Further, 
there are some Class I lines with less than 5 million gross tons, or no 
PIH, that also warrant individualized review to the extent Amtrak and 
the host railroad might elect to propose it.
    Accordingly, in response to the Amtrak comments, Sec. Sec.  
236.1019(c)(2) and (c)(3) have been added to the final rule to provide 
an option by which certain additional types of limited passenger train 
operations may qualify for a main line track exception where freight 
operations are also suitably limited and the circumstances could lead 
to significant hardship and cost that might overwhelm the value of the 
passenger service provided. In Sec.  236.1019(c)(2), FRA addresses 
lines where the host is not a Class I freight railroad, describing 
characteristics of line segments that might warrant relief from PTC. In 
Sec.  236.1019(c)(2)(i), FRA addresses passenger service involving up 
to four regularly scheduled passenger trains during a calendar day over 
a segment of unsignaled track on which less than 15 million gross tons 
of freight traffic is transported annually. In Sec.  
236.1019(c)(2)(ii), FRA addresses passenger service involving up to 12 
regularly scheduled passenger trains during a calendar day over a 
segment of signaled track on which less than 15 million gross tons of 
freight traffic is transported annually. FRA derived Sec.  
236.1019(c)(2) indirectly from discussions in the RSAC in response to 
comments by Amtrak set forth above. The PTC Working Group proposed an 
exception that might have been available anywhere an intercity or 
commuter railroad operated over a line with 5 million gross tons of 
freight traffic, including Class I lines and the lines of the intercity 
or commuter railroad. This would have opened the potential for a 
considerable exception for lines with very light freight density under 
circumstances not thoroughly explored in the short time available to 
the working group (e.g., on commuter rail branch lines, low density 
track segments on Class I railroads, etc.).
    Subsequent to the RSAC activities, Amtrak notified FRA that its 
conversations with Class II and III railroads whose lines had been at 
the root of the Amtrak comments revealed that some of the situations 
involved freight traffic exceeding 5 million gross tons, potentially 
rendering the exception ineffective for this purpose. At the same time, 
FRA noted that the policy rationale behind the proposed additional 
exception was related as much to the inherent difficulty associated 
with PTC installation during the initial period defined by law, given 
that the railroads identified by Amtrak were for the most part very 
small operations with limited technical capacity, as well as limited 
safety exposure. It was clear that in these cases care would need to be 
taken to analyze collision risk and potentially require 
mitigations.\14\ Accordingly, FRA has endeavored to address the concern 
brought forward by Amtrak with a provision that is broad enough to 
permit consideration of actual circumstances, limit this particular 
exception to operations over railroads that would not otherwise need to 
install PTC (e.g., Class II and III freight railroads), provide for a 
thorough review process, and make explicit reference to the potential 
requirement for safety mitigations. In this regard, FRA has chosen 15 
million gross tons as a threshold that should accommodate situations 
where Amtrak trains will, in actuality, face few conflicts with freight 
movements (i.e., requiring trains to clear the main line for meets and 
passes or to wait at junctions) and where mitigations are in place or 
could be put in place to establish a high sense of confidence that 
operations will continue to be conducted safely. FRA believes that less 
than 15 million gross tons represents a fair test of ``limited freight 
operations'' for these purposes, with the further caveat that specific 
operating arrangements will be examined in each case.\15\ FRA 
emphasizes that this is not

[[Page 2691]]

an entitlement, but an exclusion for which the affected railroads will 
need to make a suitable case.
---------------------------------------------------------------------------

    \14\ An example of an existing mitigation, which is provided to 
support service quality but also supports safety, is the practice of 
one Class III Amtrak host and its connecting freight partner to hold 
out fleeted empty coal trains off the Class III property during the 
period that Amtrak is running. While not constituting strict 
``temporal separation,'' it does significantly reduce collision risk 
over the route.
    \15\ Freight tonnage on Amtrak lines varies from zero on two 
segments to over 150 million gross tons. On a per-mile basis, 15 
million gross tons falls into the twenty first percentile of Amtrak 
track miles. The candidate lines on the Class I system comprise 
about 6.8% of Amtrak's route structure.
---------------------------------------------------------------------------

    Amtrak also provided to FRA a spreadsheet identifying each of its 
route segments with attributes such as route length, freight tonnage, 
number of Amtrak trains, and numbers of commuter trains. FRA further 
reviewed this information in light of Amtrak's request for main track 
exceptions. FRA noted a number of segments of the Amtrak system on 
Class I railroads where the number of Amtrak trains was low and the 
freight tonnage was also low (less than 15 million gross tons). Each of 
these lines, with the exception of one 33-mile segment, is signalized. 
FRA further noted that, with both Amtrak and Class I railroad 
locomotives equipped for PTC, use of partial PTC technology (e.g., 
monitoring of switches where trains frequently clear) should be 
available as a mitigation for collision risk. Accordingly, in Sec.  
236.1019(c)(3) FRA has provided a further narrow exception for Class I 
lines carrying no more than four intercity or commuter passenger trains 
per day and cumulative annual tonnage of less than 15 million gross 
tons, subject to FRA review. The limit of four trains takes into 
consideration that it is much less burdensome to equip the wayside of a 
Class I rail line than to install a full PTC system on a railroad that 
would not otherwise require one. Again, the exception is not automatic, 
and FRA's approval of a particular line segment would be discretionary.
    The new Sec.  236.1019(d), FRA makes clear that it will carefully 
review each proposed main track exception and may require that it be 
supported by appropriate hazard analysis and mitigations. FRA has 
previously vetted through the RSAC a Collision Hazard Analysis Guide 
that can be useful for this purpose. If FRA determines that freight 
operations are not ``limited'' as a matter of safety exposure or that 
proposed safety mitigations are inadequate, FRA will deny the 
exception.
3. Description and Estimate of Small Entities Affected
    ``Small entity'' is defined in 5 U.S.C. 601. Section 601(3) defines 
a ``small entity'' as having the same meaning as ``small business 
concern'' under section 3 of the Small Business Act. This includes any 
small business concern that is independently owned and operated, and is 
not dominant in its field of operation. Section 601(4) includes not-
for-profit enterprises that are independently owned and operated, and 
are not dominant in their field of operations within the definition of 
``small entities.'' Additionally, section 601(5) defines as ``small 
entities'' governments of cities, counties, towns, townships, villages, 
school districts, or special districts with populations less than 
50,000.
    The U.S. Small Business Administration (SBA) stipulates ``size 
standards'' for small entities. It provides that the largest a for-
profit railroad business firm may be (and still classify as a ``small 
entity'') is 1,500 employees for ``Line-Haul Operating'' railroads, and 
500 employees for ``Short-Line Operating'' railroads. See ``Table of 
Size Standards,'' U.S. Small Business Administration, January 31, 1996, 
13 CFR part 121; see also NAICS Codes 482111 and 482112.
    SBA size standards may be altered by Federal agencies in 
consultation with SBA, and in conjunction with public comment. Pursuant 
to the authority provided to it by SBA, FRA has published a final 
policy, which formally establishes small entities as railroads that 
meet the line haulage revenue requirements of a Class III railroad. See 
68 FR 24,891 (May 9, 2003). Currently, the revenue requirements are $20 
million or less in annual operating revenue, adjusted annually for 
inflation. The $20 million limit (adjusted annually for inflation) is 
based on the Surface Transportation Board's threshold of a Class III 
railroad carrier, which is adjusted by applying the railroad revenue 
deflator adjustment. See also 49 CFR part 1201. The same dollar limit 
on revenues is established to determine whether a railroad shipper or 
contractor is a small entity. FRA uses this definition for this 
rulemaking.
    The FRA's ``universe'' of considered entities generally includes 
only those small entities that can reasonably be expected to be 
directly regulated by the final rule. One type of small entity is 
potentially affected by this final rule: railroads. The level of impact 
on small railroads will vary from railroad to railroad. Class III 
railroads will be impacted for one or more of the following reasons: 
(1) They operate on Class I railroad lines that carry PIH materials and 
are required to have PTC, in which case they will need to equip the 
portion of their locomotive fleet that operates on such lines; (2) they 
operate on Amtrak or commuter rail lines, including freight railroad 
lines that host such service; (3) they host regularly scheduled 
intercity or commuter rail transportation; or (4) they have at-grade 
railroad crossings over lines required by RSIA08 to have PTC.
    The final rule will apply to small railroads' tracks over which a 
passenger railroad conducts intercity or commuter operations and 
locomotives operating on main lines of Class I freight railroads 
required to have PTC and on railroads conducting intercity passenger or 
commuter operations. The impact on Class III railroads that operate on 
Class I railroad lines required to be equipped with PTC will depend on 
the nature of such operations. Class III railroads often make short 
moves on Class I railroad lines for interchange purposes. To the extent 
that their moves do not exceed four per day or 20 miles in length of 
haul (one way), Class III railroads will be exempt from the requirement 
to equip the locomotives. However, some Class III railroads operate 
much more extensively on Class I railroad lines that will be required 
to have PTC and will have to equip some of their locomotives. It is 
likely that Class III railroads will dedicate certain locomotives to 
such service, if they have not done so already. FRA estimates that 
approximately 55 small railroads will have to equip locomotives with 
PTC system components because they have trackage rights on Class I 
freight railroad PIH lines that will be required to have PTC and will 
not be able to qualify for any of the operational exceptions discussed.
    FRA further estimates that 10 small railroads have trackage rights 
on intercity passenger or commuter railroads or other freight railroads 
hosting such operations, and will need to equip some locomotives with 
PTC systems. Half of these will need to equip locomotives anyway, 
because they also have trackage rights on Class I railroads that haul 
PIH and would otherwise be required to have PTC.
    Thus, a total of 60 railroads will need to equip locomotives. FRA 
estimates that the average small railroad will need to equip four 
locomotives, at a per railroad cost of $55,000 each, totaling $220,000, 
and that the total cost for all 60 small railroads which will need to 
equip locomotives will be $13,200,000. FRA further estimates that the 
annual maintenance cost will be 15% of that total, equaling $33,000 per 
railroad or $1,980,000 total for all small railroads.
    In addition, 15 small railroads host commuter or intercity 
passenger operations on what might be defined as main line track under 
the accompanying rulemaking; however, only five of these railroads are 
neither terminal nor port railroads, which tend to be owned and 
operated by large railroads or port authorities, or subsidiaries of 
large short

[[Page 2692]]

line holding companies with the expertise and resources across the 
disciplines comparable to larger railroads. Of those five railroads, 
only one has trackage exceeding 3.8 miles. The other four railroads may 
request that FRA define such track as other than main line after 
ensuring that all trains will be limited to restricted speed. The cost 
burden on the remaining railroad will likely be reduced by restricting 
speed, temporally separating passenger train operations, or by passing 
the cost to the passenger railroad. Thus, the expected burden to small 
entities hosting passenger operations is minimal. This impact will 
further be reduced by exclusion of track from the main track under 
Sec.  236.1019.
    At rail-to-rail crossings where at least one of the intersecting 
tracks allows operating speeds in excess of 40 miles per hour, the 
approaching non-PTC line must have a permanent maximum speed limit of 
20 miles per hour and either have some type of positive stop 
enforcement or a split-point derail incorporated into the signal system 
on the non-PTC route. In the IRFA, FRA incorrectly assumed that the 
cost of the derail would be borne by the PTC-equipped railroad, and 
that slowing to 20 miles per hour reflects current practice at most 
diamond crossings. In response to comments from Class I railroad 
representatives, FRA has revised its assumption and estimates that 
roughly half of the cost of derails will be borne by small entities. 
FRA estimates that five small railroads have rail-to-rail crossings, 
with two such crossings each, where the newly burdened small railroad 
will be slowing to 20 miles per hour from a higher track speed. FRA 
estimates that the average traffic on the newly burdened route is two 
trains per day, and that the cost to slow from a higher track speed is 
$30 per train, for a total cost of $60 per crossing per day, a per 
railroad cost of $120 per day, and a total national cost for all ten 
small railroads of $600 per day and an annual cost of $43,800 per 
railroad and a total for all small railroads of $219,000 per year. FRA 
further estimates that small railroads will pay for derails at five of 
the ten impacted crossings, at a price per crossing of $80,000, for two 
sets of derails, one on each side of the crossings, and a total cost of 
$400,000, with annual maintenance costs of $60,000 (15% of installation 
cost) total. The initial investment will therefore be $400,000 and the 
total annual cost will be $279,000. FRA estimates that only five Class 
III railroads will be affected by this provision, and that they will be 
railroads not affected by the requirement to equip locomotives, because 
railroads with equipped locomotives could simply use the PTC system and 
avoid the requirement to slow down.
    This analysis yields a total of 65 affected small entities that may 
be impacted by implementation of the final rule. FRA requested comments 
regarding this estimate of small entities potentially impacted, and the 
only comment was that Class I railroads would not necessarily bear the 
cost of equipping rail-to-rail crossings with derails.
4. Description of Reporting, Recordkeeping, and Other Compliance 
Requirements and Impacts on Small Entities Resulting From Specific 
Requirements
    Class III railroads that host intercity or commuter rail service 
will need to file implementation plans, whether or not they directly 
procure or manage installation of the PTC system. FRA believes that, 
although the implementation plan must be jointly filed by the small 
host railroad and passenger tenant railroad, the cost of these plans 
will be borne by the passenger railroads, because under typical 
trackage rights agreements, the passenger railroads are responsible for 
any costs that would not exist in the absence of the passenger 
operations. Clearly, the Class III railroads would not be required to 
install PTC in the absence of passenger traffic, so any costs the Class 
III railroads bear initially will eventually be passed on to the 
passenger railroads operating on the Class III railroads' lines. FRA 
believes that only one small entity, as described above, is likely to 
have PTC installed on its lines. The implementation plan is likely to 
be an extension of the passenger railroad's plan, and the marginal cost 
will be the cost of tailoring the plan to the host railroad, which will 
be borne by the passenger railroad, and maintaining copies of the plan 
at the host railroad, which FRA estimates to be approximately $1,000 
per year.
    The total cost to small entities will include the initial cost of 
equipping locomotives, $13,200,000, and $400,000 to equip diamond 
crossings; annual costs of $1,980,000 for maintenance of locomotive 
systems; $219,000 due to operating speed restrictions at diamond 
crossings; $60,000 to maintain diamond crossings; and $1,000 to 
maintain a copy of the PTC implementation plan. The total annual costs 
to small entities after initial acquisition will be $2,260,000 
($1,980,000 + $219,000 + $60,000 + $1,000). Individual railroads 
affected will either face an initial cost of $220,000 to equip 
locomotives, and an annual cost of $33,000 to maintain the PTC systems 
on those locomotives, or will face a per railroad cost of $80,000 to 
equip a diamond crossing, $12,000 per year to maintain a diamond 
crossing, and $43,800 per year to slow at diamond crossings. No 
railroad will face both sets of costs, because if its locomotives are 
equipped, they will not need to slow down at diamond crossings, nor 
would the crossings need to be equipped with derails.
5. Steps the Agency Has Taken To Minimize Adverse Economic Impact on 
Small Entities
    FRA is unaware of any significant alternatives that would meet the 
intent of RSIA08 and that would minimize the economic impact on small 
entities. FRA is exercising its discretion to provide the greatest 
flexibility for small entities available under RSIA08 by allowing 
operations of unequipped trains operated by small entities on the main 
lines of Class I railroads, and by defining main track on passenger 
railroads to avoid imposing undue burdens on small entities. The 
definition of passenger main track was adopted based on PTC Working 
Group recommendations that were backed strongly by representatives of 
small railroads. FRA added further, more expansive exclusions from main 
track for passenger railroads in the final rule. The provisions 
permitting operations of unequipped trains of Class I railroads 
exceeded the maximum flexibility for which the PTC Working Group could 
reach a consensus. FRA requested comments on this finding of no 
significant alternative related to small entities, but received no such 
comments.
    The process by which this final rule was developed provided 
outreach to small entities. As noted earlier in the preamble, this 
notice was developed in consultation with industry representatives via 
the RSAC, which includes small railroad representatives. From January 
to April 2009, FRA met with the entire PTC Working Group five times 
over the course of twelve days. This PTC Working Group established a 
task force to focus on issues specific to short line and regional 
railroads. The discussions yielded many insights and this final rule 
takes into account the concerns expressed by small railroads during the 
deliberations. The PTC Working Group had further discussions after 
publication of the NPRM, on August 31, 2009, and September 1 and 2, 
2009, related to the impact on small entities and on passenger 
railroads

[[Page 2693]]

(small entities may be affected under the final rule by their 
operations on passenger railroads or as hosts of passenger operations) 
and added new exclusions from main track to the RSAC recommendations. 
FRA extended these exclusions further, based on Amtrak comments, to the 
benefit of small entities.

C. Paperwork Reduction Act

    The information collection requirements in this proposed rule have 
been submitted for approval to the Office of Management and Budget 
(OMB) under the Paperwork Reduction Act of 1995, 44 U.S.C. 3501 et seq. 
The sections that contain the new information collection requirements 
and the estimated time to fulfill each requirement are as follows:

----------------------------------------------------------------------------------------------------------------
                                      Respondent         Total annual      Average time per      Total annual
           CFR section                 universe            responses           response          burden hours
----------------------------------------------------------------------------------------------------------------
234.275--Processor-Based          20 Railroads......  25 letters........  4 hours...........  100 hours.
 Systems--Deviations from
 Product Safety Plan (PSP)--
 Letters.
236.18--Software Mgmt. Control    184 Railroads.....  184 plans.........  2,150 hours.......  395,600 hours.
 Plan.
    --Updates to Software Mgmt.   90 Railroads......  20 updates........  1.50 hours........  30 hours.
     Control Plan.
236.905--Updates to RSPP........  78 Railroads......  6 plans...........  135 hours.........  810 hours.
    --Response to Request for     78 Railroads......  1 updated doc.....  400 hours.........  400 hours.
     Additional Info.
    --Request for FRA Approval    78 Railroads......  1 request/modified  400 hours.........  400 hours.
     of RSPP Modification.                             RSPP.
236.907--Product Safety Plan      5 Railroads.......  5 plans...........  6,400 hours.......  32,000 hours.
 (PSP)--Dev.
236.909--Minimum Performance
 Standard
    --Petitions for Review and    5 Railroads.......  2 petitions/PSP...  19,200 hours......  38,400 hours.
     Approval.
    --Supporting Sensitivity      5 Railroads.......  5 analyses........  160 hours.........  800 hours.
     Analysis.
236.913--Notification/Submission  6 Railroads.......  1 joint plan......  25,600 hours......  25,600 hours.
 to FRA of Joint Product Safety
 Plan (PSP).
    --Petitions for Approval/     6 Railroads.......  6 petitions.......  1,928 hours.......  11,568 hours.
     Informational Filings.
    --Responses to FRA Request    6 Railroads.......  2 documents.......  800 hours.........  1,600 hours.
     for Further Info. After
     Informational Filing.
    --Responses to FRA Request    6 Railroads.......  6 documents.......  16 hours..........  96 hours.
     for Further Info. After
     Agency Receipt of Notice of
     Product Development.
    --Consultations.............  6 Railroads.......  6 consults........  120 hours.........  720 hours.
    --Petitions for Final         6 Railroads.......  6 petitions.......  16 hours..........  96 hours.
     Approval.
    --Comments to FRA by          Public/RRs........  7 comments........  240 hours.........  1,680 hours.
     Interested Parties.
    --Third Party Assessments of  6 Railroads.......  1 assessment......  104,000 hours.....  104,000 hours.
     PSP.
    --Amendments to PSP.........  6 Railroads.......  15 amendments.....  160 hours.........  2,400 hours.
    --Field Testing of Product--  6 Railroads.......  6 documents.......  3,200 hours.......  19,200 hours.
     Info. Filings.
236.917--Retention of Records.
    --Results of tests/           6 Railroads.......  3 documents/        160,000 hrs.;       360,000 hours.
     inspections specified in                          records.            160,000 hrs.;
     PSP.                                                                  40,000 hrs.
    --Report to FRA of            6 Railroads.......  1 report..........  104 hours.........  104 hours.
     Inconsistencies with
     frequency of safety-
     relevant hazards in PSP.
236.919--Operations &
 Maintenance Man.
    --Updates to O & M Manual...  6 Railroads.......  6 updated docs....  40 hours..........  240 hours.
    --Plans for Proper            6 Railroads.......  6 plans...........  53,335 hours......  320,010 hours.
     Maintenance, Repair,
     Inspection of Safety-
     Critical Products.
    --Hardware/Software/Firmware  6 Railroads.......  6 revisions.......  6,440 hours.......  38,640 hours.
     Revisions.
236.921--Training Programs:       6 Railroads.......  6 Tr. Programs....  400 hours.........  2,400 hours.
 Development.
    --Training of Signalmen &     6 Railroads.......  300 signalmen; 20   40 hours; 20 hours  12,400 hours.
     Dispatchers.                                      dispatchers.
236.923--Task Analysis/Basic      6 Railroads.......  6 documents.......  720 hours.........  4,320 hours.
 Requirements: Necessary
 Documents.
    --Records...................  6 Railroads.......  350 records.......  10 minutes........  58 hours.
 
   SUBPART I--NEW REQUIREMENTS
 
236.1001--RR Development of More  30 Railroads......  3 rules...........  80 hours..........  240 hours.
 Stringent Rules Re: PTC
 Performance Stds.
236.1005--Requirements for PTC
 Systems.
    --Temporary Rerouting:        30 Railroads......  50 requests.......  8 hours...........  400 hours.
     Emergency Requests.
    --Written/Telephonic          30 Railroads......  50 notifications..  2 hours...........  100 hours.
     Notification to FRA
     Regional Administrator.
    --Temporary Rerouting         30 Railroads......  760 requests......  8 hours...........  6,080 hours.
     Requests Due to Track
     Maintenance.
    --Temporary Rerouting         30 Railroads......  380 requests......  8 hours...........  3,040 hours.
     Requests That Exceed 30
     Days.
236.1006--Requirements for
 Equipping Locomotives Operating
 in PTC Territory.

[[Page 2694]]

 
    --Reports of Movements in     30 Railroads......  45 reports + 45     8 hours + 170.....  8,010 hours.
     Excess of 20 Miles/RR                             reports.
     Progress on PTC Locomotives.
    --PTC Progress Reports......  35 Railroads......  35 reports........  16 hours..........  560 hours.
236.1007--Additional
 Requirements for High Speed
 Service.
    --Required HSR--125           30 Railroads......  11 documents......  3,200 hours.......  35,200 hours.
     Documents with approved
     PTCSP.
    --Requests to Use Foreign     30 Railroads......  2 requests........  8,000 hours.......  16,000 hours.
     Service Data.
    --PTC Railroads Conducting    30 Railroads......  4 documents.......  3,200 hours.......  12,800 hours.
     Operations at More than 150
     MPH with HSR-125 Documents.
    --Requests for PTC Waiver...  30 Railroads......  1 request.........  1,000 hours.......  1,000 hours.
236.1009--Procedural
 Requirements.
    --PTC Implementation Plans    30 Railroads......  25 plans..........  535 hours.........  13,375 hours.
     (PTCIP).
    --Host Railroads Filing       30 Railroads......  1 PCTIP; 15 RFAs..  535 hours; 320      5,335 hours.
     PTCIP or Request for                                                  hours.
     Amendment (RFAs).
    --Jointly Submitted PTCIPs..  30 Railroads......  5 PTCIPs..........  267 hours.........  1,335 hours.
    --Notification of Failure to  30 Railroads......  25 notifications..  32 hours..........  800 hours.
     File Joint PTCIP.
    --Comprehensive List of       30 Railroads......  25 lists..........  80 hours..........  2,000 hours.
     Issues Causing Non-
     Agreement.
    --Conferences to Develop      25 Railroads......  3 conf. calls.....  60 minutes........  3 hours.
     Mutually Acceptable PCTIP.
    --Type Approval.............  30 Railroads......  10 Type Appr......  8 hours...........  80 hours.
    --PTC Development Plans       30 Railroads......  20 Ltr. + 20 App;   8 hrs/1,600 hrs.;   96,160 hours.
     Requesting Type Approval.                         10 Plans.           6,400 hours.
    --Notice of Product Intent w/ 30 Railroads......  24 NPI; 24 IPs....  1,070 + 535 hrs...  38,520 hours.
     PTCIPs (IPs).
    --PTCDPs with PTCIPs (DPs +   30 Railroads......  6 DPs; 6 IPs......  2,135 + 535 hrs...  16,020 hours.
     IPs).
    --Updated PTCIPs w/PTCDPs     30 Railroads......  24 IPs; 24 DPs....  535 + 2,135 hrs...  64,080 hours.
     (IPs + DPs).
    --Disapproved/Resubmitted     30 Railroads......  6 IPs + 6 NPIs....  135 + 270 hrs.....  2,430 hours.
     PTCIPs/NPIs.
    --Revoked Approvals--         30 Railroads......  6 IPs + 6 DPs.....  135 + 535 hrs.....  4,020 hours.
     Provisional IPs/DP.
    --PTCIPs/PTCDPs Still         30 Railroads......  2 IPs + 2 DPs.....  135 + 535 hrs.....  1,340 hours.
     Needing Rework.
    --PTCIP/PTCDP/PTCSP Plan      30 Railroads......  1 document........  8,000 hours.......  8,000 hours.
     Contents--Documents
     Translated into English.
    --Requests for                30 Railroads......  30 ltrs; 30 docs..  8 hrs.; 800 hrs...  24,240 hours.
     Confidentiality.
    --Field Test Plans/           30 Railroads......  150 field tests; 2  800 hours.........  121,600 hours.
     Independent Assessments--                         assessments.
     Req. by FRA.
    --FRA Access: Interviews      30 Railroads......  60 interviews.....  30 minutes........  30 hours.
     with PTC Wrkrs.
    --FRA Requests for Further    30 Railroads......  5 documents.......  400 hours.........  2,000 hours.
     Information.
236.1011--PTCIP Requirements--    7 Interested        21 rev.; 60 com...  143 + 8 hrs.......  3,483 hours.
 Comment.                          Groups.
236.1015--PTCSP Content
 Requirements & PTC System
 Certification.
    --Non-Vital Overlay.........  30 Railroads......  2 PTCSPs..........  16,000 hours......  32,000 hours.
    --Vital Overlay.............  30 Railroads......  16 PTCSPs.........  22,400 hours......  358,400 hours.
    --Stand Alone...............  30 Railroads......  10 PTCSPs.........  32,000 hours......  320,000 hours.
    --Mixed Systems--Conference   30 Railroads......  3 conferences.....  32 hours..........  96 hours.
     with FRA regarding Case/
     Analysis.
    --Mixed Sys. PTCSPs (incl.    30 Railroads......  2 PTCSPs..........  28,800 hours......  57,600 hours.
     safety case).
    --FRA Request for Additional  30 Railroads......  15 documents......  3,200 hours.......  48,000 hours.
     PTCSP Data.
    --PTCSPs Applying to Replace  30 Railroads......  15 PTCSPs.........  3,200 hours.......  48,000 hours.
     Existing Certified PTC
     Systems.
    --Non-Quantitative Risk       30 Railroads......  15 assessments....  3,200 hours.......  48,000 hours.
     Assessments Supplied to FRA.
236.1017--PTCSP Supported by      30 Railroads......  1 assessment......  8,000 hours.......  8,000 hours.
 Independent Third Party
 Assessment.
    --Written Requests to FRA to  30 Railroads......  1 request.........  8 hours...........  8 hours.
     Confirm Entity Independence.
    --Provision of Additional     30 Railroads......  1 document........  160 hours.........  160 hours.
     Information After FRA
     Request.
    --Independent Third Party     30 Railroads......  1 request.........  160 hours.........  160 hours.
     Assessment: Waiver Requests.

[[Page 2695]]

 
    --RR Request for FRA to       30 Railroads......  1 request.........  32 hours..........  32 hours.
     Accept Foreign Railroad
     Regulator Certified Info.
236.1019--Main Line Track
 Exceptions.
    --Submission of Main Line     30 Railroads......  30 MTEAs..........  160 hours.........  4,800 hours.
     Track Exclusion Addendums
     (MTEAs).
    --Passenger Terminal          30 Railroads......  23 MTEAs..........  160 hours.........  3,680 hours.
     Exception--MTEAs.
    --Limited Operation           30 Railroads......  23 plans..........  160 hours.........  3,680 hours.
     Exception--Risk Mit.
    --Ltd. Exception--Collision   30 Railroads......  12 analyses.......  1,600 hours.......  19,200 hours.
     Hazard Anal.
    --Temporal Separation         30 Railroads......  11 procedures.....  160 hours.........  1,760 hours.
     Procedures.
236.1021--Discontinuances,        30 Railroads......  15 RFAs...........  160 hours.........  2,400 hours.
 Material Modifications,
 Amendments--Requests to Amend
 (RFA) PTCIP, PTCDP or PTCSP.
    --Review and Public Comment   7 Interested        7 reviews + 20      3 hours; 16 hours.  341 hours.
     on RFA.                       Groups.             comments.
236.1023--PTC Product Vendor      30 Railroads......  30 lists..........  8 hours...........  240 hours.
 Lists.
    --RR Procedures Upon          30 Railroads......  30 procedures.....  16 hours..........  480 hours.
     Notification of PTC System
     Safety-Critical Upgrades,
     Rev., Etc.
    --RR Notifications of PTC     30 Railroads......  150 notifications.  16 hours..........  2,400 hours.
     Safety Hazards.
    --RR Notification Updates...  30 Railroads......  150 updates.......  16 hours..........  2,400 hours.
    --Manufacturer's Report of    5 System Suppliers  5 reports.........  400 hours.........  2,000 hours.
     Investigation of PTC Defect.
    --PTC Supplier Reports of     5 System Suppliers  150 reports + 150   16 hours + 8 hours  3,600 hours.
     Safety Relevant Failures or                       rpt. copies.
     Defective Conditions.
236.1029--Report of On-Board      30 Railroads......  960 reports.......  96 hours..........  92,160 hours.
 Lead Locomotive PTC Device
 Failure.
236.1031--Previously Approved
 PTC Systems.
    --Request for Expedited       30 Railroads......  3 REC Letters.....  160 hours.........  480 hours.
     Certification (REC) for PTC
     System.
    --Requests for                30 Railroads......  3 requests........  1,600 hours.......  4,800 hours.
     Grandfathering on PTCSPs.
236.1035--Field Testing           30 Railroads......  150 field test      800 hours.........  120,000 hours.
 Requirements.                                         plans.
    --Relief Requests from        30 Railroads......  50 requests.......  320 hours.........  16,000 hours.
     Regulations Necessary to
     Support Field Testing.
236.1037--Records Retention.
    --Results of Tests in PTCSP   30 Railroads......  960 records.......  4 hours...........  3,840 hours.
     and PTCDP.
    --PTC Service Contractors     30 Railroads......  9,000 records.....  30 minutes........  4,500 hours.
     Training Records.
    --Reports of Safety Relevant  30 Railroads......  4 reports.........  8 hours...........  32 hours.
     Hazards Exceeding Those in
     PTCSP and PTCDP.
    --Final Report of Resolution  30 Railroads......  4 final reports...  160 hours.........  640 hours.
     of Inconsistency.
236.1039--Operations &            30 Railroads......  30 manuals........  250 hours.........  7,500 hours.
 Maintenance Manual (OMM):
 Development.
    --Positive Identification of  30 Railroads......  75,000 i.d.         1 hour............  75,000 hours.
     Safety-critical components.                       components.
    --Designated RR Officers in   30 Railroads......  60 designations...  2 hours...........  120 hours.
     OMM regarding PTC issues.
236.1041--PTC Training Programs.  30 Railroads......  30 programs.......  400 hours.........  12,000 hours.
236.1043--Task Analysis/Basic     30 Railroads......  30 evaluations....  720 hours.........  21,600 hours.
 Requirements: Training
 Evaluations.
    --Training Records..........  30 Railroads......  350 records.......  10 minutes........  58 hours.
236.1045--Training Specific to    30 Railroads......  20 trained          20 hours..........  400 hours.
 Office Control Personnel.                             employees.
236.1047--Training Specific to
 Loc. Engineers & Other
 Operating Personnel.
    --PTC Conductor Training....  30 Railroads......  5,000 trained       3 hours...........  15,000 hours.
                                                       conductors.
----------------------------------------------------------------------------------------------------------------

    All estimates include the time for reviewing instructions; 
searching existing data sources; gathering or maintaining the needed 
data; and reviewing the information.
    Organizations and individuals desiring to submit comments on the 
collection of information requirements should direct them to the Office 
of Management and Budget, Office of Information and Regulatory Affairs, 
Washington, DC 20503, Attention: FRA Desk Officer. Comments may also be 
sent via e-mail to the Office of Management and Budget at the following 
address: [email protected].

[[Page 2696]]

    OMB is required to make a decision concerning the collection of 
information requirements contained in this direct final rule between 30 
and 60 days after publication of this document in the Federal Register. 
Therefore, a comment to OMB is best assured of having its full effect 
if OMB receives it within 30 days of publication.
    FRA cannot impose a penalty on persons for violating information 
collection requirements which do not display a current OMB control 
number, if required. FRA intends to obtain current OMB control numbers 
for any new information collection requirements resulting from this 
rulemaking action prior to the effective date of this direct final 
rule. The OMB control number, when assigned, will be announced by 
separate notice in the Federal Register.

D. Federalism Implications

    This final rule has been analyzed in accordance with the principles 
and criteria contained in Executive Order 13132, ``Federalism.'' See 64 
FR 43,255 (Aug. 4, 1999).
    As discussed earlier in the preamble, this final rule would provide 
regulatory guidance and performance standards for the development, 
testing, implementation, and use of Positive Train Control (PTC) 
systems for railroads mandated by the Rail Safety Improvement Act of 
2008.
    Executive Order 13132 requires FRA to develop an accountable 
process to ensure ``meaningful and timely input by State and local 
officials in the development of regulatory policies that have 
federalism implications.'' Policies that have ``federalism 
implications'' are defined in the Executive Order to include 
regulations that have ``substantial direct effects on the States, on 
the relationship between the national government and the States, or on 
the distribution of power and responsibilities among the various levels 
of government.'' Under Executive Order 13132, the agency may not issue 
a regulation with Federalism implications that imposes substantial 
direct compliance costs and that is not required by statute, unless the 
Federal government provides the funds necessary to pay the direct 
compliance costs incurred by State and local governments, or the agency 
consults with State and local government officials early in the process 
of developing the regulation. Where a regulation has Federalism 
implications and preempts State law, the agency seeks to consult with 
State and local officials in the process of developing the regulation.
    FRA has determined that this final rule would not have substantial 
direct effects on the states, on the relationship between the national 
government and the states, nor on the distribution of power and 
responsibilities among the various levels of government. In addition, 
FRA has determined that this final rule, which is required by the Rail 
Safety Improvement Act of 2008, would not impose any direct compliance 
costs on state and local governments. Therefore, the consultation and 
funding requirements of Executive Order 13132 do not apply.
    However, this final rule will have preemptive effect. Section 20106 
of Title 49 of the United States Code provides that States may not 
adopt or continue in effect any law, regulation, or order related to 
railroad safety or security that covers the subject matter of a 
regulation prescribed or order issued by the Secretary of 
Transportation (with respect to railroad safety matters) or the 
Secretary of Homeland Security (with respect to railroad security 
matters), except when the State law, regulation, or order qualifies 
under the local safety or security exception to Sec.  20106. The intent 
of Sec.  20106 is to promote national uniformity in railroad safety and 
security standards. 49 U.S.C. 20106(a)(1). Thus, subject to a limited 
exception for essentially local safety or security hazards, this final 
rule would establish a uniform federal safety standard that must be 
met, and state requirements covering the same subject matter would be 
displaced, whether those state requirements are in the form of a state 
law, regulation, order, or common law. Part 236 establishes federal 
standards of care which preempt state standards of care, but this part 
does not preempt an action under state law seeking damages for personal 
injury, death, or property damage alleging that a party has failed to 
comply with the federal standard of care established by this part, 
including a plan or program required by this part. Provisions of a plan 
or program which exceed the requirements of this part are not included 
in the federal standard of care. The Locomotive Boiler Inspection Act 
(49 U.S.C. 20701-20703) has been held by the U.S. Supreme Court to 
preempt the entire field of locomotive safety; therefore, this part 
preempts any state law, including common law, covering the design, 
construction, or material of any part of or appurtenance to a 
locomotive.
    In sum, FRA has analyzed this final rule in accordance with the 
principles and criteria contained in Executive Order 13132. As 
explained above, FRA has determined that this final rule has no 
federalism implications, other than the preemption of state laws 
covering the subject matter of this final rule, which occurs by 
operation of law under 49 U.S.C. 20106 whenever FRA issues a rule or 
order. Accordingly, FRA has determined that preparation of a federalism 
summary impact statement for this proposed rule is not required.

E. Environmental Impact

    FRA has evaluated this final rule in accordance with its 
``Procedures for Considering Environmental Impacts'' (``FRA's 
Procedures'') (64 FR 28,545 (May 26, 1999)) as required by the National 
Environmental Policy Act (42 U.S.C. 4321 et seq.), other environmental 
statutes, Executive Orders, and related regulatory requirements. FRA 
has determined that this final rule is not a major FRA action 
(requiring the preparation of an environmental impact statement or 
environmental assessment) because it is categorically excluded from 
detailed environmental review pursuant to section 4(c)(20) of FRA's 
Procedures. In accordance with section 4(c) and (e) of FRA's 
Procedures, the agency has further concluded that no extraordinary 
circumstances exist with respect to this regulation that might trigger 
the need for a more detailed environmental review. As a result, FRA 
finds that this final rule is not a major federal action significantly 
affecting the quality of the human environment.

F. Unfunded Mandates Reform Act of 1995

    The Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4, 2 U.S.C. 
1531) (UMRA) requires agencies to prepare a written assessment of the 
costs, benefits, and other effects of proposed or final rules that 
include a federal mandate likely to result in the expenditures by 
state, local or tribal governments, in the aggregate, or by the private 
sector, of $100 million (adjusted annually for inflation with base year 
of 1995) or more in any one year. The value equivalent of $100 million 
in CY 1995, adjusted annual for inflation to CY 2008 levels by the 
Consumer Price Index for All Urban Consumers (CPI-U) is $141.3 million. 
The assessment may be included in conjunction with other assessments, 
as it is in this rulemaking.
    FRA is issuing this final rule to provide regulatory guidance and 
performance standards for the development, testing, implementation, and 
use of PTC systems for railroads mandated by the Rail Safety 
Improvement Act of 2008 Sec.  104, Public Law 110-432, 122 Stat. 4854 
(Oct. 16, 2008) (codified at 9 U.S.C. 20157), to

[[Page 2697]]

implement PTC systems. The RIA provides a detailed analysis of the 
costs of implementing PTC systems. This analysis is the basis for 
determining that, other than to the extent that this regulation 
incorporates requirements specifically set forth in RSIA08, this rule 
will not result in total expenditures by state, local or tribal 
governments, in the aggregate, or by the private sector of $141.3 
million or more in any one year. The vast bulk of costs associated with 
this final rule are directly attributable to the statutory mandate. The 
only unfunded mandate attributable to this final rule that does not 
incorporate the requirements specifically set forth in RSIA08 is the 
cost pertaining to the filing of paperwork to prove compliance with 
RSIA08. The effects are discussed above and in the Regulatory Impact 
Analysis, which has been placed in the docket for this rulemaking.
    FRA received comments asserting that the rule extends beyond the 
congressional mandates communicated in RSIA08. Even if this assertion 
was correct, the final rule alone would not create an unfunded mandate 
in excess of the threshold amount. For instance, some railroads believe 
that Sec.  236.1029(f)--which requires PTC screen access to every 
person in the locomotive cab--exceeds the statutory requirements. 
Certain freight railroads have said that this provision requires a 
second display unit, which will cost $8,000. AAR estimates that 
approximately 29,461 second display units would require installation, 
resulting in a cost of $235,688,000. FRA, however, believes that only 
27,598 screens would require installation, totaling $220,784,000.
    Certain railroads have also contested Sec.  236.1005(b)(2), which 
governs the baseline information necessary to determine whether a Class 
I railroad's track segment shall be equipped with a PTC system. Under 
that provision, initial PTC territory shall be determined based on 2008 
traffic levels. CSXT asserts that this provision will cause it to 
install PTC on 844 miles of track which will no longer meet the PIH 
materials threshold or will no longer meet the 5 million gross tons 
threshold in 2010. According to CSXT, the installation will cost 
$45,000 per mile (the RIA uses an estimate of $50,000 per mile) for a 
CSXT estimated cost of almost $38,000,000.
    As noted above, FRA believes that these requirements respond 
directly to the requirements set forth in RSIA08. For instance, to 
effectuate Congress' intent to prevent incursions into roadway worker 
zones, it is necessary to require PTC screen access to all crew members 
in the locomotive cab so that they may perform their respective duties. 
Sometimes, this may require installation of a second display unit. In 
its analysis of Sec.  236.1005(b), FRA provides sufficient 
justification for the baseline level based on the language in the 
statute, the context of the legislative process, and Congress' intent. 
If anything, FRA has reduced railroad expenditures by, inter alia, 
providing a number of exceptions from the installation requirements and 
opportunities for plan amendments.
    In any event, the aforementioned costs borne by the railroads will 
not exceed $141.3 million or more in any one year. The costs indicated 
above--totaling between $258,784,000 and $273,688,000, depending upon 
whether one relies on AAR's or FRA's second screen estimates--would be 
incurred over a period of several years. Even if FRA were to add the 
costs of paperwork filings, which FRA estimates to each have a one time 
cost of approximately $20,000, the annual monetary threshold will 
likely not be met.

G. Energy Impact

    Executive Order 13211 requires Federal agencies to prepare a 
Statement of Energy Effects for any ``significant energy action.'' 66 
FR 28,355 (May 22, 2001). Under the Executive Order, a ``significant 
energy action'' is defined as any action by an agency (normally 
published in the Federal Register) that promulgates or is expected to 
lead to the promulgation of a final rule or regulation, including 
notices of inquiry, advance notices of proposed rulemaking, and notices 
of proposed rulemaking: (1)(i) That is a significant regulatory action 
under Executive Order 12866 or any successor order, and (ii) is likely 
to have a significant adverse effect on the supply, distribution, or 
use of energy; or (2) that is designated by the Administrator of the 
Office of Information and Regulatory Affairs as a significant energy 
action. FRA has evaluated this final rule in accordance with Executive 
Order 13211. FRA has determined that this final rule is not likely to 
have a significant adverse effect on the supply, distribution, or use 
of energy. Consequently, FRA has determined that this regulatory action 
is not a ``significant regulatory action'' within the meaning of 
Executive Order 13211.

H. Privacy Act

    FRA wishes to inform all interested parties that anyone is able to 
search the electronic form of any written communications and comments 
received into any of our dockets by the name of the individual 
submitting the document (or signing the document), if submitted on 
behalf of an association, business, labor union, etc.). Interested 
parties may also review DOT's complete Privacy Act Statement in the 
Federal Register published on April 11, 2000 (65 FR 19,477) or visit 
http://www.regulations.gov.

List of Subjects

49 CFR Part 229

    Event recorders, Locomotives, Railroad safety.

49 CFR Part 234

    Highway safety, Penalties, Railroad safety, Reporting and 
recordkeeping requirements.

49 CFR Part 235

    Administrative practice and procedure, Penalties, Railroad safety, 
Reporting and recordkeeping requirements.

49 CFR Part 236

    Penalties, Positive Train Control, Railroad safety, Reporting and 
recordkeeping requirements.

IX. The Rule

0
In consideration of the foregoing, FRA amends chapter II, subtitle B of 
title 49, Code of Federal Regulations as follows:

PART 229--[AMENDED]

0
1. The authority citation for part 229 continues to read as follows:

    Authority: 49 U.S.C. 20103, 20107, 20133, 20137-38, 20143, 
20701-03, 21301-02, 21304; 28 U.S.C. 2401, note; and 49 CFR 1.49(c), 
(m).


0
2. Section 229.135 is amended by revising paragraphs (b)(3)(xxv) and 
(b)(4)(xxi) to read as follows:


Sec.  229.135  Event recorders.

* * * * *
    (b) * * *
    (3) * * *
    (xxv) Safety-critical train control data routed to the locomotive 
engineer's display with which the engineer is required to comply, 
specifically including text messages conveying mandatory directives and 
maximum authorized speed. The format, content, and proposed duration 
for retention of such data shall be specified in the Product Safety 
Plan or PTC Safety Plan submitted for the train control system under 
subparts H or I, respectively, of part 236 of this chapter, subject to 
FRA approval under this paragraph. If it can be calibrated against 
other data required by this part, such train control data may, at the 
election of the railroad, be

[[Page 2698]]

retained in a separate certified crashworthy memory module.
    (4) * * *
    (xxi) Safety-critical train control data routed to the locomotive 
engineer's display with which the engineer is required to comply, 
specifically including text messages conveying mandatory directives and 
maximum authorized speed. The format, content, and proposed duration 
for retention of such data shall be specified in the Product Safety 
Plan or PTC Safety Plan submitted for the train control system under 
subparts H or I, respectively, of part 236 of this chapter, subject to 
FRA approval under this paragraph. If it can be calibrated against 
other data required by this part, such train control data may, at the 
election of the railroad, be retained in a separate certified 
crashworthy memory module.
* * * * *

PART 234--[AMENDED]

0
3. The authority citation for part 234 continues to read as follows:

    Authority:  49 U.S.C. 20103, 20107; 28 U.S.C. 2461, note; and 49 
CFR 1.49.


0
4. In Sec.  234.275 revise paragraphs (b)(1), (b)(2), (c), and (f) to 
read as follows:


Sec.  234.275  Processor-based systems.

* * * * *
    (b) Use of performance standard authorized or required. (1) In lieu 
of compliance with the requirements of this subpart, a railroad may 
elect to qualify an existing processor-based product under part 236, 
subparts H or I, of this chapter.
    (2) Highway-rail grade crossing warning systems, subsystems, or 
components that are processor-based and that are first placed in 
service after June 6, 2005, which contain new or novel technology, or 
which provide safety-critical data to a railroad signal or train 
control system that is governed by part 236, subpart H or I, of this 
chapter, shall also comply with those requirements. New or novel 
technology refers to a technology not previously recognized for use as 
of March 7, 2005.
* * * * *
    (c) Plan justifications. The Product Safety Plan in accordance with 
49 CFR 236.907--or a PTC Development Plan and PTC Safety Plan required 
to be filed in accordance with 49 CFR 236.1013 and 236.1015--must 
explain how the performance objective sought to be addressed by each of 
the particular requirements of this subpart is met by the product, why 
the objective is not relevant to the product's design, or how the 
safety requirements are satisfied using alternative means. Deviation 
from those particular requirements is authorized if an adequate 
explanation is provided, making reference to relevant elements of the 
applicable plan, and if the product satisfies the performance standard 
set forth in Sec.  236.909 of this chapter. (See Sec.  236.907(a)(14) 
of this chapter.)
* * * * *
    (f) Software management control for certain systems not subject to 
a performance standard. Any processor-based system, subsystem, or 
component subject to this part, which is not subject to the 
requirements of part 236, subpart H or I, of this chapter but which 
provides safety-critical data to a signal or train control system shall 
be included in the software management control plan requirements as 
specified in Sec.  236.18 of this chapter.

PART 235--[AMENDED]

0
5. The authority citation for part 235 continues to read as follows:

    Authority: 49 U.S.C. 20103, 20107; 28 U.S.C. 2461, note; and 49 
CFR 1.49.


0
6. In Sec.  235.7, revise paragraph (a)(4), add paragraph (a)(5), and 
revise paragraphs (b)(2), (b)(3), and (c)(25) to read as follows:


Sec.  235.7  Changes not requiring filing of application.

    (a) * * *
    (4) Removal from service not to exceed 6 months of block signal 
system, interlocking, or traffic control system necessitated by 
catastrophic occurrence such as derailment, flood, fire, or hurricane; 
or
    (5) Removal of an intermittent automatic train stop system in 
conjunction with the implementation of a positive train control system 
approved by FRA under subpart I of part 236 of this chapter.
    (b) * * *
    (2) Removal of electric or mechanical lock, or signal used in lieu 
thereof, from hand-operated switch in automatic block signal or traffic 
control territory where train speed over the switch does not exceed 20 
miles per hour; or
    (3) Removal of electric or mechanical lock, or signal used in lieu 
thereof, from hand-operated switch in automatic block signal or traffic 
control territory where trains are not permitted to clear the main 
track at such switch.
    (c) * * *
    (25) The temporary or permanent arrangement of existing systems 
necessitated by highway-rail grade crossing separation construction. 
Temporary arrangements shall be removed within 6 months following 
completion of construction.

PART 236--[AMENDED]

0
7. The authority citation for part 236 is revised to read as follows:

    Authority: 49 U.S.C. 20102-20103, 20107, 20133, 20141, 20157, 
20301-20303, 20306, 20501-20505, 20701-20703, 21301-21302, 21304; 28 
U.S.C. 2461, note; and 49 CFR 1.49.

0
8. Section 236.0 is amended by revising paragraphs (a) and (c) through 
(e) and by adding paragraph (i) to read as follows:


Sec.  236.0  Applicability, minimum requirements, and penalties.

    (a) Except as provided in paragraph (b) of this section, this part 
applies to all railroads and any person as defined in paragraph (f) of 
this section.
* * * * *
    (c)(1) Prior to January 17, 2012, where a passenger train is 
operated at a speed of 60 or more miles per hour, or a freight train is 
operated at a speed of 50 or more miles per hour--
    (i) A block signal system complying with the provisions of this 
part shall be installed; or
    (ii) A manual block system shall be placed permanently in effect 
that shall conform to the following conditions:
    (A) A passenger train shall not be admitted to a block occupied by 
another train except when absolutely necessary and then only by 
operating at restricted speed;
    (B) No train shall be admitted to a block occupied by a passenger 
train except when absolutely necessary and then only by operating at 
restricted speed;
    (C) No train shall be admitted to a block occupied by an opposing 
train except when absolutely necessary and then only while one train is 
stopped and the other is operating at restricted speed; and
    (D) A freight train, including a work train, may be authorized to 
follow a freight train, including a work train, into a block and then 
only when the following train is operating at restricted speed.
    (2) On and after January 17, 2012, where a passenger train is 
permitted to operate at a speed of 60 or more miles per hour, or a 
freight train is permitted to operate at a speed of 50 or more miles 
per hour, a block signal system complying with the provisions of this 
part shall be installed, unless an FRA approved PTC system meeting the 
requirements of this part for the subject speed and other operating 
conditions is installed.

[[Page 2699]]

    (d)(1) Prior to December 31, 2015, where any train is permitted to 
operate at a speed of 80 or more miles per hour, an automatic cab 
signal, automatic train stop, or automatic train control system 
complying with the provisions of this part shall be installed, unless 
an FRA approved PTC system meeting the requirements of this part for 
the subject speed and other operating conditions, is installed.
    (2) On and after December 31, 2015, where any train is permitted to 
operate at a speed of 80 or more miles per hour, a PTC system complying 
with the provisions of subpart I shall be installed and operational, 
unless FRA approval to continue to operate with an automatic cab 
signal, automatic train stop, or automatic train control system 
complying with the provisions of this part has been justified to, and 
approved by, the Associate Administrator.
    (3) Subpart H of this part sets forth requirements for voluntary 
installation of PTC systems, and subpart I of this part sets forth 
requirements for mandated installation of PTC systems, each under 
conditions specified in their respective subpart.
    (e) Nothing in this section authorizes the discontinuance of a 
block signal system, interlocking, traffic control system, automatic 
cab signal, automatic train stop or automatic train control system, or 
PTC system, without approval by the FRA under part 235 of this title. 
However, a railroad may apply for approval of discontinuance or 
material modification of a signal or train control system in connection 
with a request for approval of a Positive Train Control Development 
Plan (PTCDP) or Positive Train Control Safety Plan (PTCSP) as provided 
in subpart I of this part.
* * * * *
    (i) Preemptive effect. (1) Under 49 U.S.C. 20106, issuance of these 
regulations preempts any state law, regulation, or order covering the 
same subject matter, except an additional or more stringent law, 
regulation, or order that is necessary to eliminate or reduce an 
essentially local safety or security hazard; is not incompatible with a 
law, regulation, or order of the United States Government; and that 
does not impose an unreasonable burden on interstate commerce.
    (2) This part establishes federal standards of care for railroad 
signal and train control systems. This part does not preempt an action 
under state law seeking damages for personal injury, death, or property 
damage alleging that a party has failed to comply with the federal 
standard of care established by this part, including a plan or program 
required by this part. Provisions of a plan or program which exceed the 
requirements of this part are not included in the federal standard of 
care.
    (3) Under 49 U.S.C. 20701-20703, issuance of these regulations 
preempts the field of locomotive safety, extending to the design, the 
construction, and the material of every part of the locomotive and 
tender and all appurtenances thereof.

0
9. Section 236.410 is amended by removing the Note following paragraph 
(b), and republishing paragraphs (b) and (c), to read as follows:


Sec.  236.410  Locking, hand-operated switch; requirements.

* * * * *
    (b) Approach or time locking shall be provided and locking may be 
released either automatically, or by the control operator, but only 
after the control circuits of signals governing movement in either 
direction over the switch and which display aspects with indications 
more favorable than ``proceed at restricted speed'' have been opened 
directly or by shunting of track circuit.
    (c) Where a signal is used in lieu of electric or mechanical lock 
to govern movements from auxiliary track to signaled track, the signal 
shall not display an aspect to proceed until after the control circuits 
of signals governing movement on main track in either direction over 
the switch have been opened, and either the approach locking circuits 
to the switch are unoccupied or a predetermined time interval has 
expired.
* * * * *

0
10. Section 236.909 is amended by adding four new sentences directly 
after the first sentence of paragraph (e)(1) and by revising paragraph 
(e)(2)(i) to read as follows:


Sec.  236.909  Minimum performance standards.

* * * * *
    (e) * * *
    (1) * * * The total risk assessment must have a supporting 
sensitivity analysis. The analysis must confirm that the risk metrics 
of the system are not negatively affected by sensitivity analysis input 
parameters including, for example, component failure rates, human 
factor error rates, and variations in train traffic affecting exposure. 
In this context, ``negatively affected'' means that the final residual 
risk metric does not exceed that of the base case or that which has 
been otherwise established through MTTHE target. The sensitivity 
analysis must document the sensitivity to worst case failure scenarios. 
* * *
    (2) * * *
    (i) In all cases exposure must be expressed as total train miles 
traveled per year over the relevant railroad infrastructure. 
Consequences must identify the total cost, including fatalities, 
injuries, property damage, and other incidental costs, such as 
potential consequences of hazardous materials involvement, resulting 
from preventable accidents associated with the function(s) performed by 
the system.
* * * * *

0
11. Add a new subpart I to part 236 to read as follows:
Subpart I--Positive Train Control Systems
Sec.
236.1001 Purpose and scope.
236.1003 Definitions.
236.1005 Requirements for Positive Train Control systems.
236.1006 Equipping locomotives operating in PTC territory.
236.1007 Additional requirements for high-speed service.
236.1009 Procedural requirements.
236.1011 PTC Implementation Plan content requirements.
236.1013 PTC Development Plan and Notice of Product Intent content 
requirements and Type Approval.
236.1015 PTC Safety Plan content requirements and PTC System 
Certification.
236.1017 Independent third party Verification and Validation.
236.1019 Main line track exceptions.
236.1021 Discontinuances, material modifications, and amendments.
236.1023 Errors and malfunctions.
236.1025 [Reserved]
236.1027 PTC system exclusions.
236.1029 PTC system use and en route failures.
236.1031 Previously approved PTC systems.
236.1033 Communications and security requirements.
236.1035 Field testing requirements.
236.1037 Records retention.
236.1039 Operations and Maintenance Manual.
236.1041 Training and qualification program, general.
236.1043 Task analysis and basic requirements.
236.1045 Training specific to office control personnel.
236.1047 Training specific to locomotive engineers and other 
operating personnel.
236.1049 Training specific to roadway workers.

Subpart I--Positive Train Control Systems


Sec.  236.1001  Purpose and scope.

    (a) This subpart prescribes minimum, performance-based safety 
standards for PTC systems required by 49 U.S.C. 20157, this subpart, or 
an FRA order, including requirements to ensure that the development, 
functionality,

[[Page 2700]]

architecture, installation, implementation, inspection, testing, 
operation, maintenance, repair, and modification of those PTC systems 
will achieve and maintain an acceptable level of safety. This subpart 
also prescribes standards to ensure that personnel working with, and 
affected by, safety-critical PTC system related products receive 
appropriate training and testing.
    (b) Each railroad may prescribe additional or more stringent rules, 
and other special instructions, that are not inconsistent with this 
subpart.
    (c) This subpart does not exempt a railroad from compliance with 
any requirement of subparts A through H of this part or parts 233, 234, 
and 235 of this chapter, unless:
    (1) It is otherwise explicitly excepted by this subpart; or
    (2) The applicable PTCSP, as defined under Sec.  236.1003 and 
approved by FRA under Sec.  236.1015, provides for such an exception 
per Sec.  236.1013.


Sec.  236.1003  Definitions.

    (a) Definitions contained in subparts G and H of this part apply 
equally to this subpart.
    (b) The following definitions apply to terms used only in this 
subpart unless otherwise stated:
    After-arrival mandatory directive means an authority to occupy a 
track which is issued to a train that is not effective and not to be 
acted upon until after the arrival and passing of a train, or trains, 
specifically identified in the authority.
    Associate Administrator means the FRA Associate Administrator for 
Railroad Safety/Chief Safety Officer.
    Class I railroad means a railroad which in the last year for which 
revenues were reported exceeded the threshold established under 
regulations of the Surface Transportation Board (49 CFR part 1201.1-1 
(2008)).
    Cleartext means the un-encrypted text in its original, human 
readable, form. It is the input of an encryption or encipher process, 
and the output of an decryption or decipher process.
    Controlling locomotive means Locomotive, controlling, as defined in 
Sec.  232.5 of this chapter.
    Host railroad means a railroad that has effective operating control 
over a segment of track.
    Interoperability means the ability of a controlling locomotive to 
communicate with and respond to the PTC railroad's positive train 
control system, including uninterrupted movements over property 
boundaries.
    Limited operations means operations on main line track that have 
limited or no freight operations and are approved to be excluded from 
this subpart's PTC system implementation and operation requirements in 
accordance with Sec.  236.1019(c);
    Main line means, except as provided in Sec.  236.1019 or where all 
trains are limited to restricted speed within a yard or terminal area 
or on auxiliary or industry tracks, a segment or route of railroad 
tracks:
    (1) Of a Class I railroad, as documented in current timetables 
filed by the Class I railroad with the FRA under Sec.  217.7 of this 
title, over which 5,000,000 or more gross tons of railroad traffic is 
transported annually; or
    (2) Used for regularly scheduled intercity or commuter rail 
passenger service, as defined in 49 U.S.C. 24102, or both. Tourist, 
scenic, historic, or excursion operations as defined in part 238 of 
this chapter are not considered intercity or commuter passenger service 
for purposes of this part.
    Main line track exclusion addendum (``MTEA'') means the document 
submitted under Sec. Sec.  236.1011 and 236.1019 requesting to 
designate track as other than main line.
    Medium speed means, Speed, medium, as defined in subpart G of this 
part.
    NPI means a Notice of Product Intent (``NPI'') as further described 
in Sec.  236.1013.
    PTC means positive train control as further described in Sec.  
236.1005.
    PTCDP means a PTC Development Plan as further described in Sec.  
236.1013.
    PTCIP means a PTC Implementation Plan as required under 49 U.S.C. 
20157 and further described in Sec.  236.1011.
    PTCPVL means a PTC Product Vendor List as further described in 
Sec.  236.1023.
    PTCSP means a PTC Safety Plan as further described in Sec.  
236.1015.
    PTC railroad means each Class I railroad and each entity providing 
regularly scheduled intercity or commuter rail passenger transportation 
required to implement or operate a PTC system.
    PTC System Certification means certification as required under 49 
U.S.C. 20157 and further described in Sec. Sec.  236.1009 and 236.1015.
    Request for Amendment (``RFA'') means a request for an amendment of 
a plan or system made by a PTC railroad in accordance with Sec.  
236.1021.
    Request for Expedited Certification (``REC'') means, as further 
described in Sec.  236.1031, a request by a railroad to receive 
expedited consideration for PTC System Certification.
    Restricted speed means, Speed, restricted, as defined in subpart G 
of this part.
    Safe State means a system state that, when the system fails, cannot 
cause death, injury, occupational illness, or damage to or loss of 
equipment or property, or damage to the environment.
    Segment of track means any part of the railroad where a train 
operates.
    Temporal separation means that passenger and freight operations do 
not operate on any segment of shared track during the same period and 
as further defined under Sec.  236.1019 and the process or processes in 
place to assure that result.
    Tenant railroad means a railroad, other than a host railroad, 
operating on track upon which a PTC system is required.
    Track segment means segment of track.
    Type Approval means a number assigned to a particular PTC system 
indicating FRA agreement that the PTC system could fulfill the 
requirements of this subpart.
    Train means one or more locomotives, coupled with or without cars.


Sec.  236.1005  Requirements for Positive Train Control systems.

    (a) PTC system requirements. Each PTC system required to be 
installed under this subpart shall:
    (1) Reliably and functionally prevent:
    (i) Train-to-train collisions--including collisions between trains 
operating over rail-to-rail at-grade crossings in accordance with the 
following risk-based table or alternative arrangements providing an 
equivalent level of safety as specified in an FRA approved PTCSP:

------------------------------------------------------------------------
         Crossing type             Max speed *      Protection required
------------------------------------------------------------------------
(A) Interlocking--one or more   <= 40 miles per    Interlocking signal
 PTC routes intersecting with    hour.              arrangement in
 one or more non-PTC routes.                        accordance with the
                                                    requirements of
                                                    subparts A-G of this
                                                    part and PTC
                                                    enforced stop on PTC
                                                    routes.

[[Page 2701]]

 
(B) Interlocking--one or more   > 40 miles per     Interlocking signal
 PTC routes intersecting with    hour.              arrangement in
 one or more non-PTC routes.                        accordance with the
                                                    requirements of
                                                    subparts A-G of this
                                                    part, PTC enforced
                                                    stop on all PTC
                                                    routes, and either
                                                    the use of other
                                                    than full PTC
                                                    technology that
                                                    provides positive
                                                    stop enforcement or
                                                    a split-point derail
                                                    incorporated into
                                                    the signal system
                                                    accompanied by 20
                                                    miles per hour
                                                    maximum allowable
                                                    speed on the
                                                    approach of any
                                                    intersecting non-PTC
                                                    route.
(C) Interlocking--all PTC       Any speed........  Interlocking signal
 routes intersecting.                               arrangements in
                                                    accordance with the
                                                    requirements of
                                                    subparts A-G of this
                                                    part, and PTC
                                                    enforced stop on all
                                                    routes.
------------------------------------------------------------------------

     (ii) Overspeed derailments, including derailments related to 
railroad civil engineering speed restrictions, slow orders, and 
excessive speeds over switches and through turnouts;
    (iii) Incursions into established work zone limits without first 
receiving appropriate authority and verification from the dispatcher or 
roadway worker in charge, as applicable and in accordance with part 214 
of this chapter; and
    (iv) The movement of a train through a main line switch in the 
improper position as further described in paragraph (e) of this 
section.
    (2) Include safety-critical integration of all authorities and 
indications of a wayside or cab signal system, or other similar 
appliance, method, device, or system of equivalent safety, in a manner 
by which the PTC system shall provide associated warning and 
enforcement to the extent, and except as, described and justified in 
the FRA approved PTCDP or PTCSP, as applicable;
    (3) As applicable, perform the additional functions specified in 
this subpart;
    (4) Provide an appropriate warning or enforcement when:
    (i) A derail or switch protecting access to the main line required 
by Sec.  236.1007, or otherwise provided for in the applicable PTCSP, 
is not in its derailing or protecting position, respectively;
    (ii) A mandatory directive is issued associated with a highway-rail 
grade crossing warning system malfunction as required by Sec. Sec.  
234.105, 234.106, or 234.107;
    (iii) An after-arrival mandatory directive has been issued and the 
train or trains to be waited on has not yet passed the location of the 
receiving train;
    (iv) Any movable bridge within the route ahead is not in a position 
to allow permissive indication for a train movement pursuant to Sec.  
236.312; and
    (v) A hazard detector integrated into the PTC system that is 
required by paragraph (c) of this section, or otherwise provided for in 
the applicable PTCSP, detects an unsafe condition or transmits an 
alarm; and
    (5) Limit the speed of passenger and freight trains to 59 miles per 
hour and 49 miles per hour, respectively, in areas without broken rail 
detection or equivalent safeguards.
    (b) PTC system installation. (1) Lines required to be equipped. 
Except as otherwise provided in this subpart, each Class I railroad and 
each railroad providing or hosting intercity or commuter passenger 
service shall progressively equip its lines as provided in its approved 
PTCIP such that, on and after December 31, 2015, a PTC system certified 
under Sec.  236.1015 is installed and operated by the host railroad on 
each:
    (i) Main line over which is transported any quantity of material 
poisonous by inhalation (PIH), including anhydrous ammonia, as defined 
in Sec. Sec.  171.8, 173.115 and 173.132 of this title;
    (ii) Main line used for regularly provided intercity or commuter 
passenger service, except as provided in Sec.  236.1019; and
    (iii) Additional line of railroad as required by the applicable FRA 
approved PTCIP, this subpart, or an FRA order requiring installation of 
a PTC system by that date.
    (2) Initial baseline identification of lines. For the purposes of 
paragraph (b)(1)(i) of this section, the baseline information necessary 
to determine whether a Class I railroad's track segment shall be 
equipped with a PTC system shall be determined and reported as follows:
    (i) The traffic density threshold of 5 million gross tons shall be 
based upon calendar year 2008 gross tonnage, except to the extent that 
traffic may fall below 5 million gross tons for two consecutive 
calendar years and a PTCIP or an RFA reflecting this change is filed 
and approved under paragraph (b)(4) of this section and, if applicable, 
Sec.  236.1021.
    (ii) The presence or absence of any quantity of PIH hazardous 
materials shall be determined by whether one or more cars containing 
such product(s) was transported over the track segment in calendar year 
2008 or prior to the filing of the PTCIP, except to the extent that the 
PTCIP or RFA justifies, under paragraph (b)(4) of this section, removal 
of the subject track segment from the PTCIP listing of lines to be 
equipped.
    (3) Addition of track segments. To the extent increases in freight 
rail traffic occur subsequent to calendar year 2008 that might affect 
the requirement to install a PTC system on any line not yet equipped, 
the railroad shall seek to amend its PTCIP by promptly filing an RFA in 
accordance with Sec.  236.1021. The following criteria apply:
    (i) If rail traffic exceeds 5 million gross tons in any year after 
2008, the tonnage shall be calculated for the preceding two calendar 
years and if the total tonnage for those two calendar years exceeds 10 
million gross tons, a PTCIP or its amendment is required.
    (ii) If PIH traffic is carried on a track segment as a result of a 
request for rail service or rerouting warranted under part 172 of this 
title, and if the line carries in excess of 5 million gross tons of 
rail traffic as determined under this paragraph, a PTCIP or its 
amendment is required. This does not apply when temporary rerouting is 
authorized in accordance with paragraph (g) of this section.
    (iii) Once a railroad is notified by FRA that its RFA filed in 
accordance with this paragraph has been approved, the railroad shall 
equip the line with the applicable PTC system by December 31, 2015, or 
within 24 months, whichever is later.
    (4) Exclusion or removal of track segments from PTC baseline.
    (i) Routing changes. In a PTCIP or an RFA, a railroad may request 
review of the requirement to install PTC on a track segment where a PTC 
system is otherwise required by this section, but has not yet been 
installed, based upon changes in rail traffic such as reductions in 
total traffic volume or cessation of passenger or PIH service. Any such 
request shall be accompanied by estimated traffic projections for the 
next 5 years (e.g., as a result of planned rerouting, coordinations, or 
location of new business on the line). Where the request involves prior 
or planned rerouting of PIH traffic, the railroad must provide a 
supporting analysis that takes into consideration the requirements of 
subpart I, part 172 of

[[Page 2702]]

this title, assuming the subject route and each practicable alternative 
route to be PTC-equipped, and including any interline routing impacts.
    (A) FRA will approve the exclusion if, based upon data in the 
docket of the proceeding, FRA finds that it would be consistent with 
safety as further provided in this paragraph.
    (1) In the case of a requested exclusion based on cessation of 
passenger service or a decline in gross tonnage below 5 million gross 
tons as computed over a 2-year period, the removal will be approved 
absent special circumstances as set forth in writing (e.g., because of 
anticipated traffic growth in the near future).
    (2) In the case of cessation of PIH traffic over a track segment, 
and absent special circumstances set forth in writing, FRA will approve 
an exclusion of a line from the PTCIP (determined on the basis of 2008 
traffic levels) upon a showing by the railroad that:
    (i) There is no remaining local PIH traffic expected on the track 
segment;
    (ii) Either any rerouting of PIH traffic from the subject track 
segment is justified based upon the route analysis submitted, which 
shall assume that each alternative route will be equipped with PTC and 
shall take into consideration any significant interline routing 
impacts; or the next preferred alternative route in the analysis 
conducted as set forth in this paragraph is shown to be substantially 
as safe and secure as the route employing the track segment in question 
and demonstrated considerations of practicability indicate 
consolidation of the traffic on that next preferred alternative route; 
and
    (iii) After cessation of PIH traffic on the line, the remaining 
risk associated with PTC-preventable accidents per route mile on the 
track segment will not exceed the average comparable risk per route 
mile on Class I lines in the United States required to be equipped with 
PTC because of gross tonnage and the presence of PIH traffic (which 
base case will be estimated as of a time prior to installation of PTC). 
If the subject risk is greater than the average risk on those PIH 
lines, and if the railroad making the application for removal of the 
track segment from the PTCIP offers no compensating extension of PTC or 
PTC technologies from the minimum required to be equipped, FRA may deny 
the request.
    (B) [Reserved]
    (ii) Lines with de minimis PIH risk. (A) In a PTCIP or RFA, a 
railroad may request review of the requirement to install PTC on a low 
density track segment where a PTC system is otherwise required by this 
section, but has not yet been installed, based upon the presence of a 
minimal quantity of PIH hazardous materials (less than 100 cars per 
year, loaded and residue). Any such request shall be accompanied by 
estimated traffic projections for the next 5 years (e.g., as a result 
of planned rerouting, coordinations, or location of new business on the 
line). Where the request involves prior or planned rerouting of PIH 
traffic, the railroad must provide the information and analysis 
identified in paragraph (b)(4)(i) of this section. The submission shall 
also include a full description of potential safety hazards on the 
segment of track and fully describe train operations over the line. 
This provision is not applicable to lines segments used by intercity or 
commuter passenger service.
    (B) Absent special circumstances related to specific hazards 
presented by operations on the line segment, FRA will approve a request 
for relief under this paragraph for a rail line segment:
    (1) Consisting exclusively of Class 1 or 2 track as described in 
part 213 of this title;
    (2) That carries less than 15 million gross tons annually;
    (3) Has a ruling grade of less than 1 percent; and
    (4) On which any train transporting a car containing PIH materials 
(including a residue car) is operated under conditions of temporal 
separation from other trains using the line segment as documented by a 
temporal separation plan accompanying the request. As used in this 
paragraph, ``temporal separation'' has the same meaning given by Sec.  
236.1019(e), except that the separation addressed is the separation of 
a train carrying any number of cars containing PIH materials from other 
freight trains.
    (C) FRA will also consider, and may approve, requests for relief 
under this paragraph for additional line segments where each such 
segment carries less than 15 million gross tons annually and where it 
is established to the satisfaction of the Associate Administrator that 
risk mitigations will be applied that will ensure that risk of a 
release of PIH materials is negligible.
    (D) Failure to submit sufficient information will result in the 
denial of any request under this paragraph (b)(4)(ii). If the request 
is granted, on and after the date the line would have otherwise been 
required to be equipped under the schedule contained in the PTCIP and 
approved by FRA, operations on the line shall be conducted in 
accordance with any conditions attached to the grant, including 
implementation of proposed mitigations as applicable.
    (5) Line sales. FRA does not approve removal of a line from the 
PTCIP exclusively based upon a representation that a track segment will 
be abandoned or sold to another railroad. In the event a track segment 
is approved for abandonment or transfer by the Surface Transportation 
Board, FRA will review at the request of the transferring and acquiring 
railroads whether the requirement to install PTC on the line should be 
removed given all of the circumstances, including expected traffic and 
hazardous materials levels, reservation of trackage or haulage rights 
by the transferring railroad, routing analysis under part 172 of this 
chapter, commercial and real property arrangements affecting the 
transferring and acquiring railroads post-transfer, and such other 
factors as may be relevant to continue safe operations on the line. If 
FRA denies the request, the acquiring railroad shall install the PTC 
system on the schedule provided in the transferring railroad's PTCIP, 
without regard to whether it is a Class I railroad.
    (6) New rail passenger service. No new intercity or commuter rail 
passenger service shall commence after December 31, 2015, until a PTC 
system certified under this subpart has been installed and made 
operative.
    (c) Hazard detectors. (1) All hazard detectors integrated into a 
signal or train control system on or after October 16, 2008, shall be 
integrated into PTC systems required by this subpart; and their 
warnings shall be appropriately and timely enforced as described in the 
applicable PTCSP.
    (2) The applicable PTCSP must provide for receipt and presentation 
to the locomotive engineer and other train crew members of warnings 
from any additional hazard detectors using the PTC data network, 
onboard displays, and audible alerts. If the PTCSP so provides, the 
action to be taken by the system and by the crew members shall be 
specified.
    (3) The PTCDP (as applicable) and PTCSP for any new service 
described in Sec.  236.1007 to be conducted above 90 miles per hour 
shall include a hazard analysis describing the hazards relevant to the 
specific route(s) in question (e.g., potential for track obstruction 
due to events such as falling rock or undermining of the track 
structure due to high water or displacement of a bridge over navigable 
waters), the basis for decisions concerning hazard detectors provided, 
and the manner in which such additional hazard detectors will be 
interfaced with the PTC system.
    (d) Event recorders. (1) Each lead locomotive, as defined in part 
229, of a train equipped and operating with a

[[Page 2703]]

PTC system required by this subpart must be equipped with an operative 
event recorder, which shall:
    (i) Record safety-critical train control data routed to the 
locomotive engineer's display that the engineer is required to comply 
with;
    (ii) Specifically include text messages conveying mandatory 
directives, maximum authorized speeds, PTC system brake warnings, PTC 
system brake enforcements, and the state of the PTC system (e.g., cut 
in, cut out, active, or failed); and
    (iii) Include examples of how the captured data will be displayed 
during playback along with the format, content, and data retention 
duration requirements specified in the PTCSP submitted and approved 
pursuant to this paragraph. If such train control data can be 
calibrated against other data required by this part, it may, at the 
election of the railroad, be retained in a separate memory module.
    (2) Each lead locomotive, as defined in part 229, manufactured and 
in service after October 1, 2009, that is equipped and operating with a 
PTC system required by this subpart, shall be equipped with an event 
recorder memory module meeting the crash hardening requirements of 
Sec.  229.135 of this chapter.
    (3) Nothing in this subpart excepts compliance with any of the 
event recorder requirements contained in Sec.  229.135 of this chapter.
    (e) Switch position. The following requirements apply with respect 
to determining proper switch position under this section. When a main 
line switch position is unknown or improperly aligned for a train's 
route in advance of the train's movement, the PTC system will provide 
warning of the condition associated with the following enforcement:
    (1) A PTC system shall enforce restricted speed over any switch:
    (i) Where train movements are made with the benefit of the 
indications of a wayside or cab signal system or other similar 
appliance, method, device, or system of equivalent safety proposed to 
FRA and approved by the Associate Administrator in accordance with this 
part; and
    (ii) Where wayside or cab signal system or other similar appliance, 
method, device, or system of equivalent safety, requires the train to 
be operated at restricted speed.
    (2) A PTC system shall enforce a positive stop short of any main 
line switch, and any switch on a siding where the allowable speed is in 
excess of 20 miles per hour, if movement of the train over the switch:
    (i) Is made without the benefit of the indications of a wayside or 
cab signal system or other similar appliance, method, device, or system 
of equivalent safety proposed to FRA and approved by the Associate 
Administrator in accordance with this part; or
    (ii) Would create an unacceptable risk. Unacceptable risk includes 
conditions when traversing the switch, even at low speeds, could result 
in direct conflict with the movement of another train (including a 
hand-operated crossover between main tracks, a hand-operated crossover 
between a main track and an adjoining siding or auxiliary track, or a 
hand-operated switch providing access to another subdivision or branch 
line, etc.).
    (3) A PTC system required by this subpart shall be designed, 
installed, and maintained to perform the switch position detection and 
enforcement described in paragraphs (e)(1) and (e)(2) of this section, 
except as provided for and justified in the applicable, FRA approved 
PTCDP or PTCSP.
    (4) The control circuit or electronic equivalent for all movement 
authorities over any switches, movable-point frogs, or derails shall be 
selected through circuit controller or functionally equivalent device 
operated directly by the switch points, derail, or by switch locking 
mechanism, or through relay or electronic device controlled by such 
circuit controller or functionally equivalent device, for each switch, 
movable-point frog, or derail in the route governed. Circuits or 
electronic equivalent shall be arranged so that any movement 
authorities less restrictive than those prescribed in paragraphs (e)(1) 
and (e)(2) of this section can only be provided when each switch, 
movable-point frog, or derail in the route governed is in proper 
position, and shall be in accordance with subparts A through G of this 
part, unless it is otherwise provided in a PTCSP approved under this 
subpart.
    (f) Train-to-train collision. A PTC system shall be considered to 
be configured to prevent train-to-train collisions within the meaning 
of paragraph (a) of this section if trains are required to be operated 
at restricted speed and if the onboard PTC equipment enforces the upper 
limits of the railroad's restricted speed rule (15 or 20 miles per 
hour). This application applies to:
    (1) Operating conditions under which trains are required by signal 
indication or operating rule to:
    (i) Stop before continuing; or
    (ii) Reduce speed to restricted speed and continue at restricted 
speed until encountering a more favorable indication or as provided by 
operating rule.
    (2) Operation of trains within the limits of a joint mandatory 
directive.
    (g) Temporary rerouting. A train equipped with a PTC system as 
required by this subpart may be temporarily rerouted onto a track not 
equipped with a PTC system and a train not equipped with a PTC system 
may be temporarily rerouted onto a track equipped with a PTC system as 
required by this subpart in the following circumstances:
    (1) Emergencies. In the event of an emergency--including conditions 
such as derailment, flood, fire, tornado, hurricane, earthquake, or 
other similar circumstance outside of the railroad's control--that 
would prevent usage of the regularly used track if:
    (i) The rerouting is applicable only until the emergency condition 
ceases to exist and for no more than 14 consecutive calendar days, 
unless otherwise extended by approval of the Associate Administrator;
    (ii) The railroad provides written or telephonic notification to 
the applicable Regional Administrator of the information listed in 
paragraph (i) of this section within one business day of the beginning 
of the rerouting made in accordance with this paragraph; and
    (iii) The conditions contained in paragraph (j) of this section are 
followed.
    (2) Planned maintenance. In the event of planned maintenance that 
would prevent usage of the regularly used track if:
    (i) The maintenance period does not exceed 30 days;
    (ii) A request is filed with the applicable Regional Administrator 
in accordance with paragraph (i) of this section no less than 10 
business days prior to the planned rerouting; and
    (iii) The conditions contained in paragraph (j) of this section are 
followed.
    (h) Rerouting requests. (1) For the purposes of paragraph (g)(2) of 
this section, the rerouting request shall be self-executing unless the 
applicable Regional Administrator responds with a notice disapproving 
of the rerouting or providing instructions to allow rerouting. Such 
instructions may include providing additional information to the 
Regional Administrator or Associate Administrator prior to the 
commencement of rerouting. Once the Regional Administrator responds 
with a notice under this paragraph, no rerouting may occur until the 
Regional Administrator or Associate Administrator provides his or her 
approval.

[[Page 2704]]

    (2) In the event the temporary rerouting described in paragraph 
(g)(2) of this section is to exceed 30 consecutive calendar days:
    (i) The railroad shall provide a request in accordance with 
paragraphs (i) and (j) of this section with the Associate Administrator 
no less than 10 business days prior to the planned rerouting; and
    (ii) The rerouting shall not commence until receipt of approval 
from the Associate Administrator.
    (i) Content of rerouting request. Each notice or request referenced 
in paragraph (g) and (h) of this section must indicate:
    (1) The dates that such temporary rerouting will occur;
    (2) The number and types of trains that will be rerouted;
    (3) The location of the affected tracks; and
    (4) A description of the necessity for the temporary rerouting.
    (j) Rerouting conditions. Rerouting of operations under paragraph 
(g) of this section may occur under the following conditions:
    (1) Where a train not equipped with a PTC system is rerouted onto a 
track equipped with a PTC system, or a train not equipped with a PTC 
system that is compatible and functionally responsive to the PTC system 
utilized on the line to which the train is being rerouted, the train 
shall be operated in accordance with Sec.  236.1029; or
    (2) Where any train is rerouted onto a track not equipped with a 
PTC system, the train shall be operated in accordance with the 
operating rules applicable to the line on which the train is rerouted.
    (k) Rerouting cessation. The applicable Regional Administrator may 
order a railroad to cease any rerouting provided under paragraph (g) or 
(h) of this section.


Sec.  236.1006  Equipping locomotives operating in PTC territory.

    (a) Except as provided in paragraph (b) of this section, each train 
operating on any track segment equipped with a PTC system shall be 
controlled by a locomotive equipped with an onboard PTC apparatus that 
is fully operative and functioning in accordance with the applicable 
PTCSP approved under this subpart.
    (b) Exceptions. (1) Prior to December 31, 2015, each railroad 
required to install PTC shall include in its PTCIP specific goals for 
progressive implementation of onboard systems and deployment of PTC-
equipped locomotives such that the safety benefits of PTC are achieved 
through incremental growth in the percentage of controlling locomotives 
operating on PTC lines that are equipped with operative PTC onboard 
equipment. The PTCIP shall include a brief but sufficient explanation 
of how those goals will be achieved, including assignment of 
responsibilities within the organization. The goals shall be expressed 
as the percentage of trains operating on PTC-equipped lines that are 
equipped with operative onboard PTC apparatus responsive to the 
wayside, expressed as an annualized (calendar year) percentage for the 
railroad as a whole.
    (2) Each railroad shall adhere to its PTCIP and shall report, on 
April 16, of 2011, 2012, 2013, and 2014, its progress toward achieving 
the goals set under paragraph (b)(1) of this section. In the event any 
annual goal is not achieved, the railroad shall further report the 
actions it is taking to ensure achievement of subsequent annual goals.
    (3) On and after December 31, 2015, a train controlled by a 
locomotive with an onboard PTC apparatus that has failed en route is 
permitted to operate in accordance with Sec.  236.1029.
    (4) A train operated by a Class II or Class III railroad, including 
a tourist or excursion railroad, and controlled by a locomotive not 
equipped with an onboard PTC apparatus is permitted to operate on a 
PTC-operated track segment:
    (i) That either:
    (A) Has no regularly scheduled intercity or commuter passenger rail 
traffic; or
    (B) Has regularly scheduled intercity or commuter passenger rail 
traffic and the applicable PTCIP permits the operation of a train 
operated by a Class II or III railroad and controlled by a locomotive 
not equipped with an onboard PTC apparatus;
    (ii) Where operations are restricted to four or less such 
unequipped trains per day, whereas a train conducting a ``turn'' 
operation (e.g., moving to a point of interchange to drop off or pick 
up cars and returning to the track owned by a Class II or III railroad) 
is considered two trains for this purpose; and
    (iii) Where each movement shall either:
    (A) Not exceed 20 miles in length; or
    (B) To the extent any movement exceeds 20 miles in length, such 
movement is not permitted without the controlling locomotive being 
equipped with an onboard PTC system after December 31, 2020, and each 
applicable Class II or III railroad shall report to FRA its progress in 
equipping each necessary locomotive with an onboard PTC apparatus to 
facilitate continuation of the movement. The progress reports shall be 
filed not later than December 31, 2017 and, if all necessary 
locomotives are not yet equipped, on December 31, 2019.
    (c) When a train movement is conducted under the exceptions 
described in paragraph (b)(4) of this section, that movement shall be 
made in accordance with Sec.  236.1029.


Sec.  236.1007  Additional requirements for high-speed service.

    (a) A PTC railroad that conducts a passenger operation at or 
greater than 60 miles per hour or a freight operation at or greater 
than 50 miles per hour shall have installed a PTC system including or 
working in concert with technology that includes all of the safety-
critical functional attributes of a block signal system meeting the 
requirements of this part, including appropriate fouling circuits and 
broken rail detection (or equivalent safeguards).
    (b) In addition to the requirements of paragraph (a) of this 
section, a host railroad that conducts a freight or passenger operation 
at more than 90 miles per hour shall:
    (1) Have an approved PTCSP establishing that the system was 
designed and will be operated to meet the fail-safe operation criteria 
described in Appendix C to this part; and
    (2) Prevent unauthorized or unintended entry onto the main line 
from any track not equipped with a PTC system compliant with this 
subpart by placement of split-point derails or equivalent means 
integrated into the PTC system; and
    (3) Comply with Sec.  236.1029(c).
    (c) In addition to the requirements of paragraphs (a) and (b) of 
this section, a host railroad that conducts a freight or passenger 
operation at more than 125 miles per hour shall have an approved PTCSP 
accompanied by a document (``HSR-125'') establishing that the system:
    (1) Will be operated at a level of safety comparable to that 
achieved over the 5 year period prior to the submission of the PTCSP by 
other train control systems that perform PTC functions required by this 
subpart, and which have been utilized on high-speed rail systems with 
similar technical and operational characteristics in the United States 
or in foreign service, provided that the use of foreign service data 
must be approved by the Associate Administrator before submittal of the 
PTCSP; and
    (2) Has been designed to detect incursions into the right-of-way, 
including incidents involving motor vehicles diverting from adjacent 
roads and bridges, where conditions warrant.

[[Page 2705]]

    (d) In addition to the requirements of paragraphs (a) through (c) 
of this section, a host railroad that conducts a freight or passenger 
operation at more than 150 miles per hour, which is governed by a Rule 
of Particular Applicability, shall have an approved PTCSP accompanied 
by a HSR-125 developed as part of an overall system safety plan 
approved by the Associate Administrator.
    (e) A railroad providing existing high-speed passenger service may 
request in its PTCSP that the Associate Administrator excuse compliance 
with one or more requirements of this section upon a showing that the 
subject service has been conducted with a high level of safety.


Sec.  236.1009  Procedural requirements.

    (a) PTC Implementation Plan (PTCIP). (1) By April 16, 2010, each 
host railroad that is required to implement and operate a PTC system in 
accordance with Sec.  236.1005(b) shall develop and submit in 
accordance with Sec.  236.1011(a) a PTCIP for implementing a PTC system 
required under Sec.  236.1005. Filing of the PTCIP shall not exempt the 
required filings of an NPI, PTCSP, PTCDP, or Type Approval.
    (2) After April 16, 2010, a host railroad shall file:
    (i) A PTCIP if it becomes a host railroad of a main line track 
segment for which it is required to implement and operate a PTC system 
in accordance with Sec.  236.1005(b); or
    (ii) A request for amendment (``RFA'') of its current and approved 
PTCIP in accordance with Sec.  236.1021 if it intends to:
    (A) Initiate a new category of service (i.e., passenger or 
freight); or
    (B) Add, subtract, or otherwise materially modify one or more lines 
of railroad for which installation of a PTC system is required.
    (3) The host and tenant railroad(s) shall jointly file a PTCIP that 
addresses shared track:
    (i) If the host railroad is required to install and operate a PTC 
system on a segment of its track; and
    (ii) If the tenant railroad that shares the same track segment 
would have been required to install a PTC system if the host railroad 
had not otherwise been required to do so.
    (4) If railroads required to file a joint PTCIP are unable to 
jointly file a PTCIP in accordance with paragraphs (a)(1) and (a)(3) of 
this section, then each railroad shall:
    (i) Separately file a PTCIP in accordance with paragraph (a)(1);
    (ii) Notify the Associate Administrator that the subject railroads 
were unable to agree on a PTCIP to be jointly filed;
    (iii) Provide the Associate Administrator with a comprehensive list 
of all issues not in agreement between the railroads that would prevent 
the subject railroads from jointly filing the PTCIP; and
    (iv) Confer with the Associate Administrator to develop and submit 
a PTCIP mutually acceptable to all subject railroads.
    (b) Type Approval. Each host railroad, individually or jointly with 
others such as a tenant railroad or system supplier, shall file prior 
to or simultaneously with the filing made in accordance with paragraph 
(a) of this section:
    (1) An unmodified Type Approval previously issued by the Associate 
Administrator in accordance with Sec.  236.1013 or Sec.  236.1031(b) 
with its associated docket number;
    (2) A PTCDP requesting a Type Approval for:
    (i) A PTC system that does not have a Type Approval; or
    (ii) A PTC system with a previously issued Type Approval that 
requires one or more variances;
    (3) A PTCSP subject to the conditions set forth in paragraph (c) of 
this section, with or without a Type Approval; or
    (4) A document attesting that a Type Approval is not necessary 
since the host railroad has no territory for which a PTC system is 
required under this subpart.
    (c) Notice of Product Intent (NPI). A railroad may, in lieu of 
submitting a PTCDP, or referencing an already issued Type Approval, 
submit an NPI describing the functions of the proposed PTC system. If a 
railroad elects to file an NPI in lieu of a PTCDP or referencing an 
existing Type Approval with the PTCIP, and the PTCIP is otherwise 
acceptable to the Associate Administrator, the Associate Administrator 
may grant provisional approval of the PTCIP.
    (1) A provisional approval of a PTCIP, unless otherwise extended by 
the Associate Administrator, is valid for a period of 270 days from the 
date of approval by the Associate Administrator.
    (2) The railroad must submit an updated PTCIP with either a 
complete PTCDP as defined in Sec.  236.1013(a), an updated PTCIP 
referencing an already approved Type Approval, or a full PTCSP within 
270 days after the ``Provisional Approval.''
    (i) Within 90 days of receipt of an updated PTCIP that was 
submitted with an NPI, the Associate Administrator will approve or 
disapprove of the updated PTCIP and notify in writing the affected 
railroad. If the updated PTCIP is not approved, the notification will 
include the plan's deficiencies. Within 30 days of receipt of that 
notification, the railroad or other entity that submitted the plan 
shall correct all deficiencies and resubmit the plan in accordance with 
this section and Sec.  236.1011, as applicable.
    (ii) If an update to a ``Provisionally Approved'' PTCIP is not 
received by the Associate Administrator by the end of the period 
indicated in this paragraph, the ``Provisional Approval'' given to the 
PTCIP is automatically revoked. The revocation is retroactive to the 
date the original PTCIP and NPI were first submitted to the Associate 
Administrator.
    (d) PTCSP and PTC System Certification. The following apply to each 
PTCSP and PTC System Certification.
    (1) A PTC System Certification for a PTC system may be obtained by 
submitting an acceptable PTCSP. If the PTC system is the subject of a 
Type Approval, the safety case elements contained in the PTCDP may be 
incorporated by reference into the PTCSP, subject to finalization of 
the human factors analysis contained in the PTCDP.
    (2) Each PTCSP requirement under Sec.  236.1015 shall be supported 
by information and analysis sufficient to establish that the 
requirements of this subpart have been satisfied.
    (3) If the Associate Administrator finds that the PTCSP and 
supporting documentation support a finding that the system complies 
with this part, the Associate Administrator may approve the PTCSP. If 
the Associate Administrator approves the PTCSP, the railroad shall 
receive PTC System Certification for the subject PTC system and shall 
implement the PTC system according to the PTCSP.
    (4) A required PTC system shall not:
    (i) Be used in service until it receives from FRA a PTC System 
Certification; and
    (ii) Receive a PTC System Certification unless FRA receives and 
approves an applicable:
    (A) PTCSP; or
    (B) Request for Expedited Certification (REC) as defined by Sec.  
236.1031(a).
    (e) Plan contents. (1) No PTCIP shall receive approval unless it 
complies with Sec.  236.1011. No railroad shall receive a Type Approval 
or PTC System Certification unless the applicable PTCDP or PTCSP, 
respectively, comply with Sec. Sec.  236.1013 and 236.1015, 
respectively.
    (2) All materials filed in accordance with this subpart must be in 
the English language, or have been translated into English and attested 
as true and correct.

[[Page 2706]]

    (3) Each filing referenced in this section may include a request 
for full or partial confidentiality in accordance with Sec.  209.11 of 
this chapter. If confidentiality is requested as to a portion of any 
applicable document, then in addition to the filing requirements under 
Sec.  209.11 of this chapter, the person filing the document shall also 
file a copy of the original unredacted document, marked to indicate 
which portions are redacted in the document's confidential version 
without obscuring the original document's contents.
    (f) Supporting documentation and information. (1) Issuance of a 
Type Approval or PTC System Certification is contingent upon FRA's 
confidence in the implementation and operation of the subject PTC 
system. This confidence may be based on FRA-monitored field testing or 
an independent assessment performed in accordance with Sec.  236.1035 
or Sec.  236.1017, respectively.
    (2) Upon request by FRA, the railroad requesting a Type Approval or 
PTC System Certification must engage in field testing or independent 
assessment performed in accordance with Sec.  236.1035 or Sec.  
236.1017, respectively, to support the assertions made in any of the 
plans submitted under this subpart. These assertions include any of the 
plans' content requirements under this subpart.
    (g) FRA conditions, reconsiderations, and modifications. (1) As 
necessary to ensure safety, FRA may attach special conditions to 
approving a PTCIP or issuing a Type Approval or PTC System 
Certification.
    (2) After granting a Type Approval or PTC System Certification, FRA 
may reconsider the Type Approval or PTC System Certification upon 
revelation of any of the following factors concerning the contents of 
the PTCDP or PTCSP:
    (i) Potential error or fraud;
    (ii) Potentially invalidated assumptions determined as a result of 
in-service experience or one or more unsafe events calling into 
question the safety analysis supporting the approval.
    (3) During FRA's reconsideration in accordance with this paragraph, 
the PTC system may remain in use if otherwise consistent with the 
applicable law and regulations and FRA may impose special conditions 
for use of the PTC system.
    (4) After FRA's reconsideration in accordance with this paragraph, 
FRA may:
    (i) Dismiss its reconsideration and continue to recognize the 
existing FRA approved Type Approval or PTC System Certification;
    (ii) Allow continued operations under such conditions the Associate 
Administrator deems necessary to ensure safety; or
    (iii) Revoke the Type Approval or PTC System Certification and 
direct the railroad to cease operations where PTC systems are required 
under this subpart.
    (h) FRA access. The Associate Administrator, or that person's 
designated representatives, shall be afforded reasonable access to 
monitor, test, and inspect processes, procedures, facilities, 
documents, records, design and testing materials, artifacts, training 
materials and programs, and any other information used in the design, 
development, manufacture, test, implementation, and operation of the 
system, as well as interview any personnel:
    (1) Associated with a PTC system for which a Type Approval or PTC 
System Certification has been requested or provided; or
    (2) To determine whether a railroad has been in compliance with 
this subpart.
    (i) Foreign regulatory entity verification. Information that has 
been certified under the auspices of a foreign regulatory entity 
recognized by the Associate Administrator may, at the Associate 
Administrator's sole discretion, be accepted as independently Verified 
and Validated and used to support each railroad's development of the 
PTCSP.
    (j) Processing times for PTCDP and PTCSP.
    (1) Within 30 days of receipt of a PTCDP or PTCSP, the Associate 
Administrator will either acknowledge receipt or acknowledge receipt 
and request more information.
    (2) To the extent practicable, considering the scope, complexity, 
and novelty of the product or change:
    (i) FRA will approve, approve with conditions, or deny the PTCDP 
within 60 days of the date on which the PTCDP was filed;
    (ii) FRA will approve, approve with conditions, or deny the PTCSP 
within 180 days of the date on which the PTCSP was filed;
    (iii) If FRA has not approved, approved with conditions, or denied 
the PTCDP or PTCSP within the 60-day or 180-day window, as applicable, 
FRA will provide the submitting party with a statement of reasons as to 
why the submission has not yet been acted upon and a projected deadline 
by which an approval or denial will be issued and any further 
consultations or inquiries will be resolved.


Sec.  236.1011  PTC Implementation Plan content requirements.

    (a) Contents. A PTCIP filed pursuant to this subpart shall, at a 
minimum, describe:
    (1) The functional requirements that the proposed system must meet;
    (2) How the PTC railroad intends to comply with Sec. Sec.  
236.1009(c) and (d);
    (3) How the PTC system will provide for interoperability of the 
system between the host and all tenant railroads on the track segments 
required to be equipped with PTC systems under this subpart and:
    (i) Include relevant provisions of agreements, executed by all 
applicable railroads, in place to achieve interoperability;
    (ii) List all methods used to obtain interoperability; and
    (iii) Identify any railroads with respect to which interoperability 
agreements have not been achieved as of the time the plan is filed, the 
practical obstacles that were encountered that prevented resolution, 
and the further steps planned to overcome those obstacles;
    (4) How, to the extent practical, the PTC system will be 
implemented to address areas of greater risk to the public and railroad 
employees before areas of lesser risk;
    (5) The sequence and schedule in which track segments will be 
equipped and the basis for those decisions, and shall at a minimum 
address the following risk factors by track segment:
    (i) Segment traffic characteristics such as typical annual 
passenger and freight train volume and volume of poison- or toxic-by-
inhalation (PIH or TIH) shipments (loads, residue);
    (ii) Segment operational characteristics such as current method of 
operation (including presence or absence of a block signal system), 
number of tracks, and maximum allowable train speeds, including planned 
modifications; and
    (iii) Route attributes bearing on risk, including ruling grades and 
extreme curvature;
    (6) The following information relating to rolling stock:
    (i) What rolling stock will be equipped with PTC technology;
    (ii) The schedule to equip that rolling stock by December 31, 2015;
    (iii) All documents and information required by Sec.  236.1006; and
    (iv) Unless the tenant railroad is filing its own PTCIP, the host 
railroad's PTCIP shall:
    (A) Attest that the host railroad has made a formal written request 
to each tenant railroad requesting identification of each item of 
rolling stock to be PTC

[[Page 2707]]

system equipped and the date each will be equipped; and
    (B) Include each tenant railroad's response to the host railroad's 
written request made in accordance with paragraph (a)(6)(iii)(A) of 
this section;
    (7) The number of wayside devices required for each track segment 
and the installation schedule to complete wayside equipment 
installation by December 31, 2015;
    (8) Identification of each track segment on the railroad as 
mainline or non-mainline track. If the PTCIP includes an MTEA, as 
defined by Sec.  236.1019, the PTCIP should identify the tracks 
included in the MTEA as main line track with a reference to the MTEA;
    (9) To the extent the railroad determines that risk-based 
prioritization required by paragraph (a)(4) of this section is not 
practical, the basis for this determination; and
    (10) The dates the associated PTCDP and PTCSP, as applicable, will 
be submitted to FRA in accordance with Sec.  236.1009.
    (b) Additional Class I railroad PTCIP requirements. Each Class I 
railroad shall include:
    (1) In its PTCIP a strategy for full deployment of its PTC system, 
describing the criteria that it will apply in identifying additional 
rail lines on its own network, and rail lines of entities that it 
controls or engages in joint operations with, for which full or partial 
deployment of PTC technologies is appropriate, beyond those required to 
be equipped under this subpart. Such criteria shall include 
consideration of the policies established by 49 U.S.C. 20156 (railroad 
safety risk reduction program), and regulations issued thereunder, as 
well as non-safety business benefits that may accrue.
    (2) In the Technology Implementation Plan of its Risk Reduction 
Program, when first required to be filed in accordance with 49 U.S.C. 
20156 and any regulation promulgated thereunder, a specification of 
rail lines selected for full or partial deployment of PTC under the 
criteria identified in its PTCIP.
    (3) Nothing in this paragraph shall be construed to create an 
expectation or requirement that additional rail lines beyond those 
required to be equipped by this subpart must be equipped or that such 
lines will be equipped during the period of primary implementation 
ending December 31, 2015.
    (4) As used in this paragraph, ``partial implementation'' of a PTC 
system refers to use, pursuant to subpart H of this part, of technology 
embedded in PTC systems that does not employ all of the functionalities 
required by this subpart.
    (c) FRA review. Within 90 days of receipt of a PTCIP, the Associate 
Administrator will approve or disapprove of the plan and notify in 
writing the affected railroad or other entity. If the PTCIP is not 
approved, the notification will include the plan's deficiencies. Within 
30 days of receipt of that notification, the railroad or other entity 
that submitted the plan shall correct all deficiencies and resubmit the 
plan in accordance with Sec.  236.1009 and paragraph (a) of this 
section, as applicable.
    (d) Subpart H. A railroad that elects to install a PTC system when 
not required to do so may elect to proceed under this subpart or under 
subpart H of this part.
    (e) Upon receipt of a PTCIP, NPI, PTCDP, or PTCSP, FRA posts on its 
public web site notice of receipt and reference to the public docket in 
which a copy of the filing has been placed. FRA may consider any public 
comment on each document to the extent practicable within the time 
allowed by law and without delaying implementation of PTC systems.
    (f) The PTCIP shall be maintained to reflect the railroad's most 
recent PTC deployment plans until all PTC system deployments required 
under this subpart are complete.


Sec.  236.1013  PTC Development Plan and Notice of Product Intent 
content requirements and Type Approval.

    (a) For a PTC system to obtain a Type Approval from FRA, the PTCDP 
shall be filed in accordance with Sec.  236.1009 and shall include:
    (1) A complete description of the PTC system, including a list of 
all PTC system components and their physical relationships in the 
subsystem or system;
    (2) A description of the railroad operation or categories of 
operations on which the PTC system is designed to be used, including 
train movement density (passenger, freight), operating speeds 
(including a thorough explanation of intended compliance with Sec.  
236.1007), track characteristics, and railroad operating rules;
    (3) An operational concepts document, including a list with 
complete descriptions of all functions which the PTC system will 
perform to enhance or preserve safety;
    (4) A document describing the manner in which the PTC system 
architecture satisfies safety requirements;
    (5) A preliminary human factors analysis, including a complete 
description of all human-machine interfaces and the impact of 
interoperability requirements on the same;
    (6) An analysis of the applicability to the PTC system of the 
requirements of subparts A through G of this part that may no longer 
apply or are satisfied by the PTC system using an alternative method, 
and a complete explanation of the manner in which those requirements 
are otherwise fulfilled;
    (7) A prioritized service restoration and mitigation plan and a 
description of the necessary security measures for the system;
    (8) A description of target safety levels (e.g., MTTHE for major 
subsystems as defined in subpart H of this part), including 
requirements for system availability and a description of all backup 
methods of operation and any critical assumptions associated with the 
target levels;
    (9) A complete description of how the PTC system will enforce 
authorities and signal indications;
    (10) A description of the deviation which may be proposed under 
Sec.  236.1029(c), if applicable; and
    (11) A complete description of how the PTC system will 
appropriately and timely enforce all integrated hazard detectors in 
accordance with Sec.  236.1005(c)(3), if applicable.
    (b) If the Associate Administrator finds that the system described 
in the PTCDP would satisfy the requirements for PTC systems under this 
subpart and that the applicant has made a reasonable showing that a 
system built to the stated requirements would achieve the level of 
safety mandated for such a system under Sec.  236.1015, the Associate 
Administrator may grant a numbered Type Approval for the system.
    (c) Each Type Approval shall be valid for a period of 5 years, 
subject to automatic and indefinite extension provided that at least 
one PTC System Certification using the subject PTC system has been 
issued within that period and not revoked.
    (d) The Associate Administrator may prescribe special conditions, 
amendments, and restrictions to any Type Approval as necessary for 
safety.
    (e) If submitted, an NPI must contain the following information:
    (1) A description of the railroad operation or categories of 
operations on which the proposed PTC system is designed to be used, 
including train movement density (passenger, freight), operating speeds 
(including a thorough explanation of intended compliance with Sec.  
236.1007), track characteristics, and railroad operating rules;
    (2) An operational concepts document, including a list with 
complete descriptions of all functions

[[Page 2708]]

that the proposed PTC system will perform to enhance or preserve 
safety;
    (3) A description of target safety levels (e.g., MTTHE for major 
subsystems as defined in subpart H of this part), including 
requirements for system availability and a description of all backup 
methods of operation and any critical assumptions associated with the 
target levels;
    (4) A complete description of how the proposed PTC system will 
enforce authorities and signal indications; and
    (5) A complete description of how the proposed PTC system will 
appropriately and timely enforce all integrated hazard detectors in 
accordance with Sec.  236.1005(c)(3), if applicable.


Sec.  236.1015  PTC Safety Plan content requirements and PTC System 
Certification.

    (a) Before placing a PTC system required under this part in 
service, the host railroad must submit to FRA a PTCSP and receive a PTC 
System Certification. If the Associate Administrator finds that the 
PTCSP and supporting documentation support a finding that the system 
complies with this part, the Associate Administrator approves the PTCSP 
and issues a PTC System Certification. Receipt of a PTC System 
Certification affirms that the PTC system has been reviewed and 
approved by FRA in accordance with, and meets the requirements of, this 
part.
    (b) A PTCSP submitted under this subpart may reference and utilize 
in accordance with this subpart any Type Approval previously issued by 
the Associate Administrator to any railroad, provided that the 
railroad:
    (1) Maintains a continually updated PTCPVL pursuant to Sec.  
236.1023;
    (2) Shows that the supplier from which they are procuring the PTC 
system has established and can maintain a quality control system for 
PTC system design and manufacturing acceptable to the Associate 
Administrator. The quality control system must include the process for 
the product supplier or vendor to promptly and thoroughly report any 
safety-relevant failure and previously unidentified hazards to each 
railroad using the product; and
    (3) Provides the applicable licensing information.
    (c) A PTCSP submitted in accordance with this subpart shall:
    (1) Include the FRA approved PTCDP or, if applicable, the FRA 
issued Type Approval;
    (2)(i) Specifically and rigorously document each variance, 
including the significance of each variance between the PTC system and 
its applicable operating conditions as described in the applicable 
PTCDP from that as described in the PTCSP, and attest that there are no 
other such variances; or
    (ii) Attest that there are no variances between the PTC system and 
its applicable operating conditions as described in the applicable 
PTCDP from that as described in the PTCSP; and
    (3) Attest that the system was otherwise built in accordance with 
the applicable PTCDP and PTCSP and achieves the level of safety 
represented therein.
    (d) A PTCSP shall include the same information required for a PTCDP 
under Sec.  236.1013(a). If a PTCDP has been filed and approved prior 
to filing of the PTCSP, the PTCSP may incorporate the PTCDP by 
reference, with the exception that a final human factors analysis shall 
be provided. The PTCSP shall contain the following additional elements:
    (1) A hazard log consisting of a comprehensive description of all 
safety-relevant hazards not previously addressed by the vendor or 
supplier to be addressed during the life-cycle of the PTC system, 
including maximum threshold limits for each hazard (for unidentified 
hazards, the threshold shall be exceeded at one occurrence);
    (2) A description of the safety assurance concepts that are to be 
used for system development, including an explanation of the design 
principles and assumptions;
    (3) A risk assessment of the as-built PTC system described;
    (4) A hazard mitigation analysis, including a complete and 
comprehensive description of each hazard and the mitigation techniques 
used;
    (5) A complete description of the safety assessment and 
Verification and Validation processes applied to the PTC system, their 
results, and whether these processes address the safety principles 
described in Appendix C to this part directly, using other safety 
criteria, or not at all;
    (6) A complete description of the railroad's training plan for 
railroad and contractor employees and supervisors necessary to ensure 
safe and proper installation, implementation, operation, maintenance, 
repair, inspection, testing, and modification of the PTC system;
    (7) A complete description of the specific procedures and test 
equipment necessary to ensure the safe and proper installation, 
implementation, operation, maintenance, repair, inspection, testing, 
and modification of the PTC system on the railroad and establish 
safety-critical hazards are appropriately mitigated. These procedures, 
including calibration requirements, shall be consistent with or explain 
deviations from the equipment manufacturer's recommendations;
    (8) A complete description of any additional warning to be placed 
in the Operations and Maintenance Manual in the same manner specified 
in Sec.  236.919 and all warning labels to be placed on equipment as 
necessary to ensure safety;
    (9) A complete description of the configuration or revision control 
measures designed to ensure that the railroad or its contractor does 
not adversely affect the safety-functional requirements and that 
safety-critical hazard mitigation processes are not compromised as a 
result of any such change;
    (10) A complete description of all initial implementation testing 
procedures necessary to establish that safety-functional requirements 
are met and safety-critical hazards are appropriately mitigated;
    (11) A complete description of all post-implementation testing 
(validation) and monitoring procedures, including the intervals 
necessary to establish that safety-functional requirements, safety-
critical hazard mitigation processes, and safety-critical tolerances 
are not compromised over time, through use, or after maintenance 
(adjustment, repair, or replacement) is performed;
    (12) A complete description of each record necessary to ensure the 
safety of the system that is associated with periodic maintenance, 
inspections, tests, adjustments, repairs, or replacements, and the 
system's resulting conditions, including records of component failures 
resulting in safety-relevant hazards (see Sec.  236.1037);
    (13) A safety analysis to determine whether, when the system is in 
operation, any risk remains of an unintended incursion into a roadway 
work zone due to human error. If the analysis reveals any such risk, 
the PTCDP and PTCSP shall describe how that risk will be mitigated;
    (14) A more detailed description of any alternative arrangements as 
already provided under Sec.  236.1005(a)(1)(i).
    (15) A complete description of how the PTC system will enforce 
authorities and signal indications, unless already completely provided 
for in the PTCDP;
    (16) A description of how the PTCSP complies with Sec.  
236.1019(f), if applicable;
    (17) A description of any deviation in operational requirements for 
en route failures as specified under Sec.  236.1029(c), if applicable 
and unless already completely provided for in the PTCDP;
    (18) A complete description of how the PTC system will 
appropriately and

[[Page 2709]]

timely enforce all integrated hazard detectors in accordance with Sec.  
236.1005;
    (19) An emergency and planned maintenance temporary rerouting plan 
indicating how operations on the subject PTC system will take advantage 
of the benefits provided under Sec.  236.1005(g) through (k); and
    (20) The documents and information required under Sec.  236.1007 
and Sec.  236.1033.
    (e) The following additional requirements apply to:
    (1) Non-vital overlay. A PTC system proposed as an overlay on the 
existing method of operation and not built in accordance with the 
safety assurance principles set forth in Appendix C of this part must, 
to the satisfaction of the Associate Administrator, be shown to:
    (i) Reliably execute the functions set forth in Sec.  236.1005;
    (ii) Obtain at least 80 percent reduction of the risk associated 
with accidents preventable by the functions set forth in Sec.  
236.1005, when all effects of the change associated with the PTC system 
are taken into account. The supporting risk assessment shall evaluate 
all intended changes in railroad operations coincident with the 
introduction of the new system; and
    (iii) Maintain a level of safety for each subsequent system 
modification that is equal to or greater than the level of safety for 
the previous PTC systems.
    (2) Vital overlay. A PTC system proposed on a newly constructed 
track or as an overlay on the existing method of operation and built in 
accordance with the safety assurance principles set forth in Appendix C 
of this part must, to the satisfaction of the Associate Administrator, 
be shown to:
    (i) Reliably execute the functions set forth in Sec.  236.1005; and
    (ii) Have sufficient documentation to demonstrate that the PTC 
system, as built, fulfills the safety assurance principles set forth in 
Appendix C of this part. The supporting risk assessment may be 
abbreviated as that term is used in subpart H of this part.
    (3) Stand-alone. A PTC system proposed on a newly constructed 
track, an existing track for which no signal system exists, as a 
replacement for an existing signal or train control system, or 
otherwise to replace or materially modify the existing method of 
operation, shall:
    (i) Reliably execute the functions required by Sec.  236.1005 and 
be demonstrated to do so to FRA's satisfaction; and
    (ii) Have a PTCSP establishing, with a high degree of confidence, 
that the system will not introduce new hazards that have not been 
mitigated. The supporting risk assessment shall evaluate all intended 
changes in railroad operations in relation to the introduction of the 
new system and shall examine in detail the direct and indirect effects 
of all changes in the method of operations.
    (4) Mixed systems. If a PTC system combining overlay, stand-alone, 
vital, or non-vital characteristics is proposed, the railroad shall 
confer with the Associate Administrator regarding appropriate 
structuring of the safety case and analysis.
    (f) When determining whether the PTCSP fulfills the requirements 
under paragraph (d) of this section, the Associate Administrator may 
consider all available evidence concerning the reliability and 
availability of the proposed system and any and all safety consequences 
of the proposed changes. In any case where the PTCSP lacks adequate 
data regarding safety impacts of the proposed changes, the Associate 
Administrator may request the necessary data from the applicant. If the 
requested data is not provided, the Associate Administrator may find 
that potential hazards could or will arise.
    (g) If a PTCSP applies to a system designed to replace an existing 
certified PTC system, the PTCSP will be approved provided that the 
PTCSP establishes with a high degree of confidence that the new system 
will provide a level of safety not less than the level of safety 
provided by the system to be replaced.
    (h) When reviewing the issue of the potential data errors (for 
example, errors arising from data supplied from other business systems 
needed to execute the braking algorithm, survey data needed for 
location determination, or mandatory directives issued through the 
computer-aided dispatching system), the PTCSP must include a careful 
identification of each of the risks and a discussion of each applicable 
mitigation. In an appropriate case, such as a case in which the 
residual risk after mitigation is substantial or the underlying method 
of operation will be significantly altered, the Associate Administrator 
may require submission of a quantitative risk assessment addressing 
these potential errors.


Sec.  236.1017  Independent third party Verification and Validation.

    (a) The PTCSP must be supported by an independent third-party 
assessment when the Associate Administrator concludes that it is 
necessary based upon the criteria set forth in Sec.  236.913, with the 
exception that consideration of the methodology used in the risk 
assessment (Sec.  236.913(g)(2)(vii)) shall apply only to the extent 
that a comparative risk assessment was required. To the extent 
practicable, FRA makes this determination not later than review of the 
PTCIP and the accompanying PTCDP or PTCSP. If an independent assessment 
is required, the assessment may apply to the entire system or a 
designated portion of the system.
    (b) If a PTC system is to undergo an independent assessment in 
accordance with this section, the host railroad may submit to the 
Associate Administrator a written request that FRA confirm whether a 
particular entity would be considered an independent third party 
pursuant to this section. The request should include supporting 
information identified in paragraph (c) of this section. FRA may 
request further information to make a determination or provide its 
determination in writing.
    (c) As used in this section, ``independent third party'' means a 
technically competent entity responsible to and compensated by the 
railroad (or an association on behalf of one or more railroads) that is 
independent of the PTC system supplier and vendor. An entity that is 
owned or controlled by the supplier or vendor, that is under common 
ownership or control with the supplier or vendor, or that is otherwise 
involved in the development of the PTC system is not considered 
``independent'' within the meaning of this section.
    (d) The independent third-party assessment shall, at a minimum, 
consist of the activities and result in the production of documentation 
meeting the requirements of Appendix F to this part, unless excepted by 
this part or by FRA order or waiver.
    (e) Information provided that has been certified under the auspices 
of a foreign railroad regulatory entity recognized by the Associate 
Administrator may, at the Associate Administrator's discretion, be 
accepted as having been independently verified.


Sec.  236.1019  Main line track exceptions.

    (a) Scope and procedure. This section pertains exclusively to 
exceptions from the rule that trackage over which scheduled intercity 
and commuter passenger service is provided is considered main line 
track requiring installation of a PTC system. One or more intercity or 
commuter passenger railroads, or freight railroads conducting joint 
passenger and freight operation over the same segment of track may file 
a main line track exclusion addendum (``MTEA'') to its PTCIP requesting 
to designate track as not main line subject to the conditions set forth 
in paragraphs

[[Page 2710]]

(b) or (c) of this section. No track shall be designated as yard or 
terminal unless it is identified in an MTEA that is part of an FRA 
approved PTCIP.
    (b) Passenger terminal exception. FRA will consider an exception in 
the case of trackage used exclusively as yard or terminal tracks by or 
in support of regularly scheduled intercity or commuter passenger 
service where the MTEA describes in detail the physical boundaries of 
the trackage in question, its use and characteristics (including track 
and signal charts) and all of the following apply:
    (1) The maximum authorized speed for all movements is not greater 
than 20 miles per hour, and that maximum is enforced by any available 
onboard PTC equipment within the confines of the yard or terminal;
    (2) Interlocking rules are in effect prohibiting reverse movements 
other than on signal indications without dispatcher permission; and
    (3) Either of the following conditions exists:
    (i) No freight operations are permitted; or
    (ii) Freight operations are permitted but no passengers will be 
aboard passenger trains within the defined limits.
    (c) Limited operations exception. FRA will consider an exception in 
the case of a track segment used for limited operations (at speeds not 
exceeding those permitted under Sec.  236.0 of this part) under one of 
the following sets of conditions:
    (1) The trackage is used for limited operations by at least one 
passenger railroad subject to at least one of the following conditions:
    (i) All trains are limited to restricted speed;
    (ii) Temporal separation of passenger and other trains is 
maintained as provided in paragraph (e) of this section; or
    (iii) Passenger service is operated under a risk mitigation plan 
submitted by all railroads involved in the joint operation and approved 
by FRA. The risk mitigation plan must be supported by a risk assessment 
establishing that the proposed mitigations will achieve a level of 
safety not less than the level of safety that would obtain if the 
operations were conducted under paragraph (c)(1) or (c)(2) of this 
section.
    (2) Passenger service is operated on a segment of track of a 
freight railroad that is not a Class I railroad on which less than 15 
million gross tons of freight traffic is transported annually and on 
which one of the following conditions applies:
    (i) If the segment is unsignaled and no more than four regularly 
scheduled passenger trains are operated during a calendar day, or
    (ii) If the segment is signaled (e.g., equipped with a traffic 
control system, automatic block signal system, or cab signal system) 
and no more than 12 regularly scheduled passenger trains are operated 
during a calendar day.
    (3) Not more than four passenger trains per day are operated on a 
segment of track of a Class I freight railroad on which less than 15 
million gross tons of freight traffic is transported annually.
    (d) A limited operations exception under paragraph (c) is subject 
to FRA review and approval. FRA may require a collision hazard analysis 
to identify hazards and may require that specific mitigations be 
undertaken. Operations under any such exception shall be conducted 
subject to the terms and conditions of the approval. Any main line 
track exclusion is subject to periodic review.
    (e) Temporal separation. As used in this section, temporal 
separation means that limited passenger and freight operations do not 
operate on any segment of shared track during the same period and also 
refers to the processes or physical arrangements, or both, in place to 
ensure that temporal separation is established and maintained at all 
times. The use of exclusive authorities under mandatory directives is 
not, by itself, sufficient to establish that temporal separation is 
achieved. Procedures to ensure temporal separation shall include 
verification checks between passenger and freight operations and 
effective physical means to positively ensure segregation of passenger 
and freight operations in accordance with this paragraph.
    (f) PTCSP requirement. No PTCSP--filed after the approval of a 
PTCIP with an MTEA--shall be approved by FRA unless it attests that no 
changes, except for those included in an FRA approved RFA, have been 
made to the information in the PTCIP and MTEA required by paragraph (b) 
or (c) of this section.
    (g) Designation modifications. If subsequent to approval of its 
PTCIP or PTCSP the railroad seeks to modify which track or tracks 
should be designated as main line or not main line, it shall request 
modification of its PTCIP or PTCSP, as applicable, in accordance with 
Sec.  236.1021.


Sec.  236.1021  Discontinuances, material modifications, and 
amendments.

    (a) No changes, as defined by this section, to a PTC system, PTCIP, 
PTCDP, or PTCSP, shall be made unless:
    (1) The railroad files a request for amendment (``RFA'') to the 
applicable PTCIP, PTCDP, or PTCSP with the Associate Administrator; and
    (2) The Associate Administrator approves the RFA.
    (b) After approval of an RFA in accordance with paragraph (a) of 
this section, the railroad shall immediately adopt and comply with the 
amendment.
    (c) In lieu of a separate filing under part 235 of this chapter, a 
railroad may request approval of a discontinuance or material 
modification of a signal or train control system by filing an RFA to 
its PTCIP, PTCDP, or PTCSP with the Associate Administrator.
    (d) An RFA made in accordance with this section will not be 
approved by FRA unless the request includes:
    (1) The information listed in Sec.  235.10 of this chapter and the 
railroad provides FRA upon request any additional information necessary 
to evaluate the RFA (see Sec.  235.12), including:
    (2) The proposed modifications;
    (3) The reasons for each modification;
    (4) The changes to the PTCIP, PTCDP, or PTCSP, as applicable;
    (5) Each modification's effect on PTC system safety;
    (6) An approximate timetable for filing of the PTCDP, PTCSP, or 
both, if the amendment pertains to a PTCIP; and
    (7) An explanation of whether each change to the PTCSP is planned 
or unplanned.
    (i) Unplanned changes that affect the Type Approval's PTCDP require 
submission and approval in accordance with Sec.  236.1013 of a new 
PTCDP, followed by submission and approval in accordance with Sec.  
236.1015 of a new PTCSP for the PTC system.
    (ii) Unplanned changes that do not affect the Type Approval's PTCDP 
require submission and approval of a new PTCSP.
    (iii) Unplanned changes are changes affecting system safety that 
have not been documented in the PTCSP. The impact of unplanned changes 
on PTC system safety has not yet been determined.
    (iv) Planned changes may be implemented after they have undergone 
suitable regression testing to demonstrate, to the satisfaction of the 
Associate Administrator, they have been correctly implemented and their 
implementation does not degrade safety.
    (v) Planned changes are changes affecting system safety in the 
PTCSP and have been included in all required analysis under Sec.  
236.1015. The impact of these changes on the PTC system's safety has 
been incorporated as an integral part of the approved PTCSP safety 
analysis.

[[Page 2711]]

    (e) If the RFA includes a request for approval of a discontinuance 
or material modification of a signal or train control system, FRA will 
publish a notice in the Federal Register of the application and will 
invite public comment in accordance with part 211 of this chapter.
    (f) When considering the RFA, FRA will review the issue of the 
discontinuance or material modification and determine whether granting 
the request is in the public interest and consistent with railroad 
safety, taking into consideration all changes in the method of 
operation and system functionalities, both within normal PTC system 
availability and in the case of a system failed state (unavailable), 
contemplated in conjunction with installation of the PTC system. The 
railroad submitting the RFA must, at FRA's request, perform field 
testing in accordance with Sec.  236.1035 or engage in Verification and 
Validation in accordance with Sec.  236.1017.
    (g) FRA may issue at its discretion a new Type Approval number for 
a PTC system modified under this section.
    (h) Changes requiring filing of an RFA. Except as provided by 
paragraph (i), an RFA shall be filed to request the following:
    (1) Discontinuance of a PTC system, or other similar appliance or 
device;
    (2) Decrease of the PTC system's limits (e.g., exclusion or removal 
of a PTC system on a track segment);
    (3) Modification of a safety critical element of a PTC system; or
    (4) Modification of a PTC system that affects the safety critical 
functionality of any other PTC system with which it interoperates.
    (i) Discontinuances not requiring the filing of an RFA. It is not 
necessary to file an RFA for the following discontinuances:
    (1) Removal of a PTC system from track approved for abandonment by 
formal proceeding;
    (2) Removal of PTC devices used to provide protection against 
unusual contingencies such as landslide, burned bridge, high water, 
high and wide load, or tunnel protection when the unusual contingency 
no longer exists;
    (3) Removal of the PTC devices that are used on a movable bridge 
that has been permanently closed by the formal approval of another 
government agency and is mechanically secured in the closed position 
for rail traffic; or
    (4) Removal of the PTC system from service for a period not to 
exceed 6 months that is necessitated by catastrophic occurrence such as 
derailment, flood, fire, or hurricane, or earthquake.
    (j) Changes not requiring the filing of an RFA. When the resultant 
change to the PTC system will comply with an approved PTCSP of this 
part, it is not necessary to file for approval to decrease the limits 
of a system when it involves the:
    (1) Decrease of the limits of a PTC system when interlocked 
switches, derails, or movable-point frogs are not involved;
    (2) Removal of an electric or mechanical lock, or signal used in 
lieu thereof, from hand-operated switch in a PTC system where train 
speed over such switch does not exceed 20 miles per hour, and use of 
those devices has not been part of the considerations for approval of a 
PTCSP; or
    (3) Removal of an electric or mechanical lock, or signal used in 
lieu thereof, from a hand-operated switch in a PTC system where trains 
are not permitted to clear the main track at such switch and use of 
those devices has not been a part of the considerations for approval of 
a PTCSP.
    (k) Modifications not requiring the filing of an RFA. When the 
resultant arrangement will comply with an approved PTCSP of this part, 
it is not necessary to file an application for approval of the 
following modifications:
    (1) A modification that is required to comply with an order of the 
Federal Railroad Administration or any section of part 236 of this 
title;
    (2) Installation of devices used to provide protection against 
unusual contingencies such as landslide, burned bridges, high water, 
high and wide loads, or dragging equipment;
    (3) Elimination of existing track other than a second main track;
    (4) Extension or shortening of a passing siding; or
    (5) The temporary or permanent arrangement of existing systems 
necessitated by highway-rail grade separation construction. Temporary 
arrangements shall be removed within six months following completion of 
construction.


Sec.  236.1023  Errors and malfunctions.

    (a) Each railroad implementing a PTC system on its property shall 
establish and continually update a PTC Product Vendor List (PTCPVL) 
that includes all vendors and suppliers of each PTC system, subsystem, 
component, and associated product, and process in use system-wide. The 
PTCPVL shall be made available to FRA upon request.
    (b)(1) The railroad shall specify within its PTCSP all contractual 
arrangements with hardware and software suppliers or vendors for 
immediate notification between the parties of any and all safety-
critical software failures, upgrades, patches, or revisions, as well as 
any hardware repairs, replacements, or modifications for their PTC 
system, subsystems, or components.
    (2) A vendor or supplier, on receipt of a report of any safety-
critical failure to their product, shall promptly notify all other 
railroads that are using that product, whether or not the other 
railroads have experienced the reported failure of that safety-critical 
system, subsystem, or component.
    (3) The notification from a supplier to any railroad shall include 
explanation from the supplier of the reasons for such notification, the 
circumstances associated with the failure, and any recommended 
mitigation actions to be taken pending determination of the root cause 
and final corrective actions.
    (c) The railroad shall:
    (1) Specify the railroad's process and procedures in its PTCSP for 
action upon their receipt of notification of safety-critical failure, 
as well as receipt of a safety-critical upgrade, patch, revision, 
repair, replacement, or modification.
    (2) Identify configuration/revision control measures in its PTCSP 
that are designed to ensure the safety-functional requirements and the 
safety-critical hazard mitigation processes are not compromised as a 
result of any change and that such a change can be audited.
    (d) The railroad shall provide to the applicable vendor or supplier 
the railroad's procedures for action upon notification of a safety-
critical failure, upgrade, patch, or revision for the PTC system, 
subsystem, component, product, or process, and actions to be taken 
until the faulty system, subsystem, or component has been adjusted, 
repaired or replaced.
    (e) After the product is placed in service, the railroad shall 
maintain a database of all safety-relevant hazards as set forth in the 
PTCSP and those that had not previously been identified in the PTCSP. 
If the frequency of the safety-relevant hazard exceeds the thresholds 
set forth in the PTCSP, or has not been previously identified in the 
appropriate risk analysis, the railroad shall:
    (1) Notify the applicable vendor or supplier and FRA of the 
failure, malfunction, or defective condition that decreased or 
eliminated the safety functionality;
    (2) Keep the applicable vendor or supplier and FRA apprised on a 
continual basis of the status of any and all subsequent failures; and
    (3) Take prompt counter measures to reduce or eliminate the 
frequency of the

[[Page 2712]]

safety-relevant hazards below the threshold identified in the PTCSP.
    (f) Each notification to FRA required by this section shall:
    (1) Be made within 15 days after the vendor, supplier, or railroad 
discovers the failure, malfunction, or defective condition. However, a 
report that is due on a Saturday or a Sunday may be delivered on the 
following Monday and one that is due on a holiday may be delivered on 
the next business day;
    (2) Be transmitted in a manner and form acceptable to the Associate 
Administrator and by the most expeditious method available; and
    (3) Include as much available and applicable information as 
possible, including:
    (i) PTC system name and model;
    (ii) Identification of the part, component, or system involved, 
including the part number as applicable;
    (iii) Nature of the failure, malfunctions, or defective condition;
    (iv) Mitigation taken to ensure the safety of train operation, 
railroad employees, and the public; and
    (v) The estimated time to correct the failure.
    (4) In the event that all information required by paragraph (f)(3) 
of this section is not immediately available, the non-available 
information shall be forwarded to the Associate Administrator as soon 
as practicable in supplemental reports.
    (g) Whenever any investigation of an accident or service difficulty 
report shows that a PTC system or product is unsafe because of a 
manufacturing or design defect, the railroad and its vendor or supplier 
shall, upon request of the Associate Administrator, report to the 
Associate Administrator the results of its investigation and any action 
taken or proposed to correct that defect.
    (h) PTC system and product suppliers and vendors shall:
    (1) Promptly report any safety-relevant failures or defective 
conditions, previously unidentified hazards, and recommended mitigation 
actions in their PTC system, subsystem, or component to each railroad 
using the product; and
    (2) Notify FRA of any safety-relevant failure, defective condition, 
or previously unidentified hazard discovered by the vendor or supplier 
and the identity of each affected and notified railroad.
    (i) The requirements of this section do not apply to failures, 
malfunctions, or defective conditions that:
    (1) Are caused by improper maintenance or improper usage; or
    (2) Have been previously identified to the FRA, vendor or supplier, 
and applicable user railroads.
    (j) When any safety-critical PTC system, subsystem, or component 
fails to perform its intended function, the cause shall be determined 
and the faulty product adjusted, repaired, or replaced without undue 
delay. Until corrective action is completed, a railroad shall take 
appropriate action to ensure safety and reliability as specified within 
its PTCSP.
    (k) Any railroad experiencing a failure of a system resulting in a 
more favorable aspect than intended or other condition hazardous to the 
movement of a train shall comply with the reporting requirements, 
including the making of a telephonic report of an accident or incident 
involving such failure, under part 233 of this chapter. Filing of one 
or more reports under part 233 of this chapter does not exempt a 
railroad, vendor, or supplier from the reporting requirements contained 
in this section.


Sec.  236.1025  [Reserved]


Sec.  236.1027  PTC system exclusions.

    (a) The requirements of this subpart apply to each office 
automation system that performs safety-critical functions within, or 
affects the safety performance of, the PTC system. For purposes of this 
section, ``office automation system'' means any centralized or 
distributed computer-based system that directly or indirectly controls 
the active movement of trains in a rail network.
    (b) Changes or modifications to PTC systems otherwise excluded from 
the requirements of this subpart by this section do not exclude those 
PTC systems from the requirements of this subpart if the changes or 
modifications result in a degradation of safety or a material decrease 
in safety-critical functionality.
    (c) Primary train control systems cannot be integrated with 
locomotive electronic systems unless the complete integrated systems:
    (1) Have been shown to be designed on fail-safe principles;
    (2) Have demonstrated to operate in a fail-safe mode;
    (3) Have a manual fail-safe fallback and override to allow the 
locomotive to be brought to a safe stop in the event of any loss of 
electronic control; and
    (4) Are included in the approved and applicable PTCDP and PTCSP.
    (d) PTC systems excluded by this section from the requirements of 
this subpart remain subject to subparts A through H of this part as 
applicable.


Sec.  236.1029  PTC system use and en route failures.

    (a) When any safety-critical PTC system component fails to perform 
its intended function, the cause must be determined and the faulty 
component adjusted, repaired, or replaced without undue delay. Until 
repair of such essential components are completed, a railroad shall 
take appropriate action as specified in its PTCSP.
    (b) Where a PTC onboard apparatus on a controlling locomotive that 
is operating in or is to be operated within a PTC system fails or is 
otherwise cut-out while en route (i.e, after the train has departed its 
initial terminal), the train may only continue in accordance with the 
following:
    (1) The train may proceed at restricted speed, or if a block signal 
system is in operation according to signal indication at medium speed, 
to the next available point where communication of a report can be made 
to a designated railroad officer of the host railroad;
    (2) Upon completion and communication of the report required in 
paragraph (b)(1) of this section, or where immediate electronic report 
of said condition is appropriately provided by the PTC system itself, a 
train may continue to a point where an absolute block can be 
established in advance of the train in accordance with the following:
    (i) Where no block signal system is in use, the train may proceed 
at restricted speed, or
    (ii) Where a block signal system is in operation according to 
signal indication, the train may proceed at a speed not to exceed 
medium speed.
    (3) Upon reaching the location where an absolute block has been 
established in advance of the train, as referenced in paragraph (b)(2) 
of this section, the train may proceed in accordance with the 
following:
    (i) Where no block signal system is in use, the train may proceed 
at medium speed; however, if the involved train is a passenger train or 
a train hauling any amount of PIH material, it may only proceed at a 
speed not to exceed 30 miles per hour.
    (ii) Where a block signal system is in use, a passenger train may 
proceed at a speed not to exceed 59 miles per hour and a freight train 
may proceed at a speed not to exceed 49 miles per hour.
    (iii) Except as provided in paragraph (c), where a cab signal 
system with an automatic train control system is in operation, the 
train may proceed at a speed not to exceed 79 miles per hour.
    (c) In order for a train equipped with PTC traversing a track 
segment equipped with PTC to deviate from the operating limitations 
contained in paragraph (b) of this section, the deviation must be 
described and justified in the FRA approved PTCDP or PTCSP, or the 
Order of Particular Applicability, as applicable.

[[Page 2713]]

    (d) Each railroad shall comply with all provisions in the 
applicable PTCDP and PTCSP for each PTC system it uses and shall 
operate within the scope of initial operational assumptions and 
predefined changes identified.
    (e) The normal functioning of any safety-critical PTC system must 
not be interfered with in testing or otherwise without first taking 
measures to provide for the safe movement of trains, locomotives, 
roadway workers, and on-track equipment that depend on the normal 
functioning of the system.
    (f) The PTC system's onboard apparatus shall be so arranged that 
each member of the crew assigned to perform duties in the locomotive 
can receive the same PTC information displayed in the same manner and 
execute any functions necessary to that crew member's duties. The 
locomotive engineer shall not be required to perform functions related 
to the PTC system while the train is moving that have the potential to 
distract the locomotive engineer from performance of other safety-
critical duties.


Sec.  236.1031  Previously approved PTC systems.

    (a) Any PTC system fully implemented and operational prior to March 
16, 2010, may receive PTC System Certification if the applicable PTC 
railroad, or one or more system suppliers and one or more PTC 
railroads, submits a Request for Expedited Certification (REC) letter 
to the Associate Administrator. The REC letter must do one of the 
following:
    (1) Reference a product safety plan (PSP) approved by FRA under 
subpart H of this part and include a document fulfilling the 
requirements under Sec. Sec.  236.1011 and 236.1013 not already 
included in the PSP;
    (2) Attest that the PTC system has been approved by FRA and in 
operation for at least 5 years and has already received an assessment 
of Verification and Validation from an independent third party under 
part 236 or a waiver supporting such operation; or
    (3) Attest that the PTC system is recognized under an Order issued 
prior to March 16, 2010.
    (b) If an REC letter conforms to paragraph (a)(1) of this section, 
the Associate Administrator, at his or her sole discretion, may also 
issue a new Type Approval for the PTC system.
    (c) In order to receive a Type Approval or PTC System Certification 
under paragraph (a) or (b) of this section, the PTC system must be 
shown to reliably execute the functionalities required by Sec. Sec.  
236.1005 and 236.1007 and otherwise conform to this subpart.
    (d) Previous approval or recognition of a train control system, 
together with an established service history, may, at the request of 
the PTC railroad, and consistent with available safety data, be 
credited toward satisfaction of the safety case requirements set forth 
in this part for the PTCSP with respect to all functionalities and 
implementations contemplated by the approval or recognition.
    (e) To the extent that the PTC system proposed for implementation 
under this subpart is different in significant detail from the system 
previously approved or recognized, the changes shall be fully analyzed 
in the PTCDP or PTCSP as would be the case absent prior approval or 
recognition.
    (f) As used in this section--
    (1) Approved refers to approval of a Product Safety Plan under 
subpart H of this part.
    (2) Recognized refers to official action permitting a system to be 
implemented for control of train operations under an FRA order or 
waiver, after review of safety case documentation for the 
implementation.
    (g) Upon receipt of an REC, FRA will consider all safety case 
information to the extent feasible and appropriate, given the specific 
facts before the agency. Nothing in this section limits re-use of any 
applicable safety case information by a party other than the party 
receiving:
    (1) A prior approval or recognition referred to in this section; or
    (2) A Type Approval or PTC System Certification under this subpart.


Sec.  236.1033  Communications and security requirements.

    (a) All wireless communications between the office, wayside, and 
onboard components in a PTC system shall provide cryptographic message 
integrity and authentication.
    (b) Cryptographic keys required under paragraph (a) of this section 
shall:
    (1) Use an algorithm approved by the National Institute of 
Standards (NIST) or a similarly recognized and FRA approved standards 
body;
    (2) Be distributed using manual or automated methods, or a 
combination of both; and
    (3) Be revoked:
    (i) If compromised by unauthorized disclosure of the cleartext key; 
or
    (ii) When the key algorithm reaches its lifespan as defined by the 
standards body responsible for approval of the algorithm.
    (c) The cleartext form of the cryptographic keys shall be protected 
from unauthorized disclosure, modification, or substitution, except 
during key entry when the cleartext keys and key components may be 
temporarily displayed to allow visual verification. When encrypted keys 
or key components are entered, the cryptographically protected 
cleartext key or key components shall not be displayed.
    (d) Access to cleartext keys shall be protected by a tamper 
resistant mechanism.
    (e) Each railroad electing to also provide cryptographic message 
confidentiality shall:
    (1) Comply with the same requirements for message integrity and 
authentication under this section; and
    (2) Only use keys meeting or exceeding the security strength 
required to protect the data as defined in the railroad's PTCSP and 
required under Sec.  236.1013(a)(7).
    (f) Each railroad, or its vendor or supplier, shall have a 
prioritized service restoration and mitigation plan for scheduled and 
unscheduled interruptions of service. This plan shall be included in 
the PTCDP or PTCSP as required by Sec. Sec.  236.1013 or 236.1015, as 
applicable, and made available to FRA upon request, without undue 
delay, for restoration of communication services that support PTC 
system services.
    (g) Each railroad may elect to impose more restrictive requirements 
than those in this section, consistent with interoperability 
requirements specified in the PTCSP for the system.


Sec.  236.1035  Field testing requirements.

    (a) Before any field testing of an uncertified PTC system, or a 
product of an uncertified PTC system, or any regression testing of a 
certified PTC system is conducted on the general rail system, the 
railroad requesting the testing must provide:
    (1) A complete description of the PTC system;
    (2) An operational concepts document;
    (3) A complete description of the specific test procedures, 
including the measures that will be taken to protect trains and on-
track equipment;
    (4) An analysis of the applicability of the requirements of 
subparts A through G of this part to the PTC system that will not apply 
during testing;
    (5) The date the proposed testing shall begin;
    (6) The test locations; and
    (7) The effect on the current method of operation the PTC system 
will or may have under test.
    (b) FRA may impose additional testing conditions that it believes 
may be necessary for the safety of train operations.

[[Page 2714]]

    (c) Relief from regulations other than from subparts A through G of 
this part that the railroad believes are necessary to support the field 
testing, must be requested in accordance with part 211 of this title.


Sec.  236.1037  Records retention.

    (a) Each railroad with a PTC system required to be installed under 
this subpart shall maintain at a designated office on the railroad:
    (1) A current copy of each FRA approved Type Approval, if any, 
PTCDP, and PTCSP that it holds;
    (2) Adequate documentation to demonstrate that the PTCSP and PTCDP 
meet the safety requirements of this subpart, including the risk 
assessment;
    (3) An Operations and Maintenance Manual, pursuant to Sec.  
236.1039; and
    (4) Training and testing records pursuant to Sec.  236.1043(b).
    (b) Results of inspections and tests specified in the PTCSP and 
PTCDP must be recorded pursuant to Sec.  236.110.
    (c) Each contractor providing services relating to the testing, 
maintenance, or operation of a PTC system required to be installed 
under this subpart shall maintain at a designated office training 
records required under Sec.  236.1039(b).
    (d) After the PTC system is placed in service, the railroad shall 
maintain a database of all safety-relevant hazards as set forth in the 
PTCSP and PTCDP and those that had not been previously identified in 
either document. If the frequency of the safety-relevant hazards 
exceeds the threshold set forth in either of these documents, then the 
railroad shall:
    (1) Report the inconsistency in writing by mail, facsimile, e-mail, 
or hand delivery to the Director, Office of Safety Assurance and 
Compliance, FRA, 1200 New Jersey Ave, SE, Mail Stop 25, Washington, DC 
20590, within 15 days of discovery. Documents that are hand delivered 
must not be enclosed in an envelope;
    (2) Take prompt countermeasures to reduce the frequency of each 
safety-relevant hazard to below the threshold set forth in the PTCSP 
and PTCDP; and
    (3) Provide a final report when the inconsistency is resolved to 
the FRA Director, Office of Safety Assurance and Compliance, on the 
results of the analysis and countermeasures taken to reduce the 
frequency of the safety-relevant hazard(s) below the threshold set 
forth in the PTCSP and PTCDP.


Sec.  236.1039  Operations and Maintenance Manual.

    (a) The railroad shall catalog and maintain all documents as 
specified in the PTCDP and PTCSP for the installation, maintenance, 
repair, modification, inspection, and testing of the PTC system and 
have them in one Operations and Maintenance Manual, readily available 
to persons required to perform such tasks and for inspection by FRA and 
FRA-certified state inspectors.
    (b) Plans required for proper maintenance, repair, inspection, and 
testing of safety-critical PTC systems must be adequate in detail and 
must be made available for inspection by FRA and FRA-certified state 
inspectors where such PTC systems are deployed or maintained. They must 
identify all software versions, revisions, and revision dates. Plans 
must be legible and correct.
    (c) Hardware, software, and firmware revisions must be documented 
in the Operations and Maintenance Manual according to the railroad's 
configuration management control plan and any additional configuration/
revision control measures specified in the PTCDP and PTCSP.
    (d) Safety-critical components, including spare equipment, must be 
positively identified, handled, replaced, and repaired in accordance 
with the procedures specified in the PTCDP and PTCSP.
    (e) Each railroad shall designate in its Operations and Maintenance 
Manual an appropriate railroad officer responsible for issues relating 
to scheduled interruptions of service contemplated by Sec.  236.1029.


Sec.  236.1041  Training and qualification program, general.

    (a) Training program for PTC personnel. Employers shall establish 
and implement training and qualification programs for PTC systems 
subject to this subpart. These programs must meet the minimum 
requirements set forth in the PTCDP and PTCSP in Sec. Sec.  236.1039 
through 236.1045, as appropriate, for the following personnel:
    (1) Persons whose duties include installing, maintaining, 
repairing, modifying, inspecting, and testing safety-critical elements 
of the railroad's PTC systems, including central office, wayside, or 
onboard subsystems;
    (2) Persons who dispatch train operations (issue or communicate any 
mandatory directive that is executed or enforced, or is intended to be 
executed or enforced, by a train control system subject to this 
subpart);
    (3) Persons who operate trains or serve as a train or engine crew 
member subject to instruction and testing under part 217 of this 
chapter, on a train operating in territory where a train control system 
subject to this subpart is in use;
    (4) Roadway workers whose duties require them to know and 
understand how a train control system affects their safety and how to 
avoid interfering with its proper functioning; and
    (5) The direct supervisors of persons listed in paragraphs (a)(1) 
through (a)(4) of this section.
    (b) Competencies. The employer's program must provide training for 
persons who perform the functions described in paragraph (a) of this 
section to ensure that they have the necessary knowledge and skills to 
effectively complete their duties related to operation and maintenance 
of the PTC system.


Sec.  236.1043  Task analysis and basic requirements.

    (a) Training structure and delivery. As part of the program 
required by Sec.  236.1041, the employer shall, at a minimum:
    (1) Identify the specific goals of the training program with regard 
to the target population (craft, experience level, scope of work, 
etc.), task(s), and desired success rate;
    (2) Based on a formal task analysis, identify the installation, 
maintenance, repair, modification, inspection, testing, and operating 
tasks that must be performed on a railroad's PTC systems. This includes 
the development of failure scenarios and the actions expected under 
such scenarios;
    (3) Develop written procedures for the performance of the tasks 
identified;
    (4) Identify the additional knowledge, skills, and abilities above 
those required for basic job performance necessary to perform each 
task;
    (5) Develop a training and evaluation curriculum that includes 
classroom, simulator, computer-based, hands-on, or other formally 
structured training designed to impart the knowledge, skills, and 
abilities identified as necessary to perform each task;
    (6) Prior to assignment of related tasks, require all persons 
mentioned in Sec.  236.1041(a) to successfully complete a training 
curriculum and pass an examination that covers the PTC system and 
appropriate rules and tasks for which they are responsible (however, 
such persons may perform such tasks under the direct onsite supervision 
of a qualified person prior to completing such training and passing the 
examination);
    (7) Require periodic refresher training and evaluation at intervals 
specified in the PTCDP and PTCSP that includes classroom, simulator, 
computer-based, hands-on, or other formally structured

[[Page 2715]]

training and testing, except with respect to basic skills for which 
proficiency is known to remain high as a result of frequent repetition 
of the task; and
    (8) Conduct regular and periodic evaluations of the effectiveness 
of the training program specified in Sec.  236.1041(a)(1) verifying the 
adequacy of the training material and its validity with respect to 
current railroads PTC systems and operations.
    (b) Training records. Employers shall retain records which 
designate persons who are qualified under this section until new 
designations are recorded or for at least one year after such persons 
leave applicable service. These records shall be kept in a designated 
location and be available for inspection and replication by FRA and 
FRA-certified State inspectors


Sec.  236.1045  Training specific to office control personnel.

    (a) Any person responsible for issuing or communicating mandatory 
directives in territory where PTC systems are or will be in use shall 
be trained in the following areas, as applicable:
    (1) Instructions concerning the interface between the computer-
aided dispatching system and the train control system, with respect to 
the safe movement of trains and other on-track equipment;
    (2) Railroad operating rules applicable to the train control 
system, including provision for movement and protection of roadway 
workers, unequipped trains, trains with failed or cut-out train control 
onboard systems, and other on-track equipment; and
    (3) Instructions concerning control of trains and other on-track 
equipment in case the train control system fails, including periodic 
practical exercises or simulations, and operational testing under part 
217 of this chapter to ensure the continued capability of the personnel 
to provide for safe operations under the alternative method of 
operation.
    (b) [Reserved]


Sec.  236.1047  Training specific to locomotive engineers and other 
operating personnel.

    (a) Operating personnel. Training provided under this subpart for 
any locomotive engineer or other person who participates in the 
operation of a train in train control territory shall be defined in the 
PTCDP as well as the PTCSP. The following elements shall be addressed:
    (1) Familiarization with train control equipment onboard the 
locomotive and the functioning of that equipment as part of the system 
and in relation to other onboard systems under that person's control;
    (2) Any actions required of the onboard personnel to enable, or 
enter data to, the system, such as consist data, and the role of that 
function in the safe operation of the train;
    (3) Sequencing of interventions by the system, including pre-
enforcement notification, enforcement notification, penalty application 
initiation and post-penalty application procedures;
    (4) Railroad operating rules and testing (part 217) applicable to 
the train control system, including provisions for movement and 
protection of any unequipped trains, or trains with failed or cut-out 
train control onboard systems and other on-track equipment;
    (5) Means to detect deviations from proper functioning of onboard 
train control equipment and instructions regarding the actions to be 
taken with respect to control of the train and notification of 
designated railroad personnel; and
    (6) Information needed to prevent unintentional interference with 
the proper functioning of onboard train control equipment.
    (b) Locomotive engineer training. Training required under this 
subpart for a locomotive engineer, together with required records, 
shall be integrated into the program of training required by part 240 
of this chapter.
    (c) Full automatic operation. The following special requirements 
apply in the event a train control system is used to effect full 
automatic operation of the train:
    (1) The PTCDP and PTCSP shall identify all safety hazards to be 
mitigated by the locomotive engineer.
    (2) The PTCDP and PTCSP shall address and describe the training 
required with provisions for the maintenance of skills proficiency. As 
a minimum, the training program must:
    (i) As described in Sec.  236.1043(a)(2), develop failure scenarios 
which incorporate the safety hazards identified in the PTCDP and PTCSP 
including the return of train operations to a fully manual mode;
    (ii) Provide training, consistent with Sec.  236.1047(a), for safe 
train operations under all failure scenarios and identified safety 
hazards that affect train operations;
    (iii) Provide training, consistent with Sec.  236.1047(a), for safe 
train operations under manual control; and
    (iv) Consistent with Sec.  236.1047(a), ensure maintenance of 
manual train operating skills by requiring manual starting and stopping 
of the train for an appropriate number of trips and by one or more of 
the following methods:
    (A) Manual operation of a train for a 4-hour work period;
    (B) Simulated manual operation of a train for a minimum of 4 hours 
in a Type I simulator as required; or
    (C) Other means as determined following consultation between the 
railroad and designated representatives of the affected employees and 
approved by FRA. The PTCDP and PTCSP shall designate the appropriate 
frequency when manual operation, starting, and stopping must be 
conducted, and the appropriate frequency of simulated manual operation.
    (d) Conductor training. Training required under this subpart for a 
conductor, together with required records, shall be integrated into the 
program of training required under this chapter.


Sec.  236.1049  Training specific to roadway workers.

    (a) Roadway worker training. Training required under this subpart 
for a roadway worker shall be integrated into the program of 
instruction required under part 214, subpart C of this chapter 
(``Roadway Worker Protection''), consistent with task analysis 
requirements of Sec.  236.1043. This training shall provide instruction 
for roadway workers who provide protection for themselves or roadway 
work groups.
    (b) Training subject areas. (1) Instruction for roadway workers 
shall ensure an understanding of the role of processor-based signal and 
train control equipment in establishing protection for roadway workers 
and their equipment.
    (2) Instruction for all roadway workers working in territories 
where PTC is required under this subpart shall ensure recognition of 
processor-based signal and train control equipment on the wayside and 
an understanding of how to avoid interference with its proper 
functioning.
    (3) Instructions concerning the recognition of system failures and 
the provision of alternative methods of on-track safety in case the 
train control system fails, including periodic practical exercises or 
simulations and operational testing under part 217 of this chapter to 
ensure the continued capability of roadway workers to be free from the 
danger of being struck by a moving train or other on-track equipment.


0
12. Amend Appendix A to part 236 by adding entries for subpart I as 
follows:

Appendix A to Part 236--Civil Penalties \1\
---------------------------------------------------------------------------

    \1\ The Administrator reserves the right to assess a civil 
penalty of up to $100,000 per day for any violation where 
circumstances warrant. See 459 CFR part 209, Appendix A.

[[Page 2716]]



------------------------------------------------------------------------
                                                              Willful
                 Section                     Violation       violation
------------------------------------------------------------------------
 
                              * * * * * * *
------------------------------------------------------------------------
                Subpart I--Positive Train Control Systems
------------------------------------------------------------------------
236.1005 Positive Train Control System
 Requirements:
    Failure to complete PTC system                16,000          25,000
     installation on track segment where
     PTC is required prior to 12/31/2015
    Commencement of revenue service               16,000          25,000
     prior to obtaining PTC System
     Certification......................
    Failure of the PTC system to perform           5,000           7,500
     a safety-critical function required
     by this section....................
    Failure to provide notice, obtain              5,000           7,500
     approval, or follow a condition for
     temporary rerouting when required..
    Exceeding the allowed percentage of            5,000           7,500
     controlling locomotives operating
     out of an initial terminal after
     receiving a failed initialization..
236.1006 Equipping locomotives operating
 in PTC territory:
    Operating in PTC territory a                  15,000          25,000
     controlling locomotive without a
     required and operative PTC onboard
     apparatus..........................
    Failure to report as prescribed by             5,000           7,500
     this section.......................
    Non-compliant operation of                    15,000          25,000
     unequipped trains in PTC territory.
236.1007 Additional requirements for
 high-speed service:
    Operation of passenger trains at              15,000          25,000
     speed equal to or greater than 60
     mph on non-PTC-equipped territory
     where required.....................
    Operation of freight trains at speed          15,000          25,000
     equal to or greater than 50 mph on
     non-PTC-equipped territory where
     required...........................
    Failure to fully implement incursion           5,000           7,500
     protection where required..........
236.1009 Procedural requirements:
    Failure to file PTCIP when required.           5,000           7,500
    Failure to amend PTCIP when required           5,000           7,500
    Failure to obtain Type Approval when           5,000           7,500
     required...........................
    Failure to update NPI...............           5,000           7,500
    Operation of PTC system prior to              16,000          25,000
     system certification...............
236.1011 PTCIP content requirements:
    Failure to install a PTC system in            11,000          16,000
     accordance with subpart I when so
     required...........................
236.1013 PTCDP content requirements and
 Type Approval:
    Failure to maintain quality control            5,000           7,500
     system.............................
    Inappropriate use of Type Approval..           5,000           7,500
236.1015 PTCSP content requirements and
 PTC System Certification:
    Failure to implement PTC system in            16,000          25,000
     accordance with the associated
     PTCSP and resultant system
     certification......................
    Failure to maintain PTC system in             16,000          25,000
     accordance with the associated
     PTCSP and resultant system
     certification......................
    Failure to maintain required                   2,500           5,000
     supporting documentation...........
236.1017 Independent third party
 Verification and Validation:
    Failure to conduct independent third          11,000          16,000
     party Verification and Validation
     when ordered.......................
236.1019 Main line track exceptions:
    Revenue operations conducted in non-          16,000          25,000
     compliance with the passenger
     terminal exception.................
    Revenue operations conducted in non-          16,000          25,000
     compliance with the limited
     operations exception...............
    Failure to request modification of            11,000          16,000
     the PTCIP or PTCSP when required...
    Revenue operations conducted in               16,000          25,000
     violation of (c)(2)................
    Revenue operations conducted in               25,000          25,000
     violation of (c)(3)................
236.1021 Discontinuances, material
 modifications, and amendments:
    Failure to update PTCDP when                   5,000           7,500
     required...........................
    Failure to update PTCSP when                   5,000           7,500
     required...........................
    Failure to immediately adopt and               5,000           7,500
     comply with approved RFA...........
    Discontinuance or modification of a           11,000          16,000
     PTC system without approval when
     required...........................
236.1023 Errors and malfunctions:
    Railroad failure to provide proper             5,000           7,500
     notification of PTC system error or
     malfunction........................
    Failure to maintain PTCPVL..........           2,500           5,000
    Supplier failure to provide proper             5,000           7,500
     notification of previously
     identified PTC system error or
     malfunction........................
    Failure to provide timely                      5,000           7,500
     notification.......................
    Failure to provide appropriate                15,000          25,000
     protective measures in the event of
     PTC system failure.................
236.1027 Exclusions:
    Integration of primary train control           5,000           7,500
     system with locomotive electronic
     system without approval............
236.1029 PTC system use and en route
 failures:
    Failure to determine cause of PTC              5,000           7,500
     system component failure without
     undue delay........................
    Failure to adjust, repair, or                  5,000           7,500
     replace faulty PTC system component
     without undue delay................
    Failure to take appropriate action            15,000          25,000
     pending adjustment, repair, or
     replacement of faulty PTC system
     component..........................
    Non-compliant train operation within           5,000           7,500
     PTC-equipped territory with
     inoperative PTC onboard apparatus..
    Interference with the normal                  15,000          25,000
     functioning of safety-critical PTC
     system.............................
    Improper arrangement of the PTC                2,500           5,000
     system onboard apparatus...........

[[Page 2717]]

 
236.1033 Communications and security
 requirements:
    Failure to provide cryptographic               5,000           7,500
     message integrity and
     authentication.....................
    Improper use of revoked                        5,000          15,000
     cryptographic key..................
    Failure to protect cryptographic               5,000          15,000
     keys from unauthorized disclosure,
     modification, or substitution......
    Failure to establish prioritized               5,000           7,500
     service restoration and mitigation
     plan for communication services....
236.1035 Field testing requirements:
    Field testing without authorization           10,000          20,000
     or approval........................
236.1037 Records retention:
    Failure to maintain records and                7,500          15,000
     databases as required..............
    Failure to report inconsistency.....          10,000          20,000
    Failure to take prompt                        10,000          20,000
     countermeasures....................
    Failure to provide final report.....           2,500           5,000
236.1039 Operations and Maintenance
 Manual:
    Failure to implement and maintain              3,000           6,000
     Operations and Maintenance Manual
     as required........................
236.1043 Task analysis and basic
 requirements:
    Failure to develop and maintain an            10,000          20,000
     acceptable training program........
    Failure to train persons as required           2,500           5,000
    Failure to conduct evaluation of               2,500           5,000
     training program as required.......
    Failure to maintain records as                 1,500           3,000
     required...........................
236.1045 Training specific to office
 control personnel:
    Failure to conduct training unique             2,500           5,000
     to office control personnel........
236.1047 Training specific to locomotive
 engineers and other operating
 personnel:
    Failure to conduct training unique             2,500           5,000
     to locomotive engineers and other
     operating personnel................
236.1049 Training specific to roadway
 workers:
    Failure to conduct training unique             2,500           5,000
     to roadway workers.................
------------------------------------------------------------------------


0
13. Revise Appendix B to part 236 to read as follows:

Appendix B to Part 236--Risk Assessment Criteria

    The safety-critical performance of each product for which risk 
assessment is required under this part must be assessed in 
accordance with the following minimum criteria or other criteria if 
demonstrated to the Associate Administrator for Safety to be equally 
suitable:
    (a) How are risk metrics to be expressed? The risk metric for 
the proposed product must describe with a high degree of confidence 
the accumulated risk of a train control system that operates over 
the designated life-cycle of the product. Each risk metric for the 
proposed product must be expressed with an upper bound, as estimated 
with a sensitivity analysis, and the risk value selected must be 
demonstrated to have a high degree of confidence.
    (b) How does the risk assessment handle interaction risks for 
interconnected subsystems/components? The risk assessment of each 
safety-critical system (product) must account not only for the risks 
associated with each subsystem or component, but also for the risks 
associated with interactions (interfaces) between such subsystems.
    (c) What is the main principle in computing risk for the 
previous and current conditions? The risk for the previous condition 
must be computed using the same metrics as for the new system being 
proposed. A full risk assessment must consider the entire railroad 
environment where the product is being applied, and show all aspects 
of the previous condition that are affected by the installation of 
the product, considering all faults, operating errors, exposure 
scenarios, and consequences that are related as described in this 
part. For the full risk assessment, the total societal cost of the 
potential numbers of accidents assessed for both previous and new 
system conditions must be computed for comparison. An abbreviated 
risk assessment must, as a minimum, clearly compute the MTTHE for 
all of the hazardous events identified for both previous and current 
conditions. The comparison between MTTHE for both conditions is to 
determine whether the product implementation meets the safety 
criteria as required by subpart H or subpart I of this part as 
applicable.
    (d) What major system characteristics must be included when 
relevant to risk assessment? Each risk calculation must consider the 
total signaling and train control system and method of operation, as 
subjected to a list of hazards to be mitigated by the signaling and 
train control system. The methodology requirements must include the 
following major characteristics, when they are relevant to the 
product being considered:
    (1) Track plan infrastructure, switches, rail crossings at grade 
and highway-rail grade crossings as applicable;
    (2) Train movement density for freight, work, and passenger 
trains where applicable and computed over a time span of not less 
than 12 months;
    (3) Train movement operational rules, as enforced by the 
dispatcher, roadway worker/Employee in Charge, and train crew 
behaviors;
    (4) Wayside subsystems and components;
    (5) Onboard subsystems and components;
    (6) Consist contents such as hazardous material, oversize loads; 
and
    (7) Operating speeds if the provisions of part 236 cite 
additional requirements for certain type of train control systems to 
be used at such speeds for freight and passenger trains.
    (e) What other relevant parameters must be determined for the 
subsystems and components? In order to derive the frequency of 
hazardous events (or MTTHE) applicable for a product, subsystem or 
component included in the risk assessment, the railroad may use 
various techniques, such as reliability and availability 
calculations for subsystems and components, Fault Tree Analysis 
(FTA) of the subsystems, and results of the application of safety 
design principles as noted in Appendix C to this part. The MTTHE is 
to be derived for both fail-safe and non-fail-safe subsystems or 
components. The lower bounds of the MTTF or MTBF determined from the 
system sensitivity analysis, which account for all necessary and 
well justified assumptions, may be used to represent the estimate of 
MTTHE for the associated non-fail-safe subsystem or component in the 
risk assessment.
    (f) How are processor-based subsystems/components assessed? (1) 
An MTTHE value must be calculated for each processor-based subsystem 
or component, or both, indicating the safety-critical behavior of 
the integrated hardware/software subsystem or component, or both. 
The human factor impact must be included in the assessment, whenever 
applicable, to provide the integrated MTTHE value. The MTTHE 
calculation must consider the rates of failures caused by permanent, 
transient, and intermittent faults accounting for the fault coverage 
of the integrated hardware/software subsystem or component, phased-
interval maintenance, and restoration of the detected failures.
    (2) Software fault/failure analysis must be based on the 
assessment of the design and implementation of all safety-related 
software including the application code, its operating/executive 
program, COTS software, and associated device drivers, as well as 
historical performance data, analytical methods and experimental 
safety-critical performance testing performed on the subsystem or 
component. The software assessment process must demonstrate through 
repeatable predictive results that all software defects have been 
identified and

[[Page 2718]]

corrected by process with a high degree of confidence.
    (g) How are non-processor-based subsystems/components assessed? 
(1) The safety-critical behavior of all non-processor-based 
components, which are part of a processor-based system or subsystem, 
must be quantified with an MTTHE metric. The MTTHE assessment 
methodology must consider failures caused by permanent, transient, 
and intermittent faults, phase-interval maintenance and restoration 
of operation after failures and the effect of fault coverage of each 
non-processor-based subsystem or component.
    (2) MTTHE compliance verification and validation must be based 
on the assessment of the design for adequacy by a documented 
verification and validation process, historical performance data, 
analytical methods and experimental safety-critical performance 
testing performed on the subsystem or component. The non-processor-
based quantification compliance must be demonstrated to have a high 
degree of confidence.
    (h) What assumptions must be documented for risk assessment? (1) 
The railroad shall document any assumptions regarding the derivation 
of risk metrics used. For example, for the full risk assessment, all 
assumptions made about each value of the parameters used in the 
calculation of total cost of accidents should be documented. For 
abbreviated risk assessment, all assumptions made for MTHHE 
derivation using existing reliability and availability data on the 
current system components should be documented. The railroad shall 
document these assumptions in such a form as to permit later 
comparisons with in-service experience.
    (2) The railroad shall document any assumptions regarding human 
performance. The documentation shall be in such a form as to 
facilitate later comparisons with in-service experience.
    (3) The railroad shall document any assumptions regarding 
software defects. These assumptions shall be in a form that permit 
the railroad to project the likelihood of detecting an in-service 
software defect. These assumptions shall be documented in such a 
form as to permit later comparisons with in-service experience.
    (4) The railroad shall document all of the identified safety-
critical fault paths to a mishap as predicted by the safety analysis 
methodology. The documentation shall be in such a form as to 
facilitate later comparisons with in-service faults.

0
14. Revise Appendix C to part 236 to read as follows:

Appendix C to Part 236--Safety Assurance Criteria and Processes

    (a) What is the purpose of this appendix? This appendix provides 
safety criteria and processes that the designer must use to develop 
and validate the product that meets safety requirements of this 
part. FRA uses the criteria and processes set forth in this appendix 
to evaluate the validity of safety targets and the results of system 
safety analyses provided in the RSPP, PSP, PTCIP, PTCDP, and PTCSP 
documents as appropriate. An analysis performed under this appendix 
must:
    (1) Address each of the safety principles of paragraph (b) of 
this appendix, or explain why they are not relevant, and
    (2) Employ a validation and verification process pursuant to 
paragraph (c) of this appendix.
    (b) What safety principles must be followed during product 
development? The designer shall address each of the following safety 
considerations principles when designing and demonstrating the 
safety of products covered by subpart H or I of this part. In the 
event that any of these principles are not followed, the PSP or 
PTCDP or PTCSP shall state both the reason(s) for departure and the 
alternative(s) utilized to mitigate or eliminate the hazards 
associated with the design principle not followed.
    (1) System safety under normal operating conditions. The system 
(all its elements including hardware and software) must be designed 
to assure safe operation with no hazardous events under normal 
anticipated operating conditions with proper inputs and within the 
expected range of environmental conditions. All safety-critical 
functions must be performed properly under these normal conditions. 
The system shall operate safely even in the absence of prescribed 
operator actions or procedures. The designer must identify and 
categorize all hazards that may lead to unsafe system operation. 
Hazards categorized as unacceptable, which are determined by hazard 
analysis, must be eliminated by design. Best effort shall also be 
made by the designer to eliminate by design the hazards categorized 
as undesirable. Those undesirable hazards that cannot be eliminated 
should be mitigated to the acceptable level as required by this 
part.
    (2) System safety under failures.
    (i) It must be shown how the product is designed to eliminate or 
mitigate unsafe systematic failures--those conditions which can be 
attributed to human error that could occur at various stages 
throughout product development. This includes unsafe errors in the 
software due to human error in the software specification, design, 
or coding phases; human errors that could impact hardware design; 
unsafe conditions that could occur because of an improperly designed 
human-machine interface; installation and maintenance errors; and 
errors associated with making modifications.
    (ii) The product must be shown to operate safely under 
conditions of random hardware failures. This includes single 
hardware failures as well as multiple hardware failures that may 
occur at different times but remain undetected (latent) and react in 
combination with a subsequent failure at a later time to cause an 
unsafe operating situation. In instances involving a latent failure, 
a subsequent failure is similar to there being a single failure. In 
the event of a transient failure, and if so designed, the system 
should restart itself if it is safe to do so. Frequency of attempted 
restarts must be considered in the hazard analysis required by Sec.  
236.907(a)(8).
    (iii) There shall be no single point failures in the product 
that can result in hazards categorized as unacceptable or 
undesirable. Occurrence of credible single point failures that can 
result in hazards must be detected and the product must achieve a 
known safe state that eliminates the possibility of false activation 
of any physical appliance.
    (iv) If one non-self-revealing failure combined with a second 
failure can cause a hazard that is categorized as unacceptable or 
undesirable, then the second failure must be detected and the 
product must achieve a known safe state that eliminates the 
possibility of false activation of any physical appliance.
    (v) Another concern of multiple failures involves common mode 
failures in which two or more subsystems or components intended to 
compensate one another to perform the same function all fail by the 
same mode and result in unsafe conditions. This is of particular 
concern in instances in which two or more elements (hardware or 
software, or both) are used in combination to ensure safety. If a 
common mode failure exists, then any analysis performed under this 
appendix cannot rely on the assumption that failures are 
independent. Examples include: The use of redundancy in which two or 
more elements perform a given function in parallel and when one 
(hardware or software) element checks/monitors another element (of 
hardware or software) to help ensure its safe operation. Common mode 
failure relates to independence, which must be ensured in these 
instances. When dealing with the effects of hardware failure, the 
designer shall address the effects of the failure not only on other 
hardware, but also on the execution of the software, since hardware 
failures can greatly affect how the software operates.
    (3) Closed loop principle. System design adhering to the closed 
loop principle requires that all conditions necessary for the 
existence of any permissive state or action be verified to be 
present before the permissive state or action can be initiated. 
Likewise the requisite conditions shall be verified to be 
continuously present for the permissive state or action to be 
maintained. This is in contrast to allowing a permissive state or 
action to be initiated or maintained in the absence of detected 
failures. In addition, closed loop design requires that failure to 
perform a logical operation, or absence of a logical input, output 
or decision shall not cause an unsafe condition, i.e. system safety 
does not depend upon the occurrence of an action or logical 
decision.
    (4) Safety assurance concepts. The product design must include 
one or more of the following Safety Assurance Concepts as described 
in IEEE-1483 standard to ensure that failures are detected and the 
product is placed in a safe state. One or more different principles 
may be applied to each individual subsystem or component, depending 
on the safety design objectives of that part of the product.
    (i) Design diversity and self-checking concept. This concept 
requires that all critical functions be performed in diverse ways, 
using diverse software operations and/or diverse hardware channels, 
and that critical hardware be tested with Self-Checking routines. 
Permissive outputs are allowed only if the results of the diverse 
operations correspond, and the Self-Checking

[[Page 2719]]

process reveals no failures in either execution of software or in 
any monitored input or output hardware. If the diverse operations do 
not agree or if the checking reveals critical failures, safety-
critical functions and outputs must default to a known safe state.
    (ii) Checked redundancy concept. The Checked Redundancy concept 
requires implementation of two or more identical, independent 
hardware units, each executing identical software and performing 
identical functions. A means is to be provided to periodically 
compare vital parameters and results of the independent redundant 
units, requiring agreement of all compared parameters to assert or 
maintain a permissive output. If the units do not agree, safety-
critical functions and outputs must default to a known safe state.
    (iii) N-version programming concept. This concept requires a 
processor-based product to use at least two software programs 
performing identical functions and executing concurrently in a 
cycle. The software programs must be written by independent teams, 
using different tools. The multiple independently written software 
programs comprise a redundant system, and may be executed either on 
separate hardware units (which may or may not be identical) or 
within one hardware unit. A means is to be provided to compare the 
results and output states of the multiple redundant software 
systems. If the system results do not agree, then the safety-
critical functions and outputs must default to a known safe state.
    (iv) Numerical assurance concept. This concept requires that the 
state of each vital parameter of the product or system be uniquely 
represented by a large encoded numerical value, such that permissive 
results are calculated by pseudo-randomly combining the 
representative numerical values of each of the critical constituent 
parameters of a permissive decision. Vital algorithms must be 
entirely represented by data structures containing numerical values 
with verified characteristics, and no vital decisions are to be made 
in the executing software, only by the numerical representations 
themselves. In the event of critical failures, the safety-critical 
functions and outputs must default to a known safe state.
    (v) Intrinsic fail-safe design concept. Intrinsically fail-safe 
hardware circuits or systems are those that employ discrete 
mechanical and/or electrical components. The fail-safe operation for 
a product or subsystem designed using this principle concept 
requires a verification that the effect of every relevant failure 
mode of each component, and relevant combinations of component 
failure modes, be considered, analyzed, and documented. This is 
typically performed by a comprehensive failure modes and effects 
analysis (FMEA) which must show no residual unmitigated failures. In 
the event of critical failures, the safety-critical functions and 
outputs must default to a known safe state.
    (5) Human factor engineering principle. The product design must 
sufficiently incorporate human factors engineering that is 
appropriate to the complexity of the product; the educational, 
mental, and physical capabilities of the intended operators and 
maintainers; the degree of required human interaction with the 
component; and the environment in which the product will be used.
    (6) System safety under external influences. The product must be 
shown to operate safely when subjected to different external 
influences, including:
    (i) Electrical influences such as power supply anomalies/
transients, abnormal/improper input conditions (e.g., outside of 
normal range inputs relative to amplitude and frequency, unusual 
combinations of inputs) including those related to a human operator, 
and others such as electromagnetic interference or electrostatic 
discharges, or both;
    (ii) Mechanical influences such as vibration and shock; and
    (iii) Climatic conditions such as temperature and humidity.
    (7) System safety after modifications. Safety must be ensured 
following modifications to the hardware or software, or both. All or 
some of the concerns identified in this paragraph may be applicable 
depending upon the nature and extent of the modifications. Such 
modifications must follow all of the concept, design, implementation 
and test processes and principles as documented in the PSP for the 
original product. Regression testing must be comprehensive and 
documented to include all scenarios which are affected by the change 
made, and the operating modes of the changed product during normal 
and failure state (fallback) operation.
    (c) What standards are acceptable for Verification and 
Validation? (1) The standards employed for Verification or 
Validation, or both, of products subject to this subpart must be 
sufficient to support achievement of the applicable requirements of 
subpart H and subpart I of this part.
    (2) U.S. Department of Defense Military Standard (MIL-STD) 882C, 
``System Safety Program Requirements'' (January 19, 1993), is 
recognized as providing appropriate risk analysis processes for 
incorporation into verification and validation standards.
    (3) The following standards designed for application to 
processor-based signal and train control systems are recognized as 
acceptable with respect to applicable elements of safety analysis 
required by subpart H and subpart I of this part. The latest 
versions of the standards listed below should be used unless 
otherwise provided.
    (i) IEEE standards as follows:
    (A) IEEE 1483-2000, Standard for the Verification of Vital 
Functions in Processor-Based Systems Used in Rail Transit Control.
    (B) IEEE 1474.2-2003, Standard for user interface requirements 
in communications based train control (CBTC) systems.
    (C) IEEE 1474.1-2004, Standard for Communications-Based Train 
Control (CBTC) Performance and Functional Requirements.
    (ii) CENELEC Standards as follows:
    (A) EN50129: 2003, Railway Applications: Communications, 
Signaling, and Processing Systems-Safety Related Electronic Systems 
for Signaling; and
    (B) EN50155:2001/A1:2002, Railway Applications: Electronic 
Equipment Used in Rolling Stock.
    (iii) ATCS Specification 200 Communications Systems 
Architecture.
    (iv) ATCS Specification 250 Message Formats.
    (v) AREMA 2009 Communications and Signal Manual of Recommended 
Practices, Part 16, Part 17, 21, and 23.
    (vi) Safety of High-Speed Ground Transportation Systems. 
Analytical Methodology for Safety Validation of Computer Controlled 
Subsystems. Volume II: Development of a Safety Validation 
Methodology. Final Report September 1995. Author: Jonathan F. 
Luedeke, Battelle. DOT/FRA/ORD-95/10.2.
    (vii) IEC 61508 (International Electrotechnical Commission), 
Functional Safety of Electrical/Electronic/Programmable/Electronic 
Safety (E/E/P/ES) Related Systems, Parts 1-7 as follows:
    (A) IEC 61508-1 (1998-12) Part 1: General requirements and IEC 
61508-1 Corr. (1999-05) Corrigendum 1--Part 1: General Requirements.
    (B) IEC 61508-2 (2000-05) Part 2: Requirements for electrical/
electronic/programmable electronic safety-related systems.
    (C) IEC 61508-3 (1998-12) Part 3: Software requirements and IEC 
61508-3 Corr. 1 (1999-04) Corrigendum 1--Part 3: Software 
requirements.
    (D) IEC 61508-4 (1998-12) Part 4: Definitions and abbreviations 
and IEC 61508-4 Corr. 1 (1999-04) Corrigendum 1--Part 4: Definitions 
and abbreviations.
    (E) IEC 61508-5 (1998-12) Part 5: Examples of methods for the 
determination of safety integrity levels and IEC 61508-5 Corr. 1 
(1999-04) Corrigendum 1--Part 5: Examples of methods for 
determination of safety integrity levels.
    (F) IEC 61508-6 (2000-04) Part 6: Guidelines on the applications 
of IEC 61508-2 and -3.
    (G) IEC 61508-7 (2000-03) Part 7: Overview of techniques and 
measures.
    (H) IEC 62278: 2002, Railway Applications: Specification and 
Demonstration of Reliability, Availability, Maintainability and 
Safety (RAMS);
    (I) IEC 62279: 2002 Railway Applications: Software for Railway 
Control and Protection Systems;
    (4) Use of unpublished standards, including proprietary 
standards, is authorized to the extent that such standards are shown 
to achieve the requirements of this part. However, any such 
standards shall be available for inspection and replication by FRA 
and for public examination in any public proceeding before the FRA 
to which they are relevant.
    (5) The various standards provided in this paragraph are for 
illustrative purposes only. Copies of these standards can be 
obtained in accordance with the following:
    (i) U.S. government standards and technical publications may be 
obtained by contacting the federal National Technical Information 
Service, 5301 Shawnee Rd, Alexandria, VA 22312.
    (ii) U.S. National Standards may be obtained by contacting the 
American

[[Page 2720]]

National Standards Institute, 25 West 43rd Street, 4 Floor, New 
York, NY 10036.
    (iii) IEC Standards may be obtained by contacting the 
International Electrotechnical Commission, 3, rue de Varemb[eacute], 
P.O. Box 131 CH--1211, GENEVA, 20, Switzerland.
    (iv) CENLEC Standards may be obtained by contacting any of one 
the national standards bodies that make up the European Committee 
for Electrotechnical Standardization.
    (v) IEEE standards may be obtained by contacting the IEEE 
Publications Office, 10662 Los Vaqueros Circle, P.O. Box 3014, Los 
Alamitos, CA 90720-1264.
    (vi) AREMA standards may be obtained from the American Railway 
Engineering and Maintenance-of-Way Association, 10003 Derekwood 
Lane, Suite 210, Lanham, MD 20706.


0
15. Revise Appendix D to part 236 to read as follows:

Appendix D to Part 236--Independent Review of Verification and 
Validation

    (a) This appendix provides minimum requirements for independent 
third-party assessment of product safety verification and validation 
pursuant to subpart H or subpart I of this part. The goal of this 
assessment is to provide an independent evaluation of the product 
manufacturer's utilization of safety design practices during the 
product's development and testing phases, as required by any 
mutually agreed upon controlling documents and standards and the 
applicable railroad's:
    (1) Railroad Safety Program Plan (RSPP) and Product Safety Plan 
(PSP) for processor based systems developed under subpart H or,
    (2) PTC Product Development Plan (PTCDP) and PTC Safety Plan 
(PTCSP) for PTC systems developed under subpart I.
    (b) The supplier may request advice and assistance of the 
reviewer concerning the actions identified in paragraphs (c) through 
(g) of this appendix. However, the reviewer shall not engage in any 
design efforts associated with the product, the products subsystems, 
or the products components, in order to preserve the reviewer's 
independence and maintain the supplier's proprietary right to the 
product.
    (c) The supplier shall provide the reviewer access to any and 
all documentation that the reviewer requests and attendance at any 
design review or walkthrough that the reviewer determines as 
necessary to complete and accomplish the third party assessment. The 
reviewer may be accompanied by representatives of FRA as necessary, 
in FRA's judgment, for FRA to monitor the assessment.
    (d) The reviewer shall evaluate the product with respect to 
safety and comment on the adequacy of the processes which the 
supplier applies to the design and development of the product. At a 
minimum, the reviewer shall compare the supplier processes with 
acceptable validation and verification methodology and employ any 
other such tests or comparisons if they have been agreed to 
previously with FRA. Based on these analyses, the reviewer shall 
identify and document any significant safety vulnerabilities which 
are not adequately mitigated by the supplier's (or user's) 
processes. Finally, the reviewer shall evaluate and document the 
adequacy of the railroad's
    (1) RSPP, the PSP, and any other documents pertinent to a 
product being developed under subpart H of this part; or
    (2) PTCDP and PTCSP for systems being developed under subpart I 
of this part.
    (e) The reviewer shall analyze the Hazard Log and/or any other 
hazard analysis documents for comprehensiveness and compliance with 
applicable railroad, vendor, supplier, industry, national, and 
international standards.
    (f) The reviewer shall analyze all Fault Tree Analyses (FTA), 
Failure Mode and Effects Criticality Analysis (FMECA), and other 
hazard analyses for completeness, correctness, and compliance with 
applicable railroad, vendor, supplier, industry, national and 
international standards.
    (g) The reviewer shall randomly select various safety-critical 
software, and hardware modules, if directed by FRA, for audit to 
verify whether the requirements of the applicable railroad, vendor, 
supplier, industry, national, and international standards were 
followed. The number of modules audited must be determined as a 
representative number sufficient to provide confidence that all 
unaudited modules were developed in compliance with the applicable 
railroad, vendor, supplier, industry, national, and international 
standards.
    (h) The reviewer shall evaluate and comment on the plan for 
installation and test procedures of the product for revenue service.
    (i) The reviewer shall prepare a final report of the assessment. 
The report shall be submitted to the railroad prior to the 
commencement of installation testing and contain at least the 
following information:
    (1) Reviewer's evaluation of the adequacy of the PSP in the case 
of products developed under subpart H, or PTCSP for products 
developed under subpart I of this part, including the supplier's 
MTTHE and risk estimates for the product, and the supplier's 
confidence interval in these estimates;
    (2) Product vulnerabilities, potentially hazardous failure 
modes, or potentially hazardous operating circumstances which the 
reviewer felt were not adequately identified, tracked, mitigated, 
and corrected by either the vendor or supplier or the railroad;
    (3) A clear statement of position for all parties involved for 
each product vulnerability cited by the reviewer;
    (4) Identification of any documentation or information sought by 
the reviewer that was denied, incomplete, or inadequate;
    (5) A listing of each applicable vendor, supplier, industry, 
national, or international standard, procedure or process which was 
not properly followed;
    (6) Identification of the software verification and validation 
procedures, as well as the hardware verification validation 
procedures if deemed appropriate by FRA, for the product's safety-
critical applications, and the reviewer's evaluation of the adequacy 
of these procedures;
    (7) Methods employed by the product manufacturer to develop 
safety-critical software;
    (8) If deemed applicable by FRA, the methods employed by the 
product manufacturer to develop safety-critical hardware by 
generally acceptable techniques;
    (9) Method by which the supplier or railroad addresses 
comprehensiveness of the product design which considers the safety 
elements listed in paragraph (b) of appendix C to this part.


0
16. Revise Appendix E to part 236 to read as follows:

Appendix E to Part 236--Human-Machine Interface (HMI) Design

    (a) This appendix provides human factors design criteria 
applicable to both subpart H and subpart I of this part. HMI design 
criteria will minimize negative safety effects by causing designers 
to consider human factors in the development of HMIs. The product 
design should sufficiently incorporate human factors engineering 
that is appropriate to the complexity of the product; the gender, 
educational, mental, and physical capabilities of the intended 
operators and maintainers; the degree of required human interaction 
with the component; and the environment in which the product will be 
used.
    (b) As used in this section, ``designer'' means anyone who 
specifies requirements for--or designs a system or subsystem, or 
both, for--a product subject to subpart H or subpart I of this part, 
and ``operator'' means any human who is intended to receive 
information from, provide information to, or perform repairs or 
maintenance on a safety-critical product subject to subpart H or I 
of this part.
    (c) Human factors issues the designers must consider with regard 
to the general function of a system include:
    (1) Reduced situational awareness and over-reliance. HMI design 
must give an operator active functions to perform, feedback on the 
results of the operator's actions, and information on the automatic 
functions of the system as well as its performance. The operator 
must be ``in-the-loop.'' Designers must consider at a minimum the 
following methods of maintaining an active role for human operators:
    (i) The system must require an operator to initiate action to 
operate the train and require an operator to remain ``in-the-loop'' 
for at least 30 minutes at a time;
    (ii) The system must provide timely feedback to an operator 
regarding the system's automated actions, the reasons for such 
actions, and the effects of the operator's manual actions on the 
system;
    (iii) The system must warn operators in advance when it requires 
an operator to take action;
    (iv) HMI design must equalize an operator's workload; and
    (v) HMI design must not distract from the operator's safety 
related duties.
    (2) Expectation of predictability and consistency in product 
behavior and communications. HMI design must accommodate an 
operator's expectation of logical and consistent relationships 
between actions and results. Similar objects must behave 
consistently when an operator performs the same action upon them.

[[Page 2721]]

    (3) End user limited ability to process information. HMI design 
must therefore minimize an operator's information processing load. 
To minimize information processing load, the designer must:
    (i) Present integrated information that directly supports the 
variety and types of decisions that an operator makes;
    (ii) Provide information in a format or representation that 
minimizes the time required to understand and act; and
    (iii) Conduct utility tests of decision aids to establish clear 
benefits such as processing time saved or improved quality of 
decisions.
    (4) End user limited memory. HMI design must therefore minimize 
an operator's information processing load.
    (i) To minimize short-term memory load, the designer shall 
integrate data or information from multiple sources into a single 
format or representation (``chunking'') and design so that three or 
fewer ``chunks'' of information need to be remembered at any one 
time.
    (ii) To minimize long-term memory load, the designer shall 
design to support recognition memory, design memory aids to minimize 
the amount of information that must be recalled from unaided memory 
when making critical decisions, and promote active processing of the 
information.
    (d) Design systems that anticipate possible user errors and 
include capabilities to catch errors before they propagate through 
the system;
    (1) Conduct cognitive task analyses prior to designing the 
system to better understand the information processing requirements 
of operators when making critical decisions; and
    (2) Present information that accurately represents or predicts 
system states.
    (e) When creating displays and controls, the designer must 
consider user ergonomics and shall:
    (1) Locate displays as close as possible to the controls that 
affect them;
    (2) Locate displays and controls based on an operator's 
position;
    (3) Arrange controls to minimize the need for the operator to 
change position;
    (4) Arrange controls according to their expected order of use;
    (5) Group similar controls together;
    (6) Design for high stimulus-response compatibility (geometric 
and conceptual);
    (7) Design safety-critical controls to require more than one 
positive action to activate (e.g., auto stick shift requires two 
movements to go into reverse);
    (8) Design controls to allow easy recovery from error; and
    (9) Design display and controls to reflect specific gender and 
physical limitations of the intended operators.
    (f) The designer shall also address information management. To 
that end, HMI design shall:
    (1) Display information in a manner which emphasizes its 
relative importance;
    (2) Comply with the ANSI/HFS 100-1988 standard;
    (3) Utilize a display luminance that has a difference of at 
least 35cd/m2 between the foreground and background (the displays 
should be capable of a minimum contrast 3:1 with 7:1 preferred, and 
controls should be provided to adjust the brightness level and 
contrast level);
    (4) Display only the information necessary to the user;
    (5) Where text is needed, use short, simple sentences or phrases 
with wording that an operator will understand and appropriate to the 
educational and cognitive capabilities of the intended operator;
    (6) Use complete words where possible; where abbreviations are 
necessary, choose a commonly accepted abbreviation or consistent 
method and select commonly used terms and words that the operator 
will understand;
    (7) Adopt a consistent format for all display screens by placing 
each design element in a consistent and specified location;
    (8) Display critical information in the center of the operator's 
field of view by placing items that need to be found quickly in the 
upper left hand corner and items which are not time-critical in the 
lower right hand corner of the field of view;
    (9) Group items that belong together;
    (10) Design all visual displays to meet human performance 
criteria under monochrome conditions and add color only if it will 
help the user in performing a task, and use color coding as a 
redundant coding technique;
    (11) Limit the number of colors over a group of displays to no 
more than seven;
    (12) Design warnings to match the level of risk or danger with 
the alerting nature of the signal; and
    (13) With respect to information entry, avoid full QWERTY 
keyboards for data entry.
    (g) With respect to problem management, the HMI designer shall 
ensure that the:
    (1) HMI design must enhance an operator's situation awareness;
    (2) HMI design must support response selection and scheduling; 
and
    (3) HMI design must support contingency planning.
    (h) Ensure that electronics equipment radio frequency emissions 
are compliant with appropriate Federal Communications Commission 
regulations. The FCC rules and regulations are codified in Title 47 
of the Code of Federal Regulations (CFR).
    (1) Electronics equipment must have appropriate FCC Equipment 
Authorizations. The following documentation is applicable to 
obtaining FCC Equipment Authorization:
    (i) OET Bulletin Number 61 (October, 1992 Supersedes May, 1987 
issue) FCC Equipment Authorization Program for Radio Frequency 
Devices. This document provides an overview of the equipment 
authorization program to control radio interference from radio 
transmitters and certain other electronic products and an overview 
of how to obtain an equipment authorization.
    (ii) OET Bulletin 63: (October 1993) Understanding The FCC Part 
15 Regulations for Low Power, Non-Licensed Transmitters. This 
document provides a basic understanding of the FCC regulations for 
low power, unlicensed transmitters, and includes answers to some 
commonly-asked questions. This edition of the bulletin does not 
contain information concerning personal communication services (PCS) 
transmitters operating under Part 15, Subpart D of the rules.
    (iii) 47 Code of Federal Regulations Parts 0 to 19. The FCC 
rules and regulations governing PCS transmitters may be found in 47 
CFR, Parts 0 to 19.
    (iv) OET Bulletin 62 (December 1993) Understanding The FCC 
Regulations for Computers and other Digital Devices. This document 
has been prepared to provide a basic understanding of the FCC 
regulations for digital (computing) devices, and includes answers to 
some commonly-asked questions.
    (2) Designers must comply with FCC requirements for Maximum 
Permissible Exposure limits for field strength and power density for 
the transmitters operating at frequencies of 300 kHz to 100 GHz and 
specific absorption rate (SAR) limits for devices operating within 
close proximity to the body. The Commission's requirements are 
detailed in parts 1 and 2 of the FCC's Rules and Regulations (47 CFR 
1.1307(b), 1.1310, 2.1091, 2.1093). The following documentation is 
applicable to demonstrating whether proposed or existing 
transmitting facilities, operations or devices comply with limits 
for human exposure to radiofrequency RF fields adopted by the FCC:
    (i) OET Bulletin No. 65 (Edition 97-01, August 1997), 
``Evaluating Compliance With FCC Guidelines For Human Exposure To 
Radiofrequency Electromagnetic Fields'',
    (ii) OET Bulletin No 65 Supplement A, (Edition 97-01, August 
1997), OET Bulletin No 65 Supplement B (Edition 97-01, August 1997) 
and
    (iii) OET Bulletin No 65 Supplement C (Edition 01-01, June 
2001).
    (3) The bulletin and supplements offer guidelines and 
suggestions for evaluating compliance. However, they are not 
intended to establish mandatory procedures. Other methods and 
procedures may be acceptable if based on sound engineering practice.


0
17. Add an Appendix F to part 236 to read as follows:

Appendix F to Part 236--Minimum Requirements of FRA Directed 
Independent Third-Party Assessment of PTC System Safety Verification 
and Validation

    (a) This appendix provides minimum requirements for mandatory 
independent third-party assessment of PTC system safety verification 
and validation pursuant to subpart H or I of this part. The goal of 
this assessment is to provide an independent evaluation of the PTC 
system manufacturer's utilization of safety design practices during 
the PTC system's development and testing phases, as required by the 
applicable PSP, PTCDP, and PTCSP, the applicable requirements of 
subpart H or I of this part, and any other previously agreed-upon 
controlling documents or standards.
    (b) The supplier may request advice and assistance of the 
independent third-party reviewer concerning the actions identified 
in paragraphs (c) through (g) of this appendix. However, the 
reviewer should not engage in design efforts in order to preserve 
the reviewer's independence and maintain the

[[Page 2722]]

supplier's proprietary right to the PTC system.
    (c) The supplier shall provide the reviewer access to any and 
all documentation that the reviewer requests and attendance at any 
design review or walkthrough that the reviewer determines as 
necessary to complete and accomplish the third party assessment. The 
reviewer may be accompanied by representatives of FRA as necessary, 
in FRA's judgment, for FRA to monitor the assessment.
    (d) The reviewer shall evaluate with respect to safety and 
comment on the adequacy of the processes which the supplier applies 
to the design and development of the PTC system. At a minimum, the 
reviewer shall evaluate the supplier design and development process 
regarding the use of an appropriate design methodology. The reviewer 
may use the comparison processes and test procedures that have been 
previously agreed to with FRA. Based on these analyses, the reviewer 
shall identify and document any significant safety vulnerabilities 
which are not adequately mitigated by the supplier's (or user's) 
processes. Finally, the reviewer shall evaluate the adequacy of the 
railroad's applicable PSP or PTCSP, and any other documents 
pertinent to the PTC system being assessed.
    (e) The reviewer shall analyze the Hazard Log and/or any other 
hazard analysis documents for comprehensiveness and compliance with 
railroad, vendor, supplier, industry, national, or international 
standards.
    (f) The reviewer shall analyze all Fault Tree Analyses (FTA), 
Failure Mode and Effects Criticality Analysis (FMECA), and other 
hazard analyses for completeness, correctness, and compliance with 
railroad, vendor, supplier, industry, national, or international 
standards.
    (g) The reviewer shall randomly select various safety-critical 
software modules, as well as safety-critical hardware components if 
required by FRA for audit to verify whether the railroad, vendor, 
supplier, industry, national, or international standards were 
followed. The number of modules audited must be determined as a 
representative number sufficient to provide confidence that all 
unaudited modules were developed in compliance with railroad, 
vendor, supplier, industry, national, or international standards
    (h) The reviewer shall evaluate and comment on the plan for 
installation and test procedures of the PTC system for revenue 
service.
    (i) The reviewer shall prepare a final report of the assessment. 
The report shall be submitted to the railroad prior to the 
commencement of installation testing and contain at least the 
following information:
    (1) Reviewer's evaluation of the adequacy of the PSP or PTCSP 
including the supplier's MTTHE and risk estimates for the PTC 
system, and the supplier's confidence interval in these estimates;
    (2) PTC system vulnerabilities, potentially hazardous failure 
modes, or potentially hazardous operating circumstances which the 
reviewer felt were not adequately identified, tracked or mitigated;
    (3) A clear statement of position for all parties involved for 
each PTC system vulnerability cited by the reviewer;
    (4) Identification of any documentation or information sought by 
the reviewer that was denied, incomplete, or inadequate;
    (5) A listing of each applicable vendor, supplier, industry, 
national or international standard, process, or procedure which was 
not properly followed;
    (6) Identification of the hardware and software verification and 
validation procedures for the PTC system's safety-critical 
applications, and the reviewer's evaluation of the adequacy of these 
procedures;
    (7) Methods employed by PTC system manufacturer to develop 
safety-critical software; and
    (8) If directed by FRA, methods employed by PTC system 
manufacturer to develop safety-critical hardware.

    Issued in Washington, DC, on December 30, 2009.
Joseph C. Szabo,
Administrator.
[FR Doc. E9-31362 Filed 1-12-10; 11:15 am]
BILLING CODE 4910-06-P