Federal Railroad Administration 

 This page was left blank intentionally.
Federal Railroad Administration 

Revision 00 3 October 2007 

Table of Contents 

List of Figures..................................................................................................................... 4 

Executive Summary............................................................................................................ 5 

1. Introduction:................................................................................................................ 6 

2. Structured Hazard Analysis: ....................................................................................... 7 

3. Performing the Hazard Analysis:................................................................................ 8 

3.1 Hazard Model: .................................................................................................... 8 

3.2 Severity Definitions: ........................................................................................... 9 

3.3 Frequency Definitions:...................................................................................... 11 

4. Step-by-Step Process for Collision Hazard Analysis: .............................................. 12 

4.1 System Definition: ............................................................................................ 13 

4.2 Hazard Identification: ....................................................................................... 15 

4.3 Hazard Assessment:.......................................................................................... 19 

4.4 Hazard Resolution:............................................................................................ 25 

4.4.1 Hazard Analysis Worksheet...................................................................... 25 

4.4.2 Developing Mitigation Approach ............................................................. 25 

4.4.3 Hazard Precedence.................................................................................... 28 

5. Summary:.................................................................................................................. 31

Bibliography ..................................................................................................................... 32 

Acronyms.......................................................................................................................... 33 

Appendix A. Sample Severity Definitions....................................................................... 34 

Appendix B. Sample Frequency Definitions ................................................................... 37 

Appendix C. Sample Hazard Analysis Forms ................................................................. 39 
Federal Railroad Administration 

Revision 00 4 October 2007 

List of Figures 

Figure 1. Schematic Diagram of the Hazard Analysis and Resolution Process .............. 13 

Figure 2. Hazard Reduction Precedence Flowchart......................................................... 29 

List of Tables 

Table 1. Examples of Elements that May Be Used to Define Hazard Severity............... 10 

Table 2. Hazard Frequency Definitions from MIL-STD-882.......................................... 11 

Table 3. Table of Frequency Definitions Used by South Florida Regional Transportation 

Authority (Tri-Rail) ........................................................................................... 12 

Table 4. Risk Matrix Hazard Categories from MIL-STD-882 ........................................ 19 

Table 5. Suggested Responses to Risk Matrix Hazard Categories .................................. 20 

Table 6. Table of South Florida Regional Transportation Authority (Tri-Rail) 

Consequence Definitions ................................................................................... 21 

Table 7. Table of South Florida Regional Transportation Authority (Tri-Rail) Frequency 

Definitions.......................................................................................................... 22 

Table 8. South Florida Regional Transportation Authority (Tri-Rail) Expanded Risk 

Matrix................................................................................................................. 23 

Table 9. South Florida Regional Transit Authority (Tri-Rail) Risk Matrix Disposition 

Categories .......................................................................................................... 24 

Table 10. Hazard Analysis Worksheet (Illustrative Only)............................................... 27 
Federal Railroad Administration 

Revision 00 5 October 2007 

Executive Summary 

The FRA develops programs that identify, monitor, and address safety issues on 

passenger and freight railroads. Over the past ten years, there have been a number of 

collisions resulting in serious or fatal injuries to passengers and crew. To better 

understand the risks associated with these events, FRA requests that passenger rail 

operators conduct a collision hazard analysis that identifies potential hazards and hazard 

mitigation strategies. 

The Collision Hazard Analysis Guide supports the American Public Transportation 

Association (APTA) Commuter Rail System Safety Program Plan initiative by providing 

a step-by-step procedure on how to perform a hazard analysis and how to develop 

effective mitigation strategies that will improve passenger rail safety. Where applicable, 

this analysis should be conducted in conjunction with the hazard analysis element under 

the passenger railroad’s System Safety Program Plan (SSPP). The techniques described 

in this guide are focused on passenger rail collisions but are also valid for evaluating 

other hazards or safety issues related to any type of operating system. 

Although this guide focuses on primary and secondary collision scenarios, it is also 

important for the rail system to identify other conditions that affect the safety of 

passengers. It is necessary to adequately evaluate secondary collision potential within the 

scope of this guide to ensure that all credible sources for collision, such as factors 

creating derailments and subsequent secondary collisions, are properly analyzed. 

The hazard analysis guidelines presented here are based on the U.S. Department of 

Defense document “System Safety Program Plan Requirements” (MIL-STD-882) and the 

hazard identification/resolution processes described in APTA publication “Manual for the 

Development of System Safety Program Plans for Commuter Railroads.” The 

disciplined, structured approach presented in this document allows hazards to be 

systematically identified, analyzed, and addressed. The process provides a permanent 

record of hazard analysis and serves as a reference document to review and analyze 

future incidents, accidents, or changes in system operations. 

FRA would like to acknowledge the contributions of the John A. Volpe National 

Transportation Systems Center and the American Public Transportation Association for 

partnering with FRA to produce this guide and to conduct the pilot projects used to 

validate the collision hazard analysis process. FRA would also like to thank South 

Florida Regional Transit Authority (SFRTA), operator of the Tri-Rail Commuter service, 

and the Virginia Railway Express. These two railroads volunteered to conduct collision 

hazard analysis pilot programs and shared their experience and materials with the FRA 

and the passenger rail community. 
Federal Railroad Administration 

Revision 00 6 October 2007 

Collision Hazard Analysis Guide: 

 Commuter and Intercity 

Passenger Rail Service 

1. Introduction: 

The Federal Railroad Administration (FRA) is responsible for promoting the safety of the 

nation’s passenger and freight railroads. To address this responsibility, FRA develops 

programs that identify, monitor, and address railroad safety issues. 

FRA is concerned about the risk of injury to occupants of passenger trains. Over the past 

ten years, there have been a number of collisions resulting in serious or fatal injuries to 

passengers and crew. To better understand these risks, FRA requests that passenger rail 

operators conduct a collision hazard analysis that identifies potential hazards and hazard 

mitigation strategies. The mitigation strategies should use a hazard precedence approach 

and be designed to eliminate, control, or mitigate all identified collision hazards, where 

feasible. The hazard analysis should include mitigation strategies that are currently in 

place or newly proposed. 

Some risk is inherent to all transportation activities. However, risk can be progressively 

reduced through sound operational planning, training, technology deployment, and 

modifications to vehicles, facilities, and infrastructure. Hazard analysis provides a 

foundation for progressive risk reduction by ensuring that hazards are not overlooked and 

that areas of risk are evaluated and addressed. 

It is recognized at the outset that passenger rail service is provided within a larger 

environment where many hazards to passenger train safety are introduced by third parties 

such as highway users, abutting property owners, non-railroad contractors working in 

proximity to the railroad, and persons committing criminal acts. While passenger 

railroads should attempt to address these hazards, in many cases remediation may not be 

within the railroad’s control. Remediation may be partially or wholly the responsibility 

of the persons or organizations introducing the hazards or other parties with control or 

authority for the subject matter (e.g., host railroads, motor vehicle licensing authorities, 

roadway authorities, police departments, local governments). Accordingly, where the 

passenger railroad is unable to adequately address the hazard(s) through early detection 

or mitigation of consequences, the passenger railroad should reach out to other 

organizations to address common safety issues. FRA or other Federal authorities may be 

able to assist in this process. 

Where applicable, this analysis should be done in conjunction with a broader hazard 

analysis element under the rail system’s System Safety Program Plan (SSPP). Although 

this guide focuses on primary and secondary collision scenarios, it is also important for 

the rail system to identify other conditions that affect the safety of passengers. It is 
Federal Railroad Administration 

Revision 00 7 October 2007 

necessary to adequately evaluate secondary collision potential within the scope of this 

guide to ensure that all credible sources for collision, such as factors creating derailments 

and subsequent secondary collisions, are properly analyzed. The results from previously 

conducted hazard analysis efforts should be reviewed and incorporated. 

FRA understands that many collision hazards are common to all passenger rail 

operations. However, a single common collision hazard analysis will not provide the 

detail needed to assess the risk or the effectiveness of the mitigation strategies. FRA 

cannot define specific hazards for a passenger railroad as accurately as those who 

actually operate the passenger trains and best understand the operating environment. 

Therefore, FRA requests that each collision hazard analysis be tailored to the specific 

environment present on each passenger railroad. The results of the collision hazard 

analysis, including the mitigation strategies, should be fully documented, maintained by 

the passenger railroad, and available for review by the FRA. 

The Collision Hazard Analysis Guide supports the American Public Transportation 

Association (APTA) Commuter Rail System Safety Program Plan initiative by providing 

a step-by-step procedure on how to perform a collision hazard analysis and how to 

develop effective mitigation strategies that will improve passenger rail safety. The 

techniques described in this guide are focused on passenger rail collisions but are also 

valid for evaluating other hazards or safety issues related to any type of operating system. 

2. Structured Hazard Analysis: 

The hazard analysis guidelines presented here are based on the United States Department 

of Defense document “System Safety Program Requirements,” MIL-STD-882 and the 

hazard identification/resolution processes described in APTA publication “Manual for the 

Development of System Safety Program Plans for Commuter Railroads.” MIL-STD-882 

is an excellent method for conducting hazard analyses. The disciplined, structured 

approach outlined in MIL-STD-882 allows hazards to be systematically identified, 

analyzed, and addressed. The MIL-STD-882 methodology also ensures that all hazards 

and mitigation strategies are adequately reviewed. The process provides a permanent 

record of the hazard analysis and serves as a reference document to review and analyze 

future incidents, accidents, or changes in system operations. 

MIL-STD-882 has been used as a model to create Rail System Safety Programs, has been 

successfully applied to railroad transportation systems, and is an appropriate and useful 

tool to analyze passenger rail safety issues. For example, the System Safety Plan for 

Amtrak’s Acela High Speed Rail service included a detailed MIL-STD-882 hazard 

analysis for the Acela railcars and engines. Additionally, the System Safety Plan included 

a MIL-STD-882 Operational Hazard Analysis (OHA) for the start-up and integration of 

the new service. The OHA was conducted using teams consisting of Amtrak operating 

managers, labor representatives, and FRA staff. These teams reviewed proposed 
Federal Railroad Administration 

Revision 00 8 October 2007 

operating plans, including yard operations, over-the-road operations, servicing, and 

dispatching. 

 

The Metropolitan Transportation Authority of New York developed a System Safety Plan 

and used MIL-STD-882 to conduct hazard analyses for the planning, design, construction 

and implementation of the tunneling project to connect the Long Island Railroad to Grand 

Central Station. Teams consisting of operating managers, contractors, and FRA staff 

participated in hazard identification and resolution activities. MIL-STD-882 analysis 

techniques were also used for the design and construction of a new fleet of M-7, multiple 

unit railcars. 

3. Performing the Hazard Analysis: 

A hazard analysis is performed to identify hazardous conditions for the purpose of their 

elimination or control. A hazard analysis for a complete system may include several 

analysis techniques applied throughout the life cycle of the product – from initial concept 

and design through to the final disposal of the system. A full hazard analysis can consist 

of various analysis documents including a Preliminary Hazard Analysis (PHA), Failure 

Modes and Effects Analysis (FMEA), Operating Hazard Analysis (OHA), and others. 

New start properties should initiate their hazard analysis processes early and apply 

appropriate analysis techniques during the project planning and design phase. Existing 

operations already designed, built, and operating may not require all the analysis tools 

described above. 

FRA requests that the passenger railroads perform a hazard analysis that identifies 

primary and secondary collision hazards and appropriate collision hazard resolutions. 

The analysis should consider derailment potential as a precursor to secondary collisions. 

3.1 Hazard Model: 

To initiate a hazard analysis, the passenger railroad should first establish the hazard 

model used to analyze hazards identified in the process. The hazard management team 

should develop and agree to a specific process used to determine how hazards will be 

rated for severity and frequency. It is important that the severity and frequency 

definitions developed be meaningful to the railroad and the hazard management team so 

that they can be consistently applied. Examples of severity and frequency definitions 

used in the military standard may not be appropriate for a railroad safety analysis. If this 

is found to be the case, it is perfectly acceptable to revise these definitions so that they are 

meaningful to the hazard management team and easy to apply. 
Federal Railroad Administration 

Revision 00 9 October 2007 

3.2 Severity Definitions: 

Severity definitions are applied to hazards and used to rate hazard consequences. The 

objective of establishing severity definitions is to provide a method to prioritize hazards 

so the hazard management team can concentrate on the most severe hazards first. 

Severity definitions usually consist of four categories; Catastrophic, Critical, Marginal, 

and Negligible. The definitions for each category are included in MIL-STD-882. 

However, the definitions are very broad and sometimes not directly applicable to the 

passenger rail operation. For example, MIL-STD-882 defines a catastrophic hazard as 

“Death, system loss, or severe environmental damage.” On a railroad, even a minor 

accident or a low-speed collision can lead to the death of an individual. Therefore, it 

becomes difficult to prioritize a hazard because they all have the potential to become 

critical and unacceptable. 

The passenger railroad should look for other elements that may be more meaningful and 

include them in the severity definition. Examples of some elements that may affect the 

severity of a hazard are listed in Table 1. The passenger railroad may have other 

elements that are specific to its operation. For example, the loss of a specific station or a 

bridge may have a catastrophic impact on the safety and the operation of the railroad. 

In the railroad industry, it is sometimes necessary to consider the level of system loss 

when assessing the severity of a hazard. Considering system loss is not meant to 

downplay the occurrence of a serious or fatal injury; but the level of system loss provides 

an additional tool to determine the relative severity of a hazard. For example, an accident 

that destroys a bridge or tunnel could shut down passenger rail service for an extended 

period of time. Therefore, a hazard that causes this level of disruption should probably 

be considered critical or catastrophic – even if the hazard does not generate personal 

injuries. 

FRA recommends that the passenger railroads define hazard severity in a way that is 

meaningful and useful for the railroads. Examples of how Virginia Railway Express 

(VRE) and South Florida Regional Transportation Authority (SFRTA) define severity 

appear in Appendix A. 
Federal Railroad Administration 

Revision 00 10 October 2007 

POTENTIAL SEVERITY DEFINITION ELEMENTS 

ELEMENT Catastrophic Critical Marginal Negligible 

Train Speed 50 to 79 mph 30 to 49 mph 10 to 29 mph Less than 10 mph 

Intrusion in 

Passenger 

Occupied Vehicle 

(POV) 

Severe deformation 

of POV with crushing 

and tearing of 

structure 

Loss of passenger 

volume with rents in 

structure 

Minor loss of 

passenger volume, 

no rents in structure 

No intrusion into POV 

Impact with Object Collision with another 

train or a fixed 

immoveable object 

(e.g. bridge 

abutment) 

Collision with railroad 

rolling stock, MOW 

vehicle, or a 

commercial vehicle at 

a GC 

Collision with a 

pedestrian or an 

automobile at a GC 

Collision with a fixed 

moveable object (e.g. 

signal tower, GC 

mast) 

Fire Extensive fire in a 

passenger occupied 

area that requires 

intervention by 

trained fire fighters to 

control 

Isolated or localized 

fire outside a 

passenger occupied 

area 

Fuel or other 

combustible material 

spilled without 

ignition 

No fire and no 

combustible products 

spilled 

Fall from Height Occupied equipment 

falls from a bridge or 

overpass 

Occupied equipment 

falls or rolls down an 

embankment or rolls 

on its side 

Equipment derailed 

but stays on track 

structure with minor 

tilting a jackknifing 

Equipment stays 

upright and in line 

Explosion Serious explosion 

due to collision with 

flammable material, 

commercial carrier, or 

business 

Less than serious 

explosion due to 

collision with 

explosive 

material/fuel tank 

Potential explosion 

due to damage or 

leakage (e.g. 

gasoline leakage 

from automobile) 

No explosion or 

leakage of explosive 

fluids, gases, or 

materials 

Fatalities or injuries More than 3 fatalities 

and multiple serious 

injuries to passengers 

and crew 

Up to 3 fatalities or 

multiple serious 

injuries to passengers 

and crew 

No fatalities but non 

life threatening 

injuries to 

passengers or crew 

No injuries or minor 

injuries to 

passengers and crew 

Hazardous 

Materials 

Train strikes 

hazardous material 

carrier or commercial 

business, causing 

explosion and fire 

Train collision causes 

life threatening 

hazardous material 

spill 

Significant non lifethreatening 

hazardous spill (.g. 

locomotive fuel tank 

rupture 

Minor or no 

appreciable 

hazardous material 

spill 

Water Hazard Passenger occupied 

vehicle partially or 

wholly submerged 

Passenger occupied 

vehicle comes to rest 

in water over 5 feet 

deep 

Minor water hazard No water hazard 

System Disruption System shut down for 

more than 24 hours 

System shut down 

from 2 to 24 hours 

System shut down 

from 30 minutes to 2 

hours 

System shut down of 

less than 30 minutes 

Table 1. Examples of Elements that May Be Used to Define Hazard Severity 
Federal Railroad Administration 

Revision 00 11 October 2007 

3.3 Frequency Definitions: 

Frequency definitions are used to establish how often identified hazards emerge. Hazard 

frequency and hazard severity are combined and used to determine risk. The frequency 

of the hazard can be determined quantitatively (using failure rates or accident/incident 

statistical data) or qualitatively based on the relative frequency of expected occurrence. 

An estimate of how often a hazard may occur during the life of the fleet may be helpful in 

establishing frequency. The hazard management team should establish a meaningful 

definition for their operation. 

What is meant by frequent? Once a day? Once a week? Several times per day? 

Guidance on hazard frequency from MIL-STD-882 and other properties is shown in 

Table 2 and Table 3.

Level Description 

Quantitative 

Definition (Frequency x) 

Qualitative 

Definition 

A Frequent x > 1x10-1 Likely to occur frequently, continuously 

experienced in the fleet. 

B Probable 1x10-1 > x > 1x10-2 Will occur several times in the life of an 

item, will occur frequently in the fleet. 

C Occasional 1x10-2 > x > 1x10-3 Likely to occur sometime in the life of an 

item, will occur several times in the fleet. 

D Remote 1x10-3 > x > 1x10-6 Unlikely but possible to occur in the life of 

an item, unlikely but can reasonably be 

expected to occur in the fleet. 

E Improbable 1x10-6 > x So unlikely that it can be assumed 

occurrence may not be experienced, 

unlikely to occur but possible. 

Table 2. Hazard Frequency Definitions from MIL-STD-882 

Military Standard 882 establishes five frequency categories – Frequent, Probable, 

Occasional, Remote, and Improbable. A passenger railroad is free to modify the 

categories to better suit its requirements. South Florida Regional Transportation 

Authority, who runs the Tri- Rail commuter service, uses seven frequency categories as 

described in Table 3. 
Federal Railroad Administration 

Revision 00 12 October 2007 

Frequency Definition 

Certain 

Event 

An event has occurred. 

The event will re-occur or has re-occurred at a singular location or may 

occur at other/multiple locations. 

Likely 

Event 

An event has occurred, based on a condition that exists and/or based on 

the number of persons or equipment exposed to an identified hazard. 

Reports, observations or near-miss data indicate an event may occur. 

Probable 

Event 

An event may occur at a singular location or at multiple locations based 

on an identified hazard. 

Unlikely 

Event 

An event arising from an unidentified condition(s) where sufficient 

analytical data does not exist to identify the condition(s). 

Rare 

Event 

An event has occurred on another commuter rail system with a similar 

operating environment and conditions exist that may lead to a similar 

event. 

Improbable 

Event 

Sufficient analytical data does not exist to indicate an event will occur. 

However, a series of identifiable conditions could occur, leading to an 

event 

Incredible 

Event 

Conditions may not exist leading to an incredible event. However, 

unforeseen conditions outside the system could occur, leading to an 

event on the system. 

Table 3. Table of Frequency Definitions Used by South Florida Regional 

Transportation Authority (Tri-Rail) 

As with the severity definitions, FRA believes that the passenger railroads should define 

the hazard frequency in a way that is meaningful and useful for the railroads. A 

comparison of how other passenger railroads have defined hazard frequency appears in 

Appendix B. 

4. Step-by-Step Process for Collision Hazard Analysis: 

With definitions for hazard severity and hazard frequency established, passenger 

railroads are ready to begin the collision hazard analysis process. There are five main 

steps in performing a hazard identification and resolution hazard analysis. They are: 

• System Definition 

• Hazard Identification 

• Hazard Assessment 

• Hazard Resolution 

• Follow-Up 
Federal Railroad Administration 

Revision 00 13 October 2007 

Figure 1 contains a flowchart that describes the hazard analysis and resolution process. 

Figure 1. Schematic Diagram of the Hazard Analysis and Resolution Process 

The following sections of this document provide step-by-step instructions on how to 

apply the hazard management process to passenger rail issues. 

4.1 System Definition: 

The first step of the hazard identification and resolution process is to define the system 

under consideration. A good system definition is important to understand the 

environment and interfaces that occur during operation of passenger trains – especially 

those elements that may positively or negatively affect safety. The system definition is 

best accomplished by individuals who are intimately familiar with the passenger rail 

operation. 

The system definition should be a narrative statement that fully describes, at a minimum, 

train operations, rolling stock, track configuration, signal systems, infrastructure, and 

environment. The system definition should match or complement the system definition 

included in the railroad’s existing system safety program plan. An example of 

appropriate information to include in the system definition follows: 
Federal Railroad Administration 

Revision 00 14 October 2007 

Train Operations 

• Number of trains per day 

• Frequency of trains or train schedule 

• Train headway 

• Method of operation, including train control, train stop and civil 

speed enforcement systems 

Rolling Stock 

• Age and type(s) of equipment used 

• Configuration (push-pull, MU) 

• Manufacturer 

• Passenger occupied areas 

• Safety standards applied 

• Crashworthiness standards applied 

Track Configuration 

• Types and location of special track work 

• Grade crossings 

• Civil speed restrictions 

• Location and configuration of train yards 

• Track maintenance program 

 Signal System 

• Type and description of system 

• Dragging equipment detectors 

• Automatic train stops 

• Flat wheel detectors 

Infrastructure 

• Bridges 

• Tunnels 

• Stations 

• Industrial sidings or sites 

• Other fixed objects or facilities along right-of-way 

Environment 

• Operating conditions 

• Traction power source (diesel/electric) 

• Freight or other rail traffic on adjacent or common lines 

• Amount and type of highway grade crossing traffic 

• Hazardous material 

• Heavy truck traffic at industrial crossings 
Federal Railroad Administration 

Revision 00 15 October 2007 

The system definition list presented above is not intended to be a complete list but a 

sample of the types of information that should be collected on the passenger rail property. 

The system definition list will vary depending on the specific conditions and 

circumstances that exist on a particular passenger railroad. 

The system definition is best developed by a group of individuals with expertise in 

appropriate disciplines. Many organizations form a hazard management team to develop 

the definition, develop the hazard model, identify the hazards related to the operation, and 

identify appropriate mitigation strategies. The hazard management team consists of 

individuals who have detailed knowledge of the system. As a minimum, a passenger rail 

hazard management team should include representatives from the system safety, 

operations, mechanical, and track and signals departments. It is important that the hazard 

management team include all elements in the definition that could potentially affect 

safety. Therefore, the system definition should be prepared by someone very familiar 

with the passenger rail operation and reviewed by the hazard management team for 

completeness. 

4.2 Hazard Identification: 

The second step in the hazard analysis process is hazard identification. Hazard 

identification is looking for potential hazards or undesired events that may exist on the 

passenger railroad property. Use the hazard management team to identify the hazards. In 

this case, the area of interest is collisions so hazard identification should be restricted to 

those hazards related to primary or secondary collisions. 

Hazard identification is a “What if?” activity that looks for potential causes and results of 

accidents. The hazard management team “brainstorms” to come up with as many 

credible hazards as possible for use in the hazard analysis. 

Some hazards, such as primary collisions, may seem obvious. Primary collisions 

generally represent an extreme event for any passenger or freight train. Other types of 

accidents such as derailments and secondary collisions with fixed objects (such as bridge 

abutments), may not be as obvious but should be considered – especially on passenger 

railroads that have tunnels, bridges, grade crossings, or other fixed objects on or close to 

the right-of-way. Accident histories from other railroads are full of examples of crash 

dynamics (sometimes unexpected) during a derailment or collision. Use prior accidents 

as examples of what might happen and determine if the same scenario is possible on the 

railroad being analyzed. 
Federal Railroad Administration 

Revision 00 16 October 2007 

Some of the hazards that should be considered in the hazard analysis are listed below. 

“Cab car” as used in this list indicates a passenger occupied rail vehicle that includes an 

operator cab with controls used to operate the train. 

Train to train collisions 

• Locomotive to passenger or freight locomotive(s) 

• Cab car (or EMU/DMU) to cab car 

• Cab car to passenger or freight locomotive(s) 

• Cab car to freight car 

• Cab car to passenger car 

• Sideswipe collisions 

Train to highway vehicle collisions 

• Locomotive to automobile 

• Cab car to automobile 

• Locomotive to commercial/industrial vehicle 

• Cab car to commercial/industrial vehicle 

• Locomotive to wayside maintenance vehicle 

• Cab car to wayside maintenance vehicle 

Train to fixed object collisions (after derailment) 

• Locomotive to tunnel portals 

• Cab car to tunnel portals 

• Locomotive to bridge abutments 

• Cab car to bridge abutments 

• Locomotive to fixed wayside objects 

• Cab car to fixed wayside objects 

Derailments 

• Derailments at special track work 

• Derailments that escalate due to track work 

• Derailments that cause a train to leave the clearance envelope 

As with the system definition list, the above list is not intended to be a complete list of all 

the hazards that should be considered. The hazard management team is in the best 

position to identify potential accidents on the specific passenger railroad. 

The hazard management team should consider the physical characteristics of the 

passenger railroad when identifying the hazards. For example, the hazard management 

team should consider if special track work located in a specific area can initiate or 

escalate a derailment and result in a secondary collision with a fixed object. 
Federal Railroad Administration 

Revision 00 17 October 2007 

An effective method for identifying hazards is to tour the system and take photographs of 

situations that may illustrate safety issues. Include photographs of grade crossings, 

special track work, station platforms, emergency walkways, industrial sidings, or any 

unusual conditions or events encountered during the tour. Use the photographs to 

generate discussions among the hazard management team on what types of hazards may 

exist at each location. 

The following photographs contain examples of hazards that may be present on a 

passenger railroad. The photographs also illustrate how the passenger railroad can 

review their property to identify potential hazards. Some sample checklists that are used 

for assessing grade crossings and stations appear in Appendix C. 
Federal Railroad Administration 

Revision 00 18 October 2007 

1. Crossovers can cause or escalate derailments 

and result in secondary collisions. 

2. Highway overpass is potential source of vehicles 

or other objects falling on track. 

3. Freight cars indicate siding where equipment 

can roll out and foul main line.

4 Unprotected bridge support could be damaged in 

a derailment and cause a collapse. 
Federal Railroad Administration 

Revision 00 19 October 2007 

4.3 Hazard Assessment: 

The hazard assessment approach involves assessing each hazard for severity and 

frequency to determine the relative risk of different types of occurrences. The assessment 

can be based on statistics or accident records (quantitative) or the collective opinions of a 

hazard management team (qualitative). Since quantitative data are often not available for 

accident severity or frequency or are not directly applicable to a specific passenger rail 

operation, a qualitative analysis, properly executed, is an acceptable method to perform 

hazard assessment. 

The hazard assessment should use the passenger railroad’s definitions for severity and 

frequency discussed in Sections 3.2 and 3.3. The severity and frequency rankings will 

lead to the hazard resolution procedures defined in the passenger railroad’s system safety 

program plan or established by the hazard management team. The hazard resolution 

procedure should be established before beginning the hazard assessment process to 

prevent unnecessary disagreements on hazard assessment. 

A risk matrix should be developed to provide a framework to categorize hazard severity 

and frequency and allow the hazards to be prioritized so that the most important hazards 

are addressed first. A passenger railroad may already have developed a standard risk 

matrix approach for hazard resolution and included the risk matrix in their system safety 

program plan. If an existing risk matrix for hazard resolution is not available, then 

develop an approach using the hazard management team. 

The risk matrix also serves to establish the overall relative risk for each hazard. Risk is 

defined as a combination of the severity and frequency of a hazard. Table 4 contains a 

risk matrix for hazard resolution that considers the severity and frequency for each 

hazard. 

Table 4. Risk Matrix Hazard Categories from MIL-STD-882 

Associated with each level of risk are recommended actions that provide guidance on 

how to respond to each identified hazard. A list of recommended responses appears in 

Table 5. 

Hazard Categories 

Frequency of 

Occurrence 

I 

Catastrophic

II 

Critical 

III 

Marginal 

IV 

Negligible 

A – Frequent 1A 2A 3A 4A 

B – Probable 1B 2B 3B 4B 

C – Occasional 1C 2C 3C 4C 

D – Remote 1D 2D 3D 4D 

E – Improbable 1E 2E 3E 4E 
Federal Railroad Administration 

Revision 00 20 October 2007 

Table 5. Suggested Responses to Risk Matrix Hazard Categories 

If the passenger railroad has used a different number of Severity or Frequency elements 

then the hazard matrix must be expanded or contracted accordingly. 

For example, South Florida Regional Transit Authority uses nine severity definitions in 

their hazard management process. SFRTA labels their severity definitions 

“consequences.” The full list of SFRTA’s consequence classes and descriptions appears 

in Table 6. 

SFRTA also uses expanded frequency categories. Rather than using the four frequency 

definitions listed in MIL-STD-882, SFRTA uses seven frequency definitions. The full 

list of the seven frequencies and the corresponding definitions is shown in Table 7. 

Risk Matrix 

Hazard Category 

Suggested Action 

1A, 1B, 1C, 2A, 2B, 3A Unacceptable, eliminate hazard. 

1D, 2C, 2D, 3B, 3C, 4A, 4B Undesirable, upper management decision to accept or 

reject risk. 

1E, 2E, 3D, 3E Acceptable with management review. 

4C, 4D, 4E Acceptable without review. 
Federal Railroad Administration 

Revision 00 21 October 2007 

Consequence 

Class • Description

R Service Related – 

• Delay in Revenue services, no direct effect on safety. 

C1 Negligible – 

• Any hazard that can lead to superficial injuries, and may require first-aid 

treatment only. 

• Superficial system / equipment damage under $1000. 

C2 Minor – 

• Any hazard that can lead to system / equipment damage, from $1000 – to 

the current reporting threshold amount. 

• Release of hazardous material into environment less than EPA reportable 

amount. 

C3 Minor with Medical Attention – 

• Any hazard that can lead to a recoverable injuries that require admittance 

to an emergency room for testing and/or hospital for observation. 

• Exposure to hazardous material requiring medical treatment or 

observation. 

C4 Serious with Hospitalization – 

• Any hazard that can lead to injuries which result in admittance to a 

hospital. 

• Could lead to fatality 

C5 Serious – 

• Any hazard that can lead to non-recoverable injuries or may lead to a 

fatality. 

• Occupational disease or illness. 

• Hazards that could lead to multiple minor injuries. 

• System loss between current reporting threshold amount and $50,000. 

• Release of hazardous material into environment that is EPA reportable. 

C6 Serious with Multiple Injuries – 

• Any hazard that can lead to more than 10 injuries in a single incident or 

more than 10 injuries in multiple incidents. 

• Could lead to a fatality. 

• Release of hazardous material into the environment that requires 

evacuation. 

C7 Critical – 

• Any hazard that can lead to one or more fatalities, multiple serious 

injuries in one incident. 

• System / equipment loss in excess of $50,000. 

• Release of hazardous material into environment that will result in injury 

or death. 

C8 Disastrous – 

• Any hazard that can lead to multiple fatalities or numerous serious 

injuries in a singular incident. 

• Hazards associated with Chemical, Biological, Radiological, Nuclear and 

Explosions. 

Table 6. Table of South Florida Regional Transportation Authority (Tri-Rail) 

Consequence Definitions 
Federal Railroad Administration 

Revision 00 22 October 2007 

Frequency Definition 

Certain 

Event 

An event has occurred. 

The event will re-occur or has re-occurred at a singular location or may 

occur at other/multiple locations. 

Likely 

Event 

An event has occurred, based on a condition that exists and/or, based on 

the number of persons or equipment exposed to an identified hazard. 

Reports, observations or near miss data indicate an event may occur. 

Probable 

Event 

An event may occur at a singular, or at multiple locations based on an 

identified hazard. 

Unlikely 

Event 

An event arising from an unidentified condition(s) where sufficient 

analytical data does not exist to identify the condition(s). 

Rare 

Event 

An event has occurred on another commuter rail system with a similar 

operating environment and conditions exist that may lead to a similar 

event. 

Improbable 

Event 

Sufficient analytical data does not exist to indicate an event will occur. 

However, a series of identifiable conditions could occur, leading to an 

event. 

Incredible 

Event 

Conditions may not exist leading to an incredible event. However, 

unforeseen conditions outside of the system could occur, leading to an 

event on the system. 

Table 7. Table of South Florida Regional Transportation Authority (Tri-Rail) 

Frequency Definitions 
Federal Railroad Administration 

Revision 00 23 October 2007 

SFRTA’s frequency and consequence definitions are used to create a 7 by 9 risk matrix to 

conduct hazard management on their property. Table 8 shows the complete SFRTA 

hazard risk matrix and corresponding disposition categories. 

Frequency

R C1 C2 C3 C4 C5 C6 C7 C8

Service Related Negligible Minor Minor with 

Medical Care

Serious 

Admitted to 

Hospital

Serious Serious with 

Multiple 

Injuries

Critical Disastrous

 Certain RBBBAAAAA

 Likely RCBBBBAAA

 Probable RCCBBBBAA

Unlikely RCCCCCBBA

 Rare RDCCCCCBB

Improbable RDDDD CCBB

Incredible RDDDDDDCC

Consequence

Table 8. South Florida Regional Transportation Authority (Tri-Rail) Expanded 

Risk Matrix 

The recommended hazard category dispositions based on the SFRTA Risk Matrix are 

listed in Table 9. 
Federal Railroad Administration 

Revision 00 24 October 2007 

Risk 

Class Description 

A High Risk - Short term mitigation actions must be taken immediately. Appropriate risk control 

measures will be implemented to reduce or eliminate the risk. Medium / Long term mitigation 

plans must be developed. Close observation and frequent review of mitigation plans must be 

evaluated for effectiveness. 

B Medium Risk - Short term mitigation actions must be taken as soon as practicable. Appropriate 

risk control measures will be implemented, if necessary, to reduce the risk. Medium / Long 

term mitigation plans must be developed and evaluated periodically for effectiveness.

C Low Risk - Appropriate risk control measures may be implemented to reduce the risk. Medium 

/ Long term mitigation plans may be developed to reduce or eliminate the risk and be 

periodically evaluated for effectiveness. 

D Negligible Risk – Risk may be considered acceptable; no additional risk control action may be 

required. Appropriate risk control measures may be implemented to further reduce or eliminate 

the risk. Risk should be tracked in the hazard consequence log.

E Hazard Eliminated - Hazard has been eliminated and/or condition(s) no longer exists. 

R Service-Related - No direct safety risk; no safety action is necessary. Not to be registered in 

the Hazard Log. 

Table 9. South Florida Regional Transit Authority (Tri-Rail) Risk Matrix 

Disposition Categories 
Federal Railroad Administration 

Revision 00 25 October 2007 

4.4 Hazard Resolution: 

The results of the hazard identification and hazard assessment steps should be captured 

on a hazard analysis worksheet. The hazard analysis worksheet contains all of the 

information collected on each hazard and serves as the record of how hazards are to be 

controlled or mitigated. Use the worksheet for hazard management – to ensure that all 

identified hazards are systematically addressed. A sample worksheet including sample 

hazards appears in Table 10. 

4.4.1 Hazard Analysis Worksheet 

The left side of the hazard analysis worksheet contains information on each identified 

hazard. The hazard description and the cause and effects are included in this section 

along with an estimate of the severity and the frequency or probability of the hazard. It is 

important for the hazard to be adequately defined within the environment and operating 

parameters of the passenger railroad. A collision, for example, can include a variety of 

scenarios. Collisions can occur with a locomotive or cab car in either the lead or trail 

position. Collisions can occur between a passenger train and a highway vehicle 

(automobile, truck, commercial vehicle, or maintenance vehicle), another train (freight or 

passenger), miscellaneous rolling stock (freight cars, passenger equipment) or with other 

passenger trains in various configurations. It is important that these combinations be 

considered when analyzing collisions because the crash dynamics and results of each type 

of collision may be quite different. 

The hazard process should also consider different locations and configurations on the 

system that may be critical in escalating an accident. The worst high speed rail accident 

in history was the derailment of a German ICE train near Eschede, Germany. The 

accident occurred in 1998 and resulted in 101 passenger and crew fatalities and more than 

200 injuries. The derailment was initiated by a broken wheel. The broken wheel, 

however, did not immediately cause a general derailment. The general derailment 

occurred two miles later when the train encountered a turnout and bridge supports. The 

turnout and its close location to the bridge support escalated the derailment and caused all 

of the fatalities and injuries. The accident dynamics would have been quite different if 

the turnout and bridge supports were not in close proximity. The hazard management 

team should identify all locations along the passenger rail right-of-way that could 

potentially cause or escalate an accident. 

4.4.2 Developing Mitigation Approach 

The right side of the worksheet includes information on the mitigation approach – the 

strategy adopted to reduce the severity or the frequency of the hazard. Once a mitigation 

approach is determined, the effect of the mitigation strategy on the severity and the 

probability or frequency of the hazard is estimated and the revised risk matrix figure is 
Federal Railroad Administration 

Revision 00 26 October 2007 

recorded on the worksheet. Make sure that a mitigation strategy does not have an adverse 

effect on another part of the operation and cause an unintended safety issue. In this 

manner, hazards that require mitigation can be moved to a lower risk matrix category 

where the risk may be more acceptable to the passenger railroad operator. As mitigation 

actions are implemented, the status of the hazard will change from open to closed. The 

last column should include references to the dates and documents that establish the 

closure action. 
Federal Railroad Administration 

SAMPLE 

HAZARD ANALYSIS 

WORKSHEET 

HAZARD IDENTIFICATION MITIGATION APPROACH 

Hazard 

Number 

Hazard Description Cause Effects S P Mitigation Strategy

Rev.

S 

Rev.

P Status Responsibility Comments

1.1 Cab Car 

Grade Crossing Collision with Industrial Vehicle 

Collision at Industrial Grade Crossing located at Milepost 234.5. 

Cab car penetrated and derailed. Severe/Fatal Injuries to crew and passengers. 

2C SHORT TERM: 

Reduce train speed from 50 mph to 30 mph to reduce severity and increase effective sight distance. Remove brush in the area of the grade crossing to increase visibility. 

3D Closed Operations 

Department 

Track & 

Signals Dept. 

See Revised Time Table dated 11-01-2005. 

2 MEDIUM TERM: C 

Petition state to add crossing gates to crossing. 

3E Open Admin. 

Government 

Affairs 

Include in the FY 2007 Request 

2 LONG TERM: C 

Work with industry to Eliminate Grade Crossing 

4E Open Grade 

Crossing 

Safety 

Committee 

Meet with ACME Steel to negotiate construction of an overpass to increase safety and reduce delivery delays. 

1.2 Cab Car 

Collision with Freight rolling stock 

Vandals release hand brakes on cut of cars located on industry siding. 

Cab car strikes freight cars. Cab car penetrated. Severe/Fatal Injuries to crew and passengers. 

2B SHORT TERM: 

Increase local police patrols in the areas of greatest risk. Add lighting in the area of the siding. 

2E Open Security 

RR Police 

Dept. 

Facilities 

Develop MOU with local police department to patrol area. Include improved lighting enhancements in the annual budget. 

2B MEDIUM TERM: 

Install automatic derail to prevent freight cars from fouling main. 

3E Open Track & 

Signals Dept... 

Include automatic derail in the track capital budget. 

Table 10. Hazard Analysis Worksheet (Illustrative Only) 

Revision 00 27 October 2007 

EXAMPLE
Federal Railroad Administration 

Some hazards will require more than one mitigation strategy. For example, a passenger 

railroad may decide to limit passengers in the forward end of the train as a way of 

reducing the risk of passenger injury. This would be a valid short term strategy but may 

not be appropriate in the long term. A longer term strategy, however, may be to provide 

a positive train control system or to require energy absorbing crush zones or additional 

crashworthiness features on new rolling stock. Improvements in rolling stock 

crashworthiness may represent a valid method to better protect passengers but is one that 

cannot usually be achieved immediately. Therefore, the mitigation strategies or actions 

are sometimes categorized as short term, medium term, or long term actions. 

4.4.3 Hazard Precedence 

The hazard precedence approach is a technique for controlling hazards during different 

phases of the system life cycle. Keep the hazard precedence approach to hazard 

mitigation in mind when developing mitigation strategies. The approach is most often 

used on new systems because many hazards can be eliminated during the design stage – 

before the system is initiated and put in service. The hazard precedence approach, 

however, is also useful when assessing existing systems, although changes to the design 

become retrofits and are generally far more expensive. 

The hazard precedence approach encompasses the following philosophy to eliminate or 

control hazards: 

- Design to eliminate hazards 

 - Design to control hazards 

- Provide safety devices 

- Provide warning devices 

- Provide special procedures or training 

- Accept hazard or dispose of system 

A flowchart and decision matrix for applying the hazard precedence model is shown in 

Figure 2.

Revision 00 28 October 2007 
Federal Railroad Administration 

Revision 00 29 October 2007 

Figure 2. Hazard Reduction Precedence Flowchart
Federal Railroad Administration 

Revision 00 30 October 2007 

Follow-Up 

The hazard management team should conduct regular reviews of the hazard analysis 

worksheet to ensure that mitigation strategies are fully implemented and all hazards are 

satisfactorily closed out. Medium term and long term actions should be tracked to 

completion. The hazard analysis can also be used to justify capital dependent mitigation 

strategies and help maintain visibility during budget requests. 

Hazard analysis is not a one-time activity. The techniques described in this document 

should regularly be applied to the passenger rail system as changes occur in the 

configuration or the operation of the system and as the external environment changes. 

The hazard analysis worksheets should be revisited and updated whenever changes occur. 

Changes that can affect the hazard analysis include: 

• New or expanded passenger service 

• Revised operations procedures 

• Procurement of new or modified equipment 

• Changes to grade crossing traffic mix or protection equipment 

It is important to make the hazard analysis a living process that can be modified and 

updated as new information is collected about the passenger rail operation. The hazard 

analysis worksheets should also be reviewed after each incident or accident to determine 

if the hazard analysis is valid or needs to be updated. The analysis is reviewed to 

determine if all hazards were identified and if frequency and severity information remains 

well-founded. The hazard analysis should be updated with new information as it 

becomes available. 

Some passenger railroads hire consultants to conduct hazard analysis. Consultants often 

have extensive experience in conducting hazard analysis; however, hazard analysis is an 

ongoing process that requires full participation by the passenger railroad. The railroad 

must manage and update the hazard analysis over the long term. A short term consulting 

contract will make these goals difficult. 

If a passenger railroad needs to use a consultant to conduct a hazard analysis, make sure 

that the consultant is part of a hazard management team that includes appropriate railroad 

personnel so that the hazard analysis can be taken over by the railroad when the 

consulting contract ends. 
Federal Railroad Administration 

Revision 00 31 October 2007 

5. Summary: 

FRA encourages passenger rail operators to evaluate the collision risk associated with 

passenger rail operations. There is a history of tragic accidents that resulted in serious 

injuries to passengers and crew. The outcome of some of these accidents may have been 

less tragic if mitigation strategies to better protect train occupants had been developed 

and implemented. 

FRA requests the passenger rail operators to perform their own collision hazard analysis 

and identify methods that they can use to make their operation safer, especially 

considering the vulnerability of equipment and the potential risk to persons occupying 

passenger spaces. Using this hazard management approach, FRA hopes to achieve 

improvements in passenger rail safety and sharing of hazard management information 

among passenger rail operators. 

The hazard management and hazard analysis approach outlined in this document 

represents one method to conduct a collision hazard analysis. However, there are many 

other methods and techniques for conducting a hazard analysis. Additional information 

on how to apply hazard analysis techniques to railroad operations exists in a variety of 

documents. The documents listed in the Bibliography represent a small sample of the 

type of information available. 
Federal Railroad Administration 

Revision 00 32 October 2007 

Bibliography 

U.S. Department of Defense. “Military Standard, System Safety Program Requirements.” 

MIL-STD-882. Washington, DC: U.S. Department of Defense. 

American Public Transportation Association. May 2006. “Manual for the Development 

of System Safety Program Plans for Commuter Railroads.” Washington, DC: American 

Public Transportation Association. 

U.S. Department of Transportation Federal Transit Administration. 2000. “Hazard 

Analysis Guidelines for Transit Projects.” Washington, DC: U.S. Department of 

Transportation. 

Bahr, Nicholas J. 1997. System Safety Engineering and Risk Assessment: A Practical 

Approach. New York, NY: Taylor and Francis. 

U.S. Department of Transportation Federal Transit Administration. 2003. “The Public 

Transportation System Security and Emergency Preparedness Planning Guide.” 

Washington, DC: U.S. Department of Transportation. 

National Fire Protection Association. 2004. “NFPA 1600: Standard on 

Disaster/Emergency Management and Business Continuity Programs,” Quincy, MA: 

National Fire Protection Association. 
Federal Railroad Administration 

Revision 00 33 October 2007 

Acronyms

APTA American Public Transportation Association 

DMU diesel multiple unit 

EMU electric multiple unit 

FMEA Failure Modes and Effects Analysis 

FRA Federal Railroad Administration 

MIL-STD-882 Military Standard 882 (System Safety Program Requirements) 

MOU memorandum of understanding 

OHA Operating Hazard Analysis 

PHA Preliminary Hazard Analysis 

SSPP System Safety Program Plan 

SFRTA South Florida Regional Transportation Authority (Tri-Rail) 

VRE Virginia Railway Express 
Federal Railroad Administration 

Appendix A. Sample Severity Definitions 

Virginia Railway Express Category Definition

MIL-STD 882 Virginia Railway Express (VRE) 

Category Description Definition Definition 

I Catastrophic Death, system loss, or 

severe environmental damage 

Operating conditions are such that human error, design deficiencies, element, subsystem or component failure or procedural deficiencies may result in collisions that result in multiple fatalities or major system loss and requires immediate termination of the unsafe activity or operation until the hazard is mitigated. For the purposes of this project, at VRE this can be defined as multiple losses of life, severe damage or total loss to multiple railcars, severe damage to rail infrastructure (rail, signals, roadbed, etc.), 

or other system loss that will cause all or a portion of the system to be unavailable for normal operations for an extended period of time (defined as greater than 30 calendar days). Subcategories: 

1.1 Loss of life (passenger, employee, contractor or public) 1.2 Severe damage to vehicles 

1.3 Severe damage to rail infrastructure 

1.4 Other serious system loss (rail control, station loss, hazardous material release, 

sabotage/terrorism, etc.) 

1.5 Two or more of the above subcategories affected 

II Critical Severe injury, severe 

occupational illness, major system or environmental damage 

Operating conditions are such that human error, subsystem or component failure or procedural deficiencies may result in collisions that cause severe injuries or major system damage and require immediate corrective action to mitigate the hazard. This can be defined as multiple severe injuries 

resulting from collisions, railcars that have major damaged but repairable, rail infrastructure that is damaged but can be repaired sufficiently within a month to allow service to operate in the area, or other significant system loss that is not severe enough to prevent some restoration of service within 30 calendar days. Subcategories: 

1.1 Severe injuries to passengers, employees, contractors or public 1.2 Major damage to railcars 

1.3 Major damage to rail infrastructure 

Revision 00 34 October 2007 
Federal Railroad Administration 

Virginia Railway Express Category Definition

MIL-STD 882 Virginia Railway Express (VRE) 

Category Description Definition Definition 

1.4 Other major system loss 

1.5 Two or more of the above subcategories affected 

III Marginal Minor injury, minor 

occupational illness, or minor system or environmental damage 

Operating conditions are such that they may result in collisions with minor injuries or system damage and are such that human error, subsystem or component failures can be counteracted or controlled. These collisions are of the type that does not interrupt regular service for more than one to two days. Subcategories: 

1.1 Moderate injuries to passengers, employees, contractors or public 1.2 Moderate damage to railcars 

1.3 Moderate damage to rail infrastructure 

1.4 Other moderate system loss 

1.5 Two or more of the above subcategories affected 

IV Negligible Less than minor injury, 

occupational illness, or less than minor system or environmental damage 

Operating conditions are such that human error, subsystem or component failure or procedural deficiencies will result in collisions with no significant effect on the system. Service is interrupted for 

very few passengers for less than one day. The categorization of hazards is consistent with risk-based criteria for severity; it reflects the principle 

that not all hazards pose an equal amount of risk. No subcategories are required for negligible effects of a collision. 

Revision 00 35 October 2007 
Federal Railroad Administration 

Revision 00 36 October 2007 

South Florida Regional Transportation Authority (SFRTD) (Tri-Rail) Consequence Class Description 

Consequence 

Class Description

R Service Related – 

• Delay in Revenue services, no direct effect on safety. 

C1 Negligible – 

• Any hazard that can lead to superficial injuries, and may require first-aid treatment only. • Superficial system/equipment damage under $1000. 

C2 Minor – 

• Any hazard that can lead to system/equipment damage, from $1000 – to the current reporting threshold amount. • Release of hazardous material into environment less than EPA reportable amount. 

C3 Minor with Medical Attention – 

• Any hazard that can lead to a recoverable injuries that require admittance to an emergency room for testing and/or hospital for observation. 

• Exposure to hazardous material requiring medical treatment or observation. 

C4 Serious with Hospitalization – 

• Any hazard that can lead to injuries which result in admittance to a hospital. 

• Could lead to fatality. 

C5 Serious – 

• Any hazard that can lead to non-recoverable injuries or may lead to a fatality. • Occupational disease or illness. • Hazards that could lead to multiple minor injuries. • System loss between current reporting threshold amount and $50,000. • Release of hazardous material into environment that is EPA reportable. 

C6 Serious with Multiple Injuries – 

• Any hazard that can lead to more than 10 injuries in a single incident or more than 10 injuries in multiple incidents. • Could lead to a fatality. • Release of hazardous material into the environment that requires evacuation. 

C7 Critical – 

• Any hazard that can lead to one or more fatalities, multiple serious injuries in one incident. • System/equipment loss in excess of $50,000. • Release of hazardous material into environment that will result in injury or death. 

C8 Disastrous – 

• Any hazard that can lead to multiple fatalities or numerous serious injuries in a singular incident. 

• Hazards associated with Chemical, Biological, Radiological, Nuclear and Explosions. 
Federal Railroad Administration 

Revision 00 37 October 2007 

Appendix B. Sample Frequency Definitions 

Hazard Frequency Categories 

MIL-STD-882 MIL-STD-882 Tri-Rail VRE 

Level Description 

Quantitative Definition (Frequency x) 

Qualitative 

Definition 

Qualitative 

Definition 

Qualitative 

Definition 

A Frequent x > 1x10-1 Likely to occur 

frequently, continuously experienced in the fleet. 

Certain Event An event has occurred. The event will recur or has recurred at a single location or may occur at other/multiple locations. Likely Event An event has occurred, based on a condition that exists and/or based on the number of persons or equipment exposed to an identified hazard. Reports, observations or nearmiss data indicate an event may occur. 

The probability of a particular event or a specific hazard occurring may be defined as a nondimensional ratio of the number of times that a specific event occurs to the total number of trials in which this event will occur during the planned life expectancy of a system. Generally, hazard 

probability is described qualitatively in potential occurrences per units of time, miles, trips/runs or passengers carried. A hazard probability may be derived from the analysis of transit system operating experience, evaluation of VRE safety data or from historical safety data from other passenger rail systems. Likely to occur frequently to an individual item or continuously experienced in the system. Examples in the case of collisions include unprotected grade crossings or rail operators not being efficiency tested.

B Probable 1x10-1 > x > 1x10-2 Will occur several 

times in the life of an item; will occur frequently in the fleet. 

Probable Event An event may occur at a singular, or at multiple locations based on an identified hazard. 

Will occur several times in the life of an item or will occur frequently in the system. Examples include trespassers on the right-of-way and suicides. 
Federal Railroad Administration 

Revision 00 38 October 2007 

Hazard Frequency Categories

MIL-STD-882 MIL-STD-882 Tri-Rail VRE

Level Description 

Quantitative Definition (Frequency x) 

Qualitative Definition 

Qualitative Definition

Qualitative Definition 

C Occasional 1x10-2 > x > 1x10-3 Likely to occur 

sometime in the life of an item; will occur several times in the fleet. 

Unlikely Event An event arising from an unidentified condition(s) where sufficient analytical data does not exist to identify the condition(s).

Likely to occur sometime in the life of an item or will occur several times in the system. Examples include rules or signal violations by qualified employees, and undetected or uncorrected mechanical or infrastructure defects. 

D Remote 1x10-3 > x > 1x10-6 Unlikely but 

possible to occur in the life of an item, unlikely but can reasonably be expected to occur in the fleet. 

Rare Event An event has occurred on another transit system with a similar operating environment and conditions exist that may lead to a similar event.

Unlikely, but possible to occur in the lifetime of an item. Unlikely, but can be expected to occur in the system. Examples include impairment or fatigue of qualified operators, operator illness or incapacitation or major infrastructure or software failure. 

E Improbable 1x10-6 > x So unlikely that it 

can be assumed occurrence may not be experienced, unlikely to occur but possible. 

Improbable Event Sufficient analytical data does not exist to indicate an event will occur. A series of identifiable conditions could occur, however, leading to an event. Incredible Event Conditions may not exist leading to an incredible event. Unforeseen conditions outside the system could occur, however, leading to an event on the system.

So unlikely to occur, it can be assumed possible that occurrence may not be experienced. These types of collisions are most unlikely, but possible to occur in system. Examples include acts of sabotage or terrorism. 
Federal Railroad Administration 

 

Revision 00 39 October 2007 

Appendix C. Sample Hazard Analysis Forms 

The following six checklists offer examples of measuring risk and probability. 

Grade Crossing Assessment 

Highway Grade Crossing Name: Location: Mile Post: 

Crossing Jurisdiction DOT No: 

Type of Crossing Warning (Check all that apply): 

Gates Cantilever FLS Standard FLS Wig Wags 

Hwy. Traffic Signals Bells Cross bucks Stop signs 

Key down feature Do not stop on tracks FLS Gate arm lights 

 Other 

4 quadrant gates 

Yes No 

9 inch curbs 

Yes No 

Vehicle View of track obstructed by: 

Permanent Structure Standing RR Equipment (Distance: ) 

Standing Train (Distance: ) 

Topography Vegetation Wayside Structure Not Obstructed 

Other: 

Train View of crossing obstructed by: 

Permanent Structure Standing RR Equipment (Distance: ) 

Standing Train (Distance: ) 

Topography Vegetation Wayside Structure Not Obstructed 

Other 

Whistle Ban 

Yes No 

Whistle Ban 

Signs Posted 

Yes No 

Track Speed Thru 

Crossing 

Frt: Psgr: 

Commuter: 

Typical Speed Thru 

Crossing 

Frt: Psgr: 

Commuter: 

 Location of warning: 

Both Sides 

Side of Vehicle Approach 

Opposite Side of Vehicle Approach 

Crossing illuminated 

by street or special 

lights 

Yes No 

Adjacent Intersection Description 

EXAMPLE
Federal Railroad Administration 

Revision 00 40 October 2007 

Grade Crossing Assessment 

Adjacent Intersection Description 

Distance in feet to adjacent road: Parallel connecting road: 

At grade Yes No Grade Separated Yes No 

Train Detection: 

Constant Warning 

Time 

Motion Detectors 

Traffic Light Interconnection / Preemption 

Not interconnected 

Simultaneous Preemption 

Advance Preemption 

Type of development 

Open Space Residential 

Commercial Industrial 

Number of 

Traffic Lanes 

crossing tracks 

East: 

West: 

Truck Pull out lanes 

Highway On / Off Ramps: 

(Distance: ) 

Yes No 

Posted highway speed Does traffic queue across tracks 

Yes No 

Time: 

Nearby intersection is it signalized 

Yes 

Less than 75 feet 75 to 200 feet 200 to 500 feet N/A 

No 

Are there sidewalks on the approaches of the 

crossing 

Yes No 

Do sidewalks go through the crossing 

Yes No 

Crossing surface 

Timber Asphalt Asphalt & Flange Concrete 

Concrete & Rubber Rubber Metal Other 

Pedestrian crossing gates 

Yes No 

Pavement markings Stop lines RR Xing Symbols None 

EXAMPLE
Federal Railroad Administration 

Revision 00 41 October 2007 

Grade Crossing Assessment 

Is the crossing near a 

station 

Yes No 

Distance: 

Is the crossing near an interlocking 

Yes No 

Distance: 

Is the crossing affected by switching operation 

in the area 

Yes No 

Location: 

Avg. Vehicular traffic Avg. Bus traffic Avg. Pedestrian traffic 

Avg. Truck traffic Hazardous Material route Event Recorder 

Yes No 

Is the crossing in close proximity to: 

Schools Bus Stops 

Parks Other (explain) 

Playgrounds 

Other: 

Other: 

EXAMPLE
Federal Railroad Administration 

Revision 00 42 October 2007 

Access Database Consequence 

EXAMPLE
Federal Railroad Administration 

Revision 00 43 October 2007 

Consequence Log 

EXAMPLE
Federal Railroad Administration 

Revision 00 44 October 2007 

VRA Safety/Security Report 

VRE SAFETY/SECURITY REPORT # 

DATE REPORTED: 

TIME REPORTED: 

REPORTED TO: 

LINE/TRAIN: 

 (Identify Dispatch Center if Applicable) 

LOCATION: 

HOW IDENTIFIED: 

BY WHOM: 

DESCRIPTION OF INCIDENT OR CONDITION (Attach Extra Sheets as Necessary): 

HAZARD ASSESSMENT: 

FOLLOW-UP HAZARD ASSESSMENT NEEDED? 

IF YES, BY WHOM? 

EXAMPLE
Federal Railroad Administration 

Revision 00 45 October 2007 

VRA Safety/Security Report

SKETCH OF THE INCIDENT: 

RESOLUTION: 

DATE OF RESOLUTION: 

ACTIONS TAKEN 

RESOLUTION HAZARD ASSESSMENT: 

FURTHER ACTION NEEDED: 

ACTION(S) REQUIRED: 

PERSON(S) RESPONSIBLE FOR FOLLOW-UP AND CLOSURE: 

EXAMPLE

1/25/03
Federal Railroad Administration 

Revision 00 46 October 2007 

VRE Grade Crossing Inspection Form 

Crossing Location Inspected and Railroad Ownership: Date Inspected: 

Inspected By: Time: 

Components 

 Inspected 

(A)cceptable, 

(U)nacceptable 

or 

(N/A) 

not applicable 

Exceptions 

Reported To 

(Railroad or 

Agency) 

Person 

Receiving 

Report 

Date And 

Time 

Reported 

Follow-up 

Date 

Date 

Corrected 

 Crossing Approach 

Warning Signs 

 Humpback Crossing 

Warning Signs 

 Warning Signs on 

Crossing 

Pavement Approach 

Warning Markings 

Multiple Track 

Signs 

Pavement Approach 

Conditions 

Crossing Pavement or 

Timber Conditions 

Track Sight Distance, 

Obstructions, Brush, 

Foliage, Etc. 

Warning Lights at 

Crossing 

Protective Gates at 

Crossing 

Other, not listed 

Remarks: 

________________________________________________________________________________________________

________________________________________________________________________________________________ 

________________________________________________________________________________________________

EXAMPLE