Document ID: FRA-2008-0132-0002
Agency: fra
Document Type: Rule
Title: Positive Train Control Systems
Posted Date: 2009-07-21T04:00Z

[Federal Register: July 21, 2009 (Volume 74, Number 138)]
[Proposed Rules]               
[Page 35949-36028]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr21jy09-33]                         

[[Page 35949]]

-----------------------------------------------------------------------

Part III

Department of Transportation

-----------------------------------------------------------------------

Federal Railroad Administration

-----------------------------------------------------------------------

49 CFR Parts 229, 234, 235 et al.

Positive Train Control Systems; Proposed Rule

[[Page 35950]]

-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Railroad Administration

49 CFR Parts 229, 234, 235, and 236

[Docket No. FRA-2008-0132, Notice No. 1]
RIN 2130-AC03

 
Positive Train Control Systems

AGENCY: Federal Railroad Administration (FRA), Department of 
Transportation (DOT).

ACTION: Notice of proposed rulemaking.

-----------------------------------------------------------------------

SUMMARY: FRA proposes regulations implementing a requirement of the 
Rail Safety Improvement Act of 2008 that certain passenger and freight 
railroads install positive train control systems. The proposal includes 
required functionalities of the technology and the means by which it 
would be certified. The proposal also describes the contents of the 
positive train control implementation plans required by the statute and 
contains the proposed process for submission of those plans for review 
and approval by FRA. These proposed regulations could also be 
voluntarily complied with by entities not mandated to install positive 
train control systems.

DATES: (1) Written comments must be received by August 20, 2009. 
Comments received after that date will be considered to the extent 
possible without incurring additional expenses or delays.
    (2) FRA will hold an oral public hearing on a date to be announced 
in a forthcoming notice.

ADDRESSES: Comments: Comments related to Docket No. FRA-2008-0132, may 
be submitted by any of the following methods:
     Web Site: Comments should be filed at the Federal 
eRulemaking Portal, http://www.regulations.gov. Follow the online 
instructions for submitting comments.
     Fax: 202-493-2251.
     Mail: Docket Management Facility, U.S. Department of 
Transportation, 1200 New Jersey Avenue, SE., W12-140, Washington, DC 
20590.
     Hand Delivery: Room W12-140 on the Ground level of the 
West Building, 1200 New Jersey Avenue, SE., Washington, DC between 9 
a.m. and 5 p.m. Monday through Friday, except Federal holidays.
    Instructions: All submissions must include the agency name and 
docket number or Regulatory Identification Number (RIN) for this 
rulemaking. Note that all comments received will be posted without 
change to http://www.regulations.gov including any personal 
information. Please see the Privacy Act heading in the SUPPLEMENTARY 
INFORMATION section of this document for Privacy Act information 
related to any submitted comments or materials.
    Docket: For access to the docket to read background documents or 
comments received, go to http://www.regulations.gov at any time or to 
Room W12-140 on the Ground level of the West Building, 1200 New Jersey 
Avenue, SE., Washington, DC between 9 a.m. and 5 p.m. Monday through 
Friday, except Federal Holidays.

FOR FURTHER INFORMATION CONTACT: Thomas McFarlin, Office of Safety 
Assurance and Compliance, Staff Director, Signal & Train Control 
Division, Federal Railroad Administration, Mail Stop 25, West Building 
3rd Floor West, Room W35-332, 1200 New Jersey Avenue, SE., Washington, 
DC 20590 (telephone: 202-493-6203); or Jason Schlosberg, Trial 
Attorney, Office of Chief Counsel, RCC-10, Mail Stop 10, West Building 
3rd Floor, Room W31-217, 1200 New Jersey Avenue, SE., Washington, DC 
20590 (telephone: 202-493-6032).

SUPPLEMENTARY INFORMATION: FRA is issuing this proposed rule to provide 
regulatory guidance and performance standards for the development, 
testing, implementation, and use of Positive Train Control (PTC) 
systems for railroads mandated by the Railroad Safety Improvement Act 
of 2008 section 104, Public Law 110-432, 122 Stat. 4854 (Oct. 16, 2008) 
(codified at 9 U.S.C. 20157) (hereinafter ``RSIA08'') to install PTC 
systems. These regulations may also be voluntarily complied with by 
entities not mandated to install PTC in lieu of the requirements 
contained in subpart H of part 236. The proposed rule establishes 
requirements for PTC system standard design and functionality, the 
associated submissions for FRA PTC system approval and certification, 
requirements for training, and required risk-based criteria. The RSIA08 
mandates that widespread implementation of PTC across a major portion 
of the U.S. rail industry be accomplished by December 31, 2015. This 
proposed rule is intended to provide the necessary Federal oversight, 
guidance, and assistance toward successful completion of that 
congressional requirement. This proposed rule also necessitates or 
results in some minimal revision or amendment to parts 229, 234 and 
235, as well as previously existing subparts A through H of part 236.

Table of Contents for Supplementary Information

I. Introduction
II. Background
    A. The Need for Positive Train Control Technology
    B. Earlier Efforts to Encourage Voluntary PTC Implementation
    C. Technology Advances Under Subpart H
III. The Rail Safety Improvement Act of 2008
IV. RSAC
V. Use of Performance Standards
VI. Section-by-Section Analysis
VII. Regulatory Impact and Notices
    A. Executive Order 12866 and DOT Regulatory Policies and 
Procedures
    B. Regulatory Flexibility Act and Executive Order 13272
    C. Paperwork Reduction Act
    D. Federalism Implications
    E. Environmental Impact
    F. Unfunded Mandates Reform Act of 1995
    G. Energy Impact
    H. Privacy Act
VIII. The Rule

I. Introduction

    This proposed rule provides new performance standards for the 
implementation and operation of PTC systems as mandated by RSIA08 and 
as otherwise voluntarily adopted. The proposed rule also details the 
process and identifies the documents that railroads and operators of 
passenger trains are to utilize and incorporate in their PTC 
implementation plans required by the Railroad Safety Improvement Act of 
2008 section 104, Public Law 110-432, 122 Stat. 4854, (Oct. 16, 2008) 
(codified at 9 U.S.C. 20157) (hereinafter ``RSIA08''). The proposal 
also details the process and procedure for obtaining FRA approval of 
such plans.
    FRA began the process of developing a proposed rule after RSIA08 
was signed into law. While developing the proposed rule, FRA applied 
the performance-based principles embodied in existing subpart H of part 
236 to identify and remedy any weaknesses discovered in the subpart H 
regulatory approach, while exploiting lessons learned from products 
developed under subpart H. FRA has continued to make performance-based 
safety decisions while supporting railroads in their development and 
implementation of PTC system technologies.
    Development of the proposed rule was enhanced with the 
participation of the Railroad Safety Advisory Committee (RSAC), which 
tasked a PTC Working Group to provide advice regarding development of 
implementing regulations for PTC systems and their deployment that are 
required under RSIA08. The PTC Working Group made a number of consensus 
recommendations, which have been

[[Page 35951]]

identified and included in this proposed rule. The preamble discusses 
the statutory background, the regulatory background, the RSAC 
proceedings, the alternatives considered and the rationale for the 
option selected, the proceedings to date, as well as the comments and 
conclusions on general issues. Other comments and resolutions are 
discussed within the corresponding section-by-section analysis.

II. Background

A. The Need for Positive Train Control Technology

    Since the early 1920s, systems have been in use that can intervene 
in train operations by warning crews or causing trains to stop if they 
are not being operated safely because of inattention, misinterpretation 
of wayside signal indications, or incapacitation of the crew. Pursuant 
to orders of the Interstate Commerce Commission (ICC)--whose safety 
regulatory activities were later transferred to FRA when it was 
established in 1967--cab signal systems, automatic train control, and 
automatic train stop systems were deployed on a significant portion of 
the national rail system to supplement and enforce the indications of 
wayside signals and operating speed limitations. However, these systems 
were expensive to install and maintain, and with the decline of 
intercity passenger service following the Second World War, the ICC and 
the industry allowed many of these systems to be discontinued. During 
this period, railroads were heavily regulated with respect to rates and 
service responsibilities. The development of the Interstate Highway 
System and other factors led to reductions in the railroads' revenues 
without regulatory relief, leading to bankruptcies, railroad mergers, 
and eventual abandonment of many rail lines. Consequently, railroads 
focused on fiscal survival, and investments in expensive relay-based 
train control technology were economically out of reach. The removal of 
these train control systems, which had never been pervasively 
installed, permitted train collisions to continue, notwithstanding 
enforcement of railroad operating rules designed to prevent them.
    As early as 1970, following its investigation of the August 20, 
1969, head-on collision of two Penn Central Commuter trains near 
Darien, Connecticut, in which 4 people were killed and 45 people were 
injured, the National Transportation Safety Board (NTSB) asked FRA to 
study the feasibility of requiring a form of automatic train control 
system to protect against operator error and prevent train collisions. 
Following the Darien accident, the NTSB continued to investigate one 
railroad accident after another caused by human error. During the next 
two decades, the NTSB issued a number of safety recommendations asking 
for train control measures. Following its investigation of the May 7, 
1986, rear-end collision involving a Boston and Maine Corporation 
commuter train and a Consolidated Rail Incorporated (Conrail) freight 
train in which 153 people were injured, the NTSB recommend that FRA 
promulgate standards to require the installation and operation of a 
train control system that would provide for positive train separation. 
NTSB Recommendation R-87-16 (May 19, 1987), available at http://
www.ntsb.gov/Recs/letters/1987/R87_16.pdf. When the NTSB first 
established its Most Wanted List of Transportation Safety Improvements 
in 1990, the issue of Positive Train Separation was among the 
improvements listed, and it remained on the list until just after 
enactment of RSIA08. Original ``Most Wanted'' list of Transportation 
Safety Improvements, as adopted September 1990, available at http://
www.ntsb.gov/Recs/mostwanted/original_list.htm. The NTSB continues to 
follow the progress of the technology's implementation closely and 
participated through staff in the most recent PTC Working Group 
deliberations.
    Meanwhile, enactment of the Staggers Rail Act of 1980 signaled a 
shift in public policy that permitted the railroads to shed 
unprofitable lines, largely replace published ``tariffs'' with 
appropriately priced contract rates, and generally respond to 
marketplace realities, which increasingly demanded flexible service 
options responsive to customer needs. The advent of microprocessor-
based electronic control systems and digital data radio technology 
during the mid-1980s led the freight railroad industry, through the 
Association of American Railroads (AAR) and the Railway Association of 
Canada, to explore the development of Advanced Train Control Systems 
(ATCS). With broad participation by suppliers, railroads, and FRA, 
detailed specifications were developed for a multi-level ``open'' 
architecture that would permit participation by many suppliers while 
ensuring that systems deployed on various railroads would work in 
harmony as trains crossed corporate boundaries. ATCS was intended to 
serve a variety of business purposes, in addition to enhancing the 
safety of train operations. Pilot versions of ATCS and a similar system 
known as Advanced Railroad Electronic Systems (ARES) were tested 
relatively successfully, but the systems were never deployed on a wide 
scale primarily due to cost. However, sub-elements of these systems 
were employed for various purposes, particularly for replacement of 
pole lines associated with signal systems.
    Collisions, derailments, and incursions into work zones used by 
roadway workers continued as a result of the absence of effective 
enforcement systems designed to compensate for the effects of fatigue 
and other human factors. Renewed emphasis on rules compliance and 
Federal regulatory initiatives, including rules for the control of 
alcohol and drug use in railroad operations, operational testing and 
inspection programs designed to verify railroad rules compliance, 
requirements for qualification and certification of locomotive 
engineers, and negotiated rules for roadway worker protection led to 
some reduction in risk. However, the lack of an effective collision 
avoidance system allowed the continued occurrence of accidents, some 
involving tragic losses of life and significant property damage.

B. Earlier Efforts To Encourage Voluntary PTC Implementation

    As the NTSB continued to highlight the opportunities for accident 
prevention associated with emerging train control technology through 
its investigations and findings, Congress showed increasing interest, 
mandating three separate reports over the period of a decade. In 1994, 
FRA reported to Congress on this problem, calling for implementation of 
an action plan to deploy PTC systems (Railroad Communications and Train 
Control, July 1994 (hereinafter ``1994 Report'')). The 1994 Report 
forecasted substantial benefits of advanced train control technology in 
supporting a variety of business and safety purposes, but noted that an 
immediate regulatory mandate for PTC could not be justified based upon 
normal cost-benefit principals relying on direct safety benefits. The 
report outlined an aggressive Action Plan implementing a public-private 
sector partnership to explore technology potential, deploy systems for 
demonstration, and structure a regulatory framework to support emerging 
PTC initiatives.
    Following through on the 1994 Report, FRA committed approximately 
$40 million through the Next Generation High Speed Rail Program and the 
Research and Development Program to support development,

[[Page 35952]]

testing, and deployment of PTC prototype systems in the Pacific 
Northwest, Michigan, Illinois, Alaska, and some Eastern railroads. FRA 
also initiated a comprehensive effort to structure an appropriate 
regulatory framework for facilitating voluntary implementation of PTC 
and for evaluating future safety needs and opportunities.
    In September of 1997, FRA asked the RSAC to address the issue of 
PTC. The RSAC accepted three tasks: Standards for New Train Control 
Systems (Task 1997-06), Positive Train Control Systems--Implementation 
Issues (Task 1997-05), and Positive Train Control Systems--
Technologies, Definitions, and Capabilities (Task 1997-04). The PTC 
Working Group was established, comprised of representatives of labor 
organizations, suppliers, passenger and freight railroads, other 
Federal agencies, and interested state departments of transportation. 
The PTC Working Group was supported by FRA counsel and staff, analysts 
from the Volpe National Transportation Systems Center, and advisors 
from the NTSB staff.
    In 1999, the PTC Working Group provided to the Federal Railroad 
Administrator a consensus report (``1999 Report'') with an indication 
that it would be continuing its efforts. The report defined the PTC 
core functions to include: Prevention of train-to-train collisions 
(positive train separation); enforcement of speed restrictions, 
including civil engineering restrictions (curves, bridges, etc.) and 
temporary slow orders; and protection for roadway workers and their 
equipment operating under specific authorities. The PTC Working Group 
identified additional safety functions that might be included in some 
PTC architectures: Provide warning of on-track equipment operating 
outside the limits of authority; receive and act upon hazard 
information, when available, in a more timely or more secure manner 
(e.g., compromised bridge integrity, wayside detector data); and 
provide for future capability by generating data for transfer to 
highway users to enhance warning at highway-rail grade crossings. The 
PTC Working Group stressed that efforts to enhance highway-rail grade 
crossing safety must recognize the train's necessary right of way at 
grade crossings and that it is important that warning systems employed 
at highway-rail grade crossings be highly reliable and ``fail-safe'' in 
their design.
    As the PTC Working Group's work continued, other collaborative 
efforts, including development of Passenger Equipment Safety Standards 
(including private standards through the American Public Transit 
Association), Passenger Train Emergency Preparedness rules, and 
proposals for improving locomotive crashworthiness (including improved 
fuel tank standards) have targeted reduction in collision and 
derailment consequences.
    In 2003, in light of technological advances and potential increased 
cost and system savings related to prioritized deployment of PTC 
systems, the Appropriations Committees of Congress requested that FRA 
update the costs and benefits for the deployment of PTC and related 
systems. As requested, FRA carried out a detailed analysis that was 
filed in August of 2004 (``2004 Report''), which indicated that under 
one set of highly controversial assumptions, substantial public 
benefits would likely flow from the installation of PTC systems on the 
railroad system. Further, the total amount of these benefits was 
subject to considerable controversy. While many of the other findings 
of the 2004 Report were disputed, there were no data submitted to 
challenge the 2004 Report finding that reaffirmed earlier conclusions 
that the safety benefits of PTC systems were relatively small in 
comparison to the large capital and maintenance costs. Accordingly, FRA 
continued to believe that an immediate regulatory mandate for 
widespread PTC implementation could not be justified based upon 
traditional cost-benefit principles relying on direct railroad safety 
benefits. Benefits and Costs of Positive Train Control (Report in 
Response to Committees on Appropriations, August 2004).
    Despite the economic infeasibility of PTC based on safety benefits 
alone, as outlined in the 1994, 1999, and 2004 Reports, FRA continued 
with regulatory and other efforts to facilitate and encourage the 
voluntary installation of PTC systems. As part of the High Speed Rail 
Initiative, and in conjunction with the National Railroad Passenger 
Corporation (Amtrak), the AAR, the State of Illinois, and the Union 
Pacific Railroad Company (UP), FRA created the North American Joint 
Positive Train Control (NAJPTC) Program, which set out to describe a 
single standardized open source PTC architecture and system. UP's line 
between Springfield and Mazonia, Illinois was selected for initial 
installation of a train control system to support Amtrak operations up 
to 110 mph, and the system was installed and tested on portions of that 
line. Although the system did not prove viable as then conceived, the 
project hastened the development of PTC technology that was 
subsequently employed in other projects. Promised standards for 
interoperability of PTC systems also proved elusive.
    In addition to financially supporting the NAJPTC Program, FRA 
continued to work with the rail carriers, rail labor, and suppliers on 
regulatory reforms to facilitate voluntary PTC implementation. The 
regulatory reform effort culminated when FRA issued a final rule on 
March 7, 2005, establishing a technology neutral safety-based 
performance standard for processor-based signal and train control 
systems. This new regulation, codified as subpart H to part 236, was 
carefully crafted to encourage the voluntary implementation and 
operation of processor-based signal and train control systems without 
impairing technological development. 70 FR 11052 (Mar. 7, 2005).
    FRA intended that final rule--developed in close cooperation with 
rail management, rail labor, and suppliers--to further facilitate 
individual railroad efforts to voluntarily develop and deploy cost 
effective PTC technologies that would make system-wide deployment more 
economically viable. It also appeared very possible that major 
railroads would elect to make voluntary investments in PTC to enhance 
safety, improve service quality, and foster efficiency (e.g., better 
asset utilization, reduced fuel use through train pacing).

C. Technology Advances Under Subpart H

    While FRA and RSAC worked to develop consensus on the regulations 
that would become subpart H, the railroads continued with PTC prototype 
development. The technology neutral, performance-based regulatory 
process established by subpart H proved to be very successful in 
facilitating the development of other PTC implementation approaches. 
Although the railroads prototype development efforts were generally 
technically successful and offered significant improvements in safety, 
costs of nationwide deployment continued to be untenable. Information 
gained from prototype efforts did little to reduce the estimated costs 
for widespread implementation of the core PTC safety functions on the 
nation's railroads.
    Working under subpart H, the BNSF Railway Company (BNSF), CSX 
Transportation, Inc. (CSXT), the Norfolk Southern Corporation (NS), and 
UP undertook more aggressive design and implementation work. The new 
subpart H regulatory approach also made it feasible for smaller 
railroads such as the Alaska Railroad and the Ohio Central Railroad to 
begin voluntary design and implementation work on PTC systems

[[Page 35953]]

that best suited their needs. FRA provided, and continues to provide, 
technical assistance and guidance regarding regulatory compliance to 
enable the railroads to more effectively design, install, and test 
their respective systems.
    In December 2006, FRA approved the initial version of the 
Electronic Train Management System (ETMS) product for deployment on 35 
of BNSF's subdivisions (``ETMS I Configuration'') comprising single 
track territory that was either non-signaled or equipped with traffic 
control systems. In a separate proceeding, FRA agreed that ETMS could 
be installed in lieu of restoring a block signal system on a line for 
which discontinuance had been authorized followed by a significant 
increase in traffic. During the same period, BNSF successfully 
demonstrated a Switch Point Monitoring System (SPMS)--a system that 
contains devices attached to switches that electronically report the 
position of the switches to the railroad's central dispatching office 
or the crew of an approaching train--and a Track Integrity Warning 
System (TIWS)--a system that electronically reports to the railroad's 
central dispatching office or the crew of an approaching train if there 
are any breaks in the rail that might lead to derailments. FRA believes 
both of these technologies help to reduce risk in non-signaled 
territory and are forward-compatible for use with existing and new PTC 
systems. To be forward-compatible, not to be confused with the similar 
concept of extensibility, a system must be able to gracefully provide 
input intended for use in later system versions. The introduction of a 
forward-compatible technology implies that older devices can partly 
understand and provide data generated or used by new devices or 
systems. The concept can be applied to electrical interfaces, 
telecommunication signals, data communication protocols, file formats, 
and computer programming languages. A standard supports forward-
compatibility if older product versions can receive, read, view, play, 
execute, or transmit data to the new standard. In the case of wayside 
devices, they are said to be forward compatible if they can 
appropriately communicate and interact with a PTC system when later 
installed. A wayside device might serve the function of providing only 
information or providing information and accepting commands from a new 
system.
    In addition to scheduling the installation of the ETMS I 
configuration as capital funding became available, BNSF voluntarily 
undertook the design and testing of complementary versions of ETMS that 
would support BNSF operations on more complex track configurations, at 
higher allowable train speeds, and with additional types of rail 
traffic. Meanwhile, CSXT was in the process of redesigning and 
relocating the test bed for its Communications Based Train Management 
(CBTM) system, which it has tested for several years, and UP and NS 
were working on similar systems using vital onboard processing.
    As congressional consideration of legislation that resulted in the 
RSIA08 commenced, all four major railroads had settled on the core 
technology developed for them by Wabtec Railway Electronics 
(``Wabtec''). As the legislation progressed, the railroads and Wabtec 
worked toward greater commonality in the basic functioning of the 
onboard system with a view toward interoperability. Accordingly, ETMS 
is now a generic architectural description of one type of PTC system. 
Examples of ETMS include the non-vital PTC systems of BNSF's ETMS I and 
ETMS II, CSXT's CBTM, UP's Vital Train Management System (VTMS), and 
NS's Optimized Train Control (OTC). Further work is being undertaken by 
BNSF to advance the capability of ETMS by integrating Amtrak operations 
(ETMS III). For a description of system enhancements planned by BNSF as 
per the Product Safety Plan filed in accordance with subpart H, see FRA 
Docket No. 2006-23687, Document 0017, at pp. 40-43.
    While the freight railroads' efforts for developing and installing 
PTC systems progressed over a relatively long period of time, starting 
with demonstrations of ATCS and ARES in the late 1980s and culminating 
in the initial ETMS Product Safety Plan approval in December of 2006, 
Amtrak demonstrated its ability to turn on revenue-quality PTC systems 
on its own railroad in support of high speed rail. Beginning in the 
early 1990s, Amtrak developed plans for enhanced high speed service on 
the Northeast Corridor (NEC), which included electrification and other 
improvements between New Haven and Boston and introduction of the Acela 
trainsets as the premium service from Washington to New York and New 
York to Boston. In connection with these improvements, which support 
train speeds up to 150 mph, Amtrak undertook to install the Advanced 
Civil Speed Enforcement System (ACSES) as a supplement to existing cab 
signals and automatic train control (speed control). Together, these 
systems deliver PTC core functionalities. In support of this effort, 
FRA issued an order for the installation of the system, which required 
all passenger and freight operators in the New Haven-Boston segment to 
equip their locomotives with ACSES. See 63 FR 39343 (July 22, 1998). 
ACSES was installed between 2000 and 2002, and has functioned 
successfully between New Haven and Boston, and on selected high speed 
segments between Washington and New York for a number of years.
    Amtrak voluntarily began development of an architecturally 
different PTC system, the Incremental Train Control System (ITCS), for 
installation on its Michigan Line. Amtrak developed and installed ITCS 
under waivers from specific sections of 49 CFR part 236, subparts A 
through G, granted by FRA. ITCS was applied to tenant NS locomotives as 
well as Amtrak locomotives traversing the route. Highway-rail grade 
crossings on the route were fitted with ITCS units to pre-start the 
warning systems for high-speed trains and to monitor crossing warning 
system health in real time. The ITCS was tested extensively in the 
field for safety and reliability, and it was placed in revenue service 
in 2001. As experience was gained, FRA authorized increases in speed to 
95 mph; and FRA is presently awaiting final results of an independent 
assessment of verification and validation for the system with a view 
toward authorizing operations at the design speed of 110 mph.
    Despite these successes, the widespread deployment of these various 
train control systems, particularly on the general freight system, 
remained very much constrained by prohibitive capital costs. While the 
railroads were committed to installing these new systems to enhance the 
safety afforded to the public and their employees, the railroad's 
actual widespread implementation remained forestalled due to an 
inability to generate sufficient funding for these new projects in 
excess of the capital expenditures necessary to cover the ongoing 
operating and maintenance costs. Accordingly, the railroads continued 
to plan very slow deployments of PTC system technologies.

III. The Rail Safety Improvement Act of 2008

    On May 1, 2007, the House of Representatives introduced H.R. 2095, 
which would, among other things, mandate the implementation and use of 
PTC systems. The bill passed the House on October 17, 2007. The bill 
was then amended and passed by the Senate on August 1, 2008. While the 
bill was awaiting final passage, the FRA Administrator testified before 
Congress that ``FRA is a strong supporter of PTC

[[Page 35954]]

technology and is an active advocate for its continued development and 
deployment.'' Senate Commerce Committee Briefing on Metrolink Accident, 
110th Cong. (Sept. 23, 2008) (written statement of Federal Railroad 
Administrator Joseph H. Boardman), available at http://www.fra.dot.gov/
downloads/PubAffairs/09-23-08FinalStatementFRAAdministratorPTC_Sen_
Boxer_Meeting.pdf.
    On September 24, 2008, the House concurred with the Senate 
amendment and added another amendment pursuant to H. Res. 1492. When 
considering the House's amendment, various Senators made statements 
referencing certain train accidents that were believed to be PTC-
preventable. For instance, Senator Lautenberg (NJ) took notice of the 
collision at Graniteville, South Carolina in 2005, and Senators 
Lautenberg, Hutchinson (TX), Boxer (CA), Levin (MI), and Carper (DE) 
took notice of an accident at Chatsworth, California, on September 12, 
2008. According to Senator Levin, Federal investigators have said that 
a collision warning system could have prevented that crash and the 
subject legislation would require that new technology to prevent 
crashes be installed in high risk tracks. Senators Carper and Boxer 
made similar statements, indicating that PTC systems are designed to 
prevent train derailments and collisions, like the one in Chatsworth. 
154 Cong. Rec. S10283-S10290 (2008). Ultimately, on October 1, 2008, 
the Senate concurred with the House amendment.
    The Graniteville accident referenced by Senator Lautenberg was an 
early morning collision between two NS trains in non-signaled (dark) 
territory near the Avondale Mills Textile plant. One of the trains--
which was transporting chlorine gas, sodium hydroxide, and cresol on 
the main track--approached an improperly lined hand-operated switch. As 
the train diverged through the switch, it ran onto the siding track 
where it collided with a parked train. Various tank cars ruptured, 
releasing at least 90 tons of chlorine gas. Nine people died due to 
chlorine inhalation and at least 250 people were treated for chlorine 
exposure. In addition, 5,400 residents within a mile of the crash site 
were forced to evacuate for nearly two weeks while hazardous materials 
(hazmat) teams and cleanup crews decontaminated the area.
    The Chatsworth train collision occurred on the afternoon of 
September 12, 2008, when a Union Pacific freight train and a Metrolink 
commuter train collided head-on on a single main track equipped with a 
Traffic Control System (TCS) in the Chatsworth district of Los Angeles, 
California. Although NTSB has not yet released its final report, 
evidence summarized at the NTSB's public hearing suggested that the 
Metrolink passenger train was operated past a signal displaying a stop 
indication and entered a section of single track where the opposing UP 
freight train was operating on a signal indication permitting it to 
proceed over a switch and into a siding (after which the switch would 
have been lined for the Metrolink train to proceed). As a consequence 
of the accident, 25 people died and over 130 more were seriously 
injured.
    Prior to the accidents in Graniteville and Chatsworth, the 
railroads' slow incremental deployment of PTC technologies--while not 
uniformly agreed upon by the railroads, FRA, and NTSB--was generally 
deemed acceptable by them in view of the tremendous costs involved. 
Partially as a consequence and severity of these very public accidents, 
coupled with a series of other less publicized accidents, Congress 
passed the Rail Safety Improvement Act of 2008 into law on October 16, 
2008, marking a public policy decision that, despite the implementation 
costs, railroad employee and general public safety warranted mandatory 
and accelerated installation and operation of PTC systems.
    As immediately relevant to this rulemaking, RSIA08 requires the 
installation and operation of PTC systems on all main lines, meaning 
all intercity and commuter lines--with limited exceptions entrusted to 
FRA--and on freight-only lines when they are part of a Class I railroad 
system, carrying at least 5 million gross tons of freight annually, and 
carrying any amount of poison- or toxic-by-inhalation (PIH or TIH) 
materials. While the statute vests certain responsibilities with the 
Secretary of the U.S. Department of Transportation, the Secretary has 
since delegated those responsibilities to the FRA Administrator. See 49 
CFR 1.49(oo); 74 FR 26,981 (June 5, 2009); see also 49 U.S.C. 103(g).
    In RSIA08, Congress established very aggressive dates for PTC 
system build-out completion. Each subject railroad is required to 
submit to FRA by April 16, 2010, an implementation plan indicating 
where and how it intends to install PTC systems by December 31, 2015. 
As a result of this accelerated PTC system deployment schedule, 
railroads must immediately engage in a massive reprogramming of capital 
funds.
    In light of the timetable instituted by Congress, and to better 
support railroads with their installation while maintaining safety, FRA 
decided that it is appropriate for mandatory PTC systems to be reviewed 
by FRA differently than the regulatory approval process provided under 
subpart H. FRA believes that it is important to develop a process more 
suited specifically for PTC systems that would better facilitate 
railroad reuse of safety documentation and simplify the process of 
showing that the installation of the PTC system did not degrade safety. 
FRA also believes that subpart H does not clearly address the statutory 
mandates and that such lack of clarity would complicate railroad 
efforts to comply with the new statutory requirements. Accordingly, FRA 
is hereby proposing to amend part 236 by modifying existing subpart H 
and adding a new subpart I. FRA requests comments on whether this 
proposed regulation exercises the appropriate level of discretion and 
flexibility to comply with RSIA08 in the most cost effective and 
beneficial manner.

IV. RSAC

    In March 1996, FRA established the RSAC, which provides a forum for 
collaborative rulemaking and program development. The RSAC includes 
representatives from all of the agency's major stakeholder groups, 
including railroads, labor organizations, suppliers and manufacturers, 
and other interested parties. When appropriate, FRA assigns a task to 
RSAC, and after consideration and debate, RSAC may accept or reject the 
task. If accepted, RSAC establishes a working group that possesses the 
appropriate expertise and representation of interests to develop 
recommendation to FRA for action on the task. These recommendations are 
developed by consensus. The working group may establish one or more 
task forces or other subgroups to develop facts and options on a 
particular aspect of a given task. The task force, or other subgroup, 
reports to the working group. If a working group comes to consensus on 
recommendations for action, the package is presented to the RSAC for a 
vote. If the proposal is accepted by a simple majority of the RSAC, the 
proposal is formally recommended to FRA. FRA then determines what 
action to take on the recommendation. Because FRA staff has played an 
active role at the working group and subgroup levels in discussing the 
issues and options and in drafting the language of the consensus 
proposal, and because the RSAC recommendation constitutes the consensus 
of some of the industry's

[[Page 35955]]

leading experts on a given subject, FRA is generally favorably inclined 
toward the RSAC recommendation. However, FRA is in no way bound to 
follow the recommendation and the agency exercises its independent 
judgment on whether the recommended rule achieves the agency's 
regulatory goals, is soundly supported, and was developed in accordance 
with the applicable policy and legal requirements. Often, FRA varies in 
some respects from the RSAC recommendation in developing the actual 
regulatory proposal.
    In developing this proposal, FRA adopted the RSAC PTC Working Group 
approach. As part of this effort, FRA is working with the major 
stakeholders affected by this subpart in as much a collaborative manner 
as possible. FRA believes establishing a collaborative relationship 
early in the product development and regulatory development cycles can 
help bridge the divide between the railroad carrier's management, 
railroad labor organizations, the suppliers, and FRA by ensuring that 
all stakeholders are working with the same set of data and have a 
common understanding of product characteristics or their related 
processes production methods, including the regulatory provisions, with 
which compliance is mandatory. However, where the group failed to reach 
consensus on an issue, FRA used its authority to resolve the issue, 
attempting to reconcile as many of the divergent positions as possible 
through traditional rulemaking proceedings.
    On December 10, 2008, the RSAC accepted a task (No. 08-04) entitled 
``Implementation of Positive Train Control Systems.'' The purpose of 
this task was defined as follows: ``To provide advice regarding 
development of implementing regulations for Positive Train Control 
(PTC) systems and their deployment under the Rail Safety Improvement 
Act of 2008.'' The task called for the RSAC PTC Working Group to 
perform the following:
     Review the mandates and objectives of the Act related to 
deployment of PTC systems;
     Help to describe the specific functional attributes of 
systems meeting the statutory purposes in light of available 
technology;
     Review impacts on small entities and ascertain how best to 
address them in harmony with the statutory requirements;
     Help to describe the details that should be included in 
the implementation plans that railroads must file within 18 months of 
enactment of the Act;
     Offer recommendations on the specific content of 
implementing regulations; and The task also required the PTC Working 
Group to:
     Report on the functionalities of PTC systems;
     Describe the essential elements bearing on 
interoperability and the requirements for consultation with other 
railroads in joint operations; and
     Determine how PTC systems will work with the operation of 
non-equipped trains.
    The PTC Working Group was formed from interested organizations that 
are members of the RSAC. The following organizations contributed 
members:

American Association of State Highway & Transportation Officials 
(AAHSTO)
American Chemistry Council (ACC)
American Public Transportation Association (APTA)
American Short Line and Regional Railroad Association (ASLRRA)
Association of American Railroads (AAR)
Association of State Rail Safety Managers (ASRSM)
Brotherhood of Maintenance of Way Employees Division (BMWED)
Brotherhood of Locomotive Engineers and Trainmen Division (BLETD)
Brotherhood of Railroad Signalmen
Federal Transit Administration*
International Brotherhood of Electrical Workers
National Railroad Construction and Maintenance Association
National Railroad Passenger Corporation (Amtrak)
National Transportation Safety Board (NTSB)*
Railway Supply Institute (RSI)
Transport Canada*
Tourist Railway Association Inc.
United Transportation Union (UTU)
    *Indicates associate (non-voting) member.

    From January to April 2009, FRA met with the entire PTC Working 
Group five times over the course of twelve days. During those meetings, 
in order to efficiently accomplish the tasks assigned to it, the PTC 
Working Group empowered three task forces to work concurrently. These 
task forces were the passenger, short line and regional railroad, and 
the radio and communications task forces. Each discussed issues 
specific to their particular interests and needs and produced proposed 
rule language for the PTC Working Group's consideration. The majority 
of the proposals were adopted into the rule as agreed upon by the 
working group, with rule language related to a remaining few issues 
being further discussed and enhanced for inclusion into the rule by the 
PTC Working Group.
    The passenger task force discussed testing issues relating to parts 
236 and 238 and the definition of ``main line'' under the statute, 
including possible passenger terminal and limited operations exceptions 
to PTC implementation. Recommendations of the task force were presented 
to the PTC Working Group, which adopted or refined each suggestion.
    The short line and regional railroad task group was formed to 
address the questions pertaining to Class II and Class III railroads. 
Specifically, the group discussed issues regarding the trackage rights 
of Class II and III railroads using trains not equipped with PTC 
technology over a Class I railroad's PTC territory, passenger service 
over track owned by a Class II or Class III railroads where PTC would 
not otherwise be required, and railroad crossings-at-grade involving a 
Class I railroad's PTC-equipped train and a Class II or III railroad's 
PTC unequipped train. After much discussion, there were no resolutions 
reached to any of the main issues raised. However, the discussion 
yielded insights utilized by FRA in preparing this proposed rule.
    The radio and communications task force addressed wireless 
communications issues, particularly as it relates to communications 
security, and recommended language for proposed Sec.  236.1033.
    FRA staff worked with the PTC Working Group and its task forces in 
developing many facets of this proposal. FRA gratefully acknowledges 
the participation and leadership of representatives who served on the 
PTC Working Group and its task forces. These points are discussed to 
show the origin of certain issues and the course of discussion on these 
issues at the task force and working group levels. We believe this 
helps illuminate the factors FRA weighed in making its regulatory 
decisions regarding this proposed rule and the logic behind those 
decisions.
    In general, the PTC Working Group agreed on the process for 
implementing PTC under the statute, including decisional criteria to be 
applied by FRA in evaluating safety plans, adaptation of subpart H 
principles to support this mandatory implementation, and refinements to 
subpart H and the part 236 appendices necessary to dovetail the two 
regulatory regimes and take lessons from early implementation of 
subpart H, including most aspects of the training requirements. Notable 
accords were reached, as well, on major functionalities of PTC and on 
exceptions applicable to passenger

[[Page 35956]]

service (terminal areas and main line exceptions). Major areas of 
disagreement included whether to allow non-equipped trains on PTC 
lines, extension of PTC to lines not within the statutory mandate, and 
whether to provide for additional onboard displays when two or more 
persons are regularly assigned duties in the cab. Some additional areas 
of concern were discussed but could not be resolved in the time 
available. It was understood that where discussion did not yield 
agreement, FRA would make proposals and receive public comment.

V. Use of Performance Standards

    Given the statutory mandate for the implementation of PTC systems, 
FRA intends the proposed rule to accelerate the promotion of, and not 
hinder, cost effective technological innovation by encouraging an 
efficient utilization of resources, an increased level of competition, 
and more innovative user applications and technological developments. 
FRA believes that, wherever possible, regulation must allow 
technologies the full freedom to exploit market opportunities, must 
support the challenges and opportunities resulting from the combination 
of emerging and varying technologies within an evolving marketplace, 
and should not discriminate between PTC systems vendors due to the 
technology or services provided.
    Accordingly, wherever possible, FRA has attempted to refrain as 
much as possible from developing technical or design standards, or even 
requiring implementation of particular PTC technologies that may 
prevent technological innovation or the development of alternative 
means to achieve the statutorily defined PTC functions. If FRA were to 
implement specific technical standards, emerging technologies may 
render those standards obsolete. Thus, implementation of systems by the 
railroads using new technologies that are not addressed by the specific 
standards would require railroads and FRA to manage the deployment of 
alternative technologies using a cumbersome and time consuming waiver 
process. Consequently, for the same reasons FRA expressed in the final 
rule implementing subpart H (70 FR 11052, 11055-11059 (Mar. 7, 2005)), 
FRA continues to believe that it is best to pursue a performance-based 
standard while providing sufficient basic parameters within which the 
PTC system's architectures and functionalities must be developed, 
implemented, and maintained.
    Like subpart H of part 236, proposed subpart I provides for the 
same level of product confidence and versatility in determining what 
PTC technology a railroad may elect to implement and operate, even if 
the railroad chooses to modify its PTC system over time. Unlike subpart 
H, however, proposed subpart I requires specific deployment of PTC 
while simplifying the application process, potentially reducing the 
size of the regulatory filings through facilitation of safety 
documentation reuse, and more narrowly defining the required 
performance targets based on railroad operations and in terms of more 
specific functional PTC behaviors. The approach under subpart I also 
reduces the likelihood of continually changing safety targets, which 
may vary based on each railroad's safety culture, and provides for 
incremental improvements in safety in coordination with FRA.
    To ensure sufficient confidence in each PTC system implemented 
under subpart I, FRA expects that all safety- and risk-related data be 
supported by credible evidence or information. Such credible evidence 
or information may be developed through laboratory or field testing, 
augmented by appropriate analysis and inspection, which may be 
monitored or reviewed by FRA. FRA expects that, as a practical matter, 
lab testing would be performed in the majority of cases. FRA does not 
believe it is necessary to require any railroad to lab test. However, 
field testing may be required in certain instances to test certain 
points of the PTC system in various conditions.
    If the railroad or FRA determines that the complexity of the 
technology or the supporting safety case warrants, credibility of this 
information may also be evaluated through an assessment of Verification 
and Validation performed by an acceptable independent third party 
selected and paid for by the railroad, subject to FRA approval. 
Ultimately, however, it is FRA's responsibility to determine whether 
each PTC system's performance results in an acceptable level of safety 
to railroad employees and the general public and whether any such 
system shall receive PTC System Certification, as required by statute. 
In order to provide meaningful flexibility, FRA is prepared to consider 
use of alternative risk analysis methods and proposals regarding the 
extent to which a product exhibits fail-safe behavior. FRA still 
emphasizes that higher speed and higher risk rail service should be 
supported by more highly competent train control technology and 
analysis.
    FRA recognizes that there may potentially be various PTC system 
configurations and a variety of operational scopes involved. FRA 
believes that the information requested under subpart I should be 
sufficient to permit FRA to predict whether a PTC system is fully 
adequate from a safety perspective. Subparts H and I require submission 
of similar technical data. Given the degree of uncertainty associated 
with the underlying analysis of a complex PTC system and its environs, 
subpart I--much like subpart H--requires application of FRA's judgment 
and expertise. Given the complexity of the underlying analysis--and 
FRA's need to ensure an acceptable level of safety and analytical 
uniformity between functionally equivalent but architecturally 
different systems--it is incumbent upon the subject railroad, possibly 
in concert with the vendor, supplier, or manufacturer of its PTC 
system, to make a persuasive case in its filings that the applicable 
performance standards are met. Primarily, the risk assessments required 
by the proposed rule should provide an objective measure of the safety 
risk levels involved, which will be reviewed by FRA for comparison 
purposes. As such, FRA believes that each risk assessment should 
determine relative risk levels, rather than absolute risk levels, but 
against a clearly delineated base case acceptable to FRA under the 
proposed regulation.
    Thus, this proposed rule attempts to emphasize the determination of 
relative risk. FRA believes that the guidelines captured in Appendix B 
adequately state the objectives and major considerations of any risk 
assessment it would expect to see submitted under proposed subpart I. 
FRA also believes that these guidelines allow sufficient flexibility in 
the conduct of risk assessments, yet provide sufficient uniformity by 
helping to ensure that final results are presented in familiar units of 
measurement.
    One of the major characteristics of a risk assessment is whether it 
is performed using qualitative or quantitative methods. FRA continues 
to believe that both quantitative and qualitative risk assessment 
methods may be used, as well as combinations of the two. FRA expects 
that qualitative methods should be used only where appropriate, and 
only when accompanied by an explanation as to why the particular risk 
cannot be fairly quantified. FRA also continues to believe that 
railroads and suppliers should not be limited in the type of risk 
assessments they should be allowed to perform to demonstrate compliance 
with the minimum performance standard. The state of the art of risk

[[Page 35957]]

assessment methods could potentially change more quickly than the 
regulatory process will allow, and not taking advantage of these 
innovations could slow the progress of implementation of safer signal 
and train control systems. Thus, as in subpart H, FRA is allowing risk 
assessment methods not meeting the guidelines of this rule, so long as 
it can be demonstrated to the satisfaction of the FRA Associate 
Administrator for Railroad Safety/Chief Safety Officer (hereinafter 
Associate Administrator) that the risk assessment method used is 
suitable in the context of the particular PTC system. FRA believes this 
determination is best left to the Associate Administrator because the 
FRA retains authority to ultimately prevent implementation of a system 
whose plans do not adequately demonstrate compliance with the 
performance standard under the proposed rule.
    FRA is aware that some types of risk are more amenable to 
measurement by using certain methods rather than others because of the 
type and amount of data available. If a railroad does elect to use 
different risk assessment methods, FRA will consider this as a factor 
for PTC System Certification (see Sec.  236.1015). Also, in such cases, 
when the margin of uncertainty has been inadequately described, FRA 
will be more likely to require FRA monitored field or laboratory 
testing (see Sec.  236.1035) or an independent third-party assessment 
(see Sec.  236.1017).
    When FRA issued the final rule establishing subpart H, FRA 
considered the criteria of simplicity, relevancy, reliability, cost, 
and objectivity. FRA believes that these criteria remain applicable. 
FRA has attempted to make the requirements under subpart I simpler than 
the requirements of subpart H, so that railroads will be provided with 
a greater amount of flexibility to more easily demonstrate that its PTC 
system is certifiable by FRA. Like subpart H, subpart I focuses on the 
safety-relevant characteristics of systems and emphasizes all relevant 
aspects of product performance. FRA also drafted performance standards 
that can be applied reliably and precisely in a manner which should 
yield similar results each time it is applied to the same subject. 
Although RSIA08 appears to make cost a consideration secondary to 
safety, FRA believes that demonstrating compliance under subpart I 
should minimize those costs while not degrading the primary objective 
of public safety. FRA also believes that subpart I includes an 
objective performance standard where compliance can be determined 
through sound engineering analysis, testing, or investigation.

VI. Section-by-Section Analysis

    Unless otherwise noted, all section references below refer to 
sections in title 49 of the Code of Federal Regulations (CFR). FRA 
seeks comments on all proposals made in this NPRM.

Proposed Amendments to 49 CFR Part 229

Section 229.135 Event Recorders

    Advances in electronics and software technology have not only 
enabled the development of PTC systems, but have also resulted in 
changes to the implementation of locomotive control systems. These 
technological changes have provided for the introduction of new 
functional capabilities and the integration of different functions in 
ways that advance the building, operation, and maintenance of 
locomotive control systems. FRA also recognizes that advances in 
technology may further eliminate the traditional distinctions between 
locomotive control and train control functionalities. Indeed, 
technological advances may provide opportunities for increased or 
improved functionalities in train control systems that run concurrently 
with locomotive control.
    Train control and locomotive control, however, remain two 
fundamentally different operations with different objectives. FRA does 
not want to restrict the adoption of new locomotive control functions 
and technologies by imposing regulations on locomotive control systems 
intended to address safety issues associated with train control. 
Accordingly FRA is reviewing and enhancing the Locomotive Safety 
Standards (49 CFR part 229) to address the use of advanced electronics 
and software technologies to improve safe, efficient, and economical 
locomotive operations when a new or proposed locomotive control system 
function does not interface or commingle with a safety-critical train 
control system. In the meantime, FRA proposes to amend Sec.  229.135 to 
ensure its applicability to subpart I.

Proposed Amendments to 49 CFR Part 234

Section 234.275 Processor-Based Systems

    Section 234.275 of title 49 presently requires that each processor-
based system, subsystem, or component used for active warning at 
highway-rail grade crossings that is new or novel technology, or that 
provides safety-critical data to a railroad signal or train control 
system which is qualified using the subpart H process, shall also be 
governed by those requirements, including approval of a Product Safety 
Plan. Particularly with respect to high speed rail, FRA anticipates 
that PTC systems will in some cases incorporate new or novel technology 
to provide for crossing pre-starts (reducing the length of approach 
circuits for high speed trains), verify crossing system health as 
between the wayside and approaching trains, or slow trains approaching 
locations where storage has been detected on a crossing, among other 
options. Indeed, each of these functions is presently incorporated in 
at least one train control system, and others may one day be feasible 
(including in-vehicle warning). There would appear to be no reason why 
such a functionality intended for inclusion in a PTC system mandated by 
subpart I could not be qualified with the rest of the PTC system under 
subpart I. On the other hand, care should be taken to set an 
appropriate safety standard taking into consideration highway users, 
occupants of the high speed trains, and others potentially affected.
    In fact, with new emphasis on high speed rail, FRA needs to 
consider the ability of PTC systems to integrate this type of new 
technology and thereby reduce risk associated with high speed rail 
service. Risk includes derailment of a high speed train with 
catastrophic consequences after encountering an obstacle at a highway-
rail grade crossing. To avoid such consequences, as many crossings as 
possible should be eliminated. To that end, 49 CFR 213.347 requires a 
warning and barrier plan to be approved for Class 7 track (speeds above 
110 mph) and prohibits grade crossings on Class 8 and 9 track (above 
125 mph). That leaves significant exposure on Class 5 and 6 track that 
is currently not addressed by regulation. Comment is requested on how 
best to approach this issue, ensuring that various FRA regulations, 
including subpart I, address this safety need effectively and in 
harmony with one another.

Proposed Amendments to 49 CFR Part 235

Section 235.7 Changes Not Requiring Filing of Application

    FRA proposes to amend this section of the regulation which allows 
specified changes within existing signal or train control systems be 
made without the necessity of filing an application. The amendment 
consists of adding allowance for a railroad to remove an intermittent 
automatic train stop system

[[Page 35958]]

in conjunction with the implementation of a PTC system approved under 
subpart I of part 236.
    The changes allowable under this section, without filing of an 
application, are those identified on the basis that the resultant 
condition will be at least no less safe than the previous condition. 
The required functions of PTC within subpart I provide a considerably 
higher level of functionality related to both alerting and enforcing 
necessary operating limitations than an intermediate automatic train 
stop system does. Additionally, in the event of the loss of PTC 
functionality (i.e., a failure en route), the operating restrictions 
required will provide the needed level of safety in lieu of the 
railroad being expected to keep and maintain an underlying system such 
as intermittent automatic train stop for only in such cases. FRA 
therefore believes that with the implementation of PTC under the 
requirements of subpart I, the safety value of any previously existing 
intermittent automatic train stop system is entirely obviated. There 
were no objections in the PTC Working Group to this amendment.

Proposed Amendments to 49 CFR Part 236

Section 236.0 Applicability, Minimum Requirements, and Penalties

    FRA proposes to amend this existing section of the regulation to 
remove manual block from the methods of operation permitting speeds of 
50 miles per hour or greater for freight trains and 60 miles per hour 
or greater for passenger trains. Manual block rules do create a 
reasonably secure means of preventing train collisions. However, where 
the attributes of block signal systems are not present, misaligned 
switches, broken rails, or fouling equipment may cause a train 
accident. FRA believes that contemporary expectations for safe 
operations require this adjustment, which also provides a more orderly 
foundation for the application of PTC to the subject territories. There 
were no objections in the PTC Working Group to this change.

Section 236.909 Minimum Performance Standard

    FRA is proposing to modify existing Sec.  236.909 to make the risk 
metric sensitivity analysis an integral part of the full risk 
assessment required to be submitted with a product safety plan in 
accordance with Sec.  236.907(a)(7). The proposed amendment of this 
section would also eliminate an alternative option for a railroad to 
use a risk metric in which consequences of potential accidents are 
measured strictly in terms of fatalities.
    Currently, Sec.  236.909(e)(1) indicates how safety and risk should 
be measured for the full risk assessment, but does not accentuate the 
need for running a sensitivity analysis on chosen risk metrics to 
assure that the worst case scenarios for the proposed system failures 
or malfunctions are accounted for in the risk assessment. On the other 
hand, Appendix B to this part mandates that each risk metric for the 
proposed product must be expressed with an upper bound, as estimated 
with a sensitivity analysis. The FRA's experience gained while 
reviewing product safety plans submitted to FRA in accordance with 
subpart H, revealed that the railroad's did not understand a 
sensitivity analysis for the chosen risk metrics to be a mandatory 
requirement. Accordingly, to ensure clarity regarding FRA's 
expectations, FRA proposes to amend paragraph (e)(1) to explicitly 
require the performance of a sensitivity analysis for the chosen risk 
metrics. The language proposed in this rule explains the need for the 
sensitivity analysis and describes the key input parameters that must 
be analyzed.
    The proposed modification to paragraph (e)(2) is intended to 
clarify how the exposure and its consequences, as main components of 
the risk computation formula, must be measured. Under the proposed rule 
text, the exposure must be measured in train miles per year over the 
relevant railroad infrastructure where a proposed system is to be 
implemented. When determining the consequences of potential accidents, 
the railroad must identify the total costs involved, including those 
relating to fatalities, injuries, property damage, and other 
incidentals. FRA proposes to eliminate the option of using an 
alternative risk metric, which would allow the measurement of 
consequences strictly in terms of fatalities. It is FRA's experience 
that measuring consequences of accidents strictly in terms of 
fatalities did not serve as an adequate alternative to metrics of total 
cost of accidents for two main reasons. First, the statistical data on 
railroad accidents shows that accidents involving fatalities also cause 
injuries and significant damage to railroad property and infrastructure 
for both freight and especially passenger operations. Even though the 
cost of human life is often the highest component of monetary estimates 
of accident consequences, the dollar estimates of injuries, property 
losses, and damage to the environment associated with accidents 
involving fatalities cannot and should not be discounted in the risk 
analysis. Second, allowing fatalities to serve as the only risk metrics 
of accident consequences confused the industry and the risk assessment 
analysts attempting to determine the overall risk associated with the 
use of certain types of train control systems. As a result, some risk 
analysts inappropriately converted injuries and property damages for 
observed accidents into relative estimates of fatalities. This method 
cannot be considered acceptable because, while distorting the overall 
picture of accident consequences, it also raises questions on 
appropriateness of conversion coefficients. Therefore, FRA considers it 
appropriate to eliminate from the rule the alternative option for 
consequences to be measured in fatalities only.

Subpart I--Positive Train Control Systems

Section 236.1001 Purpose and Scope

    This section describes both the purpose and the scope of subpart I. 
Subpart I provides performance-based regulations for the development, 
test, installation, and maintenance of Positive Train Control (PTC) 
Systems, and the associated personnel training requirements, that are 
mandated for installation by FRA. This subpart also details the process 
and identifies the documents that railroads and operators of passenger 
trains are to utilize and incorporate in their PTC implementation 
plans. This subpart also details the process and procedure for 
obtaining FRA approval of such plans.

Section 236.1003 Definitions

    Given that a natural language such as English contains, at any 
given time, a finite number of words, any comprehensive list of 
definitions must either be circular or leave some terms undefined. In 
some cases, it is not possible and indeed not necessary to state a 
definition. Where possible and practicable, FRA prefers to provide 
explicit definitions for terms and concepts rather than rely solely on 
a shared understanding of a term through use.
    Paragraph (a) reinforces the applicability of existing definitions 
of subparts A through H. The definitions of subparts A through H are 
applicable to subpart I, unless otherwise modified by this part.
    Paragraph (b) introduces definitions for a number of terms that 
have specific meanings within the context of subpart I. In lieu of 
analyzing each definition here, however, some of the delineated

[[Page 35959]]

terms will be discussed as appropriate while analyzing other sections 
below.
    As a general matter, however, FRA believes it is important to 
explain certain organizational changes required pursuant to RSIA08. The 
statute establishes the position of a Chief Safety Officer. The Chief 
Safety Officer has been designated as the Associate Administrator for 
Railroad Safety. Thus, the use of the term Associate Administrator in 
this subpart refers to the Associate Administrator for Railroad Safety 
and Chief Safety Officer.

Section 236.1005 Requirements for Positive Train Control Systems

    RSIA08 specifically requires that each PTC system be designed to 
prevent train-to-train collisions, overspeed derailments, incursions 
into established work zone limits, and the movement of a train through 
a switch left in the wrong position. Section 236.1005 includes the 
minimum statutory requirements and provides amplifying information 
defining the necessary PTC functions and the situations under which PTC 
systems must be installed. Each PTC system must be reliable and perform 
the functions specified in RSIA08. FRA requests comments on whether the 
definitions and amplifying information within Sec.  236.1005 are 
appropriate interpretations of RSIA08 and whether FRA is exercising the 
appropriate level of discretion and flexibility to comply with RSIA08 
in the most cost effective and efficient manner.
    Train-to-train collisions. Paragraph (a)(1)(i) proposes to apply 
the statutory requirement that a mandatory PTC system must be designed 
to prevent train-to-train collisions. FRA understands this to mean 
head-to-head, rear-end, and side and raking collisions between trains 
on the same, converging, or intersecting tracks. PTC technology now 
available can meet these needs through guidance to the locomotive 
engineer that is current and continuous and through enforcement using 
predictive braking to stop short of known targets. FRA notes that the 
technology associated with currently available PTC systems may not 
completely eliminate all collisions risks. For instance, a PTC system 
mandated by this subpart is not required to prevent a collision caused 
by a train that derails and moves over an area not covered by track and 
onto a neighboring or adjacent track (known in common parlance as a 
``secondary collision'').
    During discussions regarding available PTC technology, it has been 
noted that this technology also has inherent limitations with respect 
to prevention of certain collisions that might occur at restricted 
speed. In signaled territory, there are circumstances under which 
trains may pass red signals, other than absolute signals except with 
verbal authority, either at restricted speed or after stopping and then 
proceeding at restricted speed. Available PTC technology does not track 
the rear end of each train as a target that another train must be 
stopped short of but instead relies on the signal system to indicate 
the appropriate action. In this example, the PTC system would display 
``restricted speed'' to the locomotive engineer as the action required 
and would enforce the upper limit of restricted speed (i.e., 15 or 20 
miles per hour, depending on the railroad). This means that more 
serious rear end collisions will be prevented, because the upper limit 
of restricted speed is enforced, and it also means that fewer low speed 
rear-end collisions will occur because a continuous reminder of the 
required action will be displayed to the locomotive engineer (rather 
than the engineer relying on the aspect displayed by the last signal, 
which may have been passed some time ago). However, some potential for 
a low-speed rear-end collision will remain in these cases, and the rule 
is clear that this limitation has been accepted. Similar exposure may 
occur in non-signaled territory where trains are conducting switching 
operations or other activities under joint authorities. The PTC system 
can enforce the limits of the authority and the upper limit of 
restricted speed, but it cannot guarantee that the trains sharing the 
authority will not collide. Again, however, the likelihood and average 
severity of any potential collisions would be greatly reduced. FRA may 
address this issue in a later modification to subpart I if necessary as 
technology becomes available.
    The proposed rule text does, however, provide an example of a 
potential train-to-train collision that a PTC system should be designed 
to prevent. Rail-to-rail crossings-at-grade--otherwise known as diamond 
crossings--present a risk of side collisions. FRA recognizes that such 
intersecting lines may or may not require PTC system implementation and 
operation. Since a train operating with a PTC system cannot necessarily 
recognize a train not operating with a PTC system or moving on an 
intersecting track without a PTC system, the PTC system--no matter how 
intelligent--may not be able to prevent a train-to-train collision in 
such circumstances.
    Accordingly, paragraph (a)(1)(i) proposes to require certain 
protections for such rail-to-rail crossings-at-grade. While these 
locations are specifically referenced in paragraph (a)(1)(i), their 
inclusion is merely illustrative and does not necessarily preclude any 
other type of potential train-to-train collision. Moreover, a host 
railroad may have alternative arrangements to the specific protections 
referenced in the associated table under paragraph (a)(1)(i), which it 
must submit in its PTC Safety Plan (PTCSP)--discussed in detail below--
and receive a PTC System Certification associated with that PTCSP.
    Rail-to-rail crossings-at-grade that have one or more PTC routes 
intersecting with one or more routes without a PTC system must have an 
interlocking signal arrangement in place developed in accordance with 
subparts A through G of part 236 and a PTC enforced stop on all PTC 
routes. FRA has also determined that the level of risk varies based 
upon the speeds at which the trains operate through such crossings, as 
well as the presence, or lack, of PTC equipped lines leading into the 
crossing. Accordingly, under a compromise accepted by the PTC Working 
Group, if the maximum speed on at least one of the intersecting tracks 
is more than 40 miles per hour, then the routes without a PTC system 
must also have either some type of positive stop enforcement or a 
split-point derail on each approach to the crossing and incorporated 
into the signal system, and a permanent maximum speed limit of 20 miles 
per hour. FRA expects that these protections be instituted as far in 
advance of the crossing as is necessary to stop the encroaching train 
from entering the crossing. The 40 miles per hour threshold appears to 
be appropriate given three factors. First, the frequency of collisions 
at these rail intersections is low, because typically one of the routes 
is favored on a regular basis and train crews expect delays until 
signals clear for their movement. Second, the special track structure 
used at these intersections, known as crossing diamonds, experiences 
heavy wear; and railroads tend to limit speeds over these locations to 
no more than 40 miles per hour. Finally, FRA recognizes that for a 
train on either intersecting route, elevated speed will translate into 
higher kinetic energy available to do damage in a collision-induced 
derailment. Thus, for the relatively small number of rail crossings 
with one or more routes having an authorized train speed above 40 miles 
per hour, including higher speed passenger routes, it is particularly 
important that any collision be prevented. FRA appreciates that a more 
protective approach could be considered and welcomes any data or

[[Page 35960]]

commentary that might bear on this issue.
    FRA believes that these more aggressive measures are required to 
ensure train safety in the event the engineer does not stop a train 
before reaching the crossing when the engineer does not have a cleared 
route displayed by the interlocking signal system and higher speed 
operations are possible on the route intersected. The split-point 
derail would prevent a collision in such a case by derailing the 
offending train onto the ground before it reaches the crossing. Should 
the train encounter a split-point derail as a result of the crew's 
failure to observe the signal indication, the slower speed at which the 
unequipped train is required to travel would minimize the damage to the 
unequipped train and the potential affect on the surrounding area. As 
an alternative to split-point derails, the non-PTC line may be 
outfitted with some other mechanism that ensures a positive stop of the 
unequipped crossing train. If a PTC system or systems are installed and 
operated on all crossing lines, there are no speed restrictions other 
than those that might be enforced as part of a civil or temporary speed 
restriction. However, the crossing must be interlocked and the PTC 
system or systems must ensure that each of the crossing trains can be 
brought safely to a stop before reaching the crossing in the event that 
another train is already cleared through or occupying the crossing.
    Overspeed derailments. Paragraph (a)(1)(ii) proposes that PTC 
systems mandated under subpart I be designed to prevent overspeed 
derailments and addresses specialized requirements for doing so. FRA 
notes that a number of passenger train accidents with significant 
numbers of injuries have been caused by trains exceeding the maximum 
allowable speed at turnouts and crossovers and upon entering stations. 
Accordingly, FRA emphasizes the importance of enforcement of turnout 
and crossover speed restrictions, as well as civil speed restrictions.
    For instance, in the Chicago region, two serious train accidents 
occurred on the same Metra commuter line when locomotive engineers 
operated trains at more than 60 miles per hour while traversing between 
tracks using crossovers, which were designed to be safely traversed at 
10 miles per hour. For illustrative purposes, the rule text makes clear 
that such derailments may be related to railroad civil engineering 
speed restrictions, slow orders, and excessive speeds over switches and 
through turnouts and these types of speed restrictions are to be 
enforced by the system.
    Roadway work zones. Paragraph (a)(1)(iii) proposes that PTC systems 
mandated under subpart I be designed to prevent incursions into 
established work zone limits. Work zone limits are defined by time and 
space. The length of time a work zone limit is applicable is determined 
by human elements. Working limits are obtained by contacting the train 
dispatcher, who will confirm an authority only after it has been 
transmitted to the PTC server. Paragraph (a)(1)(iii) emphasizes the 
importance of the PTC systems to provide positive protection for 
roadway workers working within the limits of their work zone. 
Accordingly, once a work zone limit has been established, the PTC 
system must be notified. The PTC system must continue to obey that 
limit until it is notified from the dispatcher or roadway worker in 
charge, with verification from the other, either that the limit is 
released and the train is authorized to enter or the roadway worker in 
charge authorizes movement of the train through the work zone.
    As a way to achieve this technological functionality, FRA's Office 
of Railroad Development has funded the development of a Roadway Worker 
Employee in Charge (EIC) Portable Terminal that allows the EIC to 
control the entry of trains into the work zone. While no rule includes 
the commonly used term EIC, FRA recognizes that it is the equivalent to 
the ``Roadway Worker In Charge'' as used in part 214. With the portable 
terminal, the EIC can directly control the entry of trains into the 
work zone and restrict the speed of the train through the work zone. If 
the EIC does not grant authority for the train to enter the work zone, 
the train is forced to a stop prior to violating the work zone 
authority limits. If the EIC authorizes entry of the train into the 
work zone, the EIC may establish a maximum operating speed for the 
train consistent with the safety of the roadway work employees. This 
speed is then enforced on the train authorized to enter and pass 
through the work zone. The technology is significantly less complex 
than the technology associated with dispatching systems and the PTC 
onboard system. In view of this, FRA strongly encourages deployment of 
such portable terminals as opposed to current approaches which only 
require the locomotive engineer to in some manner ``acknowledge'' his 
or her authority to operate into or through the limits of the work zone 
(e.g., by pressing a soft key on the onboard display, even if in 
error).
    Pending the adoption of more secure technology such as the EIC 
Portable Terminal, FRA will scrutinize PTC Safety Plans to determine 
whether they leave no opportunity for single point human failure in the 
enforcement of work zone limits. FRA again notes that some approaches 
in the past have provided that the locomotive engineer could simply 
acknowledge a work zone warning, even if inappropriately, after which 
the train could proceed into the work zone. FRA proposes that more 
secure procedures be included in safety plans under the new proposed 
subpart.
    Movement over main line switches. Paragraph (a)(1)(iv) proposes to 
require that PTC systems mandated under subpart I be designed to 
prevent the movement of a train through a main line switch in the 
improper position. Given the complicated nature of switches--especially 
when operating in concert with wayside, cab, or other similar signal 
systems--the proposed rule provides more specific requirements in 
paragraph (e) as discussed further below.
    In numerous paragraphs, the proposed rules require various 
operating requirements based primarily on signal indications. 
Generally, these indications are communicated to the engineer, who 
would then be expected to operate the train in accordance with the 
indications and authorities provided. However, a technology that 
receives the same information does not necessarily have the wherewithal 
to respond unless it is programmed to do so. Thus, paragraph (a)(2) 
requires PTC systems implemented under subpart I to obey and enforce 
all such indications and authorities provided by these safety-critical 
underlying systems. The integration of the delivery of the indication 
or authority with the PTC system's response to those communications 
must be described and justified in the PTC Development Plan (PTCDP)--
further described below--and the PTCSP, as applicable, and then must 
comply with those descriptions and justifications.
    The PTC Working Group had extensive discussions concerning the 
monitoring of main line switches and came to the following general 
conclusions:
    First, signal systems do a good job of monitoring switch position, 
and enforcement of restrictions imposed in accordance with the signal 
system is the best approach within signaled territory (main track and 
controlled sidings). As a general rule, the enforcement required for 
crossovers, junctions, and entry into and departure from controlled 
sidings will be a positive stop, and the enforcement provided for other 
switches (providing access to industry tracks and

[[Page 35961]]

non-signaled sidings and auxiliary tracks) will be display and 
enforcement of the upper limit of restricted speed. National 
Transportation Safety Board representatives were asked to evaluate 
whether this strategy meets the needs of safety from their perspective. 
They returned with a list of accidents caused by misaligned switches 
that the Board had investigated in recent years, none of which was in 
signaled territory. Based on that data, the NTSB staff decided that it 
was not necessary to monitor individual switches in signaled territory.
    Second, switch monitoring functions of contemporary PTC systems 
provide an excellent approach to addressing this requirement in dark 
territory. However, it is important to ensure that switch position is 
determined with the same degree of integrity that one would expect 
within a signaling system (e.g., fail safe point detection, proper 
verification of adjustment). The PTC Working Group puzzled over sidings 
in dark territory and how to handle the requirement for switch 
monitoring in connection with those situations. (While these are not 
``controlled'' sidings, as such, they will often be mapped so that 
train movements into and out of the sidings are appropriately 
constrained.) At the final PTC Working Group meeting, a proposal was 
accepted that would treat a siding as part of the main line track 
structure requiring monitoring of each switch off of the siding if the 
siding is non-signaled and the authorized train speed within the siding 
exceeds 20 miles per hour.
    This issue is more fully discussed below.
    Other functions. While FRA has included the core PTC system 
requirements in Sec.  236.1005, there is the possibility that other 
functions may be explicitly or implicitly required elsewhere in subpart 
I. Accordingly, under paragraph (a)(3), each PTC system required by 
subpart I must also perform any other functions specified in subpart I. 
According to 49 U.S.C. 20157(g), FRA must prescribe regulations 
specifying in appropriate technical detail the essential 
functionalities of positive train control systems and the means by 
which those systems will be qualified.
    In addition to the general performance standards required under 
paragraphs (a)(1)-(3), paragraph (a)(4) proposes more prescriptive 
performance standards relating to the situations paragraphs (a)(1)-(3) 
intend to prevent. Paragraph (a)(4) defines specific situations where 
FRA has determined that specific warning and enforcement measures are 
necessary to provide for the safety of train operations, their crews, 
and the public and to accomplish the goals of the PTC system's 
essential core functions. Under paragraph (a)(4)(i), FRA proposes to 
prevent unintended movements onto PTC main lines and possible 
collisions at switches by ensuring proper integration and enforcement 
of the PTC system as it relates to derails and switches protecting 
access to the main line. Paragraph (a)(4)(ii) intends to account for 
operating restrictions associated with a highway-rail grade crossing 
active warning system that is in a reduced or non-operative state and 
unable to provide the required warning for the motoring public. In this 
situation, the PTC system must provide positive protection and 
enforcement related to the operational restrictions of alternative 
warning that are issued to the crew of any train operating over such 
crossing in accordance with part 234. Paragraph (a)(4)(iii) concerns 
the movement of a PTC operated train in conjunction with the issuance 
of an after arrival mandatory directive. While FRA recognizes that the 
use of after arrival mandatory directives poses a risk that the train 
crew will misidentify one or more trains and proceed prematurely, PTC 
provides a means to intervene should that occur. Further, such 
directives may sometimes be considered operationally useful. 
Accordingly, FRA fully expects that the PTC system will prevent 
collisions between the receiving trains and the approaching train or 
trains.
    FRA recognizes that movable bridges, including draw bridges, 
present an operational issue for PTC systems. Under subpart C, Sec.  
236.312 already governs the interlocking of signal appliances with 
movable bridge devices and FRA believes that this section should 
equally apply to PTC systems governing movement over such bridges. 
While subparts A through H apply to PTC systems--as stated in Sec.  
236.1001--paragraph (a)(4)(iv) proposes to make this abundantly clear. 
Accordingly, in paragraph (a)(4)(iv) and consistent with Sec.  236.312, 
movable bridges within a PTC route are to be equipped with an 
interlocked signal arrangement which is also to be integrated into the 
PTC system. A train shall be forced to stop prior to the bridge in the 
event that the bridge locking mechanism is not locked, the locking 
device is out of position, or the bridge rails of the movable span are 
out of position vertically or horizontally from the rails of the fixed 
span. Effective locking of the bridge is necessary to assure that the 
bridge is properly seated and thereby capable to support both the 
weight of the bridge and that of a passing train(s) and preventing 
possible derailment or other potential unsafe conditions. Proper track 
rail alignment is also necessary to prevent derailments, either of 
which again could result in damage to the bridge or a train derailing 
off the bridge.
    Paragraph (a)(4)(v) proposes that hazard detectors integrated into 
the PTC system--as required by paragraph (c) of this section or the FRA 
approved PTCSP--must provide an appropriate warning and associated 
applicable enforcement through the PTC system. There are many types of 
hazard detection systems and devices. Each type has varying operational 
requirements, limitations, and warnings based on the types and levels 
of hazard indications and severities. FRA expects this enforcement to 
include a positive stop where necessary to protect the train (e.g., 
areas with high water, flood, rock slide, or track structure flaws) or 
to provide an appropriate warning with possible movement restriction be 
acknowledged (i.e., hot journal or flat wheel detection). The details 
of these warnings and associated required enforcements are to be 
specifically addressed within a PTCDP and PTCSP subject to FRA 
approval, and the PTC system functions are to be maintained in 
accordance with the system specifications. FRA does not expect that all 
hazard detectors be integrated into the PTC systems, but where they 
are, they must interact properly with the PTC system to protect the 
train from the hazard that the detector is monitoring.
    Paragraph (a)(5) addresses the issue of broken rails, which is the 
leading cause of train derailments. FRA proposes to strictly limit the 
speed of passenger and freight operations in those areas where broken 
rail detection is not provided. Under Sec.  236.0(c), as amended in 
this rule, 24 months after the effective date of a final rule, freight 
trains operating at or above 50 miles per hour, and passenger trains 
operating at or above 60 miles per hour are required to have a block 
signal system unless a PTC system meeting the requirements of this part 
is installed. Since current technology for block signal systems relies 
on track circuits--which also provide for broken rail detection--FRA 
proposes limiting speeds where broken rail detection is not available 
to the maximums allowed under Sec.  236.0 when a block signal system is 
not installed.
    Deployment requirements. Paragraph (b) contains proposed 
requirements for where and when PTC systems must be installed. Under 
RSIA08, each applicable railroad carrier must implement a PTC system in 
accordance with its PTC Implementation Plan

[[Page 35962]]

(PTCIP), as further discussed below. The PTCIP is statutorily required 
to be submitted by April 16, 2010, and must explain how the railroad or 
railroads intend to implement an operating PTC system by December 31, 
2015. Essentially, a PTC system must be installed on certain tracks. In 
addition, except as provided under Sec.  236.1006, onboard components 
required for and responsive to the PTC system must be installed on each 
lead locomotive that operates over those tracks.
    The lead locomotive means the first locomotive proceeding in the 
direction of movement. In addition to the lead locomotive that controls 
the train while moving in a forward direction, a PTC system must be 
installed on any rear end unit control cab locomotive that is capable 
of controlling the train when it moves in the reverse direction. These 
proposed requirements assume that locomotives controlling the train may 
be placed only at each end. At this time, FRA is unaware of any 
locomotives not placed at either end of the train that may 
independently control the train. FRA seeks comments and information 
regarding these assumptions and understandings.
    As a threshold matter, RSIA08 requires that a PTC system be 
installed on certain main lines of each entity required to file a 
PTCIP. According to the statute, a main line is, with certain 
exceptions, a Class I railroad track over which 5 million or more gross 
tons of railroad traffic is transported annually. Pursuant to the 
statute, FRA may also designate additional tracks as main line and may 
provide exceptions for intercity rail or commuter passenger 
transportation over track where limited or no freight railroad 
operations occur. The statutory language does not indicate whether the 
phrase ``main line'' refers to the route used or actual trackage owned 
by the subject railroad. It is clear, however, that Congress intended 
to focus implementation and operation of PTC systems on freight lines 
owned or used by Class I railroads for operations specifically 
identified in the statute.
    For instance, by referencing Class I railroads--and not referencing 
any other type of freight railroad--FRA believes that Congress did not 
intend, as a general matter, to have smaller freight railroads incur 
the tremendous costs involved in PTC system implementation and 
operation unless they own track over which is provided regularly 
schedule intercity or commuter rail passenger transportation. Congress 
gives the Secretary discretion in 49 U.S.C. 20157(f) to require the 
installation of PTC systems on railroads other than Class I railroads 
and intercity or commuter passenger systems.
    The Surface Transportation Board (STB) has established a statutory 
definition for Class I, II, and III railroads based on the reported 
revenues in 1992. A reference to Class I railroads in this subpart 
refers to those railroads that have been designated as such by the 
Surface Transportation Board (STB). According to STB, a Class I 
railroad has revenues greater than $250 million (adjusted annually for 
inflation); a Class II railroad has revenues ranging from $20 million 
to $250 million (adjusted annually for inflation); and a Class III 
railroad has revenues that are less than $20 million (adjusted annually 
for inflation). All switching and terminal railroads, regardless of 
revenue size, are Class III railroads. The STB railroad classification 
determines the amount of reporting which a carrier must file with the 
STB. Class I railroads are required to file an annual R-1 Report, a 
detailed income, expense, and operating data report, quarterly and 
annual freight carload commodity reports, and reports on types of 
employees and employee compensation (Wage Form A and B).
    From time to time, as some Class II railroads approached the Class 
I railroad revenue threshold, these carriers petitioned the STB to 
remain as Class II railroads, so that these carriers would not be 
burdened with the additional reporting requirements. Generally the STB 
allowed this exemption. Accordingly, there may be some large 
railroads--including Montana Rail Link and Florida East Coast--that are 
Class II railroads ``by waiver,'' thereby freeing them from having to 
file Class I railroad reports with the STB.
    In drafts of this proposed rule provided to the RSAC PTC Working 
Group, it was suggested that a Class I railroad's main line be defined 
as track owned and controlled by the Class I railroad. By also 
including track ``controlled'' by the Class I railroad, FRA intended to 
include tracks not owned by Class I railroads, but used in a manner as 
if the Class I railroad did own that track. For instance, under the 
term ``controlled,'' FRA intended that a track owned by a Class II or 
III railroad would be considered a main line if a Class I railroad had 
effective control over the Class II or III railroad or that specific 
track. Without the ``control'' requirement, Class I railroads could 
divest themselves of track ownership while maintaining effective 
control for the purposes of avoiding PTC system implementation.
    The American Short Line and Regional Railroad Association (ASLRRA), 
however, expressed concern with this provision, instead suggesting that 
a Class I railroad's main line include only those lines owned and 
``operated'' by the Class I railroad. FRA believes that the underlying 
ASLRRA concern is that many of its member railroads may go out of 
business if they are mandated to install PTC systems and incur the 
associated untenable financial costs. FRA agrees that, from the point 
of view of the congressional mandate, a narrower concept is appropriate 
at this time. However, in light of future circumstances relating to 
railroad revenue, safety opportunities, traffic patterns, and other 
variables, FRA also recognizes that it may later require PTC system 
implementation and operation on certain Class II and III railroad 
tracks.
    To avoid confusion, FRA proposes to define main line by standards 
applicable to a single element. In its effort to define a Class I 
railroad's main line as track owned and controlled by the Class I 
railroad, FRA focuses the proposed definition on the status of the 
track. To also focus on the issue of operations could raise confusion 
and irreconcilable understandings. Thus, FRA is not comfortable with 
ASLRRA's suggestion. To accomplish FRA's goal and respond to ASLRRA's 
concerns, however, FRA has limited a Class I railroad's main lines to 
tracks and segments documented in the timetables last filed before 
October 16, 2008, by the Class I railroads with FRA under Sec.  217.7 
of this title over which 5 million or more gross tons of railroad 
traffic is transported annually. For most of its territory, each 
railroad is already required to track tonnage in order to satisfy the 
requirements for joint bar and internal rail flaw inspections. See 
213.119 (table), 213.237. Thus, FRA does not expect this determination 
to be difficult for railroads. For railroads that are required to 
submit a PTCIP by April 16, 2010, the gross tonnage will be based on 
2008 year traffic. To the extent rail traffic exceeds 5 million gross 
tons in any year after 2008, the tonnage shall be calculated for the 
preceding two calendar years in determining whether a PTCIP or its 
amendment is required. FRA seeks comments on whether any tracks 
intended to be covered would be missed under this approach and on 
whether there is a better approach.
    The RSIA08 requires certain tracks to be considered main line where 
a certain amount of railroad traffic is transported. However, in 
certain yard or terminal locations, trains are prepared for 
transportation, but railroad traffic is not ``transported.'' Moreover, 
FRA recognizes that in such locations, PTC system operation would be 
especially cumbersome and onerous and possibly

[[Page 35963]]

resulting in a reduction of safety due to inappropriate interventions 
by the PTC system that could lead to ``train handling'' derailments or 
hazards to personnel riding the sides of rolling stock. Accordingly, in 
such locations, FRA may not consider the subject tracks as main line. 
For such locations that only include freight operations, FRA proposes 
to consider these tracks other than main line by definition if all 
trains in the location are limited to restricted speed.
    However, for any tracks used by passenger trains, FRA proposes that 
any designation of track as other than main line should be performed on 
a case-by-case basis in accordance with Sec.  236.1019. FRA seeks 
comments on this issue. FRA also seeks comments on whether this 
explanation comports with the railroads' understanding of the rule 
text.
    Once a Class I railroad's main lines are determined, a PTC system 
must be installed and operated on those main line tracks over which 
passenger trains are operated or any PIH materials are is transported. 
As a corollary, PTC systems are not required on a Class I railroad's 
lines over which no PIH materials are transported and no passenger 
trains are operated. In addition to an applicable Class I railroad's 
main lines, a PTC system must be implemented and operated on all 
railroads' main lines over which regularly scheduled intercity rail 
passenger transportation or commuter rail passenger transportation, as 
defined by 49 U.S.C. 24102, is provided. However, FRA does not intend 
to apply this requirement to tracks operated by tourist railroads, as 
described in 49 U.S.C. 20103(f), because, inter alia, they are not 
Class I railroads and they do not provide regularly scheduled intercity 
or commuter passenger service.
    According to 49 U.S.C. 24102, ``intercity rail passenger 
transportation'' means rail passenger transportation, except commuter 
rail passenger transportation. 49 U.S.C. 24102 defines commuter rail 
passenger transportation as ``short-haul rail passenger transportation 
in metropolitan and suburban areas usually having reduced fare, 
multiple-ride, and commuter tickets and morning and evening peak period 
operations.''
    49 CFR 238.5 provides further guidance, defining a long-distance 
intercity passenger train as ``a passenger train that provides service 
between large cities more than 125 miles apart and is not operated 
exclusively in the National Railroad Passenger Corporation's Northeast 
Corridor'' and a commuter train as ``a passenger train providing 
commuter service within an urban, suburban, or metropolitan area. The 
term includes a passenger train provided by an instrumentality of a 
State or a political subdivision of a State.'' Section 238.5 also 
defines passenger service as ``a train or passenger equipment that is 
carrying, or available to carry, passengers. Passengers need not have 
paid a fare in order for the equipment to be considered in passenger or 
in revenue service.'' According to Sec.  238.5, a passenger train is 
``a train that transports or is available to transport members of the 
general public. If a train is composed of a mixture of passenger and 
freight equipment, that train is a passenger train for purposes of this 
part.''
    While the statute generally limits mandatory PTC system 
implementation and operation to certain main lines--defined for freight 
purposes as track over which 5 million or more gross tons of railroad 
traffic is transported annually--FRA is required to define passenger 
main line by regulation. See 49 U.S.C. 20157(i)(2)(B). In that regard, 
FRA has determined that freight density, as such, is not a relevant 
factor. FRA intends to cover the same intercity and commuter passenger 
services as 49 CFR part 238 (Passenger Equipment Safety Standards), 
which excludes tourist railroads (49 CFR 238.3). See also, 49 CFR part 
209, Appendix A.
    As a corollary, after December 31, 2015, no intercity or commuter 
passenger operations may operate on any track that does not have a PTC 
system installed, except as described in the proposed rule. A PTC 
system must be installed on any track--regardless of its ownership or 
the weight of annual traffic--before any intercity or commuter rail 
passenger operation may operate. Thus, any passenger or freight track 
over which such passenger trains operate must be PTC-equipped.
    The RSIA08 requires each intercity and commuter passenger railroad 
to implement PTC on ``its main line over which intercity rail passenger 
transportation or commuter rail passenger transportation, as defined in 
section 24102, is regularly provided.'' Section 24102 uses the terms 
``intercity'' and ``commuter'' in essentially the same way FRA has used 
the terms for safety regulatory purposes. The single question that has 
been puzzling in considering this mandate has been the meaning of the 
possessive article, ``its,'' before ``main line.'' It appears clear 
from the course of congressional consideration that the expression was 
intended to apply to the passenger railroad's entire route system, 
regardless of ownership. Amtrak's route system includes predominately 
trackage owned or controlled by others. Many commuter railroads operate 
partially or even exclusively over lines owned by freight railroads. On 
the other hand, FRA is persuaded that the same intention does not apply 
as to Class I freight railroads. A Class I freight railroad might 
operate a train under trackage rights over a Class II or III railroad, 
but it does not appear that was intended to burden the smaller railroad 
with the responsibility to install PTC.
    Accordingly, FRA is proposing to consider as passenger train main 
lines all tracks across the nation over which intercity or commuter 
passenger trains are transported. For the purposes of passenger trains, 
a main line is determined regardless of the amount (i.e., 5 million or 
more gross tons annually), except where temporary rerouting may occur 
in accordance with Sec. Sec.  236.1005(g)-(k) as further discussed 
below. Thus, if an intercity or commuter passenger train is transported 
over a track, the track requires PTC implementation and operation, 
regardless of whether the track is owned by a passenger railroad 
entity, a Class I railroad, or any smaller freight railroads, including 
Class II and short line railroads.
    This approach, permissible under 49 U.S.C. 20157(a)(1)(C), is 
consistent with both FRA's understanding of congressional intent and 
FRA's historical safety sensitivity to regulating passenger 
transportation. For example, in the relatively recent final rule 
governing continuous welded rail, different schedules were developed 
for track inspection intervals associated with freight and passenger 
train operations. See 71 FR 59,677, 59,681 (Oct. 11, 2006). According 
to FRA, the different schedules for track inspection were developed to 
consider the potentially greater severity, especially in terms of loss 
of life, from possible future track-related passenger train accidents.
    If FRA were to otherwise restrict PTC systems to passenger train 
main lines that are only owned by the passenger railroads, then PTC 
systems would only be required on 11 percent of all track used by the 
passenger railroads across the nation, which would mostly include the 
Northeast Corridor (NEC) and some passenger lines in Michigan. 
Considering Congress' concern with accidents involving multiple 
passenger fatalities, which appears to be a significant impetus for 
Congress' final passage of RSIA08, FRA believes that Congress did not 
intend in 49 U.S.C. 20157 to limit PTC system operation to this narrow 
passenger territory.

[[Page 35964]]

    Nevertheless, while all passenger routes, including those over 
track owned by freight railroads, are automatically deemed main lines 
under the proposed rule, the proposed rule also provides an exception 
for those main lines that would not be main lines but for the existence 
of passenger trains and are not deemed by FRA main lines due to limited 
or no freight railroad operations. This exception is permissible 
pursuant to 49 U.S.C. 20157(i)(2)(B). The proposed procedure for such 
exceptions can be found under Sec. Sec.  236.1011 and 236.1019, as 
further discussed below.
    In addition to determining which tracks require PTC system 
implementation and operation, paragraph (b) requires such installation 
be performed by the ``host railroad.'' Subpart I makes a distinction 
between the railroad that has effective operating control over a 
segment of track, and a railroad that is simply passing its trains 
across the same segment of track. While the concept of actual ownership 
of the track segment plays a significant role in determining the host 
railroad, a PTC system may be required on a track segment that is not 
owned by a PTC railroad. To avoid confusion, FRA designates the host 
railroad as the railroad that exercises operational control of the 
movement of trains on the segment, irrespective of the actual ownership 
of the segment. This is in contrast to a tenant railroad, which is any 
railroad that uses a segment of track but does not exercise operational 
control of the movements of its trains. The terms ``host railroad'' and 
``tenant railroad'' are defined as such in the definitions listed under 
Sec.  235.1003.
    The requirements for PTC contained in RSIA08 pertaining to freight 
lines define the intended route structure by reference to the presence 
or absence of PIH traffic and the annual gross tonnage. The law 
requires installation and operation of a PTC system where it (1) is 
part of a Class I railroad system, (2) carries at least 5 million gross 
tons of rail traffic, and (3) carries at least some PIH traffic. Based 
upon information available to FRA, and assuming a level of rail 
operations consistent with normal economic conditions, these 
requirements describe approximately 45,000 miles of freight-only 
territory plus almost 18,000 miles where both PIH and passengers are 
carried. There are another 6,000 miles of track owned by a Class I 
railroad and used for passenger service that would not otherwise be 
required to be equipped, for a total build-out of about 69,000 route 
miles. These lines basically describe the heart or ``core'' of the 
Class I freight network, albeit with some gaps.
    However, the railroads carry only about 100,000 carloads of PIH 
products annually (approximately 0.3% of all rail traffic). Facing an 
extraordinary potential for tort liability associated with this 
traffic, the railroads have sought through various means to reduce the 
potential for release of these commodities through safety improvements; 
but they have also sought to be relieved of their common carrier 
obligation to carry them. The RSIA08 mandate, which entails an 
expenditure of billions of dollars, most of it nominally because the 
lines in question carry PIH, presents an additional enormous incentive 
for the Class I railroads to shed PIH traffic and, further, to 
concentrate the remaining PIH traffic on the fewest possible lines of 
railroad.
    FRA is concerned that PIH traffic could be diverted from the rail 
mode. Although the risks of transporting these commodities can be 
reduced by product substitution, by coordination of transportation that 
reduces length of haul, and by other means, and although the U.S. DOT 
continues to support these means where feasible, for the present there 
are still realistic and supportable demands for transportation of these 
PIH commodities that implicate the national interest in a very strong 
way. Hazardous materials are vital to maintaining the health of the 
economy of the United States and are essential to the well-being of its 
people. These materials are used in water purification, farming, 
manufacturing, and other industrial applications. The need for 
hazardous materials to support essential services means that 
transportation of hazardous materials is unavoidable. There are over 20 
hazardous materials considered to be PIH that are shipped by rail in 
tank car quantities. In 2003, over 77,000 tank car loads of PIH 
materials were shipped by rail.
    Examples of PIH materials include anhydrous ammonia and chlorine. 
Anhydrous ammonia is an important source of nitrogen fertilizer for 
crops and is used in the continuous cycle cooling units found in 
various appliances and vehicles and in the production of explosives and 
manufacturing of nitric acid and certain alkalies, pharmaceuticals, 
synthetic textile fibers, plastics, and latex stabilizers. Chlorine is 
used as an elemental disinfectant for over 84 percent of large drinking 
water systems (those serving more than 10,000 people), according to the 
American Water Works Association. For pharmaceuticals, chlorine 
chemistry is essential to manufacturing 85 percent of their products. 
Chlorine chemistry is also used in 25 percent of all medical plastics, 
and 70 percent of all disposable medical applications. The single 
largest use of chlorine is for the production of polyvinyl chloride 
(PVC), which is used for building and construction materials such as 
siding, windows, pipes, decks and fences.
    The only effective modal alternative for transporting PIH materials 
is by road, and for the present insufficient capacity exists in the 
form of suitable packages (tank trucks, intermodal tanks). Further, 
diversion to highways would entail significantly higher societal costs, 
including adverse safety trade-offs from more trucks on the highways--
even before the potential for accidental release of product or further 
security vulnerabilities are considered.
    FRA is also concerned that PIH traffic could be retained on the 
railroads but concentrated in such a way as to result in circuitous 
routings with greater exposure to derailment hazards and security 
threats. Although security concerns may be addressed to some extent by 
rerouting during periods of high alert in specified urban areas, these 
detour routes would inevitably be over lines not equipped with PTC 
systems. These are the kinds of unfavorable trade-offs that the recent 
amendments to PHMSA's rail security rule--based on a separate statutory 
mandate and developed in concert with FRA--were intended to prevent. 
See, e.g., 73 FR 20752 (April 16, 2008); 73 FR 72182 (Nov. 26, 2008).); 
49 CFR 172.820.
    Finally, FRA believes that, while the presence of PIH traffic on 
the rail network was viewed by the Congress as a good proxy for risk 
sufficient to warrant PTC system installation and operation, FRA is not 
persuaded that it was the intent of Congress that PIH traffic be driven 
from the railroads or concentrated on a smaller number of lines with 
more circuitous routings. The final legislation constituting the RSIA08 
emerged following the Chatsworth collision of September 12, 2008, which 
claimed 25 lives (one rail employee and 24 passengers). However, 
neither H.R. 2095, as initially passed by the House of Representatives 
on October 17, 2007, nor the Senate version of the bill passed on 
August 1, 2008, was limited to PIH routes. All versions of the bill, 
including that finally enacted, preserved FRA's ability to apply the 
technology to additional routes.
    Although FRA recognizes that the congressional trade-offs in 
September 2008 were driven by the impending end of the 110th Congress, 
the Chatsworth accident, and the desire on the part of

[[Page 35965]]

some senators to see a rapid deployment of PTC technology (more rapid, 
in fact, than provided in either the Senate- or House-enacted 
versions), FRA does not believe that the Congress intended an 
implementation that would create substantial incentives to drive PIH 
traffic off of the railroads or concentrate it in such a way that large 
urban areas would see an increase in volume above that expected using 
normal, direct routing of the shipments. Accordingly, FRA proposes to 
use its discretion in crafting implementing regulations to preserve the 
presumed congressional intent. FRA does this by proposing in paragraph 
(b) that implementation plans required to be filed by April 16, 2010, 
be based on 2008 traffic levels. Although rail traffic, including PIH 
traffic, declined in the second half of the year, 2008 constitutes a 
much more ``normal'' base year than 2009 is expected to be due to the 
current economic conditions. It was also the year during which the 
Congress enacted the subject mandate.
    In taking this action, FRA departs from the PTC Working Group's 
consensus that 2009 be used as the base year. Since the RSAC initially 
took up this subject, rail traffic levels have continued to plummet, 
and that decision now appears to be inappropriate. FRA did advise the 
PTC Working Group that it reserved the right to ``lock in'' the PTC 
route structure as of passage of RSIA08 to prevent unintended 
consequences. From a technical standpoint, Sec.  236.1005(b) attempts 
to do just that, but with ample room for adjustment in light of normal 
changes in market conditions.
    Paragraph (b)(2) would require that the determination of Class I 
freight railroad main lines required to be equipped be initially 
established and reported as follows using a 2008 traffic base for gross 
tonnage and determine the presence of PIH traffic based on 2008 
shipments and routings. If increases in traffic occur that require a 
line to be equipped and the PTCIP has already been filed, an amendment 
would be required. As suggested by the RSAC, gross tonnage would be 
measured over two years to avoid unusual spikes in traffic driving 
investments inappropriately. However, if the 5 million gross tons 
threshold was met based on the prior two years of traffic, and PIH was 
added to the route, the railroad would be required to promptly file a 
PTCIP amendment and thereafter equip the line by the end of December 
31, 2015 or within two years, whichever is later.
    Once a PTC system is installed, it cannot be removed or treated as 
inoperative unless such discontinuance or modification is approved by 
FRA in accordance with Sec.  236.1021, as discussed below. This is the 
case even if the track segment ceases to be defined as a main line in 
accordance with subpart I due to traffic pattern or consist changes, 
such as annual traffic levels possibly dipping below the 5 million 
gross ton threshold referenced in the statute and in Sec. Sec.  
236.1003 and 236.1005 or the rerouting of PIH traffic. This result is 
consistent with longstanding practice under 49 U.S.C. 20502 (see 49 CFR 
part 235). To the extent traffic levels decline or PIH traffic ceases 
prior to April 16, 2010, or during the implementation period, a 
railroad could ask FRA to except a line segment from the requirement 
that it be equipped. The railroad would need to provide estimated 
traffic projections for the next 5 years (e.g., as a result of planned 
rerouting, coordinations, location of new business on the line). Where 
the request involves prior or planned rerouting of PIH traffic, the 
railroad would be required to provide a supporting analysis that takes 
into consideration the rail security provisions of the PHMSA rail 
routing rule, including any railroad-specific and interline routing 
impacts. See 49 CFR 172.820. For example, the request should include 
information where multiple railroad carriers may coordinate traffic, 
especially where there are parallel lines directing traffic in opposite 
directions. FRA could approve an exception if FRA finds that it would 
be consistent with safety and in the public interest.
    Once a PTC system is required to be installed, it cannot be removed 
or treated as inoperative unless such discontinuance or modification is 
approved by FRA in accordance with Sec.  236.1021, as discussed below. 
This is the case even if the track segment ceases to be defined as a 
main line in accordance with subpart I due to traffic pattern or 
consist changes, such as annual traffic levels possibly dipping below 
the 5 million gross ton threshold referenced in the statute and in 
Sec. Sec.  236.1003 and 236.1005 or the rerouting of PIH traffic.
    There was discussion in the PTC Working Group regarding how to 
handle new passenger service. Amtrak in particular suggested that FRA 
might consider some leeway for new intercity service that could be 
instituted within a short period if the sponsor (most likely a state 
government) requested. FRA considered this contingency but concluded 
that new passenger service should be adequately planned and 
deliberately executed with safety as its first priority. The proposal 
in paragraph (b) states that, after December 31, 2015, no intercity or 
commuter rail passenger service could continue or commence until a PTC 
system has been installed and made operative. FRA requests comment on 
this proposal and on whether a new rail passenger service commenced 
after April 10, 2010, but before December 31, 2015, should be permitted 
any leeway for installation of PTC after 2015 and, if so, what special 
circumstances would warrant that treatment.
    Paragraph (c) provides amplifying information regarding the 
installation and integration of hazard detectors into PTC systems. 
Paragraph (c)(1) reiterates FRA's position that any hazard detectors 
that are currently integrated into an existing signal and train control 
system must be integrated into mandatory PTC systems and that the PTC 
system will enforce as appropriate on receipt of a warning from the 
detector. Paragraph (c)(2) proposes to require each PTCSP submitted by 
a railroad to also identify any additional hazard detector to provide 
warnings to the crew that a railroad may elect to install. The PTCSP 
must also clearly define the actions required by the crew upon receipt 
of the alarm or other warning or alert. FRA does not expect a railroad 
to install hazard detectors at every location where a hazard might 
possibly exist.
    Paragraph (c)(3) proposes, in the case of high speed service (as 
described in Sec.  236.1007 as any service operating at speeds greater 
than 90 mph) that FRA will require the hazard analysis to address any 
hazards on the route, along with a reason why additional hazard 
detectors are not required to provide warning and enforcement for 
hazards not already protected by an existing hazard detector. The 
hazard analysis must clearly identify the risk associated with the 
hazard, and the mitigations taken if a hazard detector is not installed 
and interfacing with a PTC system. For instance, in the past, large 
motor vehicles have left parallel or overhead structures and have 
fouled active passenger rail lines. Depending upon the circumstances, 
such events can cause catastrophic train accidents. Although not every 
such event can be prevented, detection of obstacles such as this may 
make it more likely that the accident could be prevented.
    Under paragraph (d), FRA proposes that each lead locomotive 
operating with a PTC system be equipped with an operative event 
recorder that captures safety-critical data routed to the engineer's 
display that the engineer must obey, as well as the text of mandatory 
directives and authorized

[[Page 35966]]

speeds. FRA intends that this information be available in the event of 
an accident with a PTC-equipped system to determine root causes and the 
necessary actions that must be taken to prevent reoccurrence. Although 
FRA expects implemented PTC systems will prevent PTC-preventable 
accidents, in the event of system failure FRA believes it is necessary 
to capture available data relating to the event. Further, FRA sees 
value in capturing information regarding any accident that may occur 
outside of the control of a PTC system as it is currently designed--
including the prevention of collisions with trains not equipped with 
PTC systems--and accidents that could otherwise have been prevented by 
PTC technology, but were unanticipated by the system developers, the 
employing railroad, or FRA.
    The data may be captured in the locomotive event recorder, or a 
separate memory module. If the locomotive is placed in service on or 
after October 1, 2009, the event recorder and memory module, if used, 
shall be crashworthy, otherwise known as crash-hardened, in accordance 
with Sec.  229.135. For locomotives built prior to that period, the 
data shall be protected to the maximum extent possible within the 
limits of the technology being used in the event recorder and memory 
module.
    As required by the RSIA08 and by paragraph (a)(1)(iv), as noted 
above, a PTC system required by subpart I must be designed to prevent 
the movement of a train through a main line switch in the wrong 
position. Paragraph (e) provides amplifying information on switch point 
monitoring, indication, warning of misalignment, and associated 
enforcement. According to the statute, each PTC system must be designed 
to prevent ``the movement of a train through a switch left in the wrong 
position.'' FRA understands ``wrong position'' to mean not in the 
position for the intended movement of the train. FRA believes that 
Congress' use of the phrase ``left in the wrong position'' was 
primarily directed at switches in non-signaled (dark) territory such as 
the switch involved in the aforementioned accident at Graniteville, 
South Carolina. FRA also believes that, in order to prevent potential 
derailment or divergence to an unintended route, it is critical that 
all switches be monitored by a PTC system in some manner to detect 
whether they are in their proper position for train movements. If a 
switch is misaligned, the PTC system shall provide an acceptable safe 
state of train operations.
    Prior to the statute, PTC provided for positive train separation, 
speed enforcement, and work zone protection. The addition of switch 
point monitoring and run through prevention would have eliminated the 
Graniteville, South Carolina accident where a misaligned switch 
resulted in the unintended divergence of a train operating on the main 
track onto a siding track and the collision of that train with another 
parked train on the siding. The resulting release of chlorines gas 
caused nine deaths and required the evacuation of the entire town for 
two weeks while remediation efforts were in progress.
    As discussed above, FRA considered requiring PTC systems to be 
interconnected with each main line switch and to individually monitor 
each switch's point position in such a manner as to provide for a 
positive stop short of any misalignment condition. However, after 
further consideration and discussion with the PTC Working Group, FRA 
believes that such an approach may be overly aggressive and terribly 
expensive in signaled territory.
    Under paragraph (e), FRA instead proposes to treat switches 
differently, depending upon whether they are within a wayside or cab 
signal system--or are provided other similar safeguards (i.e., distant 
switch indicators and associated locking circuitry) required to meet 
the applicable switch position standards and requirements of subparts 
A-G--or are within non-signaled (dark) territory.
    While a PTC system in dark territory would be required to enforce a 
positive stop--as discussed in more detail below--a PTC system in 
signaled territory would require a train to operate at no more than the 
upper limit of restricted speed between the associated signal, over any 
switch in the block governed by the signal, and until reaching the next 
subsequent signal that is displaying a signal indication more 
permissive than proceed at restricted speed.
    Signaled territory includes various types of switches, including 
power-operated switches, hand-operated switches, spring switches, 
electrically-locked switches, electro-pneumatic switches, and hydra 
switches, to name the majority. Each type of switch poses different 
issues as it relates to PTC system enforcement. We look at power- and 
hand-operated switches as examples.
    On a territory without a PTC system, if a power-operated switch at 
an interlocking or control point were in a condition resulting in the 
signal system displaying a stop indication, an approaching train would 
have to stop generally only a few feet from the switch, and in the 
large majority of cases no more than several hundred feet away from it. 
In contrast, in PTC territory adhering to the aforementioned overly 
aggressive requirement, a train would have to stop at the signal, which 
may be in close proximity to its associated switch, and operate at no 
more than the upper limit of restricted speed to that switch, where it 
would have to stop again. FRA believes that, since the train would be 
required to stop at the signal, and must operate at no more than the 
upper limit of restricted speed until it completely passes the switch 
(with the crew by rule watching for and prepared to stop short of, 
among other concerns, an improperly lined switch), another enforced 
stop at the switch would be unnecessarily redundant.
    Operations using hand-operated switches would provide different, 
and arguably greater, difficulties and potential risks. Generally, in 
between each successive interlocking and control point, signal spacing 
along the right of way can approximately be 1 to 3 miles or more apart, 
determined by the usual length of track circuits and the sufficient 
number of indications that would provide optimal use for train 
operations. Each signal governs the movement through the entire 
associated block up to the next signal. Thus, a train approaching a 
hand-operated switch may encounter further difficulties since its 
governing signal may be much further away than one would be for a 
power-operated switch. If within signaled territory a hand-operated 
switch outside of an interlocking or control point were in a condition 
resulting in the signal system displaying a restricted speed signal 
indication, an approaching train may be required to stop before 
entering the block governed by the signal and proceed at restricted 
speed, or to otherwise reduce its speed to restricted speed as it 
enters the block governed by the signal, and be operated at restricted 
speed until the train reaches the next signal displaying an indication 
more permissive than proceed at restricted speed, including while 
passing over any switch within the block. The governing signal, 
however, may be anywhere from a few feet to more than a mile from the 
hand-operated switch. For instance, if a signal governs a 3 mile long 
block, and there is a switch at 1.8 miles after passing the governing 
signal (stated in advance of the signal), and that switch is 
misaligned, the train would have to travel that 1.8 miles at restricted 
speed. Even if the train crew members were able to normal the 
misaligned switch, they would need to remain at restricted

[[Page 35967]]

speed at least until the next signal (absent an upgrade of a cab signal 
indication).
    In signaled territory, to require a PTC system to enforce a 
positive stop of an approaching train at each individual switch that is 
misaligned would be an unnecessary burden on the industry, particularly 
since movement beyond the governing signal would be enforced by the PTC 
system to a speed no more than the upper limit of restricted speed. 
Accordingly, in signaled territory, FRA proposes in paragraph (e)(1) to 
require a PTC system to enforce the upper limit of restricted speed 
through the block. By definition, at restricted speed, the locomotive 
engineer must be prepared to stop within one-half the range of vision 
short of any misaligned switch or broken rail, etc., not to exceed 15 
or 20 miles per hour depending on the operating rule of the railroad. 
Accordingly, if a PTC system is integrated with the signal system, and 
a train is enforced by the PTC system to move at restricted speed past 
a signal displaying a restricted speed indication, FRA feels 
comfortable that the PTC system will meet the statutory mandate of 
preventing the movement of the train through the switch left in the 
wrong position by continuously displaying the speed to be maintained 
(i.e., restricted speed) and by enforcing the upper limit of the 
railroads' restricted speed rule (but not to exceed 20 mph). While this 
solution would not completely eliminate human factors associated with 
movement through a misaligned switch, it would significantly mitigate 
the risk of a train moving through such a switch and would be much more 
cost effective.
    Moreover, it would be cost prohibitive to require the industry to 
individually equip each of the many thousands of hand-operated switches 
with a wayside interface unit (WIU) necessary to interconnect with a 
PTC system in order to provide a positive stop short of any such switch 
that may be misaligned. Currently each switch in signaled territory has 
its position monitored by a switch circuit controller (SCC). When a 
switch is not in its normal position, the SCC opens a signal control 
circuit to cause the signal governing movement over the switch location 
to display its most restrictive aspect (usually red). A train 
encountering a red signal at the entrance to a block will be required 
to operate at restricted speed through the entire block, which can be 
several miles in length depending on signal spacing. The signal system 
is not capable of informing the train crew which switch, if any, in the 
block may be in an improper position since none of switches are 
equipped with an independent WIU. There could be many switches within 
the same block in a city or other congested area. Thus, there is a 
possibility that one or more switches may be not in its proper position 
and the signal system is unable to transmit which switch or switches 
are not in normal position. The governing signal could also be 
displaying a red aspect on account of a broken rail, broken bond wire, 
broken or wrapped line wire, bad insulated joint, bad insulated switch 
or gage rods, or other defective condition.
    FRA believes that requiring a PTC system to enforce the upper limit 
of restricted speed in the aforementioned situations is statutorily 
acceptable. The statute requires each PTC system to prevent ``the 
movement of a train through a switch left in the wrong position.'' 
Under this statutory language, the railroad's intended route must 
factor into the question of whether a switch is in the ``wrong'' 
position. In other words, in order to determine whether a switch is in 
the ``wrong position,'' we must know the switch's ``right position.'' 
The ``right position'' is determined by the intended route of the 
railroad. Thus, when determining whether a switch is in the wrong 
position, it is necessary to know the railroad's intended route and 
whether the switch is properly positioned to provide for the train to 
move through the switch to continue on that route. The intended route 
is normally determined by the dispatcher.
    Under the proposed rules, when a switch is in the wrong position, 
the PTC system must have knowledge of that information, must 
communicate that information to the railroad (e.g., the locomotive 
engineer or dispatcher), and must control the train accordingly. Once 
the PTC system or railroad has knowledge of the switch's position, FRA 
expects the position to be corrected in accordance with part 218 before 
the train operates through the switch. See, e.g., Sec. Sec.  218.93, 
218.103, 218.105, 218.107.
    If the PTC system forces the train to move at no more than the 
upper limit of restricted speed, the railroad has knowledge that a 
misaligned switch may be within the subject block, and the railroad by 
rule or dispatcher permission then makes the decision to move through 
the switch (i.e., the railroad's intent has changed as indicated by 
rule or dispatcher instructions), the switch is no longer in the 
``wrong position.'' The RSAC PTC Working Group was unanimous in 
concluding that these arrangements satisfy the safety objectives of 
RSIA08. Utilization of the signal system to detect misaligned switches 
and facilitate safe movements also provides an incentive to retain 
existing signal systems, with substantial additional benefits in the 
form of broken rail detection and detection of equipment fouling the 
main line.
    Paragraph (e)(2) addresses movements over switches in dark 
territory and under conditions of excessive risk, even if in block 
signal territory. In dark territory, by definition, there are no 
signals available to provide any signal indication or to interconnect 
with the switches or PTC system. Without the benefit of a wayside or 
cab signal system, or other similar system of equivalent safety, the 
PTC system will have no signals to obey. In such a case, the PTC system 
may be designed to allow for virtual signals, which are waypoints in 
the track database that would correspond to the physical location of 
the signals had they existed without a switch point monitoring system. 
Accordingly, paragraph (e)(2)(i) proposes to require that in dark 
territory where PTC systems are implemented and governed by this 
subpart, the PTC system must enforce a positive stop for each 
misaligned switch whereas the lead locomotive must be stopped short of 
the switch to preclude any fouling of the switch. Once the train stops, 
the railroad will have an opportunity to correct the switch's 
positioning and then continue its route as intended.
    Unlike in signaled territory, FRA expects that on lines requiring 
PTC in dark territory, each switch will be equipped with a WIU to 
monitor the switch's position. A WIU is a device that aggregates 
control and status information from one or more trackside devices for 
transmission to a central office and/or an approaching train's onboard 
PTC equipment, as well as disaggregating received requests for 
information, and promulgates that request to the appropriate wayside 
device. Most of the switches in dark territory are hand-operated with a 
much smaller amount of them being spring and hydra switches. In dark 
territory, usually none of the switches have their position monitored 
by a SCC and railroads have relied on the proper handling of these 
switches by railroad personnel. When it is necessary to throw a main 
line switch from normal to reverse, an obligation arises under the 
railroad's rules to restore the switch upon completion of the 
authorized activity. Switch targets or banners are intended to provide 
minimal visual indication of the switch's position, but in the typical 
case trains are not required to operate at a speed permitting them to 
stop short of open switches. As evidenced by the issuance of Emergency

[[Page 35968]]

Order No. 24 and the subsequent Railroad Operating Rules Final Rule (73 
FR 8442 (Feb. 13, 2008)), proper handling of main line switches cannot 
be guaranteed in every case. However, now with the implementation and 
operation of PTC technology, if a switch is not in the normal position, 
that information will be transmitted to the locomotive. The PTC system 
will then know which switch is not in the normal position and require a 
positive stop at that switch location only.
    In the event that movement through a misaligned switch would result 
in an unacceptable risk, whether in dark or signaled territory, 
paragraph (e)(2)(ii) proposes to require the PTC system to enforce a 
positive stop on each train before it crosses the switch in the same 
manner as described above for trains operating in dark, PTC territory. 
FRA acknowledges that regardless of a switch's position, and regardless 
of whether the switch is in dark or signaled territory, movement 
through certain misaligned switches--even at low speeds--may still 
create an unacceptable risk of collision with another train.
    FRA understands the term ``unacceptable risk'' to mean risk that 
cannot be tolerated by the managing activity. It is a type of 
identified risk that must be eliminated or controlled. For instance, 
such an unacceptable risk may exist with a hand-operated crossover 
between two main tracks, between a main track and a siding or auxiliary 
track, or with a hand-operated switch providing access to another 
subdivision or branch line. The switches mentioned in (e)(2)(ii) are in 
locations where, if the switch is left lined in the wrong position, a 
train would be allowed to traverse through the crossover or turnout and 
potentially into the path of another train operating on an adjoining 
main track, siding, or other route. Even if such switches were located 
within a signaled territory, the signal governing movements over the 
switch locations, for both tracks as may be applicable, would be 
displaying their most restrictive aspect (usually red). This 
restrictive signal indication would in turn allow both trains to 
approach the location at restricted speed where one or both of the 
crossover switches are lined in the reverse position. Since the PTC 
system is not capable of actually enforcing restricted speed other than 
its upper limits, the PTC system would enforce a 15 or 20 mile per hour 
speed limit dependent upon the operating rules of the railroad. 
However, there is normally up to as much as a 5 mile per hour tolerance 
allowed for each speed limit before the PTC system will actually 
enforce the applicable required speed. Thus, in reality, the PTC system 
would not enforce the restricted speed condition until each train 
obtained a speed of up to 25 miles per hour. In this scenario, it is 
conceivable that two trains both operating at a speed of up to 25 miles 
per hour could collide with each other at a combined impact speed 
(closing speed) of up to 50 miles per hour. While these examples are 
provided in the rule text, they are merely illustrative and do not 
limit the universe of what FRA may consider an unacceptable risk for 
the purpose of paragraph (e). FRA emphasizes that FRA maintains the 
final determination as to what constitutes acceptable or unacceptable 
risk in accordance with paragraph (e)(2)(ii).
    The PTC system must also enforce a positive stop short of any 
misaligned switch on a PTC controlled siding in dark territory where 
the allowable track speed is in excess of 20 miles per hour. Sidings 
are used for meeting and passing trains and where those siding 
movements are governed by the PTC system, safety necessitates the 
position of the switches located on them to be monitored in order to 
protect train movements operating on the siding. Conversely, on 
signaled sidings, train movements are governed and protected by the 
associated signal indications, track circuits, and monitored switches, 
none of which are present in dark territory.
    Paragraph (e)(3) provides that the PTCSP may include a safety 
analysis for PTC system enforcement associated with switch position and 
an identification and justification of any alternate means of 
protection other than that provided in this section shall be identified 
and justified. FRA recognizes that in certain circumstances this 
flexibility may allow the reasonable use of a track circuit in lieu of 
individually monitored switches.
    Paragraph (e)(4) provides amplifying information regarding existing 
standards of subparts A through G related to switches, movable-point 
frogs, and derails in the route governed that are equally applicable to 
PTC systems unless otherwise provided in a PTCSP approved under this 
subpart. This paragraph explains that the FRA required and accepted 
railroad industry standard types of components used to monitor switch 
point position and how those devices are required to function. This 
paragraph allows for some alternative method to be used to accomplish 
the same level of protection if it is identified and justified in a 
PTCSP approved under this subpart.
    Paragraph (f) provides amplifying information for determining 
whether a PTC system is considered to be configured to prevent train-
to-train collisions, as required under paragraph (a). FRA will consider 
the PTC system as providing the required protection if the PTC system 
enforces the upper limits of restricted speed. These criteria will 
allow following trains to pass intermediate signals displaying a 
restricting aspect and will allow for the issuance of joint mandatory 
directives.
    Where a wayside signal displays a ``Stop,'' ``Stop and Proceed,'' 
or ``Restricted Proceed'' indication, paragraph (f)(1)(i) requires the 
PTC system to enforce the signal indication accordingly. In the case of 
a ``Stop'' or ``Stop and Proceed'' indication, the train will be 
brought to a stop prior to passing the signal displaying the 
indication. The train may then proceed at 15 or 20 miles per hour, as 
applicable according to the host railroad's operating rule(s) for 
restricted speed. In the case of a ``Restricted Proceed'' indication, 
the train would be allowed to pass the signal at 15 or 20 miles per 
hour. In either event, the speed restriction would be enforced until 
the train passes a more favorable signal indication. In dark territory 
where trains operate by mandatory directive, the PTC system would be 
expected to enforce the upper limit of restricted speed on a train when 
the train was allowed into a block already occupied by another 
preceding train traveling in the same direction. FRA would expect each 
PTC system to function in this way and that each railroad will test 
each system to ensure such proper functioning.
    Paragraphs (g) through (k) all concern situations where temporary 
rerouting may be necessary and would affect application of the 
operational rules under subpart I. While the proposed rule attempts to 
reduce the opportunity for PTC and non-PTC trains to co-exist on the 
same track, FRA recognizes that this may not always be possible, 
especially when a track segment is out of service and a train must be 
rerouted in order to continue to destination. Accordingly, paragraph 
(g) allows for temporary rerouting of traffic between PTC equipped 
lines and lines not equipped with PTC systems. FRA anticipates two 
situations--emergencies and planned maintenance--that would justify 
such rerouting.
    Paragraph (g) provides the preconditions and procedural rules to 
allow or otherwise effectuate a temporary rerouting in the event of an 
emergency or planned maintenance that would prevent usage of the 
regularly used track. Historically, FRA has dealt

[[Page 35969]]

with temporary rerouting on an ad hoc basis. For instance, on November 
12, 1996, FRA granted UP, under its application RS&I-AP-No. 1099, 
conditional approval for relief from the requirements of Sec.  236.566, 
which required equipping controlling locomotives with an operative 
apparatus responsive to all automatic train stop, train control, or cab 
signal territory equipment. The conditional approval provided for 
``detour train movements necessitated by catastrophic occurrence such 
as derailment, flood, fire, or hurricane'' on certain listed UP 
territories configured with automatic cab signals (ACS) or automatic 
train stop (ATS). Ultimately, the relief would allow trains not 
equipped with the apparatus required under Sec.  236.566 to enter those 
ACS and ATS territories. However, the relief was conditional upon 
establishing an absolute block in advance of each train movement--as 
prescribed by General Code of Operating Rules (GCOR) 11.1 and 11.2--and 
notifying the applicable FRA Regional Headquarters. The detour would 
only be permissible for up to seven days and FRA could modify or 
rescind the relief for railroad non-compliance.
    On February 7, 2006, that relief was temporarily extended to 
include defined territory where approximately two months of extensive 
track improvements were necessary. Additional conditions for this 
relief included a maximum train speed of 65 miles per hour and 
notification to the FRA Region 8 Headquarters within 24 hours of the 
beginning of the non-equipped detour train movements and immediately 
upon any accident or incident. On February 27, 2007, FRA provided 
similar temporary relief for another three months on the same 
territory.
    While the aforementioned conditional relief was provided on an ad 
hoc basis, FRA feels that codifying rules regulating temporary 
rerouting involving PTC system track or locomotive equipment is 
necessary due to the potential dangers of allowing mixed PTC and non-
PTC traffic on the same track and the inevitable increased presence of 
PTC and PTC-like technologies. Moreover, FRA believes that the subject 
railroads and FRA would benefit from more regulatory flexibility to 
work more quickly and efficiently to provide for temporary rerouting to 
mitigate the problems associated with emergency situations and 
infrastructure maintenance.
    Under the proposed rule, FRA is providing for temporary rerouting 
of non-PTC trains onto PTC track and PTC trains onto non-PTC track. A 
train will not be considered rerouted for purposes of the conditions 
set forth in this section if it operates on a PTC line that is other 
than its ``normal route,'' which is equipped and functionally 
responsive to the PTC system over which it is subsequently operated, or 
if it is a non-PTC train (not a passenger train or a freight train 
having any PIH materials) operating on a non-PTC line that is other 
than its ``normal route.''
    Paragraph (g) effectively provides temporary civil penalty immunity 
from various applicable requirements of this subpart, including 
provisions under subpart I relating to lead locomotives, similar to how 
waivers from FRA have provided certain railroads immunity from Sec.  
236.566. FRA seeks comments on what other requirements under part 236 
should also be included.
    FRA expects that emergency rerouting will require some flexibility 
in order to respond to circumstances outside of the railroad's 
control--most notably changes in the weather, vandalism, and other 
unexpected occurrences--that would result in potential loss of life or 
property or prevent the train from continuing on its normal route. 
While paragraph (g) lists a number of possible emergency circumstances, 
they are primarily included for illustrative purposes and are not a 
limiting factor in determining whether an event rises to an emergency. 
For instance, FRA would also consider allowing rerouting in the event 
use of the track is prevented by vandalism or terrorism. While these 
events are not the primary reasons FRA proposes paragraph (g) to allow 
rerouting, FRA recognizes that they may fall outside of the railroad's 
control.
    In the event of an emergency that would prevent usage of the track, 
temporary rerouting may occur instantly by the railroad without 
immediate FRA notice or approval. By contrast, the vast majority of 
maintenance activities can be predicted by railroad operators. While 
the proposed rule provides for temporary rerouting for such activities, 
the lack of exigent circumstances does not require the allowance of 
instantaneous rerouting without an appropriate request and, in cases 
where the request is for rerouting to exceed 30 days, FRA approval. 
Accordingly, under paragraph (g), procedurally speaking, temporary 
rerouting for emergency circumstances will be treated differently than 
temporary rerouting for planned maintenance. While FRA continues to 
have an interest in monitoring all temporary rerouting to ensure that 
it is occurring as contemplated by FRA and within the confines of the 
rule, the timing of FRA notification, and the approval procedures, 
reflect the aforementioned differences.
    When an emergency circumstance occurs that would prevent usage of 
the regularly used track, and would require temporary rerouting, the 
subject railroad must notify FRA within one business day after the 
rerouting commences. To provide for communicative flexibility in 
emergency situations, the proposed rule provides for such notification 
to be made in writing or by telephone. FRA proposes that written 
notification may be accomplished via overnight mail, e-mail, or 
facsimile. In any event, the railroad should take the steps necessary 
for the method of notification selected to include confirmation that an 
appropriate person actually on duty with FRA receives the notification 
and FRA is duly aware of the situation. FRA is considering whether to 
employ the National Response Center (NRC) for such communications, 
whereas notification may be made to the NRC clearly describing the 
actions taken and providing the railroad's point of contact so that FRA 
may follow up for additional information if necessary. While the NRC 
provides full time telephonic services, 24 hours a day, 7 days a week, 
365 days a year, the light volume of calls FRA expects for rerouting 
purposes under this section may make the option cost prohibitive. FRA 
is currently reviewing this option and seeks comments on this issue.
    While telephone notification may provide for easy communications by 
the railroad, a mere phone call would not provide for documentation of 
information required under paragraph (g). Moreover, if for some reason 
the phone call is made at a time when the designated telephone operator 
is not on duty or if the caller is only able to leave a message with 
the FRA voice mail system, the possibility exists that the applicable 
FRA personnel would not be timely notified of the communication and its 
contents. Thus, while not in the proposed rules, FRA is considering 
requiring any telephonic notification performed in accordance with 
paragraph (g) to be followed up with written notification within 48 
hours. FRA seeks comments on this issue.
    FRA is also considering using particular contact mail and e-mail 
addresses and telephone and facsimile numbers to be used exclusively 
for the notifications required by paragraph (g) as they relate to 
emergency rerouting. Otherwise, if a railroad would notify a particular 
member of the FRA staff in writing, and that staff member is 
unavailable (e.g., on annual or sick leave, working in the field, or 
otherwise indisposed), FRA would not be timely notified of the 
emergency situation and the rerouting actions that are occurring.

[[Page 35970]]

If there is a singular contact address for each form of written 
notification, FRA could attempt to provide continuous personnel 
assignment to monitor incoming notifications. FRA seeks comments on 
this issue. FRA also seeks comments on the possible need to include 
requirements relating to confirmation of receipt of notifications 
required under paragraph (g).
    Emergency rerouting can only occur without FRA approval for 
fourteen (14) consecutive calendar days. If the railroad requires more 
time, it must make a request to the Associate Administrator. The 
request must be made directly to the Associate Administrator and 
separately from the initial notification sometime before the 14-day 
emergency rerouting period expires. Unless the Associate Administrator 
notifies the railroad of his or her approval before the end of the 
allowable emergency rerouting timeframe, the relief provided by 
paragraph (g) will expire at the end of that timeframe.
    While a mere notification is necessary to commence emergency 
rerouting, a request must be made, with subsequent FRA approval, to 
perform planned maintenance rerouting. The relative predictability of 
planned maintenance activities allows railroads to provide FRA with 
much more advance request of any necessary rerouting and allows FRA to 
review that request. FRA proposes that the request must be made at 
least 10 calendar days before the planned maintenance rerouting 
commences.
    To ensure a retrievable record, the request must be made in 
writing. It may be submitted to FRA by fax, e-mail, or courier. Because 
of security protocols placed in effect after 9/11, regular mail 
undergoes irradiation to ensure that any pathogens have been destroyed 
prior to delivery. The irradiation process adds significant delay to 
FRA's receipt of the document, and the submitted document may be 
damaged due to the irradiation process. The lack of emergency 
circumstances makes telephonic communication less necessary and less 
preferable. Like notifications for emergency rerouting, the request for 
planned rerouting must include the number of days that the rerouting 
should occur. If the planned maintenance will require rerouting up to 
30 days, then the request must be made with the Regional Administrator. 
If it will require rerouting for more than 30 days, then the request 
must be made with the Associate Administrator. These longer time 
periods reflects FRA's opportunity to review and approve the request. 
In other words, since FRA expects that the review and approval process 
will provide more confidence that a higher level of safety will be 
maintained, the rerouting period for planned maintenance activities may 
be more than the 14 days allotted for emergency rerouting.
    Regardless of whether the temporary rerouting is the result of an 
emergency situation or planned maintenance, the communication to FRA 
required under paragraph (g) must include the information listed under 
paragraph (i). This information is necessary to provide FRA with 
context and details of the rerouting. To attempt to provide railroads 
with the flexibility intended under paragraph (g), and to attempt to 
prevent enforcement of the rules from which the railroad should be 
receiving relief, FRA must be able to coordinate with its inspectors 
and other personnel. This information may also eventually be important 
to FRA in developing statistical analyses and models, reevaluating its 
rules, and determining the actual level of danger inherent in mixing 
PTC and non-PTC traffic on the same tracks.
    For emergency rerouting purposes, the information is also necessary 
for FRA to determine whether it should order the railroad or railroads 
to cease rerouting or provide additional conditions that differ from 
the standard conditions specified in paragraph (i). FRA recognizes the 
importance of allowing temporary rerouting to occur automatically in 
emergency circumstances. However, FRA must also maintain its 
responsibility of ensuring that such rerouting occurs lawfully and as 
intended by the rules. Accordingly, the proposed rules provide for the 
opportunity for FRA to review the information required by paragraph (g) 
to be submitted in accordance with paragraph (i) and order the railroad 
or railroads to cease rerouting if FRA finds that such rerouting is not 
appropriate or permissible in accordance with the requirements of 
paragraphs (g) through (i), and as may be so directed in accordance 
with paragraph (k), as discussed further below.
    For rerouting due to planned maintenance, the information required 
under paragraph (i) is equally applicable and will be used to determine 
whether the railroad should not reroute at all. If the request for 
planned maintenance is for a period of up to 30 days, then the request 
and information must be sent in writing to the Regional Administrator 
of the region in which the temporary rerouting will occur. While such a 
request is self-executing--meaning that it will automatically be 
considered permissible if not otherwise responded to--the Regional 
Administrator may prevent the temporary rerouting from starting by 
simply notifying the railroad or railroads that its request is not 
approved. The Regional Administrator may otherwise provide conditional 
approval, request that further information be supplied to the Regional 
Administrator or Associate Administrator, or disapprove the request 
altogether. If the railroad still seeks to reroute due to planned 
maintenance activities, it must provide the Regional Administrator or 
Associate Administrator, as applicable, the requested information. If 
the Regional Administrator requests further information, no planned 
maintenance rerouting may occur until the information is received and 
reviewed and the Regional Administrator provides his or her approval. 
Likewise, no planned maintenance rerouting may occur if the Regional 
Administrator disapproves of the request. If the Regional Administrator 
does not provide notice preventing the temporary rerouting, then the 
planned maintenance rerouting may begin and occur as requested. 
However, once the planned maintenance rerouting begins, the Regional 
Administrator may at any time order the railroad or railroads to cease 
the rerouting in accordance with paragraph (k).
    Requests for planned maintenance rerouting exceeding 30 days, 
however, must be made to the Associate Administrator and are not self-
executing. No such rerouting may occur without Associate Administrator 
approval, even if the date passes on which the planned maintenance was 
scheduled to commence. Under paragraph (h)(3), like the Regional 
Administrator, the Associate Administrator may provide conditional 
approval, request further information, or disapprove of the request to 
reroute. Once approved rerouting commences, the Associate Administrator 
may also order the rerouting to cease in accordance with paragraph (k).
    Paragraph (j) requires that, once temporary rerouting commences, 
regardless of whether it is for emergency or planned maintenance 
purposes, the track segments upon which the train will be rerouted must 
have an absolute block established in advance of each rerouted train 
movement and that each rerouted train movement shall not exceed 59 
miles per hour for passenger and 49 miles per hour for freight. FRA 
requests comment on whether these speed restrictions should be limited 
to trains actually transporting PIH materials or intercity or commuter 
passengers and whether a higher limit

[[Page 35971]]

should be provided on cab signal territory where the detoured train is 
led by a locomotive equipped with operative cab signals. FRA also 
requests comment on whether the more stringent requirements of Sec.  
236.1029 (trains failed en route on PTC lines) should apply. Finally, 
FRA requests comment on the extent to which the host railroad's PTCSP 
might provide for alternative safety measures.
    Moreover, as referenced in paragraph (g) as it applies to both 
emergency and planned maintenance circumstances, the track upon which 
FRA expects the rerouting to occur would require certain mitigating 
protections listed under paragraph (j) in light of the mixed PTC and 
non-PTC traffic. While FRA purposefully intends paragraph (j) to apply 
similarly to Sec.  236.567, FRA recognizes that Sec.  236.567 does not 
account for the statutory mandates of interoperability and the core PTC 
safety functions. Accordingly, paragraph (j) must be more restrictive.
    Section 236.567, which applies to territories where ``an automatic 
train stop, train control, or cab signal device fails and/or is cut out 
en route,'' requires trains to proceed at either restricted speed or, 
if an automatic block signal system is in operation according to signal 
indication, at no more than 40 miles per hour to the next available 
point of communication where report must be made to a designated 
officer. Where no automatic block signal system is in use, the train 
shall be permitted to proceed at restricted speed or where an automatic 
block signal system is in operation according to signal indication but 
not to exceed medium speed to a point where absolute block can be 
established. Where an absolute block is established in advance of the 
train on which the device is inoperative, the train may proceed at not 
to exceed 79 miles per hour. Paragraph (j) utilizes that absolute block 
condition, which more actively engages the train dispatcher in managing 
movement of the train over the territory (in both signaled and non-
signaled territory). Recognizing that re-routes under this section will 
occur in non-signaled territory, the maximum authorized speeds 
associated with such territory are used as limitations on the speed of 
re-routed trains. FRA agrees with the comments of labor representatives 
in the PTC Working Group who contend that the statutory mandate alters 
to some extent what would otherwise be considered reasonable for these 
circumstances. FRA welcomes comments on whether restrictions associated 
with re-routing should vary depending on whether the actual train in 
question is a passenger train or includes cars containing PIH 
materials.
    It should be noted that this paragraph (j) was added by FRA after 
further consideration of this issue and was not part of the PTC Working 
Group consensus. FRA believes that special precautions may be 
appropriate given the heightened safety expectations suggested by the 
statutory mandate. Comment is requested on the appropriateness of these 
restrictions, including any impact on other rail traffic.
    Paragraph (k), as previously noted, provides the Regional 
Administrator with the ability to order the railroad or railroads to 
cease rerouting operations that were requested for up to 30 days. The 
Associate Administrator may order a railroad or railroads to cease 
rerouting operations regardless of the length of planned maintenance 
rerouting requested. FRA believes this is an important measure 
necessary to prevent rerouting performed not in accordance with the 
rules and FRA's expectations based on the railroad's communications and 
to ensure the protection of train crews and the public. However, FRA is 
confident that in the vast majority of cases railroads will utilize the 
afforded latitude reasonably and only under necessary circumstances.
    FRA expects each host railroad to develop a plan to govern 
operations in the event temporary rerouting is performed in accordance 
with this section. Thus, as noted further below in Sec.  236.1015, FRA 
proposes each PTCSP to include a plan accounting for such rerouted 
operations.

Section 236.1006 Equipping Locomotives Operating in PTC Territory

    The PTC Working Group discussed at great length the issues related 
to operation of PTC-equipped locomotives, and locomotives not equipped 
with PTC onboard apparatus, over lines equipped with PTC. The PTC 
Working Group recognized that the typical rule with respect to train 
control territory is that all controlling locomotives must be equipped 
and operative (see Sec.  236.566). It was also noted in the discussion 
that the Interstate Commerce Commission (FRA's predecessor agency in 
the regulation of this subject matter) and FRA have provided some 
relief from this requirement in discrete circumstances where safety 
exposure was considered relatively low and the hardship associated with 
equipping additional locomotives was considered substantial.
    The ASLRRA noted that its member railroads conduct limited 
operations over Class I railroad lines that will be required to be 
equipped with PTC systems in a substantial number of locations. These 
operations are principally related to the receipt and delivery of 
carload traffic in interchange. The small railroad service extends onto 
the Class I railroad track in order to hold down costs and permit both 
the small railroad and the Class I railroad to retain traffic that 
might be priced off the railroad if the Class I had to dispatch a crew 
to pick up or place the cars. This, in turn, supports competitive 
transportation options for small businesses, including marginal small 
businesses in rural areas.
    The ASLRRA advocated an exception that would permit the trains of 
its members and other small railroads to continue use of existing 
trackage rights and agreements without the necessity for equipping 
their locomotives with PTC. They suggested that any incremental risk be 
mitigated by requiring that such trains proceed subject to the 
requirement for an absolute block in advance (similar to operating 
rules consistent with Sec.  236.567 applicable to trains with failed 
onboard train control systems). This position was consistently opposed 
both by the rail labor organizations and the Class I railroads. These 
organizations took the position that all trains should be equipped with 
PTC in order to gain the benefits sought by the congressional mandate 
and to provide the host railroad the full benefit of its investment in 
safety. Informal discussions suggested that Class I railroads might 
offer technical or financial assistance to certain small railroads in 
equipping their locomotives, but that this would, of course, be done 
based on the corporate interest of the Class I railroad.
    In the PTC Working Group and in informal discussions around its 
activities, Class I railroads indicated that they intended to take a 
strong position against non-equipped trains operating on their PTC 
lines, and that in order to enforce this restriction fairly they 
understood that they would need to equip their own locomotives, 
including older road switchers that might venture onto PTC-equipped 
lines only occasionally. However, during these discussions, FRA was not 
able to develop a clear understanding regarding, outside the scope of 
FRA regulations, the extent to which the Class I railroads under 
previously executed private agreements enjoy the effective ability to 
enforce a requirement that all trains be equipped. FRA presumes for 
purposes of this proposal that there will be circumstances rooted

[[Page 35972]]

in previously executed private agreements under which the Class I 
railroad would be entitled to require the small railroad to use a 
controlling locomotive equipped with PTC as a condition of operating 
onto the property. FRA wishes to emphasize that, in making this 
regulatory proposal, FRA does not intend to influence the exercise of 
private rights or to suggest that public policy would disfavor an 
otherwise legitimate restriction on the use of unequipped locomotives 
on PTC lines. Rather, this proposal is intended to explore limited 
exceptions that might be acceptable from the point of view of safety, 
and helpful from the point of view of the public interest in rail 
service, where it might be compatible with prior rights of the 
railroads involved. FRA also notes that, in the absence of clear 
guidance on this issue, a substantial number of waiver requests could 
be expected that would have to be resolved without the benefit of 
decisional criteria previously examined and refined through the 
rulemaking process.
    Paragraph (a) proposes that, as general rule, all trains operating 
over PTC territory must be PTC-equipped. In other words, paragraph (a) 
would require that each lead locomotive to be operated with a PTC 
onboard apparatus if it is controlling a train operating on a track 
equipped with a PTC system in accordance subpart I. The PTC onboard 
apparatus should operate and function in accordance with the PTCSP 
governing the particular territory. Accordingly, it must successfully 
and sufficiently interoperate with the host railroad's PTC system.
    Generally, the four parts of each PTC system are office, wayside, 
communications, and onboard components. FRA recognizes that a PTC 
onboard apparatus for a lead locomotive owned and operated by one 
railroad may not be part of the PTC system upon which the locomotive 
operates. For example, a Class II railroad lead locomotive equipped 
with a PTC onboard apparatus may operate on a Class I railroad's PTC 
line. Throughout this rule, the use of the term ``PTC system,'' 
depending upon its context, usually refers to the host railroad's PTC 
system, and not the tenant railroad's lead locomotive. When using the 
term, PTC onboard apparatus, however, FRA intends to cover all such 
mobile equipment, regardless of whether it on a locomotive owned or 
controlled by a host or tenant railroad.
    Under proposed Sec.  236.1006, FRA may enforce paragraph (a). 
Proposed paragraphs (b) and (c), however, contains a series of proposed 
qualifications and exceptions to paragraph (a).
    First, it is understood that during the time PTC technology is 
being deployed to meet the statutory deadline of December 31, 2015, 
there will be movements over PTC lines by trains with lead locomotives 
not equipped with a PTC onboard apparatus. In general, Class I railroad 
locomotives are used throughout the owning railroad's system and, under 
shared power agreements, on other railroads nationally. FRA anticipates 
that the gradual equipping of locomotives--which will occur at a 
relatively small number of specialized facilities and which will 
require a day or two out of service as well as time in transit--will 
extend well into the implementation period that ends on December 31, 
2015. It will not be feasible to tie locomotives down to PTC lines, and 
the RSAC stakeholders fully understood that point. Labor organizations 
did urge that railroads make every effort to use equipped locomotives 
as controlling units, and FRA believes that in general, railroads will 
do so in order to obtain the benefits of their investment.
    Second, FRA has included a transitional provision, related to PTC 
apparatus that fails upon attempted initialization, specifically 
intended to encourage placement of PTC-equipped locomotives on the 
point during the period when reliability may be an issue. This 
provision would allow a stated, declining percentage of locomotives 
equipped with PTC to be dispatched even if the onboard apparatus fails. 
Although FRA agrees with the objective of rail labor's suggestion for 
``consist management'' that puts equipped locomotives on the point, FRA 
also recognizes that a number of factors related to the age and 
condition of locomotives may influence this decision. Further, in the 
early stages of implementation, requiring that power be switched if 
initialization fails could result in significant train delays and 
contribute to congestion in yards and terminals. Some ``slack'' in the 
system will be required to implement PTC intelligently and 
successfully. Of course, if FRA determines during implementation that 
good faith efforts are not being made to take advantage of PTC-equipped 
locomotives, FRA could step in with more prescriptive requirements 
after providing notice and an opportunity for comment.
    Recognizing that matching PTC lines with PTC-equipped controlling 
locomotives will be a key factor in obtaining the benefits of this 
technology in the period up to December 31, 2015, FRA requests comments 
on whether PTC Implementation Plans should be required to include power 
management elements describing how this will be accomplished to the 
degree feasible.
    Third, the section provides a cross-reference to Sec.  236.1029 
pertaining to PTC onboard apparatus failing en route.
    Fourth, this provision proposes exceptions for trains operated by 
Class II and III railroads, including tourist or excursion railroads. 
The exceptions are limited to lines not carrying intercity or commuter 
passenger service, except where the Class I freight railroad and the 
passenger railroad have requested an exception in the PTC 
Implementation Plan's main line track exception addendum (MTEA) in 
accordance with Sec.  236.1019, as further discussed below, and FRA has 
approved that element of the plan.
    FRA has considered whether to provide an exception to requiring 
each Class II and III railroad locomotive to be equipped with a PTC 
onboard apparatus when operating over passenger routes to be equipped 
with a PTC system, but FRA has not been able to define conditions that 
would apparently be suitable in every case. FRA is open to 
consideration of exceptions within the context of a PTC Implementation 
Plan. To the extent that the host Class I or passenger railroad would 
need to be supportive of the exception, FRA recognizes that options may 
be foreclosed prior to FRA consideration. However, railroads have 
historically exercised substantial control of operations over track 
that they own or dispatch, and in this case those interests 
significantly parallel the apparent intent of the Congress to achieve a 
high level of safety in mixed freight and passenger operations. If FRA 
were to handle exceptions through PTC Implementation Plans, FRA seeks 
comments on how that should be accomplished. FRA also seeks comments on 
whether there should be an assumption that the lead locomotives not 
equipped with PTC onboard apparatus' on four unequipped Class II or III 
railroad trains will be permitted daily on a segment of PTC-equipped 
track and that variances from that are permitted in a PTC 
Implementation Plan. If so, FRA questions whether that should be 
subject to the agreement of both railroads. If agreement by the Class 
II or III railroad is not required, FRA seeks comments on what 
assurance there would be that the Class I railroad would not 
effectively shut out the Class II or III railroad's operation.
    FRA recognizes that most of the justifications stated for these 
proposed exceptions pertain to short movements for interchange that 
would constitute a small portion of the movements over the

[[Page 35973]]

PTC-equipped line. The accident/incident data show that the risk 
attendant upon these movements is small. A review of the last seven 
years of accident data covering 3,312 accidents that were potentially 
preventable by PTC showed that there were only two of those accidents 
which involved a Class I railroad's train and a Class II or III 
railroad's train. FRA believes that the low level of risk revealed by 
these statistics justifies an exception for Class II and III railroad 
trains traversing a PTC-equipped line for a relatively short distance. 
FRA notes that the cost of equipping those trains would be high when 
viewed in the context of the financial strength of the Class II or III 
railroad and the marginal safety benefits would be relatively low in 
those cases where a small volume of traffic is moved over the PTC-
equipped line.
    FRA also believes that it is clearly desirable to eventually have 
each train using a PTC-equipped line to have a lead locomotive equipped 
with a PTC onboard apparatus. However, FRA seeks comments on the length 
of time the exception should last and a justification of that length of 
time. Other considerations aside, FRA seeks comments on whether FRA 
should not require a Class II or III railroad locomotive used on a PTC-
equipped line to be equipped with PTC when it is rebuilt or replaced 
(i.e., when the cost of equipping a locomotive is lowest). In other 
cases, the Class II or III railroad has dedicated locomotives serving 
the line to be equipped with PTC. From the facts presently available to 
FRA, it appears to be appropriate for those locomotives to be equipped 
with PTC. Moreover, FRA is aware of other cases where Class II and III 
railroads have rather more extensive operations over Class I railroad 
lines; and, in these cases, the risks incurred could be more 
substantial. Further, in some of these cases the smaller railroads are 
aligned with the Class I railroads over which they operate or may even 
be under common ownership and control. For purposes of prompting a more 
complete public dialogue on this issue, FRA is proposing to limit 
unequipped movements by any single Class II or III railroad to not more 
than 4 trains per day over any given track segment on a PTC-equipped 
line. A train moving from the small railroad to the point of 
interchange and back within the same calendar day would count as two 
trains.
    To the extent the movements in question do not exceed 20 miles, 
this exception would be available at least until FRA next considered 
the issue of PTC deployment. Information available to FRA indicates 
that this would accommodate a substantial majority of the affected 
operations. FRA questions and seeks comments as to whether this 
latitude should be available if one or more locomotives subsequently 
acquired by the small railroad were equipped for PTC.
    To the extent the movements in question exceed 20 miles, the 
exception would be available only until December 31, 2020. In some 
cases, small railroads operate over Class I railroad tracks for over 
one hundred miles, and these operations may be integral to their 
service plans (e.g., permitting the small railroad to reach lines 
branching off from the Class I railroad's route structure for which the 
smaller railroad provides local service). FRA recognizes that in these 
circumstances the smaller railroads would face overwhelming competition 
for supplier attention and significant challenges related to pricing 
that will attend the initial period of implementation. Accordingly, FRA 
proposes to provide for these railroads to equip the necessary 
locomotives with additional time beyond the statutory deadline that 
applies to Class I railroads. In conjunction with this latitude, FRA 
would ask for progress reports to focus the attention of the railroads' 
management teams and to ensure that the agency could not be presented 
with unreasonable demands for further extensions at the end of the 
extended implementation period.
    FRA recognizes that small railroads carry a wide variety of 
commodities, including PIH traffic. FRA invites comments on whether the 
small railroad exceptions for freight operations that FRA is proposing 
should be altered if the small railroad is transporting PIH traffic on 
PTC equipped track through a densely populated area. Commenters are 
requested to detail any alternative standards they believe should be 
adopted to address such a situation.

Section 236.1007 Additional Requirements for High Speed Service

    Since the early 1990s, there has been an interest centered around 
designated high speed corridors for the introduction of high speed 
rail, and a number of States have made progress in preparing rail 
corridors through safety improvements at highway-rail grade crossings, 
investments in track structure, and other areas. FRA has administered 
limited programs of assistance using appropriated funds. With the 
passage of the American Recovery and Reinvestment Act of 2009, Public 
Law 111-5, 123 Stat. 115 (2009), which provides $8 billion in capital 
assistance for high speed rail corridors and intercity passenger rail 
service, and the President's announcement in April 2009 of a Vision for 
High Speed Rail in America, FRA expects those efforts to increase 
considerably. FRA believes that railroads conducting high speed 
operations in the United States can provide a world class service as 
safe as, or better than, any high speed operations conducted elsewhere. 
In anticipation of such service, and to ensure public safety, FRA 
proposes three tiers of requirements for PTC systems operating in high 
speed service. The proposed performance thresholds are intended to 
increase safety performance targets as the maximum speed limits 
increase to compensate for increased risks, including the potential 
frequency and adverse consequences of a collision or derailment.
    Section 236.1007 proposes setting the intervals for the high speed 
safety performance targets for operations with: maximum speeds at or 
greater than 60 and 50 miles per hour for passenger service and freight 
operations, respectively, under paragraph (a); maximum speeds greater 
than 90 miles per hour under paragraph (b); maximum speeds greater than 
125 miles per hour under paragraph (c); and maximum speeds greater than 
150 mph under paragraph (d). The reader should note that the 
requirements increase as speed rises. Thus, for instance, operations 
with trains moving above 125 miles per hour must, in addition to the 
requirements under paragraph (c), adhere to the requirements under 
paragraphs (a) and (b).
    Paragraph (a) addresses the PTC system requirements for territories 
where speeds are greater than 59 miles per hour for passenger service 
and 49 miles per hour for freight service. Under existing regulations 
(49 CFR 236.0), block signal systems are required at these speeds 
(unless a manual block system is in place, an option that this proposal 
would phase out). The proposed rule expects covered operations moving 
at these speeds to have implemented a PTC system that provides, either 
directly or with another technology, all of the statutory PTC system 
functions along with the safety-critical functions of a block signal 
system as defined in the existing standards of subparts A-F of part 
236. The safety-critical functions of a block signal system include 
track circuits, which assist in broken rail detection and unintended 
track occupancies (equipment rolling out), and fouling circuits, which 
can identify equipment that is intruding on the clearance envelope and 
may prevent raking collisions.

[[Page 35974]]

    FRA recognizes that advances in technology may render current block 
signal, fouling, and broken rail detection systems obsolete and FRA 
does not want to preclude the introduction of suitable and appropriate 
advanced technologies. Accordingly, FRA believes that alternative 
mechanisms providing the same functionality are entirely acceptable and 
FRA encourages their development and use to the extent they do not have 
an adverse impact on the level of safety.
    Paragraph (b) addresses system requirements for territories where 
operating speeds are greater than 90 miles per hour, which is currently 
the maximum allowable operating speed for passenger trains on Class 5 
track. At these higher speeds, the implemented PTC system must not only 
comply with paragraph (a), but also be shown to be fail-safe (as 
defined in Appendix C) and at all times prevent unauthorized intrusion 
of rail traffic onto the higher speed line operating with a PTC system. 
FRA intends this concept of fail-safe application to be understood in 
its commonplace meaning, i.e., that insofar as feasible the system is 
designed to fail to a safe state, which normally means that trains will 
be brought to a stop. Further, FRA understands that there are aspects 
of current system design and operation that may create a remote 
opportunity for a ``wrong-side'' or unsafe failure and that these 
issues would be described in the PTCSP and mitigations would be 
provided. FRA recognizes that, as applied in the general freight 
system, this proposal could create a significant challenge related to 
interoperability of freight equipment operating over the same 
territory. Accordingly, FRA requests comment on whether, where 
operations do not exceed 125 miles per hour or some other value, the 
requirement for compliance with Appendix C safety assurance principles 
might be limited to the passenger trains involved, with ``non-vital'' 
onboard processing permitted for the intermingled freight trains.
    As speed increases, it also becomes more important that inadvertent 
incursions on the PTC-equipped track be prevented at switch locations. 
FRA proposes that this be done by effective means that might include 
use of split-point derails properly placed, equipping of tracks 
providing entry with PTC, or arrangement of tracks and switches in such 
a way as to divert an approaching movement which is not authorized to 
enter onto the PTC line. The protection mechanism on the slower speed 
line must be integrated with the PTC system on the higher speed line in 
a manner to provide appropriate control of trains operating on the 
higher speed line if a violation is not prevented for whatever reason.
    Paragraph (c) addresses high speed rail operations exceeding 125 
miles per hour, which is the maximum speed for Class 7 track under 
Sec.  213.307. At these higher speeds, the consequences of a derailment 
or collision are significantly greater than at lower speeds due to the 
involved vehicle's increased kinetic energy. In such circumstances, in 
addition to meeting the requirements under paragraphs (a) and (b), 
including having a fail-safe PTC system, the entity operating above 125 
miles per hour must provide an additional safety analysis (the HSR-125) 
providing suitable evidence to the Associate Administrator that the PTC 
system can support a level of safety equivalent to, or better than, the 
best level of safety of comparable rail service in either the United 
States or a foreign country over the 5-year period preceding the 
submission of the PTCSP. Additionally, PTC systems on these high speed 
lines must provide the capability, as appropriate, to detect incursion 
from outside the right of way and provide warnings to trains. Each 
subject railroad is free to suggest in its HSR-125 any method to the 
Associate Administrator that ensures that the subject high speed lines 
are corridors effectively sealed and protected from such incursions 
(see Sec.  213.347 of this title), including such hazards as large 
motor vehicles falling on the track structure from highway bridges.
    Paragraph (d) addresses the highest speeds existing or currently 
contemplated for rail operations exceeding 150 miles per hour. FRA 
expects these operations to be governed by a Rule of Particular 
Applicability and the HSR-125 required by paragraph (c) shall be 
developed as part of an overall system safety plan approved by the 
Associate Administrator. The quantitative risk showing required for 
operations above 125 miles per hour is not required to include 
consideration of acts of deliberate violence. The reason for this 
exclusion is simply to remove speculative or extraordinary 
considerations from the analysis. FRA and the Department of Homeland 
Security will of course expect that security considerations are taken 
into account in system planning.

Section 236.1009 Procedural Requirements

    RSIA08 and the proposed rule requires that by April 16, 2010, each 
Class I railroad carrier and each entity providing regularly scheduled 
intercity or commuter rail passenger transportation develop and submit 
to FRA a plan for implementing a PTC system by December 31, 2015, and 
that FRA shall not permit the installation of any PTC system or 
component in revenue service unless the Administrator has certified 
them through the approval process contained in this part. FRA 
understands implementation to include design, testing, potential 
Verification and Validation, installation, and operation over the PTC 
system's life cycle.
    Current subpart H of part 236 provides a technically sound 
procedure for obtaining FRA approval of various processor-based signal 
and train control systems. However, as based on experience gained 
during BNSF's ETMS 1 project, FRA believes that its process does not 
support rapid FRA review and decision making and requires redundant 
submission of information common to multiple railroads. FRA also 
believes that although the risk analysis required by subpart H fully 
reflects operational parameters associated with the different type of 
operations, it is excessively cumbersome and overly time consuming for 
the purposes of deploying PTC system technologies at the rate required 
under RSIA08. Moreover, subpart H does not require an implementation 
plan and does not provide for ``certification.'' Arguably FRA could 
simply amend subpart H to include requirements relating to 
implementation plans and to modify the language to equate ``approval'' 
under subpart H with ``certification'' under the statute. However, FRA 
believes that such a resultant amended subpart H would remain 
unsuitable for a PTC system certification process in light of the 
congressional mandates. Those potential amendments alone would not 
remedy subpart H's inability to provide quick and efficient FRA review.
    Accordingly, for PTC system implementation, certification, and 
build-out completion to occur within the very aggressive dates set by 
Congress, FRA is proposing a new subpart I, with some minor 
modifications to subpart H. Under subpart I, Sec.  236.1007 proposes 
and explains the process by which each railroad may ultimately receive 
PTC System Certification for its PTC system. Under Sec.  236.1007, FRA 
intends to avoid procedural redundancy, provide sufficient procedural 
flexibility to accompany the varying needs of those seeking 
certification, mitigate the financial risk associated with 
technological investment necessary to comply with the regulatory 
requirements, and otherwise develop a

[[Page 35975]]

streamlined process to provide for quick review and resolution of the 
issues leading to certification.
    Generally speaking, there are three major elements of the proposed 
PTC System Certification process: PTC Implementation Plan (PTCIP) 
submission and approval, receipt or use of a Type Approval number--
which may be provided with approval of a PTC Development Plan (PTCDP)--
and PTC Safety Plan (PTCSP) submission to receive PTC System 
Certification. While Sec.  236.1009 provides for the procedural 
requirements for this process, the contents for the applicable filings 
are provided for under Sec. Sec.  236.1011, 236.1013, and 236.1015. The 
PTCIP is the written plan that defines the specific details of how and 
when the railroad will implement the PTC system. The PTCDP provides a 
detailed discussion of specific elements of the proposed technology and 
product that will be used to implement PTC as required by RSIA08. 
Approval of the PTCDP comes in the form of a Type Approval number that 
applies to the subject PTC system. The PTCSP provides the railroad-
specific elements demonstrating that the system, as installed, meets 
the required safety performance objectives. Approval of the PTCSP comes 
in the form of a PTC System Certification.
    Under paragraph (a), the PTCIP submission deadline of April 16, 
2010, applies to all host railroads--as defined in Sec.  236.1003--that 
exist at that time and are required to install a PTC system on one or 
more main lines in accordance with Sec.  236.1005(b). Intercity and 
commuter railroads that are tenants on Class I, II, or III freight 
lines must also join with their host railroad in filing these plans. 
FRA believes that the railroad that maintains operational control over 
a particular track segment is generally in the best position to develop 
and submit the PTCIP, since that railroad is more knowledgeable of the 
conditions of and operations over its track. FRA recognizes that in 
cases where a tenant passenger railroad operates over a Class II or III 
railroad, the passenger railroad may be required to take a more active 
role in planning the PTC system deployment by working with the host 
railroad.
    Paragraph (a), proposes to require that a PTCIP will be filed by 
railroads that are host railroads upon which passenger trains traverse 
and thus require PTC installation and operation. FRA recognizes that 
the statute requires timely submission of a PTCIP by each Class I 
railroad and each entity providing regularly scheduled intercity or 
commuter rail passenger transportation. Class II and III railroads that 
host intercity or commuter rail service will need to file 
implementation plans, whether or not they directly procure or manage 
installation of the PTC system.
    The tenant passenger railroad will need to file jointly with the 
Class I, II or III railroad. This is consistent with RSIA08, which 
requires each subject passenger railroad to file an implementation 
plan. In the case of an intercity or commuter railroad providing 
service over a Class I railroad, it may be sufficient for the passenger 
railroad to file a letter associating itself with the Class I's plan to 
the extent it impacts the passenger service. FRA does not propose any 
requirement for joint filing in the more common case where another 
railroad has freight trackage rights over a Class I railroad's PTC 
line. However, the Class I railroad will, of course, address these 
joint operations and discuss the issue of interoperability in its plan 
as required by law.
    If a host freight railroad and tenant passenger railroad cannot 
come to an agreement on a PTCIP to jointly file by April 16, 2010, they 
must instead each file a PTCIP separately with a notification separate 
from the PTCIP to the Associate Administrator indicating that a joint 
filing was not possible and an explanation of why the subject railroads 
could not agree upon a final PTCIP draft for joint filing. Under such a 
circumstance, each freight or passenger railroad may still be subject 
to a civil penalty assessed for each day past the deadline that a PTCIP 
is not jointly filed. FRA believes that these measures are necessary to 
ensure timely PTC system implementation and operation under the statute 
and are in the interest of public safety. FRA believes that when 
subject railroads have an obligation to submit a joint filing, they 
also carry the obligation to seek dispute resolution by private means 
if needed.
    If a PTCIP or request for amendment (RFA), as provided in Sec.  
236.1021, must be submitted in accordance with the rule after April 16, 
2010, paragraph (a) does not propose to provide the subject railroads 
with an opportunity to file separately. If a railroad intends to use 
track that would require the installation of a PTC system in accordance 
with paragraph (a)(3), and the parties have difficulty reaching 
agreement, then such usage would merely be delayed until the parties 
come to a mutually acceptable PTCIP for joint filing.
    FRA notes that new passenger railroads are likely to begin 
operations during the period between issuance of the final rule in this 
proceeding and the end of the implementation period for PTC (December 
15, 2015). Railroads beginning operations after April 16, 2010, but 
before December 31, 2015, that must install PTC would be expected to 
file a PTCIP that meets the requirements of paragraph (a) as soon as 
possible after the decision to proceed. It is FRA's position for 
purposes of this proposal that any railroad commencing operations after 
December 31, 2015, that require PTC will not be authorized to commence 
revenue operations until the PTC installation is complete. FRA requests 
comment on whether there are any legitimate exceptions to this 
approach, which appears to be the only approach consistent with the 
RSIA08.
    Paragraph (b) contains the proposed process for receiving a Type 
Approval number for a particular PTC system. Under the proposed rule, 
each PTC system must receive a Type Approval number. The Type Approval 
is a number assigned to a particular off-the-shelf PTC system product--
described in a PTCDP in accordance with Sec.  236.1013--indicating 
FRA's belief that the product could fulfill the requirements of subpart 
I. FRA's issuance of a Type Approval does not mean that the product 
will meet the requirements of subpart I. The Type Approval applies to 
the technology designed and developed, but not yet implemented, and 
does not bestow any ownership or other similar interests or rights to 
any railroad. Each Type Approval number remains under the control of 
the FRA, and can be issued or revoked in accordance with this subpart.
    FRA expects the proposed Type Approval process to provide a variety 
of benefits to FRA and the industry. If a railroad submits a PTCDP 
describing a PTC system, and the PTC system receives a Type Approval, 
then other railroads intending to use the same PTC system without 
variances may, in accordance with proposed paragraph (b)(1), simply 
rely on the Type Approval number without having to file a separate 
PTCDP. While the railroad filing the PTCDP must expend resources to 
develop and submit the PTCDP, all other railroads using the same PTC 
system would not. This would not only provide significant cost and time 
savings for a number of railroads, but will remove a significant level 
of redundancy from the approval process that is currently inherent in 
subpart H.
    If, however, a railroad intends to use a modified version of a PTC 
system that has already received a Type Approval number, and the 
variances between the two systems are of a safety-critical nature, the 
railroad must submit a new PTCDP. The new PTCDP can either fully

[[Page 35976]]

comply with the content requirements under Sec.  236.1013 or supply a 
Type Approval number for the other PTC system upon which the modified 
PTC system will rely and a document fulfilling the content requirements 
under Sec.  236.1013 as it applies to the safety-critical variances.
    In any event, to receive a new Type Approval number, the railroad 
must submit to FRA a PTCDP, drafted in accordance with Sec.  236.1013, 
no later than when it submits its PTCIP. While the PTCDP may be drafted 
by the PTC system vendor, FRA believes it is the railroads' regulatory 
responsibility and duty to submit its PTCIP to FRA. FRA believes that 
requiring the submission of the PTCDP with the PTCIP will facilitate a 
reduction in regulatory activities, thus maximizing the time available 
for the railroads to carry out the necessary activities to complete PTC 
implementation within the 65 months available between April 2010, and 
December 2015. During that time, the each railroad is expected to carry 
out all of the required actions necessary to complete design, 
manufacture, test, and installation of the PTC office, onboard, and 
wayside subsystems. FRA believes that the process proposed in paragraph 
(b) provides the railroads considerable flexibility. By requiring that 
a railroad's PTCDP be submitted no later than its PTCIP, FRA intends to 
ensure that FRA has the opportunity early in the regulatory approval 
process to review and determine whether the proposed technical solution 
in the PTCDP has the potential to satisfy the statutory requirements. 
If a PTCDP is submitted at a later time, the length of time available 
to the railroad to perform a complete PTC implementation will be 
decreased even further.
    Many issues relating to FRA's review of the railroad's PTCDP may 
also cause further delays, thus reducing the time between the receipt 
of a Type Approval and the statutory deadline of December 15, 2015, 
upon which the PTC system must be installed and operating. For 
instance, FRA may find that the PTCDP does not adequately conform to 
this subpart or otherwise has insufficient information to justify 
approval. FRA may also determine that there are issues raised by the 
PTCDP that would adversely affect the ability of FRA to eventually 
certify the system. If such a situation were to arise, the railroad and 
its vendor would need to address the issues, and resubmit the PTCDP for 
FRA approval.
    Given the magnitude of the tasks faced by the railroads, any 
additional delays beyond April 16, 2010, will increase the risk of the 
railroad failing to meet the December 31, 2015, completion date 
required by RSIA08. Such delays will increase the length of time that 
the risk to the public and railroad employees remains unmitigated by 
PTC technologies. More specifically, FRA recognizes that any loss of 
time would make it more difficult for a railroad to perform the 
installation, testing, and analyses necessary to submit its PTCSP for 
PTC System Certification. Such installation, testing, and analyses 
cannot occur until the railroad knows the PTC system that it may use, 
as identified by a Type Approval number. Accordingly, paragraph (b) 
proposes that each PTCDP be filed no later than when its associated 
PTCIP is submitted in order to preserve as much time as possible to 
ensure that each railroad meets the statutory deadline and that 
Congress' intent is not otherwise frustrated.
    FRA believes that the existence of certain overlapping issues in 
each PTCDP and PTCIP also requires their contemporaneous submission and 
review. FRA strongly believes that a meaningful implementation plan 
cannot be created if the railroad has not identified and understands 
the technology they propose to implement. Without an understanding of 
the technology, and the issues associated with its design, test, and 
implementation, any schedules developed by the railroad may be 
meaningless. Unless there is an understanding of the PTC system it 
hopes to use, and how it expects to implement that system, evaluation 
of a deployment schedule can not be undertaken.
    Moreover, the PTCIP requires that the railroad address the issue of 
interoperability with other PTC systems. Any meaningful discussion 
regarding interoperability requires that the railroad have a clear 
understanding of the technical capabilities of the system that it 
proposes to implement before it can make an informed judgment of how 
the system will interoperate with other systems. The information 
required in the PTCDP provides the implementing railroad, other 
railroads with which the implementing railroad interfaces, and FRA with 
an understanding of the technical requirements necessary for 
interoperability. FRA believes that early identification of technical 
capabilities of the proposed PTC systems will allow the concerned 
parties to make more timely design adjustments to facilitate 
interoperability, reducing any delays that may increase the level of 
risk of the railroad meeting its statutory deadline.
    FRA also believes that the process proposed by paragraph (b) will 
also reduce each railroad's financial risk related to implementing a 
technological system requiring governmental approval. Members of the 
PTC Working Group expressed concern about having to expend significant 
resources to implement and test a PTC system prior to submitting a 
PTCSP reflecting its findings in order to receive PTC System 
Certification. FRA believes that proposed paragraphs (b) and (e) 
address this concern. By requiring submission of a PTCDP earlier in the 
process, FRA intends to be involved in the design and implementation 
process from the beginning. After contemporaneously reviewing a 
railroad's PTCIP and PTCDP, FRA may be able to predetermine, and share 
with the railroad, an appropriate course of action to adequately 
address the various issues specific to the railroad and related to 
drafting a successful PTCSP. Moreover, in accordance with paragraph 
(e)--as discussed further below--each subject railroad may have the 
benefit of FRA monitoring its progress in implementing its PTC system. 
With FRA's involvement in the process, each subject railroad's 
financial risk associated with implementing a PTC system prior to PTCSP 
approval will be mitigated.
    While FRA expects each subject railroad to submit its PTCDP with 
its PTCIP, the proposed rule does not preclude a railroad from 
submitting its PTCDP before its PTCIP for FRA review and approval. FRA 
encourages an earlier submission of the PTCDP to further reduce the 
required regulatory effort necessary to review the PTCIP and PTCDP if 
submitted together. More importantly, it would present an opportunity 
for FRA to issue a Type Approval for the proposed PTC system before 
April 16, 2010, thus providing other railroads intending to use the 
same or similar PTC system the opportunity to leverage off of the work 
already accomplished by simply submitting the Type Approval--and a much 
less burdensome PTCDP in the event of variances. FRA also believes that 
the proposed regulatory procedure may incentivize railroads using the 
same or similar PTC system to jointly develop and submit a PTCDP, thus 
further reducing the paperwork burden on FRA and the industry as a 
whole and increasing confidence in the interoperability between 
systems.
    Paragraph (c) proposes to require that each subject railroad must 
either file a Request for Expedited Certification (REC) or submit an 
approved PTCIP, a Type Approval, and a PTCSP developed in accordance 
with Sec.  236.1015 in order to receive PTC System Certification. A REC 
applies only to PTC systems that

[[Page 35977]]

have already been in revenue service and meet the criteria of Sec.  
236.1031(a), as further discussed below. If a PTC system is not 
eligible for expedited certification, the railroad must submit a PTCSP. 
As required under proposed Sec.  236.1015, the PTCSP must include 
information relating to the operation and safety of the PTC system as 
defined in the PTCDP and as applied to the railroad's actual territory. 
To determine the sufficiency of the PTC system's applicability on the 
railroad's territory, the railroad may be required, as referenced in 
paragraph (e), to perform laboratory or field testing or have an 
independent assessment performed. Ultimately, PTC System 
Certification--issued by FRA based on a review and approval of the 
PTCSP--is FRA's formal recognition that the PTC system, as described 
and implemented, meets the statutory requirements and the provisions of 
subpart I. It does not imply FRA endorsement or approval of the PTC 
system itself.
    To be clear, paragraph (d) requires that each PTCIP, PTCDP, and 
PTCSP must comply with the content requirements proposed in Sec. Sec.  
236.1011, 236.1013, and 236.1015, respectively. If the submissions do 
not comply with their respective regulatory requirements, then they may 
not be approved. Without approval, a PTC system may not receive a Type 
Approval or PTC System Certification.
    Paragraph (d) also proposes that the contents of the submitted 
plans be understood by FRA personnel. In the interest of an open 
market, FRA does not want to preclude the ability of PTC system 
suppliers outside of the United States from manufacturing PTC systems 
or selling them to the subject railroads. However, in order to ensure 
the safety and reliability of those systems, FRA needs to adequately 
review the submitted plans. Accordingly, FRA proposes to require that 
all materials submitted in accordance with this subpart be in the 
English language, or be translated into the English language and 
attested as true and correct. FRA seeks comments on this proposal and 
whether any additional requirements are necessary to ensure FRA's 
adequate understanding of the submissions.
    Under subpart H of part 236, a railroad may seek confidential 
treatment for certain information required to be submitted under that 
subpart. According to Sec.  236.901(c), a railroad may label that 
information as confidential--if it deems it to be trade secrets, or 
commercial or financial information that is privileged or confidential 
under Exemption 4 of the Freedom of Information Act, 5 U.S.C. 
552(b)(4)--and submit the information in accordance with Sec.  209.11. 
FRA believes that the same concept should be applied to materials 
submitted in accordance with proposed subpart I. FRA continues to 
believe that the referenced information should receive the protections 
under the Freedom of Information Act (FOIA) (5 U.S.C. 552) and the 
Trade Secrets Act (18 U.S.C. 1905). FRA also continues to believe that 
it cannot make any flat pronouncements about the confidentiality of 
information it has not yet received. Should a FOIA request be made for 
information submitted under this rule that the submitting party has 
claimed should be withheld, the submitting company will be notified of 
the request in accordance with the submitter consultation provisions of 
the Department's FOIA regulations (Sec.  7.17) and will be afforded the 
opportunity to submit detailed written objections to the release of 
information protected by exemption 4 as provided for in Sec.  7.17(a). 
Since FRA proposes to place the redacted versions of the submitted 
plans in a docket for public comment, FRA strongly encourages 
submitting parties to request protection from withholding only for 
those portions of documents that truly justify such treatment (i.e., 
trade secrets and security sensitive information).
    While FRA continues to believe that there is no need at this time 
to substantially revise Sec.  209.11, FRA proposes in subpart I to 
require an additional document to assist FRA in efficiently and 
correctly reviewing confidential information. Under Sec.  209.11, a 
redacted and an unredacted copy of the same document must be submitted. 
When FRA review is required to determine whether confidentiality should 
be afforded, FRA personnel must painstakingly compare side-by-side the 
two versions to determine what information has been redacted. To reduce 
this burden, FRA proposes that any material submitted for confidential 
treatment under subpart I and Sec.  209.11 must include a third version 
that would indicate, without fully obscuring, the redacted portions. 
For instance, to indicate, without obscuring, the plan's redacted 
portions, the railroad may use the color or light gray highlighting, 
underlining, or strikethrough functions of its word processing program. 
This document will also be treated as confidential under Sec.  209.11. 
While FRA could instead amend Sec.  209.11 to include this requirement, 
FRA does not believe it to be necessary at this time. If more 
regulatory procedures in other subparts or parts provide for 
confidential treatment under Sec.  209.11, FRA will then consider 
whether amendment of Sec.  209.11 would be appropriate at that time.
    As discussed more specifically below, FRA is considering requiring 
the submission of an adequate GIS shapefile to fulfill some of the 
PTCIP content requirements under Sec.  236.1011. Redacting word 
processing documents includes the simple task of blocking the text 
wished to be deemed confidential. However, in a GIS shapefile, which 
includes primarily map data, visually blocking out the information 
would defeat the purpose. For instance, a black dot over a particular 
map location, or a black line over a particular route, would actually 
reveal the location. FRA expects that a railroad seeking 
confidentiality for portions of a GIS shapefile will submit three 
versions of the shapefile to comply with paragraph (d). FRA expects 
that the version for public consumption would merely not include the 
confidential information. FRA seeks comments on this proposal. FRA also 
seeks comments on how a third version of the GIS shapefile would 
indicate, without fully obscuring, the confidential portions.
    As previously noted, FRA expects that FRA-monitored laboratory or 
field testing or an independent third party assessment may be necessary 
to support conclusions made and included in a railroad's submitted 
PTCDP or PTCSP. This issue is initially addressed in paragraph (e). The 
procedural requirements to effectuate either of those requirements can 
be found in Sec. Sec.  236.1035 and Sec.  236.1017, respectively.
    Proposed paragraph (f) makes clear that FRA approval of a plan 
submitted under subpart I may be contingent upon any number of factors 
and that once the plan is approved, FRA maintains the authority to 
modify or revoke the resulting Type Approval or PTC System 
Certification. Under paragraph (f)(1), FRAs would reserve the right to 
attach additional requirements as a condition for approval of a PTCIP, 
PTCDP, or PTCSP. A risk-informed and performance-based approach is one 
in which the risk insights, and engineering analysis and performance 
history, are used to: (1) Focus attention on the most important 
activities; (2) establish objective criteria based upon risk insights 
for evaluating performance; (3) develop measurable or calculable 
parameters for monitoring systems performance; and (4) focus on the 
results as the primary basis of regulatory decision-making. To 
accomplish these tasks, it is necessary to identify, analyze,

[[Page 35978]]

assess, and control hazards and risks within all components of a 
system--including people, cultures and attitudes, procedures, 
materials, tools, equipment, facilities and software. In the 
preparation of any of these plans, railroads may have inadvertently 
failed to fully address hazards and risks associated with all of these 
components.
    FRA believes that proposed paragraph (f)(1) will make the 
regulatory process more efficient and stable. Rather than reject a 
railroad's plan completely, and consequently delay the railroad's 
implementation of its PTC system, FRA would prefer to add additional 
conditions during the approval process to address these oversights. 
When determining whether to attach conditions to plan approval, FRA 
will consider whether: (1) The plan includes a well-defined and 
discrete technical or security issue that affects system safety; (2) 
the risk or safety significance of an issue can be adequately 
determined; (3) the issue affects public health and safety; (4) the 
issue is not already being processed under an existing program or 
process; and (5) the issue cannot be readily addressed through other 
regulatory programs and processes, existing regulations, policies, 
guidance, or voluntary industry initiatives.
    Proposed paragraph (f)(2) provides FRA the right to withdraw a Type 
Approval or a PTC System Certification as a consequence of the 
discovery of new information regarding system safety that was not 
previously identified. FRA issuance of each Type Approval or PTC System 
Certification under performance-based regulations assumes that the 
model of the train control system and its associated probabilistic data 
adequately accounts for the behavior of all design features of the 
system that could contribute to system risk. Different system design 
approaches may result in different levels of detail introducing 
different approximations/errors associated with the safety performance. 
There are some characteristics for which modeling methods may not fully 
capture the behavior of the system, or there may be elements of the 
system for which historical performance data may not be currently 
available. These potential inconsistencies in the failure analysis 
could introduce significant variations in the predicted performance 
from the actual performance. Because of the design complexity 
associated with train control systems, FRA recognizes that these 
inconsistencies are not the results of deliberate acts by any 
individuals or organizations, but simply reflects the level of detail 
of the analysis, the availability of comprehensive information as well 
as the qualification and experience of the team of analysts, and the 
resource limitations of both the railroad and FRA.
    In proposed paragraph (f)(3), FRA indicates that the railroad may 
be allowed to continue operations using the system, although such 
continued operations may have special conditions attached to mitigate 
any adverse consequences. It is FRA's intent, to the maximum extent 
possible and when consistent with safety, to assist railroads in 
keeping the systems in operation. FRA expects that if it places a 
condition on PTC system operations, each railroad will have a 
predefined process and procedure in place that would allow continued 
railroad operations, albeit under reduced capability, until appropriate 
mitigations are in place, and the system can be restored to full 
operation. In certain dire situations, FRA may actually order the 
suspension or discontinuation of operations until the root cause of the 
situation is understood and adequate mitigations are in place. FRA 
believes that suspending a Type Approval or a PTC System Certification 
pending a more detailed analysis of the situation may be appropriate, 
and that any such suspension must be done without prejudice. FRA 
expects to take such an action only in the most extreme circumstances 
and after consultation with the affected parties.
    After reconsidering its issuance of a Type Approval or PTC System 
Certification, under paragraph (f)(4), FRA may either dismiss its 
reconsideration, continue to recognize the existing FRA approved Type 
Approval or PTC System Certification, allow continued operations with 
certain conditions attached, or order the railroad to cease applicable 
operations by revoking its Type Approval or PTC System Certification. 
If FRA dismisses its reconsideration or continues to recognize the Type 
Approval, any conditions required during the reconsideration period 
would no longer be applicable. If FRA will allow continued operations, 
FRA may order that the same or other conditions apply. FRA expects that 
revocation of a Type Approval or PTC System Certification may occur in 
very narrow circumstances, where the risks to safety appear 
insurmountable. Regrettably, there may be a few situations in which the 
inconsistencies are the result of deliberate fraudulent 
representations. In such situations, FRA may also seek criminal or 
civil penalties against the entities involved.
    Proposed paragraph (g) enables FRA to engage in the proper 
inspection to ensure that a railroad is in compliance with subpart I. 
FRA inspections may be required to determine whether a particular 
railroad has not implemented a PTC system where necessary. For 
instance, FRA may need to confirm whether a track segment has 
traversing over it 5 million gross tons or more of annual railroad 
traffic, PIH materials, or passenger traffic. FRA may also need to 
inspect locomotives to determine whether they are equipped with a PTC 
onboard apparatus or to review locomotive logs to determine whether it 
has entered PTC territory. Paragraph (g) makes clear FRA's statutorily 
provided power to inspect the railroads and gather information 
necessary to enforce subpart I.
    As noted above, in order to maintain an open marketplace, the 
proposed rule has been drafted to allow domestic railroads to purchase 
PTC systems from outside of the United States. FRA recognizes that PTC 
systems have been used in revenue service across the globe and that 
acceptable products may be available in other countries. FRA also 
recognizes that such use may come under a regulatory entity much like 
FRA. Accordingly, under paragraph (h), in the event information 
relating to a particular PTC system has been certified under the 
auspices of a regulatory entity in a foreign government, FRA is willing 
to consider that information as independently Verified and Validated in 
accordance with the proposed rule to support the railroad's PTCSP 
development. The phrase ``under the auspices'' intends to reflect the 
possibility of certification contractually performed by a private 
entity on behalf of a foreign government agency. However, the foreign 
regulatory entity must be one recognized by the Associate 
Administrator. A railroad seeking to enjoy the benefits of paragraph 
(h) must communicate that interest in its PTCSP.

Section 236.1011 PTC Implementation Plan Content Requirements

    This proposed section describes the minimum required contents of a 
PTC Implementation Plan. A PTCIP is a railroad's plan for complying 
with the installation of mandatory PTC systems required by RSIA08. The 
PTCIP consists of implementation schedules, narratives, rules, 
technical documentation, and relevant excerpts of agreements that an 
individual railroad will use to complete mandatory PTC implementation. 
FRA will measure the railroad's progress in meeting the required 
implementation date based on the schedule and other information in the 
PTCIP. While the proposed rule does not specify or mandate any format

[[Page 35979]]

for the PTCIP, it must at least clearly indicate which portions intend 
to address compliance with the various plan requirements under Sec.  
236.1011. The PTCIP must also clearly identify each referenced document 
and either include a copy of each document (or its applicable excerpt) 
or indicate where FRA and the public may view that document. Should FRA 
not be able to readily determine adequate response to the required 
information, FRA will assume that the information has not been 
submitted, and will handle the document accordingly. The lack of the 
required information may result in FRA's disapproval of a PTCIP. To 
facilitate timely and successful submittals, FRA, through assistance 
from a PTCIP Task Force drawn from the PTC Working Group, is developing 
a template that could be used to format the documents that must be 
submitted. FRA, however, wishes to emphasize that the use of such a 
template is strictly voluntary, and encourages railroads to prepare and 
submit the documents in whatever structure is most economical for the 
railroad. FRA does believe it is necessary to require that the 
railroads expend their limited resources in reformatting of documents 
when such an activity adds no real value. However, while the template 
may be a useful tool, and in light of the various forms a PTCIP may be 
required to take due to the system the railroad intends to implement, 
complete adherence to the template will not guarantee FRA approval of 
the submitted PTCIP.
    FRA expects each PTCIP to include various highly specific and 
descriptive elements relating to each railroad's infrastructure and 
operations. FRA recognizes that to manually assemble each piece of data 
into a PTCIP may be exceptionally onerous and time consuming and may 
make the PTCIP prone to errors. In light of the foregoing and due to 
the statutory requirement that Congress be apprised of the progress of 
the railroad carriers in implementing their PTC systems, FRA believes 
that electronic submission of much of this information may be warranted 
and preferred. To facilitate collection of this data, FRA proposes to 
require submission of this data in electronic format. Such electronic 
submission would fulfill the requirements under Sec.  236.1011 to which 
they apply.
    FRA believes that the preferred, least costly, and least error-
prone method to comply with Sec.  236.1011 is for railroads to submit 
an electronic geographic digital system map containing the 
aforementioned segment attribute information in shapefile format, which 
is a data format structure compatible with most Geographic Information 
System (GIS) software packages. Using a GIS provides an efficient means 
for organizing basic transportation-related geographic data to 
facilitate the input, analysis, and display of transport networks. 
Railways around the world rely on GIS to manage key information for 
rail operations, maintenance, asset management, and decision support 
systems. FRA believes that the railroads may have already identified 
track segments, and their physical and operational characteristics, in 
shapefile format. For instance, FRA believes that it may be preferable 
that for each track segment, a shapefile should provide the following 
identifiable information: Owning railroad(s); distance; signal system; 
track class; subdivision; number and location of sidings; maximum 
allowable speed; number and location of mainline tracks; annual volume 
of gross tonnage; annual number of cars carrying hazmat; annual number 
of cars carrying PIH; passenger traffic volume; average daily through 
trains; WIUs; switches; and at-grade rail-to-rail crossings. The 
requirements under paragraph (a) may be changed to accommodate any of 
these informational elements. FRA seeks comments on this proposal.
    Paragraph (a)(1) proposes that the railroad describe the technology 
that will be employed in its PTC system. Here, FRA intends to use the 
term ``technology'' broadly to include all applicable tools, machines, 
methods, and techniques.
    In proposed paragraph (a)(2), FRA addresses the statutory 
requirements that the PTCIP shall describe how the PTC system will 
provide interoperability with movements of trains of other railroad 
carriers over its lines. Practically speaking, this means that each 
locomotive operating within PTC territory must be able to communicate 
with and respond to the PTC systems installed on each PTC territory's 
track and signal system, except in limited situations established 
elsewhere in this proposed rule. For similar reasons, paragraph (a)(3) 
proposes that the PTCIP should describe how the PTC system will provide 
for interoperability of the system between the host and all tenant 
railroads on the lines required to be equipped with PTC systems under 
this subpart.
    Interoperability means the ability of diverse systems and 
organizations to work together (inter-operate), taking into account the 
technical, operational, and organizational factors that may impact 
system-to-system performance. FRA expects each PTC system required by 
subpart I to exhibit syntactic interoperability--so that it may 
successfully communicate and exchange data with other PTC systems--and 
semantic interoperability--so that it may automatically, accurately, 
and meaningfully interpret the exchanged information to prove useful to 
the end user of each communicating PTC system. To achieve semantic 
interoperability, both sides must defer to a common information 
exchange reference model. In other words, the content of the 
information sent must be the same as what is received and understood. 
Taking syntactic and semantic interoperability together, FRA expects 
each PTC system to provide services to, and accept services from, other 
PTC systems and to use those services exchanged to enable the PTC 
systems to operate effectively together and to provide the intended 
results. The degree of interoperability should be defined in the PTCIP 
when referring to specific cases.
    Interoperability is achieved through four interrelated means: 
Product testing, industry and community partnership, common technology 
and intellectual property, and standard implementation.
    Product testing includes conformance testing and product 
comparison. Conformance testing ensures that the product complies with 
an appropriate standard. FRA recognizes that certain standards attempt 
to create a framework that would result in the development of the same 
end product. However, many standards apply only to core elements and 
allow developers to enhance or otherwise modify products as long as 
they adhere to those core elements. Thus, if an end product is 
developed in different ways to conform to the same standard, there may 
still be discrepancies between each instantiation of the end product 
due to the existence of those variables. Accordingly, FRA believes that 
comparison testing must also occur to ensure that each instantiation of 
the same product, regardless of the means upon which it is created to 
meet the same standard, is ultimately identical. In regards to PTC 
systems, such comparison testing must occur on all portions that relate 
to each system's interoperability with other systems. Thus, it is also 
important that the PTC system be formally tested in a production 
scenario--as they will be finally implemented--to ensure that it will 
actually intercommunicate and interoperate with other PTC systems as 
advertised and intended.
    To reach interoperability between the various applicable PTC 
systems, each PTCDP must also show that the systems share common 
product engineering.

[[Page 35980]]

Product engineering refers to the common standard, or a sub-profile 
thereof, as defined by the industry and community partnerships, 
specifically intended to achieve interoperability. Without common 
product engineering, the systems will be unable to intercommunicate or 
otherwise interact as necessary to comply with the proposed rule.
    FRA expects that each interoperability standard for PTC systems 
will be developed by a partnership between various industry 
participants. Industry and community partnerships, either domestic or 
international, usually sponsor standard workgroups to define a common 
standard to provide system intercommunications for a specific purpose. 
At times, an industry or community will sub-profile an existing 
standard produced by another organization to reduce options and thus 
making interoperability more achievable. Thus, in each PTCDP, the 
railroad must discuss how it developed or adopted a standard commonly 
accepted by that partnership.
    Means of achieving interoperability include having the various 
entities involved using the same PTC system product or obtaining its 
components from the same developer. While FRA does not necessarily 
require this approach--since the agency seeks to maintain an open and 
competitive marketplace--FRA believes that this is a suitable means to 
achieve interoperability. This technique may provide similar technical 
results when using PTC system products from different vendors relying 
on the same intellectual property. FRA recognizes that certain 
developers with an intellectual property interest in a particular 
technology may provide a non-exclusive license of its intellectual 
property to another entity so that the licensee may introduce into the 
marketplace a substantially similar product reliant on that 
intellectual property. In such a case, FRA foresees that the use of a 
common PTC system technology--even if it is proprietary to a single or 
multiple entities and licensed to railroads--could reduce the 
variability between components, thus providing for a more efficient 
means to achieve interoperability.
    In order for interoperability to actually occur between multiple 
entities' PTC systems, there must be some standard to which they all 
adhere. Thus, FRA also expects that each PTCDP will provide assurances 
of a common interoperability standard agreed to between all entities 
using PTC systems that must interoperate.
    Since each of these interrelated means has an important role in 
reducing variability in intercommunication, each railroad's PTCIP must 
clearly describe the elements required under paragraph (a)(1)-(3).
    Much of the remaining information required in a PTCIP under the 
proposed rule relies on the location, length, and characteristics of 
each track segment. Therefore, a common understanding of a track 
segment is necessary. A track is the main designation for describing a 
physical linear portion of the network. Each line of railroad has a 
station location referencing system, which serves to locate inventory 
features and defects along the length of the track. Because some tracks 
can be very long, track segments are established to divide the track 
into smaller ``management units.'' Typically, segment's boundaries are 
established at point of switch (POS) locations, but may also be located 
at mile markers, grade crossings, or other readily identifiable 
locations. Inspection, condition assessment, and maintenance planning 
is performed individually on each segment. After the track network 
hierarchy is established, the attribute information associated with 
each track is defined. This attribute information describes the track 
layout (e.g., curves and grades), the track structure (e.g., rail 
weights and tie specifications), track clearance issues, and other 
track related items such as turnouts, rail-to-rail at-grade crossings, 
highway-rail grade crossings, drainage culverts, and bridges. Inventory 
information about these track attributes can be quite detailed. The 
benefits of a complete and accurate track inventory provides a record 
of the track network's properties and information about the existing 
track materials at the specific locations when maintenance or repair is 
necessary.
    Proposed paragraphs (a)(4) and (a)(5) require the railroad to put 
its entire implementation plan into an understandable context, 
primarily as it relates to the sequence and schedule of line segment 
implementation events. Under RSIA08, Sec.  20157(a)(2), Congress 
requires each subject railroad, in its PTCIP, to describe how it shall, 
to the extent practical, implement the PTC system in a manner that 
addresses areas of greater risk before areas of lesser risk. 
Accordingly, under paragraph (a)(4), the PTCIP must discuss the 
railroad's areas of risk and the criteria by which these risks were 
evaluated and prioritized for PTC system implementation. To this end, 
the railroad must clearly identify all track segments that must be 
equipped, the basis for that decision for each segment (which might be 
done by categories of segments), and, as provided in paragraph (a)(5), 
the dates that implementation of each segment will be completed, taking 
into account the time necessary to fulfill the procedural requirements 
related to PTCSP submission, review, and approval. At a minimum, the 
deployment decisions must be based on segment traffic characteristics 
such as passenger and freight traffic volumes, the quantity of PIH and 
other hazardous materials, current methods of operations, existence of 
block signals and other traditional train control technologies, the 
number and class of tracks, authorized and allowable speeds for each 
segment, and other unusual characteristics that may adversely impact 
safety, such as unusual ruling grades and other track geometries. In 
cases where deployment of the PTC system cannot be accomplished in 
order of areas with the greatest risk to areas with the least risk, 
paragraph (a)(9) proposes that the railroad must explain why such a 
deployment was not practical and the steps that will be taken to 
minimize adverse consequences to the public until the line segment can 
be equipped.
    Proposed paragraphs (a)(6) and (a)(7) require the PTCIP to include 
information regarding the rolling stock and wayside devices that will 
be equipped with the appropriate PTC technology. For a PTC system to 
work as intended, PTC system components must be installed and operated 
in all applicable offices and on all applicable onboard and wayside 
subsystems. Accordingly, the PTCIP must identify which technologies 
will be installed on each subsystem and when they are scheduled to be 
installed.
    Under paragraph (a)(6), each host railroad filing the PTCIP must 
include a comprehensive list of all rolling stock upon which a PTC 
onboard apparatus must be operative. FRA understands that in most 
situations, the rolling stock referenced in paragraph (a)(6) may only 
apply to lead locomotives. However, in the interest of not hindering 
creative technological innovations, FRA presumes the possibility that 
PTC system technology may also be attached to additional rolling stock 
to provide other functions, including determining train capacity and 
length or providing certain acceptable and novel train controls. To be 
kept apprised of these possibilities, FRA is proposing in paragraph 
(a)(6) that each PTCIP include a list of all rolling stock equipped 
with PTC technology. FRA believes that the PTCIP should also identify 
any risks associated with trains operated by tenant railroads and not 
equipped with

[[Page 35981]]

PTC system technology and the efforts that the host railroad has made 
to establish the extent of that risk. Although FRA believes that this 
is inherent to reviewing the risk in the system, FRA asks for comment 
as to whether a requirement should be specifically called out in the 
rule text.
    FRA understands that a host railroad may not receive cooperation 
from a tenant railroad in collecting the necessary rolling stock 
information. Nevertheless, FRA expects each host railroad to make a 
good faith effort. Identification of those tenant railroads that the 
host railroad attempted to obtain the requisite and applicable 
information from and that failed to address a host railroad's written 
request may establish a good faith effort by the host railroad.
    Proposed paragraph (a)(7) requires the PTCIP to provide a detailed 
schedule of and the railroad to subsequently report WIU installation. 
The selection and identification of a technology selected as part of 
the PTCIP will also, to a great extent, determine the distribution of 
the functional behaviors of each of the PTC subsystems (e.g., office, 
wayside, communications, and back office). The WIU is a type of remote 
terminal unit (RTU) that is part of a larger PTC system, which is a 
type of Supervisory Control and Data Acquisition System (SCADA). As a 
whole, the safe and efficient operation of a SCADA--a centralized 
system that covers large areas, monitors and control systems, and 
passes status information from, and operational commands to, RTUs--is 
largely dependent on the ability of each of its RTUs to accurately 
receive and distribute the required information. As such, a PTC system 
cannot properly operate without properly functioning WIUs to provide 
and receive status information and react appropriately to control 
information.
    It is commonly understood that a WIU device is capable of 
communicating directly to the office, train, or other wayside unit. FRA 
recognizes that there may not be the same amount of WIUs and devices 
that they monitor. Depending on the architecture and technology used, a 
single WIU may communicate the necessarily information as it relates to 
multiple devices. FRA is comfortable with this type of consolidation 
provided that, in the event of a failure of any one of the devices 
being monitored, the most restrictive condition will be transmitted to 
the train or office, except where the system may uniquely identify the 
failed device in a manner that will provide safe movement of the train 
when it reaches the subject location.
    Because of the critical role that WIU's play in the proper and safe 
operation of PTC systems, paragraph (a)(7) proposes that the railroad 
identify the number of WIU's required to be installed on any given 
track segment and the schedule for installing the WIU's associated with 
that segment. This information is necessary to fully and meaningfully 
fulfill the RSIA08 requirement that by December 31, 2012, Congress 
shall receive a report on the progress of the railroad carriers in 
implementing PTC systems. See 49 U.S.C. 20157(d). To comply with this 
statutory requirement, each railroad must determine the number of WIUs 
it will need to procure and the location--as defined by the applicable 
subdivision--that each WIU will be installed. FRA believes that if a 
railroad does not perform these traditional engineering tasks, it will 
risk exceeding the statutory implementation deadline of December 31, 
2015. FRA considers this information an integral part of the PTCIP that 
must be submitted to FRA for approval.
    FRA recognizes the potential for technological improvements that 
may modify the number and types of WIU's required. FRA also recognizes 
that during testing and installation, it may be discovered that 
additional WIU installation may be necessary. In either case, the 
railroad will be required to submit an RFA in accordance with Sec.  
236.1021 indicating how the railroad intends to appropriately revise 
its schedule to reflect the resulting necessary changes. Nevertheless, 
regardless of whether FRA approves or disapproves of the RFA, if a 
railroad is required to submit its PTCIP by April 16, 2010, 
implementation must still be completed by the statutory deadline 
December 31, 2015.
    Under proposed paragraph (a)(8), each railroad must also identify 
in its PTCIP which of its track segments are either main line or not 
main line. This list must be made based solely on the statutory and 
regulatory definitions regardless of whether FRA may later deem a track 
segment as other than main line. If a railroad has a main line that it 
believes should be considered not main line, it may file with the PTCIP 
a main line track exception addendum (MTEA) in accordance with Sec.  
236.1019, as further discussed below. Each track segment included in 
the MTEA should be indicated as much on the list required under 
paragraph (a)(8) so that the PTCIP accounts for each track segment with 
an appropriate cross-reference to the subject MTEA.
    Paragraph (a)(9) requires that the plan call out the basis for this 
determination to the extent the railroad determines that risk-based 
prioritization required by paragraph (a)(4) of this section is not 
practical. FRA recognizes that there may be situations where risk is 
somewhat evenly distributed and where other factors related to 
practical considerations--such as the need to establish reliable 
operation of the system in less complex environments before installing 
it in more complex environments--may be the prudent course. However, 
the burden of establishing the reasonableness of this approach would be 
on the railroad, starting with a showing that risk does not vary 
substantially among the line segments in question.
    As previously mentioned, Sec.  236.1005(a) requires each applicable 
PTC system to be designed to prevent train-to-train collisions. Under 
that section, FRA has proposed various requirements that would apply to 
at-grade rail-to-rail crossings, also known as diamond crossings. While 
the proposed rule text includes certain specific technical 
requirements, it also provides the opportunity for each subject 
railroad to submit an alternative arrangement providing an equivalent 
level of safety as specified in an FRA approved PTCSP. Accordingly, 
under proposed paragraph (a)(10), if the railroad intends to utilize 
alternative arrangements providing an equivalent level of safety to 
that of the table provided under Sec.  236.1005(a)(1)(i), each PTCSP 
must identify those alternative arrangements and methods, with any 
associated risk reduction measures, in its PTCSP.
    Paragraph (b) contains proposed provisions related to further 
deployment of PTC. As noted elsewhere in this preamble, the specific 
characteristics of the PTC route structure, with the focus on PIH 
traffic as an indicator of risk, was a late addition to the bill that 
would become RSIA08, not having appeared in either the House or Senate 
bills until the final package was assembled using consultations between 
the committee staffs in lieu of a formal committee of conference. 
Although the statutory construct (Class I rail line with 5 million 
gross tons and some PIH materials) adequately defines most of the core 
of the national freight rail system, it is a construct that will 
introduce distortions at both ends of the spectrum of risk.
    On one hand, a line with a maximum speed limit of 25 miles per hour 
ending at a grain elevator that receives a few cars of anhydrous 
ammonia per year is a ``main line'' if it has at least 5 million gross 
tons of traffic (a very low threshold for a Class I railroad). This is 
not a line without risk, particularly if it lacks wayside signals, but 
FRA analysis

[[Page 35982]]

shows that the potential for a catastrophic release from a pressure 
tank car is very low at an operating speed of 25 miles per hour, and 
the low tonnage is likely associated with relatively infrequent train 
movements--limiting the chance of a collision. As FRA understands the 
congressional mandate, the law gives FRA little choice but to require 
PTC under these circumstances.
    On the other end of the spectrum, lines with greater risk may go 
unaddressed. For instance, a line carrying perhaps a much higher level 
of train traffic and significant volumes of other hazardous materials 
at higher speeds, without any PIH or passenger traffic, would not be 
equipped. This example is not likely to be present to any significant 
extent under current conditions. However, should the Class I railroads 
raise freight rates sufficiently to eliminate PIH traffic by making 
rail transportation prohibitively expensive, the issue would be 
presented as a substantial one. Most of the transportation risk--
including hazards to train crews and roadway workers and exposure to 
other hazardous materials if released--would remain, but not the few 
carloads of PIH. FRA believes that the intent of Congress with respect 
to deployment of PTC might be defeated, even though the literal 
language of the legislation would be satisfied. Other lines carrying 
very heavy volumes of bulk commodities such as coal and intermodal 
traffic may or may not include PIH traffic. Putting aside the risk 
associated with PIH materials, significant risk exists to train crews 
and persons in the immediate vicinity of the right-of-way if a 
collision or other PTC-preventable accident occurs. Any place on the 
national rail system is a potential roadway work zone, but special 
challenges are presented in providing for on-track safety where train 
movements are very frequent.
    Risk on the larger Class II and III railroads' lines is also a 
matter of concern, and the presence of significant numbers of Class I 
railroad trains on some of those properties presents the opportunity 
for further risk reduction, since over the coming years virtually all 
Class I railroad locomotives will be equipped with PTC onboard 
apparatus'. Examples include trackage and haulage rights retained over 
Class II and III railroads following asset sales in which the Class I 
railroads divested the subject lines. Other prominent examples involve 
switching and terminal railroads, the largest of which are owned and 
controlled by two or more Class I railroads and function, in effect, as 
extensions of their systems. Conrail Shared Assets, a large regional 
switching railroad that is owned by NS and CSXT and is comprised of 
major segments of the former Conrail, then a Class I railroad, is 
perhaps the classic example.
    FRA notes that there has also been a trend, only recently and 
temporarily abated by the downturn in the economy, toward higher train 
counts on some non-signaled lines of the Class I railroads. On a train-
mile basis, these operations present about twice the risk as similar 
operations on signalized lines. These safety gaps need to be filled; 
and, while most will be filled due to the presence of PIH traffic, FRA 
cannot verify that this is the case in every instance.
    FRA concludes that the mandated deployment of PTC will leave some 
substantial gaps in the Class I route structure, including gaps in some 
major urban areas. FRA believes that these gaps will, over time, be 
``filled in'' by voluntary actions of the Class I railroads as they 
establish the reliability of their PTC systems, verify effective 
interoperability, and begin to enjoy the safety and other business 
benefits from use of these systems. FRA fully understands both the 
desire of the labor stakeholders in the PTC Working Group to see a 
broader build-out of PTC systems than that ``minimally'' required by 
RSIA08 and the concerns of the Class I railroads' representatives who 
noted the extreme challenge associated with equipping tens of thousands 
of wayside units, some 20,000 locomotives, and their dispatching 
centers' back offices within the statutory implementation period.
    The Congress recognized that all of these issues are legitimate 
concerns and so mandated the establishment of Risk Reduction Programs 
under the same legislation. Section 103 of RSIA08 codifies language 
that includes, within the Risk Reduction Program, a Technology 
Implementation Plan that is specifically required to address technology 
alternatives, including PTC. Accordingly, the PTC and Risk Reduction 
provisions in RSIA08 are clearly aligned in purpose; and there are also 
references in the technology plan elements of the Risk Reduction 
language that address installation of PTC by other railroads. Further, 
FRA has been charged with a separate rulemaking under section 406 of 
RSIA08 regarding risk in non-signaled (dark) territory that 
significantly overlaps the issue set in this rulemaking and the Risk 
Reduction section. Use of technologies that are integral to PTC systems 
constitute the best response to hazards associated with non-signaled 
lines. Switch position monitoring systems, track integrity circuits, 
digital data links and other technology used to address dark territory 
issues should be and, as presently conceived, are forward-compatible 
with PTC. FRA proposes in paragraph (b) to dovetail these requirements 
by requiring that each Class I railroad include in its PTCIP deployment 
strategies indicating how it will approach the further build-out of 
full PTC, or partial implementation of PTC (e.g., using PTC technology 
to prevent train-to-train collisions but perhaps not monitoring all 
switches in the territory; or using PTC to protect movements of the 
Class I over a switching or terminal railroad without initially 
requiring all controlling locomotives of the switching or terminal 
railroad to be equipped). These railroads would then be required to 
include in the technology elements of their initial Risk Reduction 
plans a specification of which lines will be equipped and with what PTC 
system elements. Proposed paragraph (b) makes clear that there would be 
no expectation regarding additional lines being equipped until those 
mandated by subpart I have been addressed. FRA shares the view of the 
Class I railroads and the passenger railroads that the December 31, 
2015, deadline already presents a substantial challenge for railroads, 
suppliers and the employees affected.
    Paragraph (c) proposes to codify in regulation the statutory 
mandate that FRA review the PTCIP and determine, within 90 days upon 
receipt of the plan, whether to provide its approval or disapproval. 
FRA believes it is also important to provide procedural rules to 
communicate approval or disapproval. Thus, under paragraph (c), FRA 
proposes that any approval or disapproval of a PTCIP requires FRA to 
provide written notice. In the event that FRA disapproves of the PTCIP, 
the notice will also include a narrative explaining the reasons for 
disapproval. Once the railroad receives notification that its PTCIP has 
been disapproved by FRA, it will have 30 days to resubmit its PTCIP for 
review and approval. While FRA may provide assistance to remedy a 
faulty PTCIP, it is ultimately the railroad's responsibility and burden 
to develop and submit a PTCIP worthy of FRA approval. A railroad may be 
subject to civil penalties if it fails to timely file its PTCIP under 
this section. As noted previously, subpart I applies to each railroad 
that Congress and FRA has mandated to install a PTC system. A railroad 
that is not required to install a PTC system may still do so under its 
own volition. In such a case, it may

[[Page 35983]]

either seek approval of its system under either subpart H or I. 
Paragraph (d) intends to make this choice clear.
    Paragraph (e) responds to comments by labor organizations in the 
PTC Working Group. These employee representatives sought the 
opportunity to comment on major PTC filings. The paragraph provides 
that, upon receipt of a PTCIP, PTCDP, or PTCSP, FRA posts on its public 
Web site notice of receipt and reference to the public docket in which 
a copy of the filing has been placed. FRA may consider any public 
comment on each document to the extent practicable within the time 
allowed by law and without delaying implementation of PTC systems. The 
version of any filing initially placed in the public docket would be 
the redacted copy as filed by the railroad. If FRA later determined 
that additional material was not deserving of protection as 
confidential, that material would be added to the docket.

Section 236.1013 PTCDP Content Requirements and Type Approval

    As noted in the discussion above regarding Sec.  236.1009, each 
PTCSP must be submitted with a Type Approval number identifying a PTC 
system that FRA believes could fulfill the requirements of subpart I. 
Under Sec.  236.1009, a railroad may submit an existing Type Approval 
number in lieu of a PTC Development Plan (PTCDP) if the PTC system it 
intends to implement and operate is identical to the one described in 
that Type Approval's associated PTCDP. In the event, however, that a 
railroad intends to install a system for which a Type Approval number 
has not yet been assigned, or to use a system with an assigned Type 
Approval number that may have certain variances to its safety-critical 
functions, then the railroad must submit a PTCDP to obtain a new Type 
Approval number.
    The PTCDP is the core document that provides the Associate 
Administrator sufficient information to determine whether the PTC 
system proposed for installation by the railroad could meet the 
statutory requirements for PTC systems specified by RSIA08 and the 
regulatory requirements under subpart I. Issuance of a product Type 
Approval number is contingent upon the approval of the PTCDP by the 
Associate Administrator. While filing of a PTCDP is optional in the 
sense that the railroad may proceed directly to submission of the PTCSP 
by the April 16, 2010 deadline (see Sec.  236.1009), FRA encourages 
railroads engaged in joint operations to do so. Approval of the PTCDP, 
and issuance of a Type Approval, presents the opportunity for other 
railroads to reduce the effort required to obtain a PTC System 
Certification. If a Type Approval for a PTC system exists, another 
railroad may also use that Type Approval provided there are no 
variances in the system as described in the Type Approval's PTCDP. In 
such cases, the other railroad may avoid submitting its own PTCDP by 
simply incorporating by reference the supporting information in the 
Type Approval's PTCDP and certifying that no variances in the PTC 
system have been made.
    This proposed section describes the contents of the PTCDP required 
to obtain FRA approval in the form of issuance of a Type Approval 
number. The proposed provisions of this section require each PTCDP to 
include all the elements and practices listed in this section to 
provide reasonable assurance that the subject PTC system will meet the 
statutory requirements and are developed consistent with generally-
accepted principles and risk-oriented proof of safety methods 
surrounding this technology. FRA believes it is necessary to include 
the provisions contained in this section in order to provide reasonable 
assurance that the product, when developed and deployed, will have no 
adverse impact on the safety of railroad employees, the public, and the 
movement of trains.
    FRA recognizes that much of the information required by Sec.  
236.1013 normally resides with the PTC system's developer or supplier 
maintains and not the client railroad. While FRA expects that each 
railroad and its PTC system supplier may jointly draft a PTCDP, the 
railroad has the primary responsibility for the safety of its 
operations and for providing the information required under Sec.  
236.1013. Accordingly, each railroad required to submit a PTCDP under 
subpart I should make the necessary arrangements to ensure that the 
requisite information is readily available from the supplier for 
submission to the agency. FRA believes that suppliers and railroads 
will develop a PTCDP for most products that adequately address the 
requirements of the new subpart without substantial additional expense. 
As part of the design and evaluation process, it is essential to ensure 
that an adequate analysis of the features and capabilities is made to 
minimize the possibility of conflicts resulting from any use or 
feature, including a software fault. Since this analysis is a normal 
cost of software engineering development, FRA does not believe this 
requirement imposes any additional significant costs beyond what should 
already be done when developing safety-critical software.
    In proposed Sec. Sec.  236.1013 and 236.1015, various adjectives 
may precede the several of the requirements. For instance, certain 
paragraphs require ``a complete description,'' ``a detailed 
description,'' or simply a ``description.'' These phrases are inherited 
from subpart H. Their inclusion in subpart I are similarly not to imply 
that any description should be more or less detailed or complete than 
any other description required. By contrast, they are included merely 
for the purposes of emphasis.
    Paragraph (a)(1) proposes to require that the PTCDP include system 
specifications that describe the overall product and identify each 
component and its physical relationship in the system. FRA will not 
dictate specific product architectures, but will examine each PTC 
system to fully understand how its various parts interrelate. Safety-
critical functions in particular will be reviewed to determine whether 
they are designed to be fail-safe. FRA believes this provision is an 
important element that can be applied to determine whether safety is 
maximized and maintainability can be achieved.
    Paragraph (a)(2) proposes to require a description of the operation 
where the product will be used. Upon receipt of this information within 
a PTCDP, FRA will have better contextual knowledge of the product as it 
applies to the type of operation on which it is designed to be used. 
Where operational behaviors are not applicable to a particular 
railroad, or the product design is not intended to address a particular 
operational behavior, FRA would expect a short statement indicating 
which operational characteristics do not apply and why they are not 
applicable.
    Paragraph (a)(3) proposes that the PTCDP include a concept of 
operations, a list of the product's functional characteristics, and a 
description explaining how various components within the system are 
controlled. FRA expects that the information provided under paragraphs 
(a)(2) and (a)(3) will together provide a thorough understanding of the 
PTC system. FRA will review this information--primarily by comparing 
the subject PTC system's functionalities with those underlying 
principles contained in standards for existing signal and train control 
systems--to determine whether the PTC system is designed to account for 
all relevant safety issues. While FRA proposes to not prescribe PTC 
system design standards, FRA expects that each applicant compare the 
concepts contained in existing standards to the

[[Page 35984]]

operational concepts, functionalities, and controls contemplated for 
the PTC system in order to determine whether a sufficient level of 
safety will be achieved. For example, the proposed requirements 
prescribe that where a track relay is de-energized, a switch or derail 
is improperly lined, a rail is removed, or a control circuit is opened, 
each signal governing movements into the subject block occupied by a 
train, locomotive, or car must display its most restrictive aspect for 
the safety of train operations. The principle behind the requirement is 
that, when a condition exists in the operating environment, or with 
respect to the functioning of the system, that entails a potential 
hazard, the system will assume its most restrictive state to protect 
the safety of train operations.
    Paragraph (a)(4) proposes that each PTCDP include a document that 
identifies and describes each safety-critical function of the subject 
PTC system. The product architecture includes both hardware and 
software aspects that identify the protection developed against random 
hardware faults and systematic errors. Further, the document should 
identify the extent to which the architecture is fault tolerant. FRA 
intends to use this information to determine whether appropriate safety 
concepts have been incorporated into the proposed PTC system. For 
example, existing regulations require that when a route has been 
cleared for a train movement, it cannot be changed until the governing 
signal has been caused to display its most restrictive indication and a 
predetermined time interval has expired where time locking is used or 
where a train is in approach to the location where approach locking is 
used. FRA intends to use this information to determine whether all the 
safety-critical functions are included. Where such functionalities are 
not clearly determined to exist as a result of technology development, 
FRA will expect the reasoning to be stated and a justification provided 
describing how that technology provides the required level of safety. 
Where FRA identifies a void in safety-critical functions, FRA may not 
approve the PTCDP until remedial action is taken to rectify the 
concern.
    FRA recognizes that the information required under paragraph (a)(4) 
may already be provided when complying with paragraph (a)(1). In such a 
case, the railroad shall cross reference where in the PTCDP that both 
paragraphs (a)(1) and (a)(4) are jointly satisfied.
    Paragraph (a)(5) proposes to require that each PTCDP address the 
minimum requirements under Sec.  236.1005 for development of safety-
critical PTC systems. FRA expects the information provided under 
paragraph (a)(5) to cover: identification of all safety requirements 
that govern the operation of a system; evaluation of the total system 
to identify known or potential safety hazards that may arise over the 
life-cycle of the system; identification of all safety issues during 
the design phase of the process; elimination or reduction of the risks 
posed by the hazards identified; resolution of safety issues presented; 
development of a process to track progress; and development of a 
program of testing and analysis to demonstrate that safety requirements 
are met. Paragraph (a)(5) also requires that each railroad identify the 
PTC system's safety assurance concepts.
    Paragraph (a)(6) proposes to require a submission of a preliminary 
human factors analysis that addresses each applicable human-machine 
interface (HMI) and all proposed product functions to be performed by 
humans to enhance or preserve safety. FRA expects this analysis to 
place special emphasis on proposed human factors responses--and the 
result of any failure to perform such a response--to safety-critical 
hazards, including the consequences of human failure to perform. For 
each HMI, the PTCDP should address the proposed basis of assumptions 
used for selecting each such interface, its potential affect upon 
safety, and all potential hazards associated with each interface. Where 
more than one employee is expected to perform duties dependent upon HMI 
input or output, the analysis must address the consequences of failure 
by one or multiple employees. FRA intends to use this information to 
determine the proposed HMI's effect upon the safety of railroad 
operations. The preliminary human factors analysis must propose how the 
railroad or its PTC system supplier plans to address the HMI criteria 
listed in Appendix E to part 236 or any alternatives proposed by the 
railroad and deemed acceptable by the Associate Administrator.
    Paragraph (a)(6) also proposes that the PTCDP explain how the 
proposed HMI will affect interoperability. RSIA08 requires that each 
subject railroad explain how it intends to obtain system 
interoperability. The ability of a train crew member to operate another 
railroad's PTC system significantly depends upon a commonly understood 
HMI. The HMI provides the end user with a method of interacting with 
the underlying system and accessing the PTC functionality. FRA expects 
that each railroad will adopt an HMI standard that will ensure ease of 
use of the PTC system both within, and between, railroads.
    Paragraph (a)(7) proposes to require an analysis regarding how 
subparts A through G of part 236 apply, or no longer apply, to the 
subject PTC system. FRA recognizes that while a PTC system may be 
designed in accordance with the underlying safety concepts of subparts 
A through G, the specific existing requirements contained in those 
subparts are not applicable. In any event, the PTCDP must identify each 
pertinent requirement considered to be inapplicable, fully describe the 
alternative method used to fulfill that underlying safety concept, and 
explain how the proposed PTC system supports the underlying safety 
principle. FRA notes that certain sections in subparts A though G may 
always be applicable to PTC systems certified under subpart I.
    FRA is concerned about all dimensions of system security. Thus, 
paragraph (a)(8) proposes to require the PTCDP to include a description 
of the security measures necessary to meet the specifications for each 
PTC system. Security is an important element in the design and 
development of PTC systems and covers issues such as developing 
measures to prevent hackers from gaining access to software and to 
preclude sudden system shutdown, mechanisms to provide message 
integrity, and means to authenticate the communicating parties. Safety 
and security are two closely related topics. Both are elements for 
ensuring that a subject is protected and without risk of harm. In the 
industrial marketplace, the goals of safety and security are to create 
an environment protecting assets from hazards or harm. While activities 
to ensure safety usually relate to the possibility of accidental harm, 
activities to ensure security usually relate to protecting a subject 
from intentional malicious acts such as espionage, theft, or attack. 
Since system performance may be affected by either inadvertent or 
deliberate hazards or harms, the safety and security involved in the 
implementation and operation of a PTC system must both be considered.
    Integrated security recognizes that optimum protection comes from 
three mutually supporting elements: physical security measures, 
operational procedures, and procedural security measures. Today, the 
convergence of information and physical security is being driven by 
several powerful forces, including: interdependency, efficiency and 
organizational simplification, security awareness, regulations, 
directives, standards, and the evolving global communications 
infrastructure. Physical security describes measures

[[Page 35985]]

that prevent or deter attackers from accessing a facility, resource, or 
information stored on physical media and guidance on how to design 
structures to resist various hostile acts. Communications security 
describes measures and controls taken to deny unauthorized persons 
information derived from telecommunications and ensure the authenticity 
of such telecommunications. Because of the integrated nature of 
security, FRA expects that each PTCDP will address security as a 
holistic concept, and not be restricted to limited or specific aspects.
    Paragraph (a)(9) proposes to require documentation of assumptions 
concerning reliability and availability targets of mechanical, 
electrical, and electronic components. When building a PTC system, 
designers may make numerous presumptions that will directly impact 
specific implementation decisions. These fundamental assumptions 
usually come in the form of data (e.g., facts collected as the result 
of experience, observation or experiment, or processes, or premises) 
that can be randomly sampled. FRA does not expect to audit all of the 
fundamental assumptions on which a PTC system has been developed. 
Instead, FRA envisions sampling and reviewing fundamental assumptions 
prior to product implementation and after operation for some time. FRA 
expects that the data sampled may vary, depending upon the PTC system. 
It is not possible to provide a single set of quantitative numbers 
applicable to all systems, especially when systems have yet to be 
designed and for which the fundamental assumptions are yet to be 
determined. Quantification is part of the risk management process for 
each project. FRA believes that the actual performance of the system 
observed during the pre-operational testing and post-implementation 
phases will provide indications of the validity of the fundamental 
assumptions. FRA proposes that this review process will occur for the 
life of the PTC system (i.e., as long as the product is kept in 
operation). The depth of details required will depend upon what FRA 
observes. The range of difference between a PTC system's predicted and 
actual performance may indicate to FRA the validity of the underlying 
fundamental assumptions. Generally, if the actual performance matches 
the predicted performance, FRA believes that it will not have to 
extensively review the fundamental assumptions. If the actual 
performance does not match predicted performance, FRA may need to more 
extensively review the fundamental assumptions.
    FRA expects each subject railroad to confirm the validity of 
initial assumptions by comparing them to actual in-service data. FRA is 
aware that mechanical and electronic component failure rates and times 
to repair are easily quantified data, and usually are kept as part of 
the logistical tracking and maintenance management of a railroad. FRA 
believes that this proposed criterion will enhance the quality of risk 
assessments conducted pursuant to this subpart by forcing PTC system 
designers and users to consider the long-term effects of operation over 
the course of the PTC system's projected life-cycle. If a PTC system 
can be used beyond its design life-cycle, FRA expects that any 
continued use would be only under a waiver provided in accordance with 
part 211 or under a PTCDP or PTCSP amended in accordance with Sec.  
236.1021. In its request for waiver or request for amendment, the 
railroad should address any new risks associated with the life-cycle 
extension.
    Paragraph (a)(9) also proposes to require specification of the 
target safety levels. This includes the identity of each potential 
hazard and how the events leading to a hazard will be identified for 
each safety-critical subsystem; the proposed safety integrity level of 
each safety-critical subsystem, and the proposed means that 
accomplishment of these targets will be evaluated. This paragraph also 
requires identification of the proposed backup methods of operation and 
safety-critical assumptions regarding availability of the product. FRA 
believes this information is essential for making determinations about 
the safety of a product and both the immediate and long-term effect of 
its failure. FRA contends that availability is directly related to 
safety to the extent the backup means of controlling operations 
involves greater risk (either inherently or because it is infrequently 
practiced).
    Paragraph (a)(10) proposes to require a complete description of how 
the PTC system will enforce all pertinent authorities and block signal, 
cab signal, or other signal related indications. FRA appreciates that 
not all PTC architectures will seek to enforce the speed restrictions 
associated with intermediate signals directly, but nevertheless a clear 
description of these functions is necessary for clarity and evaluation.
    Proposed paragraph (a)(11) requires that, if the railroad is 
seeking to deviate from the requirements of section 236.1029 with 
respect to movement of trains with onboard equipment that has failed en 
route using the flexibility provided by paragraph (c) of that section, 
a justification must be provided in the PTCDP. Paragraph (c) of 
proposed Sec.  236.1029 provides that, in order for a PTC train that 
operates at a speed above 90 miles per hour to deviate from the 
operating limitations contain in paragraph (b) of that section, the 
deviation must be described and justified in the FRA approved PTCDP or 
PTCSP, or by reference to an Order of Particular Applicability, as 
applicable. For instance, if Amtrak wished to continue to operate at up 
to 125 miles per hour with cab signals and automatic train control in 
the case of failure of onboard ACSES equipment, Amtrak would request to 
do so based on the applicable language of the Order of Particular 
Applicability that required installation of that system on portions of 
the Northeast Corridor. Similarly, a railroad wishing more liberal 
requirements for a high speed rail system on a dedicated right-of-way 
could request that latitude by explaining how the safety of all 
affected train movements would be maintained.
    Paragraph (a)(12) requires a complete description of how the PTC 
system will appropriately and timely enforce all hazard detectors that 
are interconnected with the PTC system in accordance with Sec.  
236.105(c)(3), as may be applicable.
    Proposed paragraph (b) specifies the approval standard that will be 
employed by the Associate Administrator. The PTCDP is not expected to 
provide absolute assurance to the Associate Administrator that every 
potential hazard will be eliminated with complete certainty. It only 
needs to establish that the PTC system meets the appropriate statutory 
and regulatory requirements for a PTC system required under this 
subpart, and that there is a reasonable chance that once built, it will 
meet the required safety standards for its intended use. FRA emphasizes 
that approval of a PTCDP and issuance of a Type Approval does not 
constitute final approval to operate the product in revenue service. 
Such approval only comes when the Associate Administrator issues an 
applicable PTC System Certification.
    Paragraph (c) proposes a time limit on the validity of a Type 
Approval. Provided that at least one product is certified within the 5 
year period after issuance of the Type Approval, the Type Approval 
remains valid until final retirement of the system. The main purpose of 
this requirement is to incentivize installation, not just creation, of 
a PTC system. This paragraph would also allow FRA to periodically clean 
out its records

[[Page 35986]]

relating to Type Approvals and PTCDPs for obsolete PTC systems.
    Paragraph (d) proposes the conditions under which a Type Approval 
may be used by another railroad. These conditions consist of the 
railroad maintaining a continually updated PTCPVL pursuant to Sec.  
236.1023(c) and the railroad providing licensing information associated 
with the use of the Type Approval. Under paragraph (d), FRA intends to 
ensure the implementation of the proper technology and not any orphan 
product using apparently similar, but actually different, technology. 
When a railroad submits a previously issued Type Approval for its PTC 
system, FRA expects that all the proper licensing agreements provide 
for continued use and maintenance of the PTC system are in place. To 
ensure FRA's confidence in this area, FRA proposes to require each Type 
Approval submission to include this relevant licensing information. FRA 
recognizes that there may be various licensing arrangements available 
relating to the exclusivity and sublicensing of manufacturing or 
vending of a particular PTC system. There may be other intellectual 
property variables that may make arrangements even more complex. To 
adequately capture all applicable arrangements, FRA proposes to 
generally require the submission of ``licensing information.'' More 
specific language may preclude FRA's ability to collect information 
necessary to fulfill its intent. If any of this information were to 
change, either through any type of sale, transfer, or sublicense of any 
right or ownership, then FRA would expect the railroad to submit a 
request for amendment of its PTCDP in accordance with Sec.  236.1021. 
FRA recognizes that this may be difficult for a railroad to accomplish, 
given the railroad may not be privy to any intellectual property 
transactions that may occur outside of its control. In any event, FRA 
would expect that a railroad would ensure, either through contractual 
obligation or otherwise, that its vendor or supplier provide it with 
updated licensing information on a continuing basis. FRA seeks comments 
on this proposal.
    Paragraph (e) proposes to require that a railroad submitting a 
PTCDP demonstrate that its vendor has a suitable quality control 
system. This requirement provides protection to the railroad and FRA 
that there is a reasonable probability that the vendor can design and 
manufacture the product such that it will meet the design targets 
specified in paragraph (a). FRA expects that compliance with paragraph 
(e) will eliminate the operation of a PTC system where its vendor has 
inadequate quality control procedures and processes to support the 
proper development of a safety critical product.
    Paragraph (f) proposes language retaining the Associate 
Administrator's ability to impose any conditions necessary to ensure 
the safety of the public, train crews, and train operations when 
approving the PTCDP and issuing a Type Approval. While FRA expects that 
adherence to the remainder of this section's requirements should 
justify issuance of a Type Approval, FRA also recognizes that there may 
be situations where other unaccounted for variables may reduce the 
Associate Administrator's confidence in the PTC system, its 
manufacturer, supplier, vendor, or operator.

Section 236.1015 PTCSP Content Requirements and PTC System 
Certification

    The PTC Safety Plan (PTCSP) is the core document that provides the 
Associate Administrator the information necessary to certify that the 
as-built PTC system fulfills the required statutory PTC functions and 
is in compliance with the requirements of this subpart. Issuance of a 
PTC System Certification is contingent upon the approval of the PTCSP 
by the Associate Administrator. Under the proposed rules, the filing 
and approval of the PTCSP and issuance of a PTC System Certification is 
a mandatory prerequisite for PTC system operation in revenue service. 
Each PTCSP is unique to each railroad and must addresses railroad-
specific implementation issues associated with the PTC system 
identified by the submitted Type Approval. Paragraph (a) proposes 
language explaining these meanings and limits.
    When filing a PTCSP, proposed paragraph (b) proposes to require 
each railroad to: Include the applicable and approved PTCIP, PTCDP, and 
Type Approval; describe any changes subsequently made to the PTC 
system, as reflected in the PTCSP, that would require amendment of the 
PTCIP or PTCDP; and assure FRA whether the PTC system built is the same 
PTC system described in the PTCDP and PTCSP. Paragraph (b)(1) 
effectively merges the approved PTCIP and PTCDP into the PTCSP so that 
there will be a single ``package'' available for PTC operations and FRA 
review before and after issuance of a PTC System Certification. If a 
PTCSP is approved, and the railroad receives a PTC System 
Certification, all three plans continue to ``live'' and can only be 
amended in accordance with Sec.  236.1021.
    FRA recognizes the possibility that between PTCIP or PTCDP 
approval, and prior to PTCSP submission, there may be changes to the 
former two documents. While such changes may only be made in accordance 
with Sec.  236.1021, documentation of those changes may not be readily 
apparent to the reader of the PTCSP. Accordingly, under proposed 
paragraph (b)(2), FRA expects that each PTCSP shall include a clear and 
complete description of any such changes by specifically and rigorously 
documenting each variance. Paragraph (b)(2) also proposes to require 
that the PTCSP include an explanation of each variance's significance. 
To ensure that there are no other existing variances not documented in 
the PTCSP, FRA also proposes under this paragraph to require the 
railroad to attest that there are no further variances. For the same 
reason, paragraph (b)(3) proposes that, if there have been no changes 
to the plans or to the PTC system as intended, the railroad be required 
to attest that there are no such variances.
    Proposed paragraph (c) delineates the contents of the PTCSP. The 
first elements of the PTCSP are the same elements as the PTCDP (and are 
described more fully in the section by section for 236.1013). If the 
railroad had already submitted, and FRA had already approved, the 
PTCDP, then attachment of the PTCDP to the PTCSP should fulfill this 
requirement.
    The additional, proposed railroad specific elements are as follows:
    Paragraph (c)(1) proposes to require that the PTCSP include a 
hazard log comprehensively describing all hazards to be addressed 
during the life-cycle of the product, including maximum threshold 
limits for each hazard. For unidentified hazards, the threshold shall 
be exceeded at one occurrence. In other words, if the hazard has not 
been predicted, then any single occurrence of that hazard is 
unacceptable. The hazard log addresses safety-relevant hazards, or 
incidents or failures that affect the safety and risk assumptions of 
the PTC system. Safety relevant hazards include events such as false 
proceed signal indications and false restrictive signal indications. If 
false restrictive signal indications occur with any type of frequency, 
they could influence train crew members, roadway workers, dispatchers, 
or other users to develop an apathetic attitude towards complying with 
signal indications or instructions from the PTC system, creating human 
factors problems.
    Incidents in which stop indications are inappropriately displayed 
may also necessitate sudden brake applications

[[Page 35987]]

that may involve risk of derailment due to in-train forces. Other 
unsafe or wrong-side failures which affect the safety of the product 
will be recorded on the hazard log. The intent of this paragraph is to 
identify all possible safety-relevant hazards which would have a 
negative effect on the safety of the product. Right-side failures, or 
product failures which have no adverse effect on the safety of the 
product (i.e., do not result in a hazard) would not be required to be 
recorded on the hazard log.
    Paragraph (c)(2) proposes to require that a risk assessment be 
included in the PTCSP. FRA will use this information as a basis to 
confirm compliance with the appropriate performance standard. A 
performance standard specifies the outcome required, but leaves the 
specific measures to achieve that outcome up to the discretion of the 
regulated entity. In contrast to a design standard or a technology-
based standard that specifies exactly how to achieve compliance, a 
performance standard sets a goal and lets each regulated entity decide 
how to meet that goal. An appropriate performance standard should 
provide reasonable assurance of safe and effective performance by 
making provision for: (1) Considering the construction, components, 
ingredients, and properties of the device and its compatibility with 
other systems and connections to such systems; (2) testing of the 
product on a sample basis or, if necessary, on an individual basis; (3) 
measurement of the performance characteristics; and (4) requiring that 
the results of each or of certain of the tests required show that the 
device is in conformity with the portions of the standard for which the 
test or tests were required. Typically, the specific process used to 
design, verify and validate the product is specified in a private or 
public standard. The Administrator may recognize all or part of an 
appropriate standard established by a nationally or internationally 
recognized standard development organization.
    Paragraph (c)(3) proposes to require that the PTCSP include a 
hazard mitigation analysis. The hazard mitigation analysis must 
identify the techniques used to investigate the consequences of various 
hazards and list all hazards addressed in the system hardware and 
software including failure mode, possible cause, effect of failure, and 
remedial actions. A safety-critical system must satisfy certain 
specific safety requirements specified by the system designer or 
procuring entity. To determine whether these requirements are 
satisfied, the safety assessor must determine that: (1) Hazards 
associated with the system have been comprehensively identified; (2) 
hazards have been appropriately categorized according to risk 
(likelihood and severity); (3) appropriate techniques for mitigating 
the hazards have been identified; and (4) hazard mitigation techniques 
have been effectively applied. See Leveson, Nancy G., Safeware: System 
Safety and Computers, (Addison-Wesley Publishing Company, 1995).
    FRA does not expect that the safety assessment will prove that a 
product is absolutely safe. However, the safety assessment should 
provide evidence that risks associated with the product have been 
carefully considered and that steps have been taken to eliminate or 
mitigate them. Hazards associated with product use need to be 
identified, with particular focus on those hazards found to have 
significant safety effects. The risk assessment proposed under 
paragraph (c)(2) must include each hazard that cannot be mitigated by 
system designs (e.g., human over-reliance of the automated systems) no 
matter how low its probability may be. After the risk assessment, the 
designer must take steps to remove them or mitigate their effects. 
Hazard analysis methods are employed to identify, eliminate, and 
mitigate hazards. Under certain circumstances, FRA may require an 
independent third party assessment in accordance with proposed Sec.  
236.1017 to review these methods as a prerequisite to FRA approval.
    Paragraph (c)(4) also proposes that the PTCSP address safety 
Verification and Validation procedures as defined under part 236. FRA 
believes that Verification and Validation for safety are vital parts of 
the PTC system development process. Verification and Validation require 
forward planning. Consequently, the PTCSP should identify the testing 
to be performed at each stage of development and the levels of rigor 
applied during the testing process. FRA will use this information to 
ensure that the adequacy and coverage of the tests are appropriate.
    Paragraph (c)(5) proposes to require the railroad to include in its 
PTCSP the training, qualification, and designation program for workers 
regardless of whether those railroad employees will perform inspection, 
testing, and maintenance tasks involving the PTC system. FRA believes 
many benefits accrue from the investment in comprehensive training 
programs and are fundamental to creating a safe workforce. Effective 
training programs can result in fewer instances of human casualties and 
defective equipment, leading to increased operating efficiencies, less 
troubleshooting, and decreased costs. FRA expects any training program 
to include employees, supervisors, and contractors engaged in railroad 
operations, installation, repair, modification, testing, or maintenance 
of equipment and structures associated with the product.
    Paragraph (c)(6) proposes to require the PTCSP to identify specific 
procedures and test equipment necessary to ensure the safe operation, 
installation, repair, modification and testing of the product. 
Requirements for operation of the system must be succinct in every 
respect. The procedures must be specific about the methodology to be 
employed for each test to be performed that is required for 
installation, repair, or modification including documenting the results 
thereof. FRA will review and compare the repair and test procedures for 
adequacy against existing similar requirements prescribed for signal 
and train control systems. FRA intends to use this information to 
ascertain whether the product will be properly installed, maintained, 
tested, and repaired.
    Paragraph (c)(7) proposes that each railroad develop a manual 
covering the requirements for the installation, periodic maintenance 
and testing, modification, and repair for its PTC system. The 
railroad's Operations and Maintenance Manual must address the issues of 
warnings and describe the warning labels to be placed on each piece of 
PTC system equipment as necessary. Such warnings include, but are not 
limited to: Means to prevent unauthorized access to the system; 
warnings of electrical shock hazards; cautionary notices about improper 
usage, testing, or operation; and configuration management of memory 
and databases. The PTCSP should provide an explanation justifying each 
such warning and an explanation of why there are no alternatives that 
would mitigate or eliminate the hazard for which the warning is placed.
    Paragraph (c)(8) proposes to require that the PTCSP identify the 
various configurable applications of the product, since this rule 
mandates use of the product only in the manner described in its PTCDP. 
Given the importance of proper configuration management in safety-
critical systems, FRA believes it is essential that railroads learn of 
and take appropriate configuration control of hardware and software. 
FRA believes that a requirement for configuration management control 
will enhance the safety of these systems and ultimately provide other 
benefits to the railroad as

[[Page 35988]]

well. Under this proposed paragraph, railroads are responsible--through 
its applicable Operations and Maintenance Plan and other supporting 
documentation maintained throughout the system's life-cycle--for all 
changes to configuration of their products in use, including both 
changes resulting from maintenance and engineering control changes, 
which result from manufacturer modifications to the product. Since not 
all railroads may experience the same software faults or hardware 
failures, the configuration management and fault reporting tracking 
system play a crucial role in the ability of the railroad and the FRA 
to determine and fully understand the risks and their implications. 
Without an effective configuration management tracking system in place, 
it is difficult, if not impossible, to fairly evaluate risks associated 
with a product over the life of the product.
    Paragraph (c)(9) proposes to require the railroad to develop 
comprehensive plans and procedures for product implementation. 
Implementation (field validation or cutover) procedures must be 
prepared in detail and identify the processes necessary to verify that 
the PTC system is properly installed and documented, including measures 
to provide for the safety of train operations during installation. FRA 
will use this information to ascertain whether the product will be 
properly installed, maintained, and tested. FRA also believes that 
configuration management should reduce disarrangement issues. Further, 
configuration management will reduce the cost of troubleshooting by 
reducing the number of variables and will be more effective in 
promoting safety.
    Paragraph (c)(10) proposes to require the railroad to provide a 
complete description of the particulars concerning measures required to 
assure that the PTC system, once implemented, continues to provide the 
expected safety level without degradation or variation over its life-
cycle. The measures specifically provide the prescribed intervals and 
criteria for the following: testing; scheduled preventive maintenance 
requirements; procedures for configuration management; and procedures 
for modifications, repair, replacement and adjustment of equipment. FRA 
intends to use this information, among other data, to monitor the PTC 
system to assure it continually functions as intended.
    Paragraph (c)(11) proposes to include in each PTCSP a description 
of each record concerning safe operation. Recordkeeping requirements 
for each product are discussed in proposed Sec.  236.1037.
    Paragraph (c)(12) proposes to require a safety analysis of 
unintended incursions into a work zone. Measuring incursion risks is a 
key safety risk assumption. Failing to identify incursion risk can have 
the effect of making a system seem safer on paper than it actually is. 
The requirements set forth in this paragraph attempt to mandate design 
consideration of incursion protection at an early stage in the product 
development process. The totality of the arrangements made to prevent 
unintended incursions or operation at higher than authorized speed 
within the work zone must be analyzed. That is, in addition to the 
functions of the PTC system, the required actions for dispatchers, 
train crews, and roadway workers in charge must be evaluated. 
Regardless of whether a PTC system has been previously approved or 
recognized, FRA will not accept a system that allows a single point 
human failure to defeat the essential protection intended by the 
Congress. See NTSB Recommendations R-08-05 and R-08-06. FRA believes 
that exposure should be identified because increases in risk due to 
increased exposure could be easily distinguished from increases in risk 
due solely to implementation and use of the proposed PTC system.
    In the past, little attention was given to formalizing incursion 
protection procedures. Training for crews has also not been uniform 
among organizations, and has frequently received inadequate attention. 
As a result, a variety of procedures and techniques evolved based on 
what has been observed or what just seemed correct at the time. This 
lack of structure, standardization, and formal training is inconsistent 
with the goal of increasing the safety and efficiency.
    Paragraph (c)(13) proposes to require a more detailed description 
of any alternative arrangements provided under proposed Sec.  
236.1011(a)(10), pertaining to at grade rail-to-rail crossings.
    Paragraph (c)(14) proposes to require a complete description of how 
the PTC system will enforce mandatory directives and signal 
indications, unless already addressed in the PTCDP. FRA recognizes that 
all systems will enforce all signal indications; however, the PTCDP 
must describe where the architecture of the system performs this 
function.
    Proposed paragraph (c)(15) refers to the requirement of Sec.  
236.1019(e) that the PTCSP is aligned with the PTCIP, including any 
amendments.
    Under proposed Sec.  236.1029(b), FRA proposes to require certain 
limitations on PTC trains operating over 90 miles per hour. Under Sec.  
236.1029(c), FRA provides railroads with an opportunity to deviate from 
those limitations if the railroad describes and justifies the deviation 
in its PTCDP, PTCSP, or by reference to an Order of Particular 
Applicability, as applicable. Thus, proposed paragraph (c)(16) to Sec.  
236.1015 reminds railroads that this is one of the optional elements 
that may be included in a PTCSP. This need may also be addressed 
through review of the PTCDP, and FRA reserves the right to so provide 
in the final rule.
    Railroads are required under Sec.  236.1005(c) to submit a complete 
description of its compliance regarding hazard detector integration and 
under Sec. Sec.  236.1005(g)-(k) to submit a temporary rerouting plan 
in the event of emergencies and planned maintenance. Railroads must 
also submit a document indicating any alternative arrangements for each 
rail at-grade crossing not adhering to the table under Sec.  
236.1005(a)(1)(i). Proposed paragraphs (c)(17), (c)(18), and (c)(19) to 
Sec.  236.1015 reminds railroads that such requirements must be 
fulfilled with the submission of the PTCSP. For example, under proposed 
paragraph (c)(18), FRA expects each temporary rerouting plan to explain 
the host railroad's procedure relating to detouring the applicable 
traffic. In other words, FRA expects that each temporary rerouting plan 
address how the host railroad will choose the track that traffic will 
be rerouted onto. For instance, the plan should explain the factors 
that will be considered in determining whether and how the railroad 
should take advantage of temporary rerouting. FRA remains concerned 
about the unnecessary commingling of PTC and non-PTC traffic on the 
same track and expects each temporary rerouting plan to address this 
possibility. More specifically, each plan should describe how the 
railroad expects to make decisions to reroute non-PTC train traffic 
onto a PTC line, especially where another non-PTC line may be 
available. While FRA recognizes each railroad may seek to use the most 
cost effective route, FRA expects the railroad to also consider the 
level of risk associated with that route.
    In paragraph (d), FRA proposes to state the criteria that FRA will 
refer to when evaluating the PTCSP, depending upon the underlying 
technical approach. Whereas in subpart H the safety case is evaluated 
to determine whether it demonstrates with a high degree of confidence 
that relevant risk

[[Page 35989]]

will be no greater under the new product than previously, the statutory 
mandate for PTC calls for a different approach. In crafting the 
proposed approach, FRA has attempted to limit requirements for 
quantitative risk assessment to those situations where the technique is 
truly needed. Regardless of the type of PTC system, the safety case for 
the system must demonstrate that it will reliably execute all of the 
functions required by this subpart (particularly those provided under 
proposed Sec. Sec.  236.1005 and 236.1007). With this foundation, the 
additional criteria that must be met depend upon the type of PTC 
technology to be employed.
    It is FRA's understanding that PTC systems may be categorized as 
one of the following four system types: Non-vital overlay; vital 
overlay; standalone; and mixed. Initially, however, all PTC systems 
will have some features that are not fully fail-safe in nature, even if 
onboard processing and certain wayside functions are fully fail-safe. 
Common causes include surveying errors of the track database, errors in 
consist weight or makeup from the railroad information technology 
systems, and the crew input errors of critical operational data. To the 
extent computer-aided dispatching systems are the only check on 
potential dispatcher error in the creation or inappropriate 
cancellation of mandatory directives, some room for undetected wrong-
side failure will continue to exist in this function as well. This 
issue is addressed under paragraph (g) of this section.
    Proposed paragraph (d)(1) specifies the required behavior for non-
vital overlay systems. Based on previous experience with non-vital 
systems, FRA believes it is well within the technical capability of the 
railroads to reduce the level of risk on any particular track segment 
to a level of risk 80% lower than the level of risk prior to 
installation of PTC on that segment. For subsequent PTC system 
installations on the same line segment, FRA recognizes that requiring 
an additional 80% improvement may not be technically or economically 
practical. Therefore, FRA is only proposing that an entity installing 
or modifying an existing PTC system need only demonstrate that the 
level of safety is equal to, and preferably greater than, the level of 
safety of the prior PTC system. The risk that must be reduced is the 
risk against which the PTC functionalities are directed, assuming a 
high level of availability. Note that the required functionalities 
themselves do not call for elimination of all risk of mishaps. It is 
scope of risk reduction that the functionalities describe that becomes 
the 100% universe which is the basis of comparison. Although it is 
understood that the system will endeavor to eliminate 100% of this 
risk--meaning that if the system worked as intended every time and was 
always available, 100% of the target risk would be eliminated--the 
analysts will need to account for cases where wrong side failure of the 
technology is coincident with a human failure potentially induced by 
reliance on the technology. Since, within an appropriate conservative 
engineering analysis (i.e., pro forma analysis), non-vital processing 
has the theoretical potential to result in more failures than will 
typically be experienced, a 20% margin is provided. In preparing the 
PTCSP, the railroad will want to affirmatively address how training and 
oversight--including programs of operational testing under 49 CFR 
217.9--will reduce the potential for inappropriate reliance by those 
charged with functioning in accordance with the underlying method of 
operation.
    The 80% reduction in risk for PTC preventable accidents must be 
demonstrated by an appropriate risk analysis acceptable to the 
Associate Administrator and must address all intended track segments 
upon which the system will be installed. Again, FRA does not expect, or 
require, that these types of systems will prevent all wrong side 
failures. However, FRA expects that the systems will be designed to be 
robust, all pertinent risk factors (including human factors) will be 
fully addressed, and that no corners will be cut to ``take advantage'' 
of the nominal allowance provided for non-vital approaches. FRA also 
encourages those using non-vital approaches to preserve as much as 
possible the potential for a transition to vital processing.
    Proposed paragraph (d)(2) addresses vital overlays. Unlike a non-
vital system, the vital system must be designed to address, at a 
minimum, the factors delineated in Appendix C. The railroad and their 
vendors are encouraged to carry out a more thorough design analysis 
addressing any other potential product specific hazards. FRA cannot 
overemphasize that vital overlay system designs must be fully designed 
to address the factors contained in Appendix C. The associated risk 
analysis supporting this design analysis demonstrating compliance may 
be accomplished using any of the risk analysis approaches in subpart H, 
including abbreviated risk analysis.
    Proposed paragraph (d)(3) addresses stand-alone PTC systems that 
are used to replace existing methods of operations. The PTCSP design 
and risk analysis submitted to the Associate Administrator must show 
that the system does not introduce any new hazards that have not been 
acceptably mitigated, based upon all proposed changes in railroad 
operation. The required analysis for standalone systems is much more 
comprehensive than that required for vital overlay systems, since it 
must provide sufficient information to the Associate Administrator to 
make a decision with a high degree of confidence. FRA will uniquely and 
separately consider each request for standalone operations, and will 
render decisions in the context of the proposed operation and the 
associated risks. FRA recognizes that application of this standard to a 
new rail system for which there is no clear North American antecedent 
could present a conceptual challenge. FRA invites comments regarding 
how best to frame the risk assessment showing for a standalone system 
applied to a new rail operation.
    Proposed paragraph (d)(4) addresses mixed systems (i.e., systems 
that include a combination of the systems identified in paragraphs 
(d)(1) through (d)(3). Because of the inherent complexity of these 
systems, FRA will determine an appropriate approach to demonstrating 
compliance after consultation with the railroad. Any approach will, of 
course, require that the system perform the PTC requirements as 
proposed in Sec. Sec.  236.1005 and 236.1007.
    Paragraph (e) discusses proposed factors that the Associate 
Administrator will consider in reviewing the PTCSP. In general, PTC 
systems will have some features that are not failsafe in nature. 
Examples include surveys of the track database, errors in consist data 
from the railroad such as weight and makeup, and crew input errors. FRA 
participation in the design and testing of the PTC system product helps 
FRA to better understand the strengths and weaknesses of the product 
for which approval is requested, and facilitates the approval process.
    The railroad must establish through safety analysis that its 
assertions are true. This standard places the burden on the railroad to 
demonstrate that the safety analysis is accurate and sufficiently 
supports certification of the PTC system. The FRA Associate 
Administrator will determine whether the railroad's case has been made. 
As provided in subpart H, FRA believes that final agency determinations 
under this new subpart I should also be made at the technical level, 
rather than the policy level, due to the complex and sometimes esoteric 
subject matters associated with risk analysis and

[[Page 35990]]

evaluation. This is particularly appropriate in light of the RSIA08's 
designation of the Associate Administrator for Railroad Safety as the 
Chief Safety Officer of FRA. When considering the PTC system's 
compliance with recognized standards in product development, FRA will 
weigh appropriate factors, including: The use of recognized standards 
in system design and safety analyses; the acceptable methods in risk 
estimates; the proven safety records for proposed components; and the 
overall complexity and novelty of the product design. In those cases 
where the submission lacks information the Associate Administrator 
deems necessary to make an informed safety decision, FRA will solicit 
the data from the railroad. If the railroad does not provide the 
requested information, FRA may determine that a safety hazard exists. 
Depending upon the amount and scope of the missing data, PTCSP 
approval, and the subsequent system certification, may be denied.
    While paragraph (e) summarizes how FRA intends to evaluate the risk 
analysis, proposed paragraph (f) applies specifically to cases where a 
PTC system has already been installed and the railroad subsequently 
wants to put in a new PTC system. Paragraph (f) re-emphasizes that FRA 
policy regarding the safety of PTC systems is not, and cannot expect to 
be, static. Rather, FRA policy may evolve as railroad operations 
evolve, operating rules are refined, related hazards are addressed 
(e.g., broken rails), and other readily available options for risk 
reduction emerge and become more affordable. FRA embraces the concept 
of progressive improvement and expects that when new systems are 
installed to replace existing systems that actual safety outcomes equal 
or exceed those for the existing systems.

Section 236.1017 Independent Third Party Review of Verification and 
Validation

    As previously noted in the discussion of proposed Sec.  
236.1009(e), FRA may require a railroad to engage in an independent 
assessment of its PTC system. In the event an independent assessment is 
required, Sec.  236.1017 proposes the applicable rules and procedures.
    Proposed paragraph (a) establishes factors considered by FRA when 
requiring a third-party assessment. FRA will attempt to make a 
determination of the necessary level of third party assessment as early 
as possible in the approval process. However, based on issues that may 
arise during the development and testing processes, or during the 
detailed technical reviews of the PTCDP and PTCSP, FRA may deem it 
necessary to require a third party assessment at any time during the 
review process.
    Proposed paragraph (b) is intended to make it clear that it is FRA 
that will make the determination of the acceptability of the 
independence of the third party to avoid any potential issues 
downstream regarding the acceptability of the assessor's independence. 
If a third party assessment is required, each railroad is encouraged to 
identify in writing what entity it proposes to utilize as its third 
party assessor. Compliance with paragraph (b) is not mandatory. 
However, if FRA determines that the railroad's choice of a third party 
does not meet the level of independence contemplated under proposed 
paragraph (c), then the railroad will be obligated to have the 
assessment repeated, at its expense, until it has been completed by a 
third party suitable to FRA.
    Paragraph (c) proposes a definition of the term ``independent third 
party'' as used in this section. It limits independent third parties to 
those that are compensated by the railroad or an association on behalf 
of one or more railroads that is independent of the PTC system 
supplier. FRA believes that requiring the railroad to compensate a 
third party will heighten the railroad's interest in obtaining a 
quality analysis and will avoid ambiguous relationships between 
suppliers and third parties that could indicate possible conflicts of 
interest.
    Proposed paragraph (d) explains that the minimum requirements of a 
third party audit are outlined in Appendix F (which is modeled on 
current Appendix D, which is used in conjunction with subpart H) and 
that FRA has discretion to limit the extent of the third party 
assessment. FRA intends to limit the scope of the assessment to areas 
of the safety Verification and Validation as much as possible, within 
the bounds of FRA's regulatory obligations. This will allow reviewers 
to focus on areas of greatest safety concern and eliminate any 
unnecessary expense to the railroad. In order to limit the number of 
third-party assessments, FRA first strives to inform the railroad as to 
what portions of a submittal could be amended to avoid the necessity 
and expense of a third-party assessment altogether. However, FRA wishes 
to make it clear that Appendix F represents minimum requirements and 
that, if circumstances warrant, FRA may expand upon the Appendix F 
requirements as necessary to enable FRA to render a decision that is in 
the public interest (i.e., if FRA is unable to certify the system 
without the additional information).

Section 236.1019 Main Line Track Exceptions

    The RSIA08 generally defines ``main line'' as ``a segment of 
railroad tracks over which 5,000,000 or more gross tons of railroad 
traffic is transported annually.'' See 49 U.S.C. 20157(i)(2). However, 
FRA may also define ``main line'' by regulation ``for intercity rail 
passenger transportation or commuter rail passenger transportation 
routes or segments over which limited or no freight railroad operations 
occur.'' See 49 U.S.C. 20157(i)(2)(B); 49 CFR 1.49(oo). FRA recognizes 
that there may be circumstances where certain statutory PTC system 
implementation and operation requirements are not practical and provide 
no significant safety benefits. In those circumstances, FRA proposes to 
exercise its statutory discretion provided under 49 U.S.C. 
20157(i)(2)(B).
    In accordance with the authority provided by the statute and with 
carefully considered recommendations from the RSAC, FRA proposes to 
consider requests for designation of track over which rail operations 
are conducted as ``other than main line track'' for passenger and 
commuter railroads, or freight railroads operating jointly with 
passenger or commuter railroads. Such relief may be granted only after 
request by the railroad or railroads filing a PTCIP and approval by the 
Associate Administrator.
    Paragraph (a), therefore, proposes to require the submittal of a 
main line track exclusion addendum (MTEA) to any PTCIP filed by a 
railroad that seeks to have any particular track segment deemed as 
other than main line. Since the statute only provides for such 
regulatory flexibility as it applies to passenger transportation routes 
or segments which limited or no freight railroad operations occur, only 
a passenger railroad may file an MTEA as part of its PTCIP. This may 
include a PTCIP jointly filed by freight and passenger railroads. In 
fact, FRA expects that in the case of joint operations, only one MTEA 
should be agreed upon and submitted by the railroads filing the PTCIP. 
After reviewing a submitted MTEA, FRA may provide full or partial 
approval for the requested exemptions.
    Each MTEA must clearly identify and define the physical boundaries, 
use, and characterization of the trackage for which exclusion is 
requested. When describing the tracks' use and characterization, FRA 
expects the requesting railroad or railroads to include copies of the 
applicable track

[[Page 35991]]

and signal charts. Ultimately, FRA expects each MTEA to include 
information sufficiently specific to enable easy segregation between 
main line track and non-main line track. In the event the railroad 
subsequently requests additional track to be considered for exclusion, 
a well-defined MTEA should reduce the amount of future information 
required to be submitted to FRA. Moreover, if FRA decides to grant only 
certain requests in an MTEA, the portions of track for which FRA has 
determined should remain considered as main line track can be easily 
severed from the MTEA. Otherwise, the entire MTEA, and thus its 
concomitant PTCIP, may be entirely disapproved by FRA, increasing the 
risk of the railroad or railroads not meeting its statutory deadline 
for PTC implementation and operation.
    For each particular track segment, the MTEA must also provide a 
justification for such designation in accordance with paragraphs (b) or 
(c) of this section.
    Proposed paragraph (b) specifically addresses the conditions for 
relief for passenger and commuter railroads with respect to passenger-
only terminal areas. As noted previously in the analysis of Sec.  
236.1005(b), FRA proposes to except from the definition of main line 
any track within a yard used exclusively by freight operations moving 
at restricted speed. In those situations, operations are usually 
limited to preparing trains for transportation and do not usually 
include actual transportation. FRA does not propose to extend this 
automatic exclusion to yard or terminal tracks that include passenger 
operations. Such operations may also include the boarding and 
disembarking of passengers, heightening FRA's sensitivity to safety and 
blurring the lines between what defines ``transportation'' and 
``preparing for transportation.'' Moreover, while FRA could not expend 
its resources to review whether a freight-only yard should be deemed 
other than main line track, FRA believes that the relatively lower 
number of passenger yards and terminals would allow for such review. 
Accordingly, FRA believes that it is appropriate to review these 
circumstances on a case-by-case basis.
    During the PTC Working Group discussions, the major passenger 
railroads requested an exception for tracks in passenger terminal areas 
because of the impracticability of installing PTC. These are locations 
where signal systems govern movements over very complex special track 
work divided into short signal blocks. Operating speeds are low (not to 
exceed 20 miles per hour), and locomotive engineers moving in this 
environment expect conflicting traffic and restrictive signals. 
Although low-speed collisions do occasionally occur in these 
environments, the consequences are low; and the rate of occurrence is 
very low in relation to the exposure. It is the nature of current-
generation PTC systems that they work with averages in terms of 
stopping distance and use conservative braking algorithms. Applying 
this approach in congested terminals would add to congestion and 
frustrate efficient passenger service, in the judgment of those who 
operate these railroads. The density of wayside infrastructure required 
to effect PTC functions in these terminal areas would also be 
exceptionally costly in relation to the benefits obtained. FRA agrees 
that technical solutions to address these concerns are not presently 
available. FRA does believe that the appropriate role for PTC in this 
context is to enforce the maximum allowable speed (which is presently 
accomplished in cab signal territory through use of automatic speed 
control, a practice which could continue where already in place).
    If FRA grants relief, the proposed conditions of (b)(1), (b)(2), or 
(b)(3), as applicable, must be strictly adhered to. These three 
conditions represent the minimum conditions FRA believes is necessary 
for safe operations. FRA reserves the right to add more restrictive 
conditions if necessary to provide for the safety of the public and 
train crews. If FRA approves a MTEA and the railroad subsequently 
violates any of the applicable conditions, civil penalties may apply.
    Under paragraph (b)(1), FRA proposes to limit relief under 
paragraph (b) to operations that do not exceed 20 miles per hour. The 
PTC Working Group agreed upon the 20 miles per hour limitation, instead 
of requiring restricted speed, because the operations in question will 
be by signal indication in congested and complex terminals with short 
block lengths and numerous turnouts. FRA agrees with the PTC Working 
Group that the use of restricted speed in this environment would 
exacerbate congestion, delay trains, and diminish the quality of rail 
passenger service.
    Moreover, when trains on the excluded track are controlled by a 
locomotive with an operative PTC onboard apparatus, FRA proposes to 
require that PTC system component to enforce the regulatory speed limit 
or actual maximum authorized speed, whichever is less. While the actual 
track may not be outfitted with a PTC system in light of a MTEA 
approval, FRA believes it would be nevertheless prudent to require such 
enforcement when the technology is available on the operating 
locomotives. This can be accomplished in cab signal territory using 
existing automatic train stop technology and outside of cab signal 
territory by mapping the terminal and causing the onboard computer to 
enforce the maximum speed allowed.
    Under paragraph (b)(2), FRA proposes to also limit relief under 
paragraph (b) to operations that enforce interlocking rules. Under 
interlocking rules, trains are prohibited from moving in reverse 
directions without dispatcher permission on track where there are no 
signal indications. FRA believes that such a restriction would minimize 
the potential for a head-on impact.
    Also, under proposed paragraph (b)(3), such operations would only 
be allowed in yard or terminal areas where no freight operations are 
permitted. While the definition of main line may not include yard 
tracks used solely by freight operations, FRA does not propose to 
extend any relief or exception to tracks within yards or terminals 
shared by freight and passenger operations. The collision of a 
passenger train with a freight consist is typically a more severe 
condition because of the greater mass of the freight equipment.
    Paragraph (c) proposes the conditions under which joint limited 
passenger and freight operations may occur on defined track segments 
without the requirement for installation of PTC. This paragraph 
proposes three alternative paths to the main line exception.
    First, under paragraph (c)(1), an exception may be available where 
both the freight and passenger trains are limited to restricted speed. 
Such operations are feasible only for short distances, and FRA would 
examine the circumstances involved to ensure that the exposure is 
limited and that appropriate operating rules and training are in place.
    Second, under paragraph (c)(2), FRA will consider an exception 
where temporal separation of the freight and passenger operations can 
be ensured. A more complete definition of temporal separation is 
provided in paragraph (d). Temporal separation of passenger and freight 
services reduces risk because the likelihood of a collision is reduced 
(e.g., due to freight cars engaged in switching that are not properly 
secured) and the possibility of a relatively more severe collision 
between a passenger train and much heavier freight consist is obviated.
    Third, under paragraph (c)(3), FRA will consider commingled freight 
and passenger operations provided that a jointly agreed risk analysis 
is provided

[[Page 35992]]

by the passenger and freight railroads, and the level of safety is the 
same as that which would be provided under one of the two prior options 
selected as the base case. FRA seeks comments on whether FRA or the 
subject railroad should determine the appropriate base case. FRA 
recognizes that there may be situations where temporal separation may 
not be possible. In such situations, FRA may allow commingled 
operations provided the risk to the passenger operation is no greater 
than if the passenger and freight trains where operating under temporal 
separation or with all trains limited to restricted speed. For an 
exception to be made under paragraph (c)(3), FRA requires a risk 
analysis jointly agreed to and submitted by the applicable freight and 
passenger services. This ensures that the risks and consequences to 
both parties have been fully analyzed, understood, and mitigated to the 
extent practical.
    Paragraph (d) proposes the definition of temporal separation with 
respect to paragraph (c)(2). The temporal separation approach is 
currently used under the FRA-Federal Transit Administration Joint 
Policy on Shared Use, which permits co-existence of light rail 
passenger services (during the day) and local freight service (during 
the nighttime). See Joint Statement of Agency Policy Concerning Shared 
Use of the Tracks of the General Railroad System by Conventional 
Railroads and Light Rail Transit Systems, 65 FR. 42,526 (July 10, 
2000); FRA Statement of Agency Policy Concerning Jurisdiction Over the 
Safety of Railroad Passenger Operations and Waivers Related to Shared 
Use of the Tracks of the General Railroad System by Light Rail and 
Conventional Equipment, 65 FR 42529 (July 10, 2000). Conventional rail 
technology and secure procedures are used to ensure that these services 
do not commingle. Amtrak representatives in the PTC Working Group were 
confident that more refined temporal separation strategies could be 
employed on smaller railroads that carry light freight volumes and few 
Amtrak trains (e.g., one train per day or one train per day in each 
direction). The Passenger Task Force agreed.
    Proposed paragraph (e) ensures that by the time the railroad 
submits its PTCSP, it has made no unapproved changes to the MTEA and 
that the PTC system, as implemented, reflects the PTCIP and its MTEA. 
Under the proposed rule, the PTCSP shall reflect the PTCIP, including 
its MTEA, as it was approved or how it has been modified in accordance 
with proposed Sec.  236.1021. FRA believes that it is also important 
that the railroad attest that no other changes to the documents or to 
the PTC system, as implemented, have been made.
    FRA understands that as a railroad implements its PTC system in 
accordance with its PTCIP or even after it receives PTC System 
Certification, the railroad may decide to modify the scope of which 
tracks it believes to be other than main line. To effectuate such 
changes, paragraph (f) proposes to require FRA review. In the case that 
the railroad believes that such relief is warranted, the railroad may 
file in accordance with proposed Sec.  236.1021 a request for amendment 
of the PTCIP, which will eventually be incorporated into the PTCSP upon 
PTCSP submission. Each request, however, must be fully justified to and 
approved by the Associate Administrator before the requested change can 
be made to the PTCIP. If such a RFA is submitted simultaneously with 
the PTCSP, the RFA may not be approved, even if the PTCSP is otherwise 
acceptable. A change made to a MTEA subsequent to FRA approval of its 
associated PTCIP that involves removal or reduction in functionality of 
the PTC system is treated as a material modification. In keeping with 
traditional signaling principles, such requests must be formally 
submitted for review and approval by FRA.

Section 236.1021 Discontinuances, Material Modifications, and 
Amendments

    FRA recognizes that after submittal of a plan or implementation of 
a train control system, the subject railroad may have legitimate 
reasons for making changes in the system design and the locations where 
the system is installed. In light of the statutory and regulatory 
mandates, however, FRA believes that the railroad should be required to 
request FRA approval prior to effectuating certain changes. Section 
236.1021 proposes the scope and procedure for requesting and approving 
those changes. For example, all requests for covered changes must be 
made in a request for amendment (RFA) of the subject PTC system or 
plan. While Sec.  236.1021 includes lengthy descriptions of what 
changes may, or may not, require FRA approval, there are various places 
elsewhere in subpart I that also require the filing of a RFA.
    Under paragraph (a), FRA proposes to require FRA approval prior to 
certain PTC system changes. FRA expects that if a railroad wants to 
make a PTC system change covered by subpart I, then any such change 
would result in noncompliance with one of the railroad's plans approved 
under this subpart. For instance, if a railroad seeks to modify the 
geographical limits of its PTC implementation, such changes would not 
be reflected in the PTCIP. Accordingly, under paragraph (a), after a 
plan is approved by FRA and before any change is made to the PTC 
system's development, implementation, or operation, FRA proposes that 
the railroad file a RFA to the subject plan.
    FRA considers an amendment to be a formal or official change made 
to the PTC system or its associated PTCIP, PTCDP, or PTCSP. Amendments 
can add, remove, or update parts of these documents, which may reflect 
proposed changes to the development, implementation, or operation of 
its PTC system. FRA believes that an amending procedure provides a 
simpler and cleaner option than requiring the railroad to file an 
entirely new plan.
    While the railroad may develop a RFA without FRA input or 
involvement, FRA believes that it is more advantageous for the railroad 
to informally confer with FRA before formally submitting its RFA. If 
FRA is not involved in the drafting process, FRA may not have a 
complete understanding of the system, making it difficult for FRA to 
evaluate the impact of the proposed changes on public safety. After RFA 
submission, all applicable correspondence between FRA and the railroad 
must be made formally in the associated docket, as further discussed 
below. In such a situation, FRA's review may take a significantly 
longer time than usual. If FRA continues to not understand the impact, 
it may request a third party audit, which would only further delay a 
decision on the request. Accordingly, FRA believes it is more 
advantageous for the railroad drafting an RFA to informally confer with 
FRA before its formal submission of the change request. The railroad 
would then be provided an opportunity to discuss the details of the 
change and to assure FRA's understanding of what the railroad wishes to 
change and of the change's potential impact.
    Paragraph (b) proposes a mechanism for requesting such change. Once 
the RFA is approved, the railroad may--and, in fact, is required under 
paragraph (b)--to adopt those changes into the subject plan and 
immediately ensure that its PTC complies with the plan, as amended. FRA 
expects that each PTC system accurately reflects the information in its 
associated approved plans. FRA believes that this requirement will also 
incentivize railroads to make approved changes as quickly as possible. 
Otherwise, if a railroad delays in implementing the changes reflected 
in an approved RFA,

[[Page 35993]]

FRA may find it difficult to enforce its regulations until 
implementation is completed, since they plans and PTC system to not 
accurately and adequately reflect each other. In such circumstances, 
railroads may be assessed a civil penalty for violating its plan or for 
falsifying records.
    Any change to a PTCIP, PTCDP, or PTCSP, which may include removal 
or discontinuance of any signal system, may not take effect until after 
FRA has approved the corresponding submitted or amended PTCIP, PTCDP, 
or PTCSP. FRA may provide partial or conditional approval. Until FRA 
has granted appropriate relief or approval, the railroad may not make 
the change, and once a requested change has been made, the railroad 
must comply with requested change.
    FRA recognizes that a railroad may wish to remove an existing train 
control system due to new and appropriate PTC system implementation. 
For train control systems existing prior to promulgation of subpart I, 
any request for a material modification or discontinuance must be made 
pursuant to part 235. FRA proposes in paragraph (c), however, to 
provide the railroads with an opportunity to instead request such 
changes in accordance with proposed Sec.  236.1021. FRA believes that 
this proposal would reduce the number of required filings and would 
otherwise simplify the process requesting material modifications or 
discontinuances.
    Paragraph (d) proposes the minimum information required to be 
submitted to FRA when requesting an amendment. While FRA proposes to 
promulgate procedural rules here different than those in part 235, FRA 
expects that the same or similar information be provided. Accordingly, 
under paragraph (d)(1), the RFA must contain the information required 
in 235.10. Paragraph (d)(1) also requires the railroad to submit, upon 
FRA request, certain additional information, including the information 
referenced in Sec.  235.12. Paragraphs (d)(2) through (d)(7) provide 
further examples of such information. While such information may only 
be required upon request, FRA urges each railroad to include this 
information in its RFA to help expedite the review process.
    FRA believes that proposed paragraphs (d)(2) through (d)(6) are 
self-explanatory. However, according to proposed paragraph (d)(7), FRA 
may require with each RFA an explanation of whether each change to the 
PTCSP is planned or unplanned. Planned changes are those that the 
system developer and the railroad have included in the safety analysis 
associated with the PTC system, but have not yet implemented. These 
changes provide enhanced functionality to the system, and FRA strongly 
encourages railroads to include PTC system improvements that further 
increase safety. A planned change may require FRA approved regression 
testing to demonstrate that its implementation has not had an adverse 
affect on the system it is augmenting. Each planned change must be 
clearly identified as part of the PTCSP, and the PTCSP safety analysis 
must show the affect that its implementation will have on safety.
    Unplanned changes are those either not foreseen by the railroad or 
developer, but nevertheless necessary to ensure system safety, or are 
unplanned functional enhancements from the original core system. The 
scope of any additional necessary work necessary to ensure safety may 
depend upon when in the development cycle phase the changes are 
introduced. For instance, if the PTCDP has not yet been submitted to 
FRA, no FRA involvement is required. However if the PTCDP has been 
submitted to FRA, or if the change impacts the safety functionality of 
the system once a Type Approval has been issued, and a PTCSP has not 
yet submitted, the railroad must submit a RFA requesting and 
documenting that change. Once FRA approves that RFA, FRA expects the 
subsequently filed PTCSP to account for the change in analysis.
    If the change is made after approval of the PTCSP and the system 
has been certified by FRA, a RFA must be submitted to FRA for approval. 
Because this requires significant effort by FRA and the railroad, FRA 
expects that every effort will be made to eliminate the need for 
unplanned changes. If the railroad and the vendor submit unplanned 
safety related changes that FRA believes are a significant amount or 
inordinately complex, FRA may revoke any approvals previously granted 
and disallow the use of the product until such time the railroad 
demonstrates the product is sufficiently mature.
    Paragraph (e) proposes that if a RFA is submitted for a 
discontinuance or a material modification to a portion or all of its 
PTC system, a notice of its submission shall be published in the 
Federal Register. Interested parties will be provided an opportunity to 
comment on the RFA, which will be located in an identified docket.
    Proposed paragraph (f) makes it clear that FRA will consider all 
impacts on public safety prior to approval or disapproval of any 
request for discontinuance, modification, or amendment of a PTC system 
and any associated changes in the existing signal system that may have 
been concurrently submitted. While the economic impact to the affected 
parties may be considered by the FRA, the primary and final deciding 
factor on any FRA decision is safety. FRA will consider not only how 
safety is affected by installation of the system, but how safety is 
impacted by the failure modes of the system.
    The purpose of proposed paragraph (g) is to emphasize the right of 
FRA to unilaterally issue a new Type Approval, with whatever conditions 
are necessary to ensure safety based on the impact of the proposed 
changes.
    In proposed paragraph (h), FRA makes clear that it considers any 
implemented PTC system to be a safety device. Accordingly, the 
discontinuance, modification, or other change of the implemented system 
or its geographical limits will not be authorized without prior FRA 
approval. While this requirement primarily applies to safety critical 
changes, FRA believes that they should also apply to all changes that 
will affect interoperability. FRA seeks comments on this issue. The 
principles expressed in the paragraph parallel those embodied in part 
235, which implements 49 U.S.C. 20502(a).
    That said, FRA recognizes that there are a limited number of 
situations where changes of the PTC system may not have an adverse 
impact upon public safety. Specific situations where prior FRA approval 
is required are proposed in paragraphs (h)(1) through (h)(4).
    Paragraph (i) proposes the exceptions from the requirement for 
prior approval in cases where the discontinuance of a system or system 
element will be treated as pre-approved, as when a line of railroad is 
abandoned.
    Paragraph (j) proposes exceptions for certain lesser changes that 
are not expected to materially affect system risk, such as removal of 
an electric lock from a switch where speed is low and trains are not 
allowed to clear.
    Paragraph (k) proposes additional exceptions consisting of 
modifications associated with changes in the track structure or 
temporary construction. FRA notes that only temporary removal of the 
PTC system without prior FRA approval is allowed to support highway 
rail separation construction or damage to the PTC system by 
catastrophic events. In both cases, the PTC system must be restored to 
operation no later than 6 months after completion of the event.

[[Page 35994]]

Section 236.1023 Errors and Malfunctions

    Because PTC systems are approved, in part, based on certain 
assumptions regarding expected failure modes and frequencies, reporting 
and recording of errors and malfunctions takes on critical importance. 
If the number of errors and malfunctions exceeds those originally 
anticipated in the design, or errors and malfunctions that were not 
predicted are observed to occur, the validity of the risk analysis 
becomes suspect. Since not all railroads may experience the same 
software faults or hardware failures, the developer's development, 
configuration management, and fault reporting tracking system play a 
crucial role in the ability of the railroad and FRA to determine and 
fully understand the risks and their implications. Without an effective 
configuration management tracking system in place, it is difficult, if 
not impossible, to fairly evaluate PTC system risks during the system's 
life cycle.
    In the event of a safety-essential PTC system component failing to 
perform as intended, FRA intends to propose under Sec.  236.1023 that 
the cause be identified and corrective action be taken without undue 
delay. Until the repair is completed, the railroad and vendors are 
required to take appropriate measures to assure the safety of train 
movements, roadway workers, and on-track equipment. This requirement 
mirrors the current requirements of 49 CFR 236.11, which applies to all 
signal system components. FRA recognizes that there may be situations 
where reducing the severity of such hazards will suffice for an 
equivalent reduction in risk. For example, a reduction in operating 
speeds may not reduce the frequency of certain hazards involving 
safety-critical products, but it may reduce the severity of such 
hazards in most cases.
    Paragraph (a) proposes a direct obligation on suppliers to report 
safety-relevant failures, including ``wrong-side'' failures and other 
failures significantly impacting availability, where the PTCSP 
indicates availability to be a material issue in the safety performance 
of the larger railroad system. FRA expects each applicable supplier to 
identify the problem and the necessary corrective actions, recommended 
risk mitigations, and provide an estimated amount of time it expects to 
complete the corrective actions. FRA believes that it should be 
informed to ensure public safety in any case where a commercial dispute 
(e.g., over liability) might disrupt communication between a railroad 
and supplier.
    Paragraph (b) proposes a similar responsibility on the part of the 
railroad to report safety relevant failures to the supplier and FRA, 
and to keep the vendor and FRA apprised of any subsequent failures. To 
aid FRA in understanding the scope of a problem on a railroad, and to 
aid the railroad in communicating any PTC system failures to the 
appropriate vendor, paragraph (c) proposes to require that each 
railroad keep a currently updated PTC Product Vendor List (PTCVPL), 
which must identify each supplier of PTC equipment on its railroad.
    Paragraph (d) proposes the requirement that each railroad identify 
the procedures for action upon notification from the manufacturer of a 
safety-critical upgrade, patch, or revision performed within the scope 
of the applicable PTCDP. FRA expects that when issues are discovered 
that may adversely affect the safe operation of the system, regardless 
if the railroad has experienced the problem, the railroad will take 
corrective action without undue delay (see Sec.  236.11). FRA believes 
this is necessary to ensure that each railroad promptly addresses 
applicable errors to maintain a common safety baseline by performing 
component changes that, if left uncorrected, would increase risk or 
interfere with the safety of train operations. If the action were to 
take a significant amount of time, FRA proposes to require the railroad 
to provide FRA with periodic frequent progress reports.
    Paragraph (e) proposes time limits for reporting failures and 
malfunctions and the minimum reporting requirements. FRA has no 
specific format for the reports, and will accept any format provided it 
contains at least the information required by this proposed rule. FRA 
will accept delivery of these reports by commercial courier, fax, and 
e-mail.
    Paragraph (f) proposes to require the manufacturer to provide a 
detailed explanation of the problem and the intended or performed 
corrective action to FRA upon request, in the event that a PTC system 
is found to be unsafe due to a design or manufacturing defect. While 
the railroad may be able to report symptoms of a problem, it is the 
manufacturer who is in the best position to determine its underlying 
root cause. FRA may require this information to determine the full 
impact of the problem, and to determine if any additional restrictions 
or limitations on the use of the PTC may be warranted to ensure the 
safety of the general public and the railroad personnel.
    Proposed paragraph (g) is intended to limit unnecessary reporting. 
If the failure was the result of improper operation of the PTC system 
outside of the design parameters or of non-compliance with the 
applicable operating instructions, FRA believes that compliance with 
paragraph (f) is not necessary. Instead, FRA expects, and proposes to 
require, the railroad to engage in more narrow remedial measures, 
including remedial training by the railroad in the proper operation of 
the PTC system. Similarly, once a problem has been identified to all 
stakeholders, FRA does not believe it is necessary for a manufacturer 
to repeatedly submit a formal report in accordance with paragraph (f). 
In either situation, however, FRA expects that all users of the 
equipment are proactively and timely notified of the misuse that 
occurred and the corrective actions taken.
    Such reports, however, do not have to be made within seven days of 
occurrence, as required for other notifications under paragraph (e), 
but within a reasonable time appropriate to the nature and extent of 
the problem.
    Proposed paragraph (h) is intended to make clear that the reporting 
requirements of part 233 are not a substitute for the proposed 
reporting requirements of this subpart. Both requirements apply. In the 
case of a false proceed signal indication, FRA would not expect the 
railroad to wait for the frequency of such occurrences to exceed the 
threshold reporting level assigned in the hazard log of the PTCSP. 
Rather, current Sec.  233.7 requires all such instances to be reported.

Section 236.1027 Exclusions

    This section retains similarities to, but also establishes 
contrasts with, Sec.  236.911, which deals with exclusions from subpart 
H. In particular, Sec.  236.911(c) offers reassurance that a stand-
alone computer aided dispatching (CAD) system would not be considered a 
safety-critical processor-based system within the purview of subpart H. 
CADs have long been used by large and small railroads to assist 
dispatchers in managing their workload, tracking information required 
to be kept by regulation, and--most importantly--providing a conflict 
checking function designed to alert dispatchers to incipient errors 
before authorities are delivered. Even Sec.  236.911, however, states 
that ``a subsystem or component of an office system must comply with 
the requirements of this subpart if it performs safety-critical 
functions

[[Page 35995]]

within, or affects the safety performance of, a new or next-generation 
train control system.'' In fact, FRA is currently working with a vendor 
on a simple CAD that provides authorities in an automated fashion, 
without the direct involvement of a dispatcher.
    For subpart I, FRA wishes to retain the exception referred to in 
Sec.  236.911 for CAD systems not associated with a PTC system. Many 
smaller railroads use CAD systems to good effect, and there is no 
reason to impose additional regulations where dispatchers 
contemporaneously retain the function of issuing mandatory directives. 
However, in the present context, it is necessary to recognize that PTC 
systems utilize CAD systems as the ``front end'' of the logic chain 
that defines authorities enforced by the PTC system, particularly in 
non-signaled territory.
    Accordingly, paragraph (a) proposes the potential exclusion of 
certain office systems technologies from subpart I compliance. These 
existing systems have been implemented voluntarily to enhance 
productivity and have proven to provide a reasonably high level of 
safety, reliability, and functionality. FRA recognizes that full 
application of subpart I to these systems would present the rail 
industry with a tremendous burden. The burdens of subpart I may 
discourage voluntary PTC implementation and operation by the smaller 
railroads.
    However, FRA proposes to apply subpart I to those subsystems or 
components that perform safety critical functions or affect the safety 
performance of the associated PTC system. The level and extent of 
safety analysis and review of the office systems will vary depending 
upon the type of PTC system with which the office system interfaces. 
For example, to prevent the issuance of overlapping and inconsistent 
authorities, FRA expects that each PTC system demonstrate sufficient 
credible evidence that the requisite safety-critical, conflict 
resolution (although not necessarily vital) hardware and software 
functions of the system will work as intended. FRA also expects that 
the applicable PTCDP's and PTCSP's risk analysis will identify the 
associated hazards and describe how they have been mitigated. 
Particularly where mandatory directives and work authorities are 
evaluated for use in a PTC system use without separate oral 
transmission from the dispatcher to the train crew or employee in 
charge--with the opportunity for receiving personnel to evaluate and 
confirm the integrity of the directive or authority received and the 
potential for others overhearing the transmission to note conflicting 
actions by the dispatching center--FRA will insist on explanations 
sufficient to provide reasonable confidence that additional errors will 
not be introduced.
    Paragraph (b) proposes requirements for modifications of excluded 
PTC systems. At some point when a change results in degradation of 
safety or in a material increase in safety-critical functionality, 
changes to excluded PTC systems or subsystems may be significant enough 
to require application of subpart I's safety assurance processes. FRA 
believes that all modifications caused by unforeseen implementation 
factors will not necessarily cause the product to become subject to 
subpart I. These types of implementation modifications will be minor in 
nature and be the result of site specific physical constraints. 
However, FRA expects that implementation modifications that will result 
in a degradation of safety or a material increase in safety-critical 
functionality, such as a change in executive software, will cause the 
PTC system or subsystem to be subject to subpart I and its 
requirements. FRA is concerned, however, that a series of incremental 
changes, while each individually not meeting the threshold for 
compliance with this subpart, may when aggregated result in a product 
which differs sufficiently so as to be considered a new product. 
Therefore, FRA reserves the right to require products that have been 
incrementally changed in this manner to comply with the requirements of 
this subpart. Prior to FRA making such a determination, the affected 
railroad will be allowed to present detailed technical evidence why 
such a determination should not be made. This provision mirrors 
paragraph (d) of existing Sec.  236.911.
    Proposed paragraph (c) addresses the integration of train control 
systems with other locomotive electronic control systems. The earliest 
train control systems were electro-mechanical systems that were 
independent of the discrete pneumatic and mechanical control systems 
used by the locomotive engineer for normal throttle and braking 
functions. Examples of these train control systems included cab signals 
and ACS/ATC appliances. These systems included a separate antenna for 
interfacing with the track circuit or inductive devices on the wayside. 
Their power supply and control logic were separate from other 
locomotive functions, and the cab signals were displayed from a 
separate special-purpose unit. Penalty brake applications by the train 
control system bypassed the locomotive pneumatic and mechanical control 
systems to directly operate a valve that accomplished a service 
reduction of brake pipe pressure and application of the brakes as well 
as reduction in locomotive tractive power. In keeping with this 
physical and functional separation, train control equipment on board a 
locomotive came under part 236, rather than the locomotive inspection 
requirements of part 229.
    Advances in hardware and software technology have allowed the 
various PTC systems' and components' original equipment manufacturers 
(OEMs) to repackage individual components, eliminating parts and system 
function control points access. Access to control functions became 
increasingly restricted to the processor interfaces using proprietary 
software. While this resulted in significant simplification of the 
previously complex discrete pneumatic and mechanical control train and 
locomotive control systems into fewer, more compact and reliable 
devices, it also creates significant challenges with respect to 
compatibility of the application programs and configuration management.
    FRA encourages such enhancements, and believes, if properly done, 
can result in significant safety, as well as operational, improvements. 
Locomotive manufacturers can certainly provide secure locomotive and 
train controls, and it is important that they do so if locomotives are 
to function safely in their normal service environment. FRA highly 
encourages the long-term goal of common platform integration. However, 
when such an integration occurs, it must not be done at the expense of 
decreasing the safe, and reliable operation of the train control 
system. Accordingly FRA expects that the complete integrated system 
will be shown to have been designed to fail-safe principles, and then 
demonstrated that the system operates in a fail safe mode. Any 
commingled system must have a manual failsafe fall back up that allows 
the engineer to be brought to a safe stop in the event of an electronic 
system failure. This analysis must be provided to FRA for approval in 
the PTCDP and PTCSP as appropriate. This provision mirrors the 
heightened scrutiny called for by Sec.  236.913(c) of subpart H for 
commingled systems, but is more explicit with respect to FRA's 
expectations. The provision in general accords with the requirements 
for locomotive systems that are currently under development in the 
RSAC's Locomotive Safety Standards Working Group.
    Finally proposed paragraph (d) clarifies the application of 
subparts A

[[Page 35996]]

through H to products excluded from compliance with Subpart I. These 
products are excluded from the requirements of subpart I, but FRA 
expects that the developing activity demonstrates compliance of 
products with Subparts A through H. FRA believes that railroads not 
mandated to implement PTC, or that are implementing other non-PTC 
related processor based products should be given the option to have 
those products approved under subpart H by submitting a PSP and 
otherwise complying with subpart H or voluntarily complying with 
subpart I. This provision mirrors Sec.  236.911(e) of subpart H.

Section 236.1029 PTC System Use and En Route Failures

    This section proposes minimum requirements, in addition to those 
found in the PTC system's plans, for each PTC system with a PTC System 
Certification. Railroads are allowed, and encouraged, to adopt more 
restrictive rules that increase safety.
    Paragraph (a) proposes to require that, in the event of the failure 
of a component essential to the safety of a PTC system to perform as 
intended, the cause be identified and corrective action taken without 
undue delay. The paragraph also requires that until the corrective 
action is completed, the railroad is required at a minimum, to take the 
appropriate measures, including those specified in the PTCSP, to assure 
the safety of train movements, roadway workers, and on-track equipment. 
This proposed requirement mirrors current requirements of Sec.  236.11, 
which applies to all signal and train control system components. Under 
proposed paragraph (a), FRA intends to apply to PTC systems provided 
PTC System Certification under subpart I the same standard in current 
Sec.  236.11.
    Paragraph (b) proposes the circumstance where a PTC onboard 
apparatus on a lead locomotive that is operating in or is to be 
operated within a PTC system fails or is otherwise cut-out while en 
route. Under proposed paragraph (b), the subject train may only 
continue such operations in accordance with specific limitations. An en 
route failure is applicable only in instances after the subject train 
has departed its initial terminal, having had a successful 
initialization, and subsequently rendering it no longer responsive to 
the PTC system. For example, FRA believes that an en route failure may 
occur when the PTC onboard apparatus incurs an onboard fault or is 
otherwise cut out.
    Under subpart H, existing Sec.  236.567 provides specific 
limitations on each train failing en route in relation to its 
applicable automatic cab signal, train stop, and train control system. 
FRA believes that it would be desirable to impose somewhat more 
restrictive conditions given the statutory mandate and the desire to 
have an appropriate incentive to properly maintain the equipment and to 
timely respond to en route failures. For instance, FRA recognizes that 
the limitations of Sec.  236.567 do not account for the statutory 
mandates of the core PTC safety functions. However, during the PTC 
Working Group meetings, no consensus was reached on how to regulate en 
route failures on PTC territory. Nevertheless, proposed Sec.  236.1029, 
and in particular proposed paragraph (b), purposefully intend to 
parallel the limitations contained in Sec.  236.567. In other words, 
FRA intends that Sec.  236.567 and proposed paragraph (b) to Sec.  
236.1029 will share the common purpose of maintaining a level of safety 
generally in accord with that expected with the train control system 
fully functional. This is accomplished by requiring supplementary 
procedures to heighten awareness and provide operational control 
(limiting the frequency of unsafe events) and by restricting the speed 
of the failed train (reducing the potential severity of any unsafe 
event).
    Paragraph (b)(1) proposes to allow the subject train to proceed at 
restricted speed--or at medium speed if a block signal system is in 
operation according to signal indication--to the next available point 
where communication of a report can be made to a designated railroad 
officer of the host railroad. The intent of this requirement is to 
ensure that the occurrence of an en route failure may be appropriately 
recorded and that the necessary alternative protection of absolute 
block is established.
    After a report is made in accordance with paragraph (b)(1), or made 
electronically and immediately by the PTC system itself, paragraph 
(b)(2) proposes to allow the train to continue to a point where an 
absolute block can be established in advance of the train in accordance 
with the limitations that follow in paragraphs (b)(2)(i) and (ii). 
Paragraph (b)(2)(i) proposes to require that where no block signal 
system is in use, the train may proceed at restricted speed. 
Alternatively, under proposed paragraph (b)(2)(ii), the train may 
proceed at a speed not to exceed medium speed where a block signal 
system is in operation according to signal indication.
    Paragraph (b)(3) proposes to require that, upon the subject train 
reaching the location where an absolute block has been established in 
advance of the train, the train may proceed in accordance with the 
limitations that follow in paragraphs (b)(3)(i), (ii), or (iii). 
Proposed paragraph (b)(3)(i) requires that where no block signal system 
is in use, the train may proceed at medium speed; however, if the 
involved train is a train which is that of the criteria requiring the 
PTC system installation (i.e., a passenger train or a train hauling any 
amount of PIH material), it may only proceed at a speed not to exceed 
30 miles per hour. Paragraph (b)(3)(ii) requires that where a block 
signal system is in use, a passenger train may proceed at a speed not 
to exceed 59 miles per hour and a freight train may proceed at a speed 
not to exceed 49 miles per hour. Paragraph (b)(3)(iii) requires that 
except as provided in paragraph (c), where a cab signal system with an 
automatic train control system is in operation, the train may proceed 
at a speed not to exceed 79 miles per hour.
    Paragraph (c) requires that, in order for a PTC train that operates 
at a speed above 90 miles per hour to deviate from the operating 
limitations contained in paragraph (b) of this section, the deviation 
must be described and justified in the FRA approved PTCDP or PTCSP, or 
the Order of Particular Applicability, as applicable.
    Paragraph (d) proposes to require that the railroad operate its PTC 
system within the design and operational parameters specified in the 
PTCDP and PTCSP. Railroads will not exceed maximum volumes, speeds, or 
any other parameter provided for in the PTCDP or PTCSP. On the other 
hand, a PTCDP or PTCSP could be based upon speed or volume parameters 
that are broader than the intended initial application, so long as the 
full range of sensitivity analyses is included in the supporting risk 
assessment. FRA feels this requirement will help ensure that 
comprehensive product risk assessments are performed before products 
are implemented.
    Paragraph (e) sets forth the requirement that any testing of the 
PTC system must not interfere with its normal safety-critical 
functioning, unless an exception is obtained pursuant to 49 CFR 
236.1035, where special conditions have been established to protect the 
safety of the public and the train crew. Otherwise, paragraph (e) 
requires that each railroad ensure that the integrity of the PTC system 
not be compromised, by prohibiting the normal functioning of such 
system to be interfered with by testing or otherwise without first 
taking measures to provide for the safety of train movements, roadway 
workers, and

[[Page 35997]]

on-track equipment that depend on the normal safety-critical 
functioning of the system. This provision parallels current Sec.  
236.4, which applies to all systems. By requiring this paragraph, FRA 
also intends to clarify that the standard in current Sec.  236.4 also 
applies to subpart I PTC systems.
    Paragraph (f) proposes to require that each member of the operating 
crew has appropriate access to the information and functions necessary 
to perform his or her job safely when products are implemented and used 
in revenue service. Where two-person crews are employed, availability 
of a screen and any needed function keys will enable the second crew 
person to carry out PTC onboard computer-related activities without 
distracting the locomotive engineer from maintaining situational 
awareness of activities outside the locomotive cab. FRA's existing 
regulations for train control in Sec.  236.515 requires that the cab 
signal display be clearly visible to each member of the crew. FRA 
believes the decision to operate with one PTC screen, only accessible 
to the engineer, can only be made after careful analysis of the human 
factor implications, the associated risks, and the sensitivity of the 
safety analysis that is used to potentially justify the decision. FRA 
notes that the principles of crew resource management and current crew 
briefing practices in the railroad industry require that all members of 
a functioning team (e.g., engineer, conductor, dispatcher, roadway 
worker in charge) have all relevant information available to facilitate 
constructive interactions and permit incipient errors to be caught and 
corrected. Retaining and reinforcing this level of cooperation will be 
particularly crucial during the early PTC implementation as errors in 
train consist information, errors generated in on-board processing, 
delays in delivery of safety warnings due to radio frequency 
congestion, and occasional errors in dispatching challenge the 
integrity of PTC systems even as the normal reliability of day-to-day 
functioning supports reductions in vigilance. Loss of crew cooperation 
could easily spill over to other functions, including switching 
operations and management of emergency situations.
    This issue was the subject of significant disagreement within the 
PTC Working Group. FRA appreciates the views of those who suggest that 
the cost of additional displays is not warranted and the argument that, 
where there is an additional crew member assigned, no value may be 
added by isolating the second crew member from potentially corrupted 
information communicated from the PTC display. However, FRA believes 
that there is a strong likelihood that railroads will at some point in 
the future seek to deliver electronically all mandatory directives from 
the dispatcher to the PTC onboard apparatus, obviating the need for 
oral transmission. When this occurs, FRA believes that having a second 
crew member involved in receipt and confirmation of the authority will 
be useful to verify situational appropriateness and avoid information 
overload of the locomotive engineer.

Section 236.1031 Previously Approved PTC Systems

    FRA recognizes that substantial effort has been voluntarily 
undertaken by the railroads to develop, test, and deploy PTC systems 
prior to the passage of the RSIA08, and that some of the PTC systems 
have accumulated a significant history of safe and reliable operations. 
In order to facilitate the ability of the railroads to leverage the 
results of PTC design, development, and implementation efforts that 
have been previously been approved or recognized by FRA prior to the 
adoption of this subpart, FRA is proposing an expedited certification 
process in this section.
    Under proposed paragraph (a), each railroad that has a PTC system 
that may qualify for expedited treatment would have to submit a Request 
for Expedited Certification (REC) letter. Products that have not 
received approval under the subpart H, or that have not been previously 
recognized by FRA, would be ineligible. The REC letter may be jointly 
submitted by PTC railroads and suppliers as long as there is at least 
one PTC railroad. A PTC system may qualify for expedited certification 
if it fulfills at least one of the descriptions proposed in paragraphs 
(a)(1) through (a)(3). While these descriptions are objective in 
nature, FRA intends them to cover ETMS, ITCS, and ACSES, respectively.
    Proposed paragraph (a)(1) applies to systems that have been 
recognized or approved by FRA after submission of a product safety plan 
(PSP) in accordance with subpart H. Subpart I generally reflects the 
same criteria required for a PSP under subpart H. Thus, FRA believes 
that most of the PTCDP and PTCSP requirements in subpart I can be 
fulfilled with the submission of the existing and approved PSP. 
However, FRA notes that the subject railroad will also need to submit 
the information required in a PTCDP and PTCSP that is not in the 
current PSP.
    FRA also recognizes that certain PTC systems may currently operate 
in revenue service with FRA approval through the issuance of a waiver 
or order. Proposed paragraphs (a)(2) and (a)(3) intend to cover those 
systems.
    If a PTC system complying with paragraph (a)(1) is provided 
expedited certification, the system plans should ultimately match the 
criteria required for each PTCDP and PTCSP. As previously noted, a 
railroad may seek to use a PTC system that has already received a Type 
Approval. To extend this benefit as it applies to previously used 
systems for which expedited certification is provided, paragraph (b) 
proposes to give the Associate Administrator the ability to provide a 
Type Approval to systems receiving expedited certification in 
accordance with paragraph (a)(1).
    FRA recognizes that certain systems eligible for expedited 
certification may not entirely comply with the subsequently issued 
statutory mandate. Accordingly, under paragraph (c), FRA is compelled 
to propose that before any Type Approval or expedited certification may 
be provided, the PTC system must be shown to reliably execute the same 
functionalities of every other PTC system required by subpart I. 
Nothing in this abbreviated process should be construed as implying the 
automatic granting by FRA of a Type Approval or PTC System 
Certification. Each expedited request for a Type Approval or PTC System 
Certification must be submitted by the railroad under this abbreviated 
process and, as required under subpart I, must demonstrate that the 
system reliably enforces positive train separation and prevents 
overspeed derailments, incursions into roadway worker zones, and 
movements through misaligned switches.
    Under proposed paragraph (d), FRA encourages railroads, to the 
maximum extent possible, to use proven service history data to support 
their requests for Type Approval and PTC System Certification. While 
proven service history cannot be considered a complete replacement for 
an engineering analysis of the risks and mitigations associated with a 
PTC product, it provides great creditability for the accuracy of the 
engineering analysis. Testing and operation can only show the absence 
or mitigation of a particular failure mode, and FRA believes that there 
will always be some failure modes that may only be determined through 
analysis. Due to this inherent limitation associated with testing and 
operation, FRA also strongly encourages the railroads to also submit 
any available analysis or information.
    Paragraph (e) proposes that, to the extent that the PTC system 
proposed for implementation under this subpart is different in 
significant detail from the

[[Page 35998]]

system previously approved or recognized, the changes shall be fully 
analyzed in the PTCDP or PTCSP as would be the case absent prior 
approval or recognition. FRA understands that the PTC product for which 
expedited Type Approval and PTC System Certification is sought may 
differ in terms of functionality or implementation from the PTC product 
previously approved or recognized by FRA. In such a case, the service 
history and analysis may not align directly with the new variant of the 
product. Similarly, the available service history and analysis 
associated with a PTC product may be inconclusive about the reliability 
of a particular function. It is because of these possible situations 
that FRA can not unequivocally promise that all requests for expedited 
Type Approval and PTC System Certification submitted by a railroad 
under this subpart will be automatically granted. FRA will, however, 
apply the available service history and analytical data as credible 
evidence to the maximum extent possible. FRA believes that this still 
greatly simplifies each railroad's task in making its safety case, 
since the additional testing and analysis required need only address 
those areas for which credible evidence is insufficient. To reduce the 
overall level of financial resources and effort necessary to obtain 
sufficient credible evidence to support the claims being made for the 
safety performance of the product, FRA also encourages each railroad to 
share with other railroads a system's service history and the results 
of any analysis, even in the case where the shared information does not 
fully support a particular railroad's safety analysis.
    Proposed paragraph (f) defines terms used only in this section. 
``Approved'' refers to approval of a Product Safety Plan under subpart 
H. As this NPRM was being prepared, only BNSF Railway's ETMS 
Configuration I had been so approved, but other systems were under 
development. ``Recognized'' refers to official action permitting a 
system to be implemented for control of train operations under an order 
or waiver, after review of safety case documentation for the 
implementation. As this NPRM was being prepared, only ACSES I had been 
recognized under an order of particular applicability, and ACSES II was 
under review for potential approval. Only one system, the ITCS in place 
on Amtrak's Michigan line, had been approved for unrestricted revenue 
service under waiver.
    FRA was unable to fashion an outright ``grandfathering'' of 
equipment previously used in transit and foreign service. FRA does not 
have the same degree of direct access to the service history of these 
systems. Transit systems--except those that are connected to the 
general railroad system--are not directly regulated by FRA. FRA has had 
limited positive experience eliciting safety documentation from foreign 
authorities, particularly given the influence of national industrial 
policies.
    However, FRA believes that, while complete exclusion may not be 
available in those circumstances, procedural simplification may be 
possible. FRA is considering a procedure under which the railroad and 
supplier could establish safety performance at the highest level of 
analysis for the particular product, relying in part on experience in 
the other service environments and showing why similar performance 
should be expected in the U.S. environment. Foreign signal suppliers 
should be in a good position to marshal service histories for these 
products and present them as part of the railroad's PTCSP. For any 
change, the applicant must provide additional information that will 
enable FRA to make an informed decision regarding the potential impact 
of the change on safety. This information must include, but is not 
limited to, the following: (1) A detailed description of the change; 
(2) a detailed description of the hardware and software impacted by the 
change; (3) a detailed description of any new functional data flows 
resulting from the change; (4) the results of the analysis used to 
verify that the change did not introduce any new safety risks or, if 
the change did introduce any new safety risks, a detailed description 
of the new safety risks and the associated risk mitigation actions 
taken; (5) the results of the tests used to verify and validate the 
correct functionality of the product after the change has been made; 
(6) a detailed description of any required modifications in the 
railroad training plan that are necessary for continued safe operation 
of the product after the change; and (7) a detailed description of any 
new test equipment and maintenance procedures required for the 
continued safe operation of the product. FRA requests comment on 
whether and in what way these concepts might be captured in the final 
rule.
    In the same vein, paragraph (g) encourages re-use of safety case 
documentation previously reviewed, whether under subpart H or subpart 
I.

Section 236.1033 Communications and Security Requirements

    Subpart I proposes specific communications security requirements 
for PTC system messages. Proposed Sec.  236.1033 originated from the 
radio and communications task force within the PTC Working Group. The 
objectives of the proposal are to ensure data integrity and 
authentication for communications with and within a PTC system.
    In data communications, ``cleartext'' is a message or data in a 
form that is immediately comprehensible to a human being without 
additional processing. In particular, it implies that this message is 
transferred or stored without cryptographic protection. It is related 
to, but not entirely equivalent to, the term ``plaintext.'' Formally, 
plaintext is information that is fed as an input to a cryptographic 
process, while ``ciphertext'' is what comes out of that process. 
Plaintext might be compressed, encrypted, or otherwise manipulated 
before the cryptographic process is applied, so it is quite common to 
find plaintext that is not cleartext. Cleartext material is sometimes 
in plain text form, meaning a sequence of characters without 
formatting, but this is not strictly required. The security 
requirements proposed in this document are consistent with the 
Department of Homeland Security (DHS) guidance for SCADA systems and 
the National Institute of Standards and Technology guidance. FRA has 
coordinated this proposal with DHS.
    Proposed paragraph (a) establishes the requirement for message 
integrity and authentication. Integrity is the assurance that data is 
consistent and correct. Generally speaking, in cryptography and 
information security, integrity refers to the validity of data. 
Integrity can be compromised through malicious altering--such as an 
attacker altering an account number in a bank transaction, or forgery 
of an identity document--or accidental altering--such as a transmission 
error, or a hard disk crash. A level of data integrity can be achieved 
by mechanisms such as parity bits and Cyclic Redundancy Codes (CRCs). 
Such techniques, however, are designed only to detect some proportion 
of accidental bit errors; they are powerless to thwart deliberate data 
manipulation by a determined adversary whose goal is to modify the 
content of the data for his or her own gain. To protect data against 
this sort of attack, cryptographic techniques are required. Thus, 
appropriate algorithms and keys must be employed and commonly 
understood between the entity wanting to provide data integrity and the 
entity wanting to be assured of data integrity.
    Authentication is the act of establishing or confirming something 
(or someone) as authentic. Various systems have been invented to 
provide a means

[[Page 35999]]

for readers to reliably authenticate the sender. In any event, the 
communication must be properly protected; otherwise, an eavesdropper 
can simply copy the relevant data and later replay it, thereby 
successfully masquerading as the original, legitimate entity.
    Sender authentication typically finds application in two primary 
contexts. Entity identification serves simply to identify the specific 
entity involved, essentially in isolation from any other activity that 
the entity might want to perform. The second context is data origin 
identification, which identifies a specific entity as the source or 
origin of a given piece of data. This is not entity identification in 
isolation, nor is it entity identification for the explicit purpose of 
enabling some other activity. Rather, this is identification with the 
intent of statically and irrevocably binding the identified entity to 
some particular data, regardless of any subsequent activities in which 
the entity might engage. Cryptographically based signatures provide 
nearly irrefutable evidence that can be used subsequently to prove to a 
third party that this entity did originate--or at least possess--the 
data.
    Proposed paragraph (b)(1) requires that cryptographic algorithms 
and keys used to establish integrity and authenticity be approved by 
either the National Institute of Standards or a similar standards 
organization acceptable to FRA. As a practical matter, cryptographic 
algorithms can be believed secure by competent, experienced, practicing 
cryptographers. This requires that the algorithms be publicly known and 
have been seriously studied by working cryptographers. Algorithms that 
have been approved by NIST (or similar standards bodies) can be assured 
of being both publicly known and seriously studied.
    Proposed paragraph (b)(2) allows the use of either manual or 
automated means to distribute keys. Key distribution is the most 
important component in secure transmissions. The general key 
distribution problem refers to the task of distributing keys between 
communicating parties to provide the required security properties. 
Frequent key changes are usually desirable to limit the amount of data 
compromised if an attacker learns the key. Therefore, the strength of 
any cryptographic system results with the key distribution technique, a 
term that refers to the means of delivering a key to two parties that 
wish to exchange data without allowing others to see the key. Key 
distribution can be achieved in a number of ways. There are various 
combinations by which a key can be selected manually or in automation 
amongst one or multiple parties.
    Proposed paragraph (b)(3) establishes the conditions under which 
cryptographic keys must be revoked. Paragraph (b)(3)(i) addresses the 
situation when a key has actually been found to have been compromised 
and when the possibility of key compromise exists. Cryptographic 
algorithms are part of the foundations of the security house, and any 
house with weak foundations will collapse. Adequate procedures should 
be foreseen to take an algorithm out of service or to upgrade an 
algorithm which has been used beyond its lifetime
    Proposed paragraph (d) addresses physical protection as applied to 
cryptographic equipment. Compliance does not necessitate locking 
devices within mechanical safes or enclosing their electronics within 
thick steel or concrete shields (i.e. making them tamper-proof). 
Compliance does, however, involve using sound design practices to 
construct a system capable of attack detection by a comprehensive range 
of sensors (i.e. tamper resistant). The level of physical security 
suggested should be such that unauthorized attempts at access or use 
will either be unsuccessful or will have a high probability of being 
detected during or after the event. Additionally, the cryptographic 
equipment should be prominently situated in operation so that its 
condition (outward appearance, indicators, controls, etc.) is easily 
visible to minimize the possibility of undetected penetration. In any 
system containing detection and destruction methods as described here, 
there is naturally a cost penalty for providing very high levels of 
tamper resistance, due to construction and test requirements by the 
manufacturer. It is naturally important to analyze the risks of key 
disclosure against cost of protection and specify a suitable 
implementation.
    Confidentiality has been defined by the International Organization 
for Standardization (ISO) as ``ensuring that information is accessible 
only to those authorized to have access.'' Confidentiality, integrity, 
and authentication all rely on the same basic cryptographic 
primitives--algorithms with basic cryptographic properties--and their 
relationship to other cryptographic problems. These primitives provide 
fundamental properties, which guarantee one or more of the high-level 
security properties. In proposed paragraph (e)(1), FRA makes it clear 
that while providing for confidentiality of message data is not a 
regulatory requirement, if confidentiality is elected to be implemented 
by a railroad, that the same protection mechanisms applicable to the 
cryptographic primitives that support integrity and authentication must 
also be provided for the cryptographic primitives that support 
confidentiality.
    It is only the difficulty of obtaining the key that determines 
security of the system, provided that there is no analytic attack 
(i.e., a ``structural weakness'' in the algorithms or protocols used), 
and assuming that the key is not otherwise available (such as via 
theft, extortion, or compromise of computer systems). A key should 
therefore be large enough that a brute force attack (possible against 
any encryption algorithm) is infeasible, whereas the attack would take 
too long to execute. Under information theory, to achieve perfect 
secrecy, it is necessary for the key length to be at least as large as 
the message to be transmitted and only used once (this algorithm is 
called the one-time pad). In light of this, and the practical 
difficulty of managing such long keys, modern cryptographic practice 
has discarded the notion of perfect secrecy as a requirement for 
encryption, and instead focuses on computational security. Under this 
definition, the computational requirements of breaking an encrypted 
text must be infeasible for an attacker. Paragraph (e)(2) proposes to 
require that in the event that a railroad elects to implement 
confidentiality, the chosen key length should provide the appropriate 
level of computational complexity to protect the information being 
protected, and that this information be included in the PTCSP. Both 
academic and private organizations provide recommendations and 
mathematical formulas to approximate the minimum key size requirement 
for security based on mathematic attacks; they generally do not take 
algorithmic attacks, hardware flaws, or other such issues into account.
    Key management--the process of handling and controlling 
cryptographic keys and associated material during their life cycle in a 
cryptographic system--includes ordering, generating, distributing, 
storing, loading, escrowing, archiving, auditing, and destroying the 
different types of material. Paragraph (e) proposes to require that 
cleartext stored cryptographic keys be protected from unauthorized 
disclosure, modification, or substitution. During key management, 
however, it may be necessary to validate the accuracy of the key being 
entered, especially in cases where the key management process is being 
done manually. During the key

[[Page 36000]]

entry process, keys not encrypted to protect against disclosures may be 
temporarily displayed to allow visual verification. However, if the key 
has been encrypted to protect against disclosure, then the cleartext 
version of the key may not be displayed. This does not, however, 
preclude the display of the encrypted version of the key.
    In proposed paragraph (f), FRA requires that each railroad 
implement a service restoration and mitigation plan to address restoral 
of communications services in the event of their loss or disruption and 
to make this plan available to FRA. Loss of communications services 
reduces or eliminates the effectiveness of a PTC system and FRA 
requires that these critical safety systems, once implemented, are 
restored to operation as soon as practical. FRA believes that the 
restoration plan must include testing and validating the plan, 
communicating the plan, and validating backup and restoration 
operations.
    To ensure that these or any other procedures work in the railroads 
operational environment, the railroad must validate each procedure 
intended for implementation. The backup and restoration plan should 
clearly describe who is to implement procedures and how they are to do 
it. The primary information to be communicated includes: the team or 
person (specified as an individual or a role) that is responsible for 
determining when restoration of service is required and the procedures 
to be used to restore service, as well as the team or person 
responsible for implementing procedures for each restoration scenario; 
the criteria for determining which restoration procedures are most 
appropriate for a specific situation; the time estimates for 
restoration of service in each restoration scenario; the restoration 
procedures to be used, including the tools required to complete each 
procedure; and the information required to restore data and settings.
    Finally, paragraph (g) is proposed to make clear that railroads are 
permitted to implement more restrictive security requirements provided 
the requirements do not adversely impact the interoperability.

Section 236.1035 Field Testing Requirements

    Initial field or subsequent regression testing of a PTC product on 
the general rail system is often required before the product has been 
certified in order to obtain data to support the safety case presented 
in the PTCSP. To ensure the safety of the public and train crews, prior 
FRA approval is required to conduct test operations on the general rail 
system. This paragraph proposes an alternative to the waiver process 
when only part 236 regulations are involved. When regulations 
concerning track safety grade crossing safety or when operational rules 
are involved, however, this process would not be available. Such 
testing may also implicate other safety issues, including adequacy of 
warning at highway-rail crossings (including part 234 compliance), 
qualification of passenger equipment (part 238), sufficiency of the 
track structure to support higher speeds or unbalance (part 213), and a 
variety of other safety issues, not all of which can be anticipated in 
any special approval procedure. Approval under this part for testing 
does not grant relief from other parts of this title and the railroads 
must still apply for relief from the non-part 236 regulations under the 
discrete special approval sections of those regulations, the provisions 
of part 211 related to waivers, or both.
    The information required for this filing is described in proposed 
paragraphs 236.1035(a)(1) through (a)(7). This information is necessary 
in order for FRA to make informed decisions regarding the safety of 
testing operations. FRA would prefer that the informational filings to 
test under this part be accompanied by any requests for relief from 
non-part 236 regulations so that they may be considered as a whole.
    Proposed paragraph (b) provides notification that FRA may--based on 
the results of the review of the information provided in paragraph (a) 
and in order to provide additional oversight to ensure the safety of 
rail operations--impose special conditions on the execution of the 
testing, including the appointment of a FRA test monitor. When a test 
monitor is appointed, he or she has the authority to stop testing if 
unsafe conditions arise, require additional tests as necessary to 
demonstrate the safe operation of the system, or have tests rerun when 
the results are in question.
    Paragraph (c) reemphasizes the earlier discussion that either 
temporary or permanent requests for relief for other than requirements 
of part 236 must be submitted in accordance with the waiver processes 
specified by part 211.

Sections 236.103 Through 236.1049

    In subpart H, Sec. Sec.  236.917 through 236.929 contain various 
requirements that involve PSPs. FRA believes that these requirements 
should apply equally to PTC systems governed by subpart I. FRA has 
included proposed Sec. Sec.  236.1037 to 236.1049 to inform interested 
parties how these elements would apply. FRA intends that the meanings 
of those sections in subpart H, as described in the preamble to its 
proposed and final rules, would also apply equally in the context of 
this proposal. While FRA has considered amending these sections in 
subpart H to incorporate references to subpart I, FRA believes such an 
attempt and its results would be cumbersome and awkward. Thus, FRA has 
included the provisions in proposed subpart I for clarity. FRA seeks 
comments on this issue.

Appendix B to Part 236--Risk Assessment Criteria

    FRA proposes modifying Appendix B of part 236 to enhance the 
language for risk assessment criteria in a light of experience gained 
during the initial stage of PTC system implementation under subpart H 
and to accommodate the requirements of subpart I regulating the use of 
mandatory PTC systems. As modified, Appendix B will modify certain 
headings and incorporate new language in paragraphs (a) through (h).
    Paragraph (a) reflects the change in the required length of time 
over which the system's risk must be computed. FRA replaces the 
requirement to assess risk for the system ``over the life-cycle of 25 
years or greater'' with the requirement to assess risk ``over the 
designed life-cycle of the product.'' FRA believes that the proposed 
language is consistent with the preamble discussion of the subpart H 
final rule inasmuch that they do not specify the length of a system's 
life cycle, thereby providing flexibility for new processor-based 
systems to have a life cycle other than 25 years.
    FRA proposes to modify paragraph (b) only to clarify FRA's intent.
    FRA proposes to modify the heading and content of paragraph (c) to 
better identify the main purpose of this requirement and to ensure its 
consistency with the associated requirements of Sec. Sec.  236.909(c) 
and (d). FRA believes that current paragraph (c) and its heading do not 
fully support or clarify the main intent of subpart H, which requires 
that the total cost of hazardous events should be the risk measure for 
a full risk assessment and that the mean time to hazardous event 
(MTTHE) calculations for all hazardous events should be the risk 
measure for the abbreviated risk assessment. The existing subpart H 
text asks for both the base case and the proposed case to be expressed 
in the same metrics. Paragraph (c) of this appendix, as currently 
written, does not fully reflect FRA's intent that the same risk metric 
is to be used in the risk assessment for both the previous and current

[[Page 36001]]

conditions (see Sec.  236.913(g)(2)(vii). FRA believes that the revised 
title of this paragraph poses the right question and that its new 
language provides better guidance on how to perform risk assessment for 
previous and current conditions.
    FRA proposes to modify the heading and text of paragraph (d) to 
create a comprehensive and detailed list of system characteristics that 
must be included in the risk assessment for each proposed PTC system 
subject to requirements of subpart H or subpart I, or both, as 
applicable. FRA believes that the extended description of system 
characteristics better suits the risk assessment requirements of 
subpart H and subpart I. For example, the proposed revisions clarify 
that the risk assessment must account for the total volume of traffic, 
the type of transported freight materials (PIH, PIH), and any 
additional requirements for PTC systems with trains operating at 
certain speeds.
    FRA proposes to modify paragraph (e) to clarify its intent and 
reflect the industry's experience in risk assessment techniques gained 
during the initial stage of PTC system implementation under subpart H. 
In the proposed language of paragraph (e), FRA provides more specific 
guidance on how to derive the main risk characteristics, MTTHE, and 
what role reliability and availability parameters, such as mean time to 
failure (MTTF) or mean time between failures (MTBF), for different 
system components can play while assessing risk for vital and non-vital 
hardware or software components of the system. FRA emphasizes that it 
is critical that each railroad and its vendors include the software 
failure rates into risk assessments for the system. FRA also finds it 
necessary to advise each railroad and its vendors to include 
reliability and availability characteristics, such as MTTF or MTBF, 
into its risk assessment to account for potential system exposure to 
hazards during system failures or malfunctioning when the system 
operates in its fall back mode--the back-up operation, as described in 
the PTCSP, when the PTC system fails to operate.
    FRA believes that the proposed modifications to paragraph (e) more 
accurately address the industry's need for clarity in interpretation 
and execution of the requirements related to risk assessment.
    FRA proposes to modify paragraph (f)(2) to reflect FRA's 
understanding that a software failure analysis may not necessarily be 
based on MTTHE ``Verification and Validation'' processes and that MTTHE 
characteristics cannot be easily obtained for the system software 
components. Therefore, the proposed modification intends to outline the 
significance of detailed software fault/failure analysis and software 
testing to demonstrate repeatable predictive results that all software 
defects are identified and corrected.
    FRA proposes to modify paragraph (g) to clarify that MMTHE 
calculations should account for the restoration time after system or 
component failure and that the system design must be assessed for 
adequacy through the Verification and Validation process.
    FRA proposes to modify paragraph (h) to emphasize the need to 
document all assumptions made during the risk assessment process. FRA 
believes that the assumptions should be documented while deriving the 
total cost of potential accident consequences for full risk assessment 
or MTTHE values for abbreviated risk assessment, rather than only 
documenting assumptions for her intermediate parameters, such as MTTF 
and MTTR, as currently required. These two referenced parameters may or 
may not be relevant for the risk assessment.

Appendix C to Part 236--Safety Assurance Criteria and Processes

    FRA proposed to modify Appendix C to Part 236 to enhance and 
clarify its language, re-organize the existing list of safe system 
design principles in accordance with the well established models of 
system safety engineering, and augment the list of safe system design 
principles with the principles related to safe system software design. 
A safe state is a system configuration that the system defaults to in 
the event of a fault or failure or when unacceptable or dangerous 
conditions are detected. The safe state is a state of the process 
operation where the hazardous event cannot occur. Paragraph (a), as 
proposed, is revised to reflect the main purpose of this appendix in 
clear, accurate, and consistent language that will be repeatedly used 
throughout the appendix. It also outlines that the requirements of this 
appendix will be applicable to each railroad's PTCIP and PTCSP, as 
required by subpart I.
    Paragraph (b), as proposed, is modified and restructured to 
consistently present a complete list of safety assurance principles 
properly classified or categorized in accordance with well established 
system safety engineering principles that need to be followed by the 
designer of the system to assure that all system components perform 
safely under normal operating conditions and under failures, accounting 
for human factor impacts, external influencing, and procedures and 
policies related to maintenance, repair, and modification of the 
system. FRA also proposes adding language indicating that these 
principles must also be applicable to PTC systems designed and 
implemented under the requirements of subpart I. FRA's intent in 
promulgating Appendix C was to ensure that safety principles are 
followed during the design stage and that Verification and Validation 
methods are used to assure that the product meets the safety criteria 
established in Sec.  236.909. The heading of this paragraph and its 
subparagraphs are changed to more adequately and precisely capture this 
paragraph's purpose. For instance, FRA proposes to modify the heading 
of paragraph (b)(1) to better suit the chosen base of classification 
for all safety principles under paragraph (b).
    Under paragraph (b)(3), FRA proposes to amend the definition of 
Closed Loop Principle to reflect its industry accepted definition 
provided by the AREMA Manual. FRA believes that the current definition 
is too general and does not reflect the essence of the most significant 
principles of safe signaling system design.
    Under paragraph (b)(4), FRA proposes to add a list of Safety 
Assurance Concepts that the designer may consider for implementation to 
assure sail-safe system design and operation. These principles are 
predominantly applicable for the safe system software design and quoted 
from the IEEE-1483 standard. Based on this proposed amendment, FRA also 
proposes to renumber some of the remaining subparagraphs of paragraph 
(b) to follow the chosen scheme for the proper classification and 
sequence of safety principles.
    FRA proposes to amend paragraph (c) reflect the changes in 
recommended standards. For instance, the standard ``EN50126: 1999, 
Railway Applications: Specification and Demonstration of Reliability, 
Availability, Maintainability and Safety'' (RAMS) is superseded by the 
standard IEC62278: 2002 under the same title. The standard ``EN50128 
(May 2001), Railway Applications: Software for Railway Control and 
Protection Systems'' is superseded by the Standard IEC62279: 2002 under 
the same title.
    Under paragraph (c)(3)(i), FRA references additional IEEE standards 
that have become available and will support the designs of PTC systems 
that are widely using communications as their main component. In 
addition to existing reference under paragraph (c)(3)(i)(A) for IEEE-
1483 Standard, the following standards are added to paragraph 
(c)(3)(i): IEEE 1474.2-2003,

[[Page 36002]]

Standard for user interface requirements in communications based train 
control (CBTC) systems; and IEEE 1474.1-2004, Standard for 
Communications-Based Train Control (CBTC) Performance and Functional 
Requirements.
    After an analysis of the current applicability of ATCS 
Specification 130 and 140, FRA believes that they are not being used. 
Thus, FRA proposes to remove these standards from the list of 
referenced standards. However, FRA also proposes to add the ATCS 200, 
Data Communication standard that remains relevant for communication 
segment of PTC system designs.
    FRA also considers it necessary to reference several additional 
sections of the current AREMA 2009 Communications and Signal Manual of 
Recommended Practices. In addition to Section 17 of this manual 
referenced in a previous version of Appendix C, FRA proposes to add to 
the list of references Section 16 Vital Circuit and Software Design; 
Section 21 Data Transmission; and Section 23 Communication-Based 
Signaling.

VII. Regulatory Impact and Notices

A. Executive Order 12866 and DOT Regulatory Policies and Procedures

    This proposed rule has been evaluated in accordance with existing 
policies and procedures, and determined to be significant under both 
Executive Order 12866 and DOT policies and procedures (44 FR 11034; 
Feb. 26, 1979). We have prepared and placed in the docket a regulatory 
impact analysis (RIA) addressing the economic impact of this proposed 
rule. FRA invites comments on this RIA.
    The costs anticipated to accrue from adopting this proposed rule 
would include: (1) Costs associated with developing implementation 
plans and administrative functions related to the implementation and 
operation of PTC systems, including the information technology and 
communication systems that make up the central office; (2) hardware 
costs for onboard locomotive system components, including installation; 
(3) hardware costs for wayside system components, including 
installation; and (4) maintenance costs for all system components.
    Two types of benefits are expected to result from the 
implementation of this proposed rule--benefits from railroad accident 
reduction and business benefits from efficiency gains. The first type 
would include safety benefits or savings expected to accrue from the 
reduction in the number and severity of casualties arising from train 
accidents that would occur on lines equipped with PTC systems. Casualty 
mitigation estimates are based on a value of statistical life of $6 
million. In addition, benefits related to accident preventions would 
accrue from a decrease in damages to property such as: Locomotives, 
railroad cars, and track; environmental damage; track closures; road 
closures; and evacuations. Benefits more difficult to monetize--such as 
the avoidance of hazmat accident related costs incurred by Federal, 
State, and local governments and impacts to local businesses--will also 
result. FRA also expects that once PTC systems are refined, there would 
likely be substantial additional business benefits resulting from more 
efficient transportation service; however such benefits are not 
included because of significant uncertainties regarding whether and 
when individual elements will be achieved and given the complicating 
factor that some benefits might, absent deployment of PTC, be captured 
using alternative technologies at lower cost. FRA requests comments on 
whether this proposed regulation exercises the appropriate level of 
discretion and flexibility to comply with RSIA08 in the most cost 
effective and beneficial manner.
    This document presents a 20-year analysis of the costs and benefits 
associated with FRA's proposed rule, using both 7 percent and 3 percent 
discount rates, and two types of sensitivity analyses. The first is 
associated with varying cost assumptions used for estimating PTC 
implementation costs. The second takes into account potential business 
benefits from realizing service efficiencies and related additional 
societal benefits from attainment of environmental goals and an overall 
reduction in transportation risk from modal diversion.
    The 20-year total cost estimates are $10.00 billion (PV, 7%) and 
$13.85 billion (PV, 3%). Annualized costs are $0.95 billion (PV, 7%) 
and $0.93 billion (PV, 3%). Using high-cost assumptions, the 20-year 
total cost estimates would be $17.12 billion (PV, 7%) and $23.76 
billion (PV, 3%). Using low-cost assumptions, the 20-year cost 
estimates would be $7.09 billion (PV, 7%) and $9.84 billion (PV, 3%). 
The later the expenditures are made, the lower the discounted cost 
impact, which in any event is a very small portion of the total PTC 
costs.
    Twenty-year railroad safety (railroad accident reduction) benefit 
estimates associated with implementation of the proposed rule are $608 
million (PV, 7%) and $931 million (PV, 3%). Annualized benefits are $57 
million (PV, 7%), and $63 million (PV, 3%). Some forecasts predict 
significant growth of both passenger and freight transportation 
demands, and it is thus possible that greater activity on the system 
could present the potential for larger safety benefits than estimated 
in this analysis. The presence of a very large PTC-equipped freight 
locomotive fleet also supports the opportunity for introduction of new 
passenger services of higher quality at less cost to the sponsor of 
that service. Information is not presently available to quantify that 
benefit.

             Total 20--Year Benefits and Discounted Benefits
                             [At 3% and 7%]
------------------------------------------------------------------------

------------------------------------------------------------------------
Discount rate.....................              3.00%              7.00%
Costs:                              .................  .................
    Central Office and Development       $283,025,904       $263,232,675
    Wayside Equipment.............      3,109,098,494      2,586,453,456
    On-Board Equipment............      1,643,839,209      1,416,706,349
    Maintenance...................      8,812,624,111      5,741,220,231
                                   -------------------------------------
        Total.....................     13,848,587,717     10,007,612,712
------------------------------------------------------------------------
Railroad Safety Benefits..........        931,253,681        607,711,640
------------------------------------------------------------------------

    The Port Authority Trans Hudson (PATH), a commuter railroad, is 
apparently considering the system used by the New York City Transit 
Authority on the Canarsie line. This system, which is known as 
Communication-Based

[[Page 36003]]

Train Control, is not similar in concept to any of the other PTC 
systems (including the CSX CBTC, with which its name might easily be 
confused), and would not be suitable, as FRA understands the system, 
except on a railroad with operating characteristics similar to a heavy 
rail mass transit system. FRA believes that, in absence of the 
statutory mandate or this rulemaking, PATH would have adopted PTC for 
business reasons.
    Although costs associated with implementation of the proposed rule 
are significant and such costs would far exceed the benefits, FRA is 
constrained by the requirements of RSIA08, which do not provide 
latitude to for implementing PTC differently. Nevertheless, FRA has 
taken several steps to avoid triggering unnecessary costs in the 
proposed rule. For instance, FRA is not proposing to require use of 
separate monitoring of switch position in signal territory or that the 
system be designed to determine the position of the end of the train. 
FRA also minimized costs, such as by proposing a requirement to monitor 
derails protecting the mainline, but limiting it to derails connected 
to the signal system; and by proposing a requirement to monitor hazard 
detectors protecting the mainline, but limiting it to hazard detectors 
connected to the signal system. FRA also minimized costs related to 
diamond crossings, where a PTC equipped railroad crosses a non-PTC 
equipped railroad at grade; included exceptions to main track for 
passenger train operations, and proposed provisions that would permit 
some Class III railroad operation of trains not equipped with PTC over 
Class I railroad freight lines equipped with PTC.
    RSIA08 requires the railroads to have all mandatory PTC systems 
operational on or before December 31, 2015. Members of the PTC Working 
Group, especially railroad and supplier representatives, said that the 
timeframe was very tight, and that the scheduled implementation dates 
would be difficult to meet. In general, the faster a government agency 
requires a regulated entity to adopt new equipment of procedures, the 
more expensive compliance becomes. In part, this is due to supply 
elasticity being less over shorter time periods.
    FRA is unable to estimate the potential savings if Congress 
provided a longer implementation schedule or provided incentives, 
rather than mandates, for PTC system installation. In order to estimate 
the likely reduction in costs in such situations, FRA would need to 
develop some other schedule for implementation. The element least 
sensitive to an implementation's schedule appears to be onboard costs. 
Each PTC system's onboard equipment seems similar and is not very 
different from existing onboard systems. Further, the 2015 deadline is 
not so restrictive that it would cause railroads to pull locomotives 
out of service just to install on board PTC equipment. Locomotives must 
be inspected thoroughly every 90 and more extensively every 360 days. 
The inspections can last from one to several days. Railroads usually 
bring locomotives into their shops to perform these inspections, during 
which time a skilled and experienced team could install the on board 
equipment for PTC. System development is much less certain, and more 
time would enable vendors to develop, test, and implement the software 
at a more reasonable cost. Wayside costs are also sensitive to the 
installation timetable, as the wayside must be mapped and measured, and 
then the railroads must install wayside interface units (WIUs). Wayside 
mapping and measurement takes a highly skilled workforce. A larger 
workforce is necessary to timely implement the required PTC systems in 
a shorter amount of time. WIU installation is likely similar to 
existing signal or communication systems installation, and is likely to 
involve use of existing railroad skilled workers. The shorter the 
installation time period, the more work will be done at overtime rates, 
which are, of course, higher.
    FRA believes that lower costs could result from a longer 
installation period, but FRA also believes that the differences in 
costs would be within the range of the low costs provided in the main 
analysis of the proposed rule. The 2004 report included some lower cost 
estimates, but in light of current discussions with railroads, the cost 
estimates in the 1998 report seem more accurate. The lower estimates 
FRA received in preparing the 2004 report were both overly optimistic, 
and excluded installation costs, as well as higher costs which stem 
from meeting the performance standards.
    Some of the costs of PTC implementation, operation, and maintenance 
may be offset by business benefits, especially in the long run, 
although there is uncertainty regarding the timing and level of those 
benefits. Economic and technical feasibility of the necessary system 
refinements and modifications to yield the potential business benefits 
has not yet been demonstrated. FRA analyzed business benefits 
associated with PTC system implementation and presented its findings in 
the 2004 Report. Due to the aggressive implementation schedule for PTC 
and the resulting need to issue a rule promptly, FRA has not formally 
updated this study. Nevertheless, FRA believes that there is 
opportunity for significant business benefits to accrue several years 
after implementation once the systems have been refined to the degree 
necessary. Thus, FRA conducted a sensitivity analysis of potential 
business benefits based on the 2004 Report.
    The 2004 Report included business benefits from improved or 
enhanced locomotive diagnostics, fuel savings attributable to train 
pacing, precision dispatch, and capacity enhancement. Although 
railroads are enhancing locomotive diagnostics using other 
technologies, FRA believes that PTC could provide the basis for 
significant gains in the other three areas.
    In the years since the 2004 Report, developing technology and 
rising fuel costs have caused the rail supply industry and the 
railroads to focus on additional means of conserving diesel fuel while 
minimizing in-train forces that can lead to derailments and delays from 
train separations (usually broken coupler knuckles). Software programs 
exist that can translate information concerning throttle position and 
brake use, together with consist information and route characteristics, 
to produce advice for prospective manipulation of the locomotive 
controls to limit in-train forces. Programs are also being conceived 
that project arrival at meet points and other locations on the 
railroad. These types of tools can be consolidated into programs that 
either coaches the locomotive engineer regarding how to handle the 
train or even take over the controls of the locomotive under the 
engineer's supervision. The ultimate purpose of integrating this 
technology is to conserve fuel use while handling the train properly 
and arriving at a designated location ``just in time'' (e.g., to meet 
or pass a train or enter a terminal area in sequence ahead of or behind 
other traffic). Further integrating this technology with PTC 
communications platforms and traffic planning capabilities could permit 
transmittal of ``train pacing'' information to the locomotive cab in 
order to conserve fuel. Like the communications backbone, survey data 
concerning route characteristics can be shared by both systems. The 
cost of diesel fuel for road operations to the Class I railroads is 
approximately $3.5 billion annually and is gradually rising. If PTC 
technology helps to spur the growth and effective use of train pacing, 
fuel savings of 5% ($175,000,000

[[Page 36004]]

annually) or greater could very likely be achieved. Clearly, if the 
railroads are able to conserve use of fuel, they will also reduce 
emissions and contribute to attainment of environmental goals, even 
before modal diversion occurs.
    The improvements in dispatch and capacity have further 
implications. With those improvements, railroads could improve the 
reliability of shipment arrival time and, thus, dramatically increase 
the value of rail transportation to shippers, who in turn would divert 
certain shipments from highway to rail. Such diversion would yield 
greater overall transportation safety benefits since railroads have 
much lower accident risk than highways, on a point-to-point ton-mile 
basis. The total societal benefits of PTC system implementation and 
operation, following the analysis, would be much greater than total 
societal costs, although the costs would fall disproportionately more 
heavily on the railroads.
    At present, the PTC systems contemplated by the railroads, with the 
possible exception of PATH, would not increase capacity, at least not 
for some time. If the locomotive braking algorithms need to be made 
more conservative in order to ensure that each train does not exceed 
the limits of its authority, PTC system operation may actually decrease 
rail capacity where applied in the early years. Further investment 
would be required to bring about the synergy that would result in 
capacity gains. A more significant business benefit of PTC system 
operation would be derived from precision dispatching, which decreases 
the variance of arrival times of delivered freight. To avoid the risk 
of running out of stock, shippers often overstock their inventory at an 
annual cost of approximately 25% of its inventory value, regardless of 
the material being stored. This estimate accounts for shrinkage, 
borrowing costs, and storage costs. Of course, freight with more value 
per unit of mass or volume tends to have greater storage costs per 
unit. At present, no rail precision dispatch system exists. However, if 
a shipper would take advantage of precision dispatching, thus 
increasing freight arrival time accuracy, then it could reduce its 
overstock inventory. Accurate train data is a necessary, but not a 
sufficient condition, for precision dispatch. At least two of the Class 
I railroads have unsuccessfully attempted to develop precision dispatch 
systems. The mandatory installation of PTC systems is likely to divert 
any resources that might have been devoted to precision dispatch, so 
these benefits are unlikely during the first several years of this 
rule.
    Applying current factors to the variables used in the 2004 Report 
to Congress, the resulting analysis indicates that diversion could 
result in highway annual safety benefits of $744 million by 2022, and 
$1,148 million by 2032. Of course, these benefits require that the 
productivity enhancing systems be added to PTC, and are heavily 
dependent on the underlying assumptions of the 2004 model.
    Modal diversion would also yield environmental benefits. The 2004 
Report estimated that reduced air pollution costs would have been 
between $68 million and $132 million in 2010 (assuming PTC would be 
implemented by 2010), and between $103 million and $198 million in 
2020. This benefit would have accrued to the general public. FRA has 
not broken out the pollution cost benefit of the current rule, but 
offers the estimates from the 2004 Report as a guide to the order of 
magnitude of such benefits.
    While railroads argued that many of the benefits identified in 
FRA's 2004 report were exaggerated, shortly after the publication of 
the report, several railroads began developing strategies for PTC 
system development and implementation. This investment by the railroads 
would seem to illustrate that they believe that there is some potential 
for PTC to provide a boost to railroad profits, beyond providing any of 
the aforementioned societal benefits.
    Modal diversion is highly sensitive to service quality. Problems 
with terminal congestion and lengthy dwell times might overwhelm the 
benefits of PTC or other initiatives which the railroads have been 
pursuing (reconfiguration of yards, pre-blocking of trains, shared 
power arrangements, car scheduling, Automatic Equipment Identification, 
etc.) might actually work in synergy with PTC. It should also be noted 
that, in the years since the 2004 Report was developed, the Class I 
railroads have shown an increased ability to retain operating revenue 
as profit, rather than surrendering it in the form of reduced rates. 
This was particularly true during the period prior to the current 
recession, when strained highway capacity favored the growth of rail 
traffic. The sensitivity analysis performed by FRA indicates that 
realization of business benefits could yield benefits sufficient to 
close the gap between PTC implementation costs and rail accident 
reduction benefits within the first 20 years of the rule, applying a 3% 
discount rate, and by year 25 of the rule, applying a discount rate of 
7%. Accordingly, the precise partition of business and societal 
benefits cannot be estimated with any certainty.
    FRA recognizes that the likelihood of business benefits is 
uncertain and that the cost-to-benefit comparison of this rule, 
excluding any business benefits, is not favorable. However, FRA has 
taken measures to minimize the rule's adverse impacts and to provide as 
much flexibility as FRA is authorized to grant under RSIA08.

B. Regulatory Flexibility Act and Executive Order 13272

    The Regulatory Flexibility Act (5 U.S.C. 601 et seq.) and Executive 
Order 13272 require a review of proposed and final rules to assess 
their impacts on small entities. An agency must prepare an initial 
regulatory flexibility analysis (IRFA) unless it determines and 
certifies that a rule, if promulgated, would not have a significant 
impact on a substantial number of small entities. FRA has not 
determined whether this proposed rule would have a significant economic 
impact on a substantial number of small entities. Therefore, we are 
publishing this IRFA to aid the public in commenting on the potential 
small business impacts of the proposals in this NPRM. We invite all 
interested parties to submit data and information regarding the 
potential economic impact that would result from adoption of the 
proposals in this NPRM. We will consider all comments received in the 
public comment process when making a determination in the Final 
Regulatory Flexibility Assessment.
    In accordance with the Regulatory Flexibility Act, an IRFA must 
contain:
    (1) A description of the reasons why action by the agency is being 
considered;
    (2) A succinct statement of the objectives of, and the legal basis 
for, the proposed rule;
    (3) A description of, and where feasible, an estimate of the number 
of small entities to which the proposed rule will apply;
    (4) A description of the projected reporting, recordkeeping and 
other compliance requirements of the proposed rule, including an 
estimate of the classes of small entities that will be subject to the 
requirement and the type of professional skills necessary for 
preparation of the report or record;
    (5) An identification, to the extent practicable, of all relevant 
Federal rules that may duplicate, overlap, or conflict with the 
proposed rule; and
    (6) A description of any significant alternatives to the proposed 
rule that accomplish the stated objectives of applicable statutes and 
which minimize any significant economic impact of the

[[Page 36005]]

proposed rule on small entities. 5 U.S.C. 603(b), (c).
1. Reasons for Considering Agency Action
    PTC systems will be designed to prevent train-to-train collisions, 
overspeed derailments, incursions into established work zone limits, 
and the movement of a train through a switch left in the wrong 
position.
    As discussed in more detail in section I of the preamble, the 
RSIA08 mandates that widespread implementation of PTC across a major 
portion of the U.S. rail industry be accomplished by December 31, 2015. 
RSIA08 requires each Class I carrier and each entity providing 
regularly scheduled intercity or commuter rail passenger transportation 
to develop a plan for implementing PTC by April 16, 2010. The Secretary 
of Transportation is responsible for reviewing and approving or 
disapproving such plans. The Secretary has delegated this 
responsibility to FRA. This proposed rule details the process and 
procedure for obtaining FRA approval of the plans.
2. Legal Basis for the Proposed Rule
    As discussed earlier in the preamble, FRA is issuing this proposed 
rule to provide regulatory guidance and performance standards for the 
development, testing, implementation, and use of Positive Train Control 
(PTC) systems for railroads mandated by the Rail Safety Improvement Act 
of 2008. section 104, Public Law 110-432, 122 Stat. 4848, 4856, (Oct. 
16, 2008) (codified at 49 U.S.C. 20157).
3. Description and Estimate of Small Entities Affected
    ``Small entity'' is defined in 5 U.S.C. 601. Section 601(3) defines 
a ``small entity'' as having the same meaning as ``small business 
concern'' under section 3 of the Small Business Act. This includes any 
small business concern that is independently owned and operated, and is 
not dominant in its field of operation. Section 601(4) includes not-
for-profit enterprises that are independently owned and operated, and 
are not dominant in their field of operations within the definition of 
``small entities.'' Additionally, section 601(5) defines as ``small 
entities'' governments of cities, counties, towns, townships, villages, 
school districts, or special districts with populations less than 
50,000.
    The U.S. Small Business Administration (SBA) stipulates ``size 
standards'' for small entities. It provides that the largest a for-
profit railroad business firm may be (and still classify as a ``small 
entity'') is 1,500 employees for ``Line-Haul Operating'' railroads, and 
500 employees for ``Short-Line Operating'' railroads. See ``Table of 
Size Standards,'' U.S. Small Business Administration, January 31, 1996, 
13 CFR part 121; see also NAICS Codes 482111 and 482112.
    SBA size standards may be altered by Federal agencies in 
consultation with SBA, and in conjunction with public comment. Pursuant 
to the authority provided to it by SBA, FRA has published a final 
policy, which formally establishes small entities as railroads that 
meet the line haulage revenue requirements of a Class III railroad. See 
68 FR 24,891 (May 9, 2003). Currently, the revenue requirements are $20 
million or less in annual operating revenue, adjusted annually for 
inflation. The $20 million limit (adjusted annually for inflation) is 
based on the Surface Transportation Board's threshold of a Class III 
railroad carrier, which is adjusted by applying the railroad revenue 
deflator adjustment. See also 49 CFR part 1201. The same dollar limit 
on revenues is established to determine whether a railroad shipper or 
contractor is a small entity. FRA proposes to use this definition for 
this rulemaking.
    The IRFA's ``universe'' of considered entities generally includes 
only those small entities that can reasonably be expected to be 
directly regulated by the proposed action. One type of small entity is 
potentially affected by this proposed rule: railroads. The level of 
impact on small railroads will vary from railroad to railroad. Class 
III railroads will be impacted for one or more of the following 
reasons: (1) They operate on Class I railroad lines that carry PIH 
materials and are required to have PTC, in which case they would need 
to equip the portion of their locomotive fleet that operates on such 
lines; (2) they operate on Amtrak or commuter rail lines, including 
freight railroad lines that host such service; (3) they host regularly 
scheduled intercity or commuter rail transportation; or (4) they have 
at-grade railroad crossings over lines required by RSIA08 to have PTC. 
Generally, to the extent that Class III railroads incur costs 
associated with implementation of PTC it will limited to equipping 
locomotives, and not the wayside, for the reasons discussed below.
    The proposed rule would apply to small railroads' tracks over which 
a passenger railroad conducts intercity or commuter operations and 
locomotives operating on main lines of Class I freight railroads 
required to have PTC and on railroads conducting intercity passenger or 
commuter operations. The impact on Class III railroads that operate on 
Class I railroad lines required to be equipped with PTC will depend on 
the nature of such operations. Class III railroads often make short 
moves on Class I railroad lines for interchange purposes. To the extent 
that their moves do not exceed four per day or 20 miles in length of 
haul (one way), Class III railroads will be exempt from the requirement 
to equip the locomotives. However some Class III railroads operate much 
more extensively on Class I railroad lines that will be required to 
have PTC and would have to equip some of their locomotives. It is 
likely that Class III railroads will dedicate certain locomotives to 
such service, if they have not done so already. FRA estimates that 
approximately 55 small railroads would have to equip locomotives with 
PTC system components because they have trackage rights on Class I 
freight railroad PIH lines that would be required to have PTC and would 
not be able to qualify for any of the operational exceptions discussed.
    FRA further estimates that 10 small railroads have trackage rights 
on intercity passenger or commuter railroads or other freight railroads 
hosting such operations, and might need to equip some locomotives with 
PTC systems. Half of these would need to equip locomotives anyway, 
because they also have trackage rights on Class I railroads that haul 
PIH and would otherwise be required to have PTC.
    Thus, a total of 60 railroads would need to equip locomotives. FRA 
estimates that the average small railroad will need to equip four 
locomotives, at a per railroad cost of $55,000 each, totaling $220,000, 
and that the total cost for all 60 small railroads which will need to 
equip locomotives would be $13,200,000. The annual maintenance cost 
would be 15% of that total, equaling $33,000 per railroad or $1,980,000 
total for all small railroads. FRA requests comments regarding this 
cost estimate.
    In addition, 15 small railroads host commuter or intercity 
passenger operations on what might be defined as main line track under 
the accompanying rulemaking; however, only five of these railroads are 
neither terminal or port railroads, which tend to be owned and operated 
by large railroads or port authorities, nor subsidiaries of large short 
line holding companies with the expertise and resources across the 
disciplines comparable to larger railroads. Of those five railroads, 
only one has trackage exceeding 3.8 miles. The other four railroads may 
request that FRA define such track as other than main line after 
ensuring that all trains

[[Page 36006]]

will be limited to restricted speed. The cost burden on the remaining 
railroad will likely be reduced by restricting speed, temporally 
separating passenger train operations, or by passing the cost to the 
passenger railroad. Thus, the expected burden to small entities hosting 
passenger operations is minimal. FRA requests comments related to this 
analysis.
    At rail-to-rail crossings where at least one of the intersecting 
tracks allows operating speeds in excess of 40 miles per hour, the 
approaching non-PTC line must have a permanent maximum speed limit of 
20 miles per hour and either have some type of positive stop 
enforcement or a split-point derail incorporated into the signal system 
on the non-PTC route.. FRA believes that the cost of the derail would 
be borne by the PTC-equipped railroad, and that slowing to 20 miles per 
hour reflects current practice at most diamond crossings. FRA estimates 
that ten crossings exist, on five small railroads with two crossings 
each, where the newly burdened small railroad will be slowing to 20 
miles per hour from a higher track speed. FRA estimates that the 
average traffic on the newly burdened route is two trains per day, and 
that the cost to slow from a higher track speed is $30 per train, for a 
total cost of $60 per crossing per day, a per railroad cost of $120 per 
day, and a total national cost for all ten small railroads of $600 per 
day and an annual cost of $43,800 per railroad and a total for all 
small railroads of $219,000 per year. FRA estimates that only five 
railroads will be affected by this provision, and that they will be 
railroads not affected by the requirement to equip locomotives, because 
railroads with equipped locomotives could simply use the PTC system and 
avoid the requirement to slow down. This analysis yields a total of 65 
affected small entities that may be impacted by implementation of the 
proposed rule. FRA requests comments regarding this estimate of small 
entities potentially impacted.
4. Description of Reporting, Recordkeeping, and Other Compliance 
Requirements and Impacts on Small Entities Resulting From Specific 
Proposed Requirements
    Class III railroads that host intercity or commuter rail service 
will need to file implementation plans, whether or not they directly 
procure or manage installation of the PTC system. FRA believes that 
although the implementation plan must be jointly filed by the small 
host railroad and passenger tenant railroad, the cost of these plans 
will be borne by the passenger railroads. FRA believes that only one 
small entity, as described above, is likely to have PTC installed on 
its lines. The implementation plan is likely to be an extension of the 
passenger railroad's plan, and the marginal cost will be the cost of 
tailoring the plan to the host railroad, which will be borne by the 
passenger railroad, and maintaining copies of the plan at the host 
railroad, which FRA estimates to be approximately $1,000 per year.
    The total cost to small entities would include the initial cost of 
equipping locomotives, $13,200,000; annual costs of $1,980,000 for 
maintenance; $219,000 due to operating speed restrictions at diamond 
crossings; and $1,000 to maintain a copy of the PTC implementation 
plan. The total annual costs to small entities after initial 
acquisition would be $2,200,000 ($1,980,000 + $219,000 + $1,000). 
Individual railroads affected would either face an initial cost of 
$220,000 to equip locomotives, and an annual cost of $33,000 to 
maintain the PTC systems on those locomotives, or would face a per 
railroad cost of $43,800 per year to slow at diamond crossings.
5. Identification of Relevant Duplicative, Overlapping, or Conflicting 
Federal Rules
    There are no Federal rules that would duplicate, overlap, or 
conflict with this proposed rule.
6. Alternatives Considered
    FRA is unaware of any significant alternatives that would meet the 
intent of RSIA08 and that would minimize the economic impact on small 
entities. FRA is exercising its discretion to provide the greatest 
flexibility for small entities available under RSIA08 by proposing to 
allow operations of unequipped trains operated by small entities on the 
main lines of Class I railroads, and in defining main track on 
passenger railroads to avoid imposing undue burdens on small entities. 
The definition of passenger main track was adopted based on PTC Working 
Group recommendations that were backed strongly by representatives of 
small railroads. The provisions permitting operations of unequipped 
trains of Class I railroads exceeded the maximum flexibility for which 
the PTC Working Group could reach a consensus. FRA requests comments on 
this finding of no significant alternative related to small entities. 
FRA also requests comments on whether this proposed regulation 
exercises the appropriate level of discretion and flexibility to comply 
with RSIA08 in the most cost effective and beneficial manner.
    The process by which this proposed rule was developed provided 
outreach to small entities. As noted earlier in the preamble, this 
notice was developed in consultation with industry representatives via 
the RSAC, which includes small railroad representatives. From January 
to April 2009, FRA met with the entire PTC Working Group five times 
over the course of twelve days. This PTC Working Group established a 
task force to focus on issues specific to short line and regional 
railroads. The discussions yielded many insights and this proposed rule 
takes into account the concerns expressed by small railroads during the 
deliberations.

C. Paperwork Reduction Act

    The information collection requirements in this proposed rule have 
been submitted for approval to the Office of Management and Budget 
(OMB) under the Paperwork Reduction Act of 1995, 44 U.S.C. 3501 et seq. 
The sections that contain the new information collection requirements 
and the estimated time to fulfill each requirement are as follows:

----------------------------------------------------------------------------------------------------------------
                                                                                   Average time
            CFR section              Respondent universe        Total annual       per response    Total annual
                                                                 responses            (hours)      burden hours
----------------------------------------------------------------------------------------------------------------
234.275--Processor-Based Systems--  20 Railroads.........  25 letters...........               4             100
 Deviations from Product Safety
 Plan (PSP)--Letters.
236.18--Software Mgmt Control Plan  184 Railroads........  184 plans............           2,150         395,600
    --Updates to Software Mgmt.     90 Railroads.........  20 updates...........            1.50              30
     Control Plan.
236.905--Updates to RSPP..........  78 Railroads.........  6 plans..............             135             810
    --Response to Request For       78 Railroads.........  1 updated doc........             400             400
     Additional Info.

[[Page 36007]]

    --Request for FRA Approval of   78 Railroads.........  1 request/modified                400             400
     RSPP Modification.                                     RSPP.
236.907--Product Safety Plan        5 Railroads..........  5 plans..............           6,400          32,000
 (PSP)--Dev.
236.909--Minimum Performance
 Standard.
    --Petitions For Review and      5 Railroads..........  2 petitions/PSP......          19,200          38,400
     Approval.
    --Supporting Sensitivity        5 Railroads..........  5 analyses...........             160             800
     Analysis.
236.913--Notification/Submission    6 Railroads..........  1 joint plan.........          25,600          25,600
 to FRA of Joint Product Safety
 Plan (PSP).
    --Petitions for Approval/       6 Railroads..........  6 petitions..........           1,928          11,568
     Informational Filings.
    --Responses to FRA Request For  6 Railroads..........  2 documents..........             800           1,600
     Further Info. After
     Informational Filing.
    --Responses to FRA Request For  6 Railroads..........  6 documents..........              16              96
     Further Info. After Agency
     Receipt of Notice of Product
     Development.
    --Consultations...............  6 Railroads..........  6 consults...........             120             720
    --Petitions for Final Approval  6 Railroads..........  6 petitions..........              16              96
    --Comments to FRA by            Public/RRs...........  7 comments...........             240           1,680
     Interested Parties.
    --Third Party Assessments of    6 Railroads..........  1 assessment.........         104,000         104,000
     PSP.
    --Amendments to PSP...........  6 Railroads..........  15 amendments........             160           2,400
    --Field Testing of Product--    6 Railroads..........  6 documents..........           3,200          19,200
     Info. Filings.
236.917--Retention of Records.
    --Results of tests/inspections  6 Railroads..........  3 documents/records..        160,000;         360,000
     specified in PSP.                                                                  160,000;
                                                                                          40,000
    --Report to FRA of              6 Railroads..........  1 report.............             104             104
     Inconsistencies with
     frequency of safety-relevant
     hazards in PSP.
236.919--Operations & Maintenance
 Man.
    --Updates to O & M Manual.....  6 Railroads..........  6 updated docs.......              40             240
    --Plans For Proper              6 Railroads..........  6 plans..............          53,335         320,010
     Maintenance, Repair,
     Inspection of Safety-Critical
     Products.
    --Hardware/Software/Firmware    6 Railroads..........  6 revisions..........           6,440          38,640
     Revisions.
236.921--Training Programs:         6 Railroads..........  6 Tr. Programs.......             400           2,400
 Development.
    --Training of Signalmen &       6 Railroads..........  300 signalmen; 20              40; 20          12,400
     Dispatchers.                                           dispatchers.
236.923--Task Analysis/Basic        6 railroads..........  6 documents..........             720           4,320
 Requirements: Necessary Documents.
    --Records.....................  6 railroads..........  350 records..........          \1\ 10              58
SUBPART I--NEW REQUIREMENTS
236.1001--RR Development of More    30 railroads.........  3 rules..............              80             240
 Stringent Rules Re: PTC
 Performance Stds.
236.1005--Requirements for PTC
 Systems.
    --Temporary Rerouting:          30 railroads.........  50 requests..........               8             400
     Emergency Requests.
    --Written/Telephonic            30 railroads.........  50 notifications.....               2             100
     Notification to FRA Regional
     Administrator.
    --Temporary Rerouting Requests  30 railroads.........  95 requests..........               8             760
     Due to Track Maintenance.
    --Temporary Rerouting Requests  30 railroads.........  800 requests.........               8           6,400
     That Exceed 30 Days.
236.1006--Requirements for
 Equipping Locomotives Operating
 in PTC Territory.
    --Reports of Movements in       35 railroads.........  35 reports...........              16             560
     Excess of 20 Miles/RR
     Progress on PTC Locomotives.
 236.1007--Additional Requirements
 for High Speed Service.
    --Required HSR-125 Documents    30 railroads.........  11 documents.........           3,200          35,200
     with approved PTCSP.
    --Requests to Use Foreign       30 railroads.........  2 requests...........           8,000          16,000
     Service Data.
    --PTC Railroads Conducting      30 railroads.........  11 documents.........           4,000          44,000
     Operations at More than 150
     MPH with HSR-125 Documents.
236.1009-Procedural Requirements.
    --PTC Implementation Plans      30 Railroads.........  30 plans.............             535          16,050
     (PTCIP).
    --Host Railroads Filing PTCIP   30 Railroads.........  1 PCTIP; 15 RFAs.....        535; 320           5,335
     or Request for Amendment
     (RFAs).
    --Notification of Failure to    30 Railroads.........  30 notifications.....              32             960
     File Joint PTCIP.
    --Comprehensive List of Issues  30 Railroads.........  30 lists.............              80           2,400
     Causing Non-Agreement.
    --Conferences to Develop        30 Railroads.........  3 conf. calls........          \1\ 30               2
     Mutually Acceptable PCTIP.
    --Type Approval...............  30 Railroads.........  10 Type Appr.........               8              80
    --PTC Development Plans         30 Railroads.........  20 Ltr. + 20 App. + 5     8; 8; 6,400          32,320
     Requesting Type Approval.                              Plans.

[[Page 36008]]

    --PTCIP/PTCDP/PTCSP Plan        30 Railroads.........  1 document...........           8,000           8,000
     Contents--Documents
     Translated into English.
    --Requests for Confidentiality  30 Railroads.........  30 ltrs; 30 docs.....          8; 800          24,240
    --Field Test Plans/Independent  30 Railroads.........  150 field tests; 2                800         121,600
     Assessments--Req. by FRA.                              assessments.
    --FRA Access: Interviews with   30 Railroads.........  60 interviews........          \1\ 30              30
     RR PTC Personnel.
236.1011--PTCIP Requirements--      7 Interested Groups..  21 reviews + 60                143; 8           3,483
 Review and Public Comments on                              comments.
 PTCIPs, PTCDPs, and PTCSPs.
236.1015--PTCSP Content
 Requirements & PTC System
 Certification.
    --Non-Vital Overlay...........  30 Railroads.........  2 PTCSPs.............          16,000          32,000
    --Vital Overlay...............  30 Railroads.........  16 PTCSPs............          22,400         358,400
    --Stand Alone.................  30 Railroads.........  10 PTCSPs............          32,000         320,000
    --Mixed Systems--Conference     30 Railroads.........  3 conferences........              32              96
     with FRA regarding Case/
     Analysis.
    --Mixed Sys. PTCSPs (incl.      30 Railroads.........  2 PTCSPs.............          28,800          57,600
     safety case).
    --FRA Request for Additional    30 Railroads.........  15 documents.........           3,200          48,000
     PTCSP Data.
    --PTCSPs Applying to Replace    30 Railroads.........  15 PTCSPs............           3,200          48,000
     Existing Certified PTC
     Systems.
    --Non-Quantitative Risk         30 Railroads.........  15 assessments.......           3,200          48,000
     Assessments Supplied to FRA.
236.1017--PTCSP Supported by        30 Railroads.........  1 assessment.........           8,000           8,000
 Independent Third Party
 Assessment.
    --Written Requests to FRA to    30 Railroads.........  1 request............               8               8
     Confirm Entity Independence.
    --Provision of Additional       30 Railroads.........  1 document...........             160             160
     Information After FRA Request.
    --Independent Third Party       30 Railroads.........  1 request............             160             160
     Assessment: Waiver Requests.
    --RR Request for FRA to Accept  30 Railroads.........  1 request............              32              32
     Foreign Railroad Regulator
     Certified Info.
236.1019--Main Line Track
 Exceptions.
    --Submission of Main Line       30 Railroads.........  30 MTEAs.............             160           4,800
     Track Exclusion Addendums
     (MTEAs).
    --Passenger Terminal            30 Railroads.........  23 MTEAs.............             160           3,680
     Exception--MTEAs.
    --Limited Operation Exception-- 30 Railroads.........  30 plans.............             160           4,800
     Risk Mitigation Plans.
    --Temporal Separation           30 Railroads.........  15 procedures........             160           2,400
     Procedures.
236.1021--Discontinuances,          30 Railroads.........  15 RFAs..............              80           1,200
 Material Modifications,
 Amendments--Requests to Amend
 (RFA) PTCIP, PTCDP or PTCSP.
    --Review and Public Comment on  7 Interested Groups..  7 reviews + 20                  3; 16             341
     RFA.                                                   comments.
236.1023--PTC Errors and            30 Railroads.........  60 notifications.....              32           1,920
 Malfunctions--Notifications.
    --Notifications of PTC Defect   30 Railroads.........  150 notifications....              16           2,400
     That Decreases Safety.
    --Notification Updates of PTC   30 Railroads.........  150 updates..........              16           2,400
     Defect.
    --PTC Product Vendor Lists      30 Railroads.........  30 lists.............               8             240
     (PTCPVL).
    --RR Procedures Upon            30 Railroads.........  30 procedures........              16             480
     Notification of PTC System
     Safety-Critical Upgrades,
     Rev., Etc.
    --Manufacturer's Report of      5 System Suppliers...  5 reports............             400           2,000
     Investigation of PTC Defect.
236.1029--Report of On-Board Lead   30 Railroads.........  960 reports..........              96          92,160
 Locomotive PTC Device Failure.
236.1031--Previously Approved PTC
 Systems.
    --Request for Expedited         30 Railroads.........  3 REC Letters........             160             480
     Certification (REC) for PTC
     System.
    --Requests for Grandfathering   30 Railroads.........  3 requests...........           1,600           4,800
     on PTCSPs.
236.1035--Field Testing             30 railroads.........  150 field test plans.             800         120,000
 Requirements.
236.1037--Records Retention.
    --Results of Tests in PTCSP     30 railroads.........  960 records..........               4           3,840
     and PTCDP.
    --PTC Service Contractors       30 Railroads.........  9,000 records........          \1\ 30           4,500
     Training Records.
    --Reports of Safety Relevant    30 Railroads.........  4 reports............               8              32
     Hazards Exceeding Those in
     PTCSP and PTCDP.
    --Final Report of Resolution    30 Railroads.........  4 final reports......             160             640
     of Inconsistency.
236.1039--Operations & Maintenance  30 railroads.........  30 manuals...........             250           7,500
 Manual (OMM): Development.
    --Positive Identification of    30 railroads.........  75,000 i.d.                         1          75,000
     Safety-critical Components.                            components.
    --Designated RR Officers in     30 railroads.........  60 designations......               2             120
     OMM regarding PTC issues.

[[Page 36009]]

236.1041--PTC Training Programs...  30 Railroads.........  30 programs..........             400          12,000
236.1043--Task Analysis/Basic       30 railroads.........  6 evaluations........             720           4,320
 Requirements: Training
 Evaluations.
    --Training Records............  30 railroads.........  350 records..........          \1\ 10              58
236.1045--Training Specific to      30 railroads.........  20 trained employees.              20             400
 Office Control Personnel.
236.1047--Training Specific to
 Loc. Engineers & Other Operating
 Personnel.
    --PTC Conductor Training......  30 railroads.........  5,000 trained                       3         15,000
                                                            conductors.
----------------------------------------------------------------------------------------------------------------
\1\ In minutes.

All estimates include the time for reviewing instructions; searching 
existing data sources; gathering or maintaining the needed data; and 
reviewing the information. Pursuant to 44 U.S.C. 3506(c)(2)(B), FRA 
solicits comments concerning: Whether these information collection 
requirements are necessary for the proper performance of the functions 
of FRA, including whether the information has practical utility; the 
accuracy of FRA's estimates of the burden of the information collection 
requirements; the quality, utility, and clarity of the information to 
be collected; and whether the burden of collection of information on 
those who are to respond, including through the use of automated 
collection techniques or other forms of information technology, may be 
minimized. For information or a copy of the paperwork package submitted 
to OMB, contact Mr. Robert Brogan, Information Clearance Officer, at 
202-493-6292, or Ms. Nakia Jackson at 202-493-6073.
    Organizations and individuals desiring to submit comments on the 
collection of information requirements should direct them to Mr. Robert 
Brogan or Ms. Nakia Jackson, Federal Railroad Administration, 1200 New 
Jersey Avenue, SE., 3rd Floor, Washington, DC 20590. Comments may also 
be submitted via e-mail to Mr. Brogan or Ms. Jackson at the following 
address: robert.brogan@dot.gov; nakia.jackson@dot.gov.
    OMB is required to make a decision concerning the collection of 
information requirements contained in this proposed rule between 30 and 
60 days after publication of this document in the Federal Register. 
Therefore, a comment to OMB is best assured of having its full effect 
if OMB receives it within 30 days of publication. The final rule will 
respond to any OMB or public comments on the information collection 
requirements contained in this proposal.
    FRA is not authorized to impose a penalty on persons for violating 
information collection requirements which do not display a current OMB 
control number, if required. FRA intends to obtain current OMB control 
numbers for any new information collection requirements resulting from 
this rulemaking action prior to the effective date of the final rule. 
The OMB control number, when assigned, will be announced by separate 
notice in the Federal Register.

D. Federalism Implications

    This proposed rule has been analyzed in accordance with the 
principles and criteria contained in Executive Order 13132, 
``Federalism'' (64 FR 43255, Aug. 4, 1999).
    As discussed earlier in the preamble, this proposed rule would 
provide regulatory guidance and performance standards for the 
development, testing, implementation, and use of Positive Train Control 
(PTC) systems for railroads mandated by the Railroad Safety Improvement 
Act of 2008.
    Executive Order 13132 requires FRA to develop an accountable 
process to ensure ``meaningful and timely input by State and local 
officials in the development of regulatory policies that have 
Federalism implications.'' Policies that have ``Federalism 
implications'' are defined in the Executive Order to include 
regulations that have ``substantial direct effects on the States, on 
the relationship between the national government and the States, or on 
the distribution of power and responsibilities among the various levels 
of government.'' Under Executive Order 13132, the agency may not issue 
a regulation with Federalism implications that imposes substantial 
direct compliance costs and that is not required by statute, unless the 
Federal government provides the funds necessary to pay the direct 
compliance costs incurred by State and local governments, or the agency 
consults with State and local government officials early in the process 
of developing the proposed regulation. Where a regulation has 
Federalism implications and preempts State law, the agency seeks to 
consult with State and local officials in the process of developing the 
regulation.
    FRA has determined that this proposed rule would not have 
substantial direct effects on the States, on the relationship between 
the national government and the States, nor on the distribution of 
power and responsibilities among the various levels of government. In 
addition, FRA has determined that this proposed rule, which is required 
by the Railroad Safety Improvement Act of 2008, would not impose any 
direct compliance costs on State and local governments. Therefore, the 
consultation and funding requirements of Executive Order 13132 do not 
apply.
    However, this proposed rule would have preemptive effect. Section 
20106 of Title 49 of the United States Code provides that States may 
not adopt or continue in effect any law, regulation, or order related 
to railroad safety or security that covers the subject matter of a 
regulation prescribed or order issued by the Secretary of 
Transportation (with respect to railroad safety matters) or the 
Secretary of Homeland Security (with respect to railroad security 
matters), except when the State law, regulation, or order qualifies 
under the local safety or security exception to section 20106. The 
intent of Sec.  20106 is to promote national uniformity in railroad 
safety and security standards. 49 U.S.C. 20106(a)(1). Thus, subject to 
a limited exception for essentially local safety or security hazards, 
this proposed rule would establish a uniform Federal safety standard 
that must be met, and State requirements covering the same subject 
matter would be displaced, whether those State requirements are in the 
form of a State law, regulation, or order.
    In sum, FRA has analyzed this proposed rule in accordance with the 
principles and criteria contained in Executive Order 13132. As 
explained above, FRA has determined that this proposed rule has no 
Federalism implications, other than the preemption of State laws 
covering the subject matter

[[Page 36010]]

of this proposed rule, which occurs by operation of law under 49 U.S.C. 
20106 whenever FRA issues a rule or order. Accordingly, FRA has 
determined that preparation of a Federalism summary impact statement 
for this proposed rule is not required.

E. Environmental Impact

    FRA has evaluated this proposed rule in accordance with its 
``Procedures for Considering Environmental Impacts'' (``FRA's 
Procedures'') (64 FR 28545, May 26, 1999) as required by the National 
Environmental Policy Act (42 U.S.C. 4321 et seq.), other environmental 
statutes, Executive Orders, and related regulatory requirements. FRA 
has determined that this proposed rule is not a major FRA action 
(requiring the preparation of an environmental impact statement or 
environmental assessment) because it is categorically excluded from 
detailed environmental review pursuant to section 4(c)(20) of FRA's 
Procedures. In accordance with section 4(c) and (e) of FRA's 
Procedures, the agency has further concluded that no extraordinary 
circumstances exist with respect to this regulation that might trigger 
the need for a more detailed environmental review. As a result, FRA 
finds that this proposed rule is not a major Federal action 
significantly affecting the quality of the human environment.

F. Unfunded Mandates Reform Act of 1995

    The Unfunded Mandates Reform Act of 1995 (Pub. L. 104-4, 2 U.S.C. 
1531) requires agencies to prepare a written assessment of the costs, 
benefits, and other effects of proposed or final rules that include a 
Federal mandate likely to result in the expenditures by State, local or 
tribal governments, in the aggregate, or by the private sector, of more 
than $100 million annually (adjusted annually for inflation with base 
year of 1995). The value equivalent of $100 million in CY 195, adjusted 
annually for inflation to CY 2008 levels by the Consumer Price Index 
for All Urban Consumers (CPI-U) is $141.3 million. The assessment may 
be included in conjunction with other assessments, as it is here.
    The proposed rule itself would not create an unfunded mandate in 
excess of the threshold amount. The bulk of unfunded mandate for 
implementation of PTC is attributable to RSIA08. The effects are 
discussed earlier in this document in the Regulatory Impact Analysis. 
Any unfunded mandates attributable to the proposed rulemaking would 
pertain to the costs of filing paperwork to prove compliance with 
RSIA08.

G. Energy Impact

    Executive Order 13211 requires Federal agencies to prepare a 
Statement of Energy Effects for any ``significant energy action.'' 66 
FR 28355 (May 22, 2001). Under the Executive Order, a ``significant 
energy action'' is defined as any action by an agency (normally 
published in the Federal Register) that promulgates or is expected to 
lead to the promulgation of a final rule or regulation, including 
notices of inquiry, advance notices of proposed rulemaking, and notices 
of proposed rulemaking: (1)(i) That is a significant regulatory action 
under Executive Order 12866 or any successor order, and (ii) is likely 
to have a significant adverse effect on the supply, distribution, or 
use of energy; or (2) that is designated by the Administrator of the 
Office of Information and Regulatory Affairs as a significant energy 
action. FRA has evaluated this proposed rule in accordance with 
Executive Order 13211. FRA has determined that this proposed rule is 
not likely to have a significant adverse effect on the supply, 
distribution, or use of energy. Consequently, FRA has determined that 
this regulatory action is not a ``significant regulatory action'' 
within the meaning of Executive Order 13211.

H. Privacy Act

    FRA wishes to inform all interested parties that anyone is able to 
search the electronic form of any written communications and comments 
received into any of our dockets by the name of the individual 
submitting the document (or signing the document), if submitted on 
behalf of an association, business, labor union, etc.). Interested 
parties may also review DOT's complete Privacy Act Statement in the 
Federal Register published on April 11, 2000 (65 FR 19477) or visit 
http://www.regulations.gov.

List of Subjects

49 CFR Part 234

    Highway safety, Penalties, Railroad safety, Reporting and 
recordkeeping requirements.

49 CFR Part 235

    Administrative practice and procedure, Penalties, Railroad safety, 
Reporting and recordkeeping requirements.

49 CFR Part 236

    Penalties, Positive Train Control, Railroad safety, Reporting and 
recordkeeping requirements.

VIII. The Rule

    In consideration of the foregoing, FRA proposes to amend chapter 
II, subtitle B of title 49, Code of Federal Regulations as follows:

PART 229--[AMENDED]

    1. The authority citation for part 229 continues to read as 
follows:

    Authority:  49 U.S.C. 20102-03, 20107, 20133, 20137-38, 20143, 
20701-03, 21301-02, 21304; 28 U.S.C. 2401, note; and 49 CFR 1.49(c), 
(m).

    2. Section 229.135 is amended by revising paragraphs (b)(3)(xxv) 
and (b)(4)(xxi) to read as follows:

Sec.  229.135  Event Recorders.

* * * * *
    (b) * * *
    (3) * * *
    (xxv) Safety-critical train control data routed to the locomotive 
engineer's display with which the engineer is required to comply, 
specifically including text messages conveying mandatory directives and 
maximum authorized speed. The format, content, and proposed duration 
for retention of such data shall be specified in the product safety 
plan or PTC Safety Plan submitted for the train control system under 
subparts H or I, respectively, of part 236 of this chapter, subject to 
FRA approval under this paragraph. If it can be calibrated against 
other data required by this part, such train control data may, at the 
election of the railroad, be retained in a separate certified 
crashworthy memory module.
    (4) * * *
    (xxi) Safety-critical train control data routed to the locomotive 
engineer's display with which the engineer is required to comply, 
specifically including text messages conveying mandatory directives and 
maximum authorized speed. The format, content, and proposed duration 
for retention of such data shall be specified in the product safety 
plan or PTC Safety Plan submitted for the train control system under 
subparts H or I, respectively, of part 236 of this chapter, subject to 
FRA approval under this paragraph. If it can be calibrated against 
other data required by this part, such train control data may, at the 
election of the railroad, be retained in a separate certified 
crashworthy memory module.

PART 234--[AMENDED]

    3. The authority citation for part 234 continues to read as 
follows:

    Authority:  49 U.S.C. 20103, 20107; 28 U.S.C. 2461, note; and 49 
CFR 1.49.

[[Page 36011]]

    4. In Sec.  234.275 revise paragraphs (b)(1), (b)(2), (c), and (f) 
to read as follows:

Sec.  234.275  Processor-based systems.

* * * * *
    (b) Use of performance standard authorized or required. (1) In lieu 
of compliance with the requirements of this subpart, a railroad may 
elect to qualify an existing processor-based product under part 236, 
subparts H or I, of this chapter.
    (2) Highway-rail grade crossing warning systems, subsystems, or 
components that are processor-based and that are first placed in 
service after June 6, 2005, which contain new or novel technology, or 
which provide safety-critical data to a railroad signal or train 
control system that is governed by part 236, subpart H or I, of this 
chapter, shall also comply with those requirements. New or novel 
technology refers to a technology not previously recognized for use as 
of March 7, 2005.
* * * * *
    (c) Plan justifications. The Product Safety Plan in accordance with 
49 CFR 236.903--or a PTC Development Plan (PTCDP) and PTC Safety Plan 
(PTCSP) required to be filed in accordance with 49 CFR 236.1011 and 
236.1013--must explain how the performance objective sought to be 
addressed by each of the particular requiremnts of this subpart is met 
by the product, why the objective is not relevant to the product's 
design, or how the safety requirements are satisfied using alternative 
means. Deviation from those particular requirements is authorized if an 
adequate explanation is provided, making reference to relevant elements 
of the applicable plan, and if the product satisfies the performance 
standard set forth in Sec.  236.909 of this chapter. (See Sec.  
236.907(a)(14) of this chapter.)
* * * * *
    (f) Software management control for certain systems not subject to 
a performance standard. Any processor-based system, subsystem, or 
component subject to this part, which is not subject to the 
requirements of part 236, subpart H or I, of this chapter but which 
provides safety-critical data to a signal or train control system shall 
be included in the software management control plan requirements as 
specified in Sec.  236.18 of this chapter.

PART 235--[AMENDED]

    5. The authority citation for part 235 continues to read as 
follows:

    Authority:  49 U.S.C. 20103, 20107; 28 U.S.C. 2461, note; and 49 
CFR 1.49.

    6. In Sec.  235.7, add paragraph (a)(5) to read as follows:

Sec.  235.7  Changes not requiring filing of application.

    (a) * * *
    (5) Removal of an intermittent automatic train stop system in 
conjunction with the implementation of a positive train control system 
approved by FRA under subpart I of part 236.
* * * * *

PART 236--[AMENDED]

    7. The authority citation for Part 236 is revised to read as 
follows:

    Authority:  49 U.S.C. 20102-20103, 20107, 20133, 20141, 20157, 
20301-20303, 20306, 21301-21302, 21304; 28 U.S.C. 2461, note; and 49 
CFR 1.49.
* * * * *
    8. Section 236.0 is amended by revising paragraphs (c) through (e) 
to read as follows:

Sec.  236.0  Applicability, minimum requirements, and penalties.

* * * * *
    (c)(1) Prior to [insert date 24 months from publication of the 
final rule in the Federal Register], where a passenger train operates 
at a speed of 60 or more miles per hour, or a freight train operates at 
a speed of 50 or more miles per hour--
    (i) A block signal system complying with the provisions of this 
part shall be installed; or
    (ii) A manual block system shall be placed permanently in effect 
that shall conform to the following conditions:
    (A) A train shall not be admitted, except for emergency purposes, 
to a block occupied by another train unless both trains are operating 
at restricted speed.
    (B) A freight train, including a work train, may be authorized to 
follow a freight train, including a work train, into a block but the 
following train must proceed at restricted speed.
    (2) On and after [insert date 24 months from publication of the 
final rule in the Federal Register], where a passenger train is 
permitted to operate at a speed of 60 or more miles per hour, or a 
freight train is permitted to operate at a speed of 50 or more miles 
per hour, a block signal system complying with the provisions of this 
part shall be installed, unless an FRA approved PTC system meeting the 
requirements of this part for the subject speed and other operating 
conditions, is installed.
    (d)(1) Prior to December 31, 2015, where any train is permitted to 
operate at a speed of 80 or more miles per hour, an automatic cab 
signal, automatic train stop, or automatic train control system 
complying with the provisions of this part shall be installed, unless 
an FRA approved PTC system meeting the requirements of this part for 
the subject speed and other operating conditions, is installed.
    (2) Subpart I of this part sets forth requirements for installation 
of PTC systems under conditions specified in that subpart.
    (e) Nothing in this section authorizes the discontinuance of a 
block signal system, interlocking, traffic control system, automatic 
train control or train stop system, cab signal system, or PTC system 
without approval by the FRA under part 235 of this title. However, a 
railroad may apply for approval of discontinuance or material 
modification of a signal or train control system in connection with a 
request for approval of a Positive Train Control Development Plan 
(PTCDP) or Positive Train Control Safety Plan (PTCSP) as provided in 
subpart I of this part.
* * * * *
    9. Section 236.909 is amended by adding a new sentence directly 
after the first sentence of paragraph (e)(1) and by revising paragraph 
(e)(2)(i) to read as follows:

Sec.  236.909  Minimum performance standards.

* * * * *
    (e) * * *
    (1) * * * The total risk assessment must have a supporting 
sensitivity analysis. The analysis must confirm that the risk metrics 
of the system are not negatively affected by sensitivity analysis input 
parameters including, for example, component failure rates, human 
factor error rates, and variations in train traffic affecting exposure. 
The sensitivity analysis must document the sensitivity to worst case 
failure scenarios. * * *
    (2) * * *
    (i) In all cases exposure must be expressed as total train miles 
traveled per year over the relevant railroad infrastructure. 
Consequences must identify the total cost, including fatalities, 
injuries, property damage, and other incidental costs, such as 
potential consequences of hazardous materials involvement, resulting 
from preventable accidents associated with the function(s) performed by 
the system.
* * * * *
    10. Add a new subpart I to part 236 to read as follows:
Subpart I--Positive Train Control Systems
Sec.
236.1001 Purpose and scope.
236.1003 Definitions.

[[Page 36012]]

236.1005 Requirements for Positive Train Control systems.
236.1006 Equipping locomotives operating in PTC territory.
236.1007 Additional requirements for high-speed service.
236.1009 Procedural requirements.
236.1011 PTCIP content requirements.
236.1013 PTCDP content requirements and Type Approval.
236.1015 PTCSP content requirements and PTC System Certification.
236.1017 Independent third party Verification and Validation.
236.1019 Main line track exceptions.
236.1021 Discontinuances, material modifications, and amendments.
236.1023 Errors and malfunctions.
236.1027 Exclusions.
236.1029 PTC system use and en route failures.
236.1031 Previously approved PTC systems
236.1033 Communications and security requirements.
236.1035 Field testing requirements.
236.1037 Records retention.
236.1039 Operations and Maintenance Manual.
236.1041 Training and qualification program, general.
236.1043 Task analysis and basic requirements.
236.1045 Training specific to office control personnel.
236.1047 Training specific to locomotive engineers and other 
operating personnel.
236.1049 Training specific to roadway workers.

Subpart I--Positive Train Control Systems

Sec.  236.1001  Purpose and scope.

    (a) This subpart prescribes minimum, performance-based safety 
standards for PTC systems required by 49 U.S.C. 20157, this subpart, or 
an FRA order including requirements to ensure that the development, 
functionality, architecture, installation, implementation, inspection, 
testing, operation, maintenance, repair, and modification of those PTC 
systems will achieve and maintain an acceptable level of safety. This 
subpart also prescribes standards to ensure that personnel working 
with, and affected by, safety-critical PTC system related products 
receive appropriate training and testing.
    (b) Each railroad may prescribe additional or more stringent rules, 
and other special instructions, that are not inconsistent with this 
subpart.
    (c) This subpart does not exempt a railroad from compliance with 
any requirement of subpart A through H of this part or parts 233, 234, 
and 235 of this chapter, unless:
    (1) it is otherwise explicitly excepted by this subpart; or
    (2) the applicable PTCSP, as defined under Sec.  236.1003 and 
approved by FRA under Sec.  236.1015 provides for such an exception per 
Sec.  236.1013.

Sec.  236.1003  Definitions.

    (a) Definitions contained in subparts G and H of this part apply 
equally to this subpart.
    (b) The following definitions apply to terms used only in this 
subpart unless otherwise stated:
    After-arrival mandatory directive means any mandatory directive 
that makes the authority for train movement contingent upon the arrival 
of another train.
    Associate Administrator means the FRA Associate Administrator for 
Railroad Safety and Chief Safety Officer.
    Class I railroad means a railroad which in the last year for which 
revenues were reported exceeded the threshold established under 
regulations of the Surface Transportation Board (49 CFR part 1201.1-1 
(2008)).
    Cleartext means the un-encrypted text in its original, human 
readable, form. It is the input of an encryption or encipher process, 
and the output of an decryption or decipher process.
    Host railroad means a railroad that has effective operating control 
over a segment of track.
    Interoperability means the ability of a controlling locomotive to 
communicate with and respond to the PTC railroad's positive train 
control system, including uninterrupted movements over property 
boundaries.
    Limited operations means operations on main line track that have 
limited or no freight operations and are approved to be excepted from 
this subpart's PTC system implementation and operation requirements in 
accordance with Sec.  236.1019(c);
    Main line means, except as provided in Sec.  236.1019 or where all 
trains are limited to restricted speed within a yard or terminal area 
or on auxiliary or industry tracks, a segment or route of railroad 
tracks:
    (1) of a Class I railroad, as documented in current timetables 
filed by the Class I railroad with the FRA under Sec.  217.7 of this 
title, over which 5,000,000 or more gross tons of railroad traffic is 
transported annually; or
    (2) used for regularly scheduled intercity or commuter passenger 
service, as defined in 49 U.S.C. 24102, or both. Tourist, scenic, 
historic, or excursion operations as defined in part 238 of this 
chapter are not considered intercity or commuter passenger service for 
purposes of this part.
    Main line track exclusion addendum (``MTEA'') means the document 
submitted under Sec. Sec.  236.1011 and 236.1019 requesting to 
designate track as other than main line.
    PTC means positive train control as further described in Sec.  
236.1005.
    PTCDP means a PTC Development Plan as further described in Sec.  
236.1013.
    PTCIP means a PTC Implementation Plan as required under 49 U.S.C. 
20157 and further described in Sec.  236.1011.
    PTC railroad means each Class I railroad and each entity providing 
regularly scheduled intercity or commuter rail passenger transportation 
required to implement or operate a PTC system.
    PTCSP means a PTC Safety Plan as further described in Sec.  
236.1015.
    PTCPVL means a PTC Product Vendor List as further described in 
Sec.  236.1023.
    PTC System Certification means certification as required under 49 
U.S.C. 20157 and further described in Sec. Sec.  236.1009 and 236.1015.
    Request for Amendment (``RFA'') means a request for an amendment of 
a plan or system made by a PTC railroad in accordance with Sec.  
236.1021.
    Request for Expedited Certification (``REC'') means, as further 
described in Sec.  236.1031, a request by a railroad to receive 
expedited consideration for PTC System Certification.
    Restricted speed means, Speed, restricted, as defined in subpart G 
of this part.
    Safe State means a system configuration that cannot cause harm when 
the system fails.
    Segment of track means any part of the railroad where a train 
operates.
    Temporal separation means the process or processes in place to 
assure that limited passenger and freight operations do not operate on 
any segment of shared track during the same period and as further 
defined under Sec.  236.1019.
    Tenant railroad means a railroad, other than a host railroad, 
operating on track upon which a PTC system is required.
    Track segment means segment of track.
    Type Approval means a number assigned to a particular PTC system 
indicating FRA agreement that the PTC system could fulfill the 
requirements of this subpart.
    Train means one or more locomotives, coupled with or without cars.

Sec.  236.1005  Requirements for Positive Train Control systems.

    (a) PTC system requirements. Each PTC system required to be 
installed under this subpart shall:
    (1) Reliably and functionally prevent:
    (i) Train-to-train collisions--including collisions between trains 
operating over at-grade crossings of rail lines--where the risk 
associated with such collisions

[[Page 36013]]

is unacceptable in accordance with the following table or alternative 
arrangements providing an equivalent level of safety as specified in an 
FRA approved PTCSP:

----------------------------------------------------------------------------------------------------------------
            Crossing type                    Max speed *                       Protection required
----------------------------------------------------------------------------------------------------------------
Interlocking--one or more PTC routes   <=40 miles per hour....  Interlocking signal arrangement in accordance
 intersecting with one or more non-                              with the requirements of subparts A-G of this
 PTC routes.                                                     part and PTC enforced stop on PTC routes.
Interlocking--one or more PTC routes   >40 miles per hour.....  Interlocking signal arrangement in accordance
 intersecting with one or more non-                              with the requirements of subparts A-G of this
 PTC routes.                                                     part, PTC enforced stop on all PTC routes, and
                                                                 either the use of other than full PTC
                                                                 technology that provides positive stop
                                                                 enforcement or a split-point derail
                                                                 incorporated into the signal system accompanied
                                                                 by 20 miles per hour maximum allowable speed on
                                                                 the approach of any intersecting non-PTC route.
Interlocking--all PTC routes           Any speed..............  Interlocking signal arrangements in accordance
 intersecting.                                                   with the requirements of subparts A-G of this
                                                                 part, and PTC enforced stop on all routes.
----------------------------------------------------------------------------------------------------------------

     (ii) Overspeed derailments, including derailments related to 
railroad civil engineering speed restrictions, slow orders, and 
excessive speeds over switches and through turnouts;
    (iii) Incursions into established work zone limits without first 
receiving appropriate authority and verification from the dispatcher or 
roadway worker in charge, as applicable and in accordance with part 214 
of this chapter; and
    (iv) The movement of a train through a main line switch in the 
improper position as further described in paragraph (e) of this 
section.
    (2) Include safety-critical integration of all authorities and 
indications of a wayside or cab signal system, or other similar 
appliance, method, device, or system of equivalent safety, in a manner 
by which the PTC system shall provide associated warning and 
enforcement to the extent, and except as, described and justified in 
the FRA approved PTCDP or PTCSP, as applicable;
    (3) As applicable, perform the additional functions specified in 
this subpart;
    (4) Provide an appropriate warning or enforcement when:
    (i) A derail or switch protecting access to the main line required 
by Sec.  236.1007, or otherwise provided for in the applicable PTCSP, 
is not in its derailing or protecting position, respectively;
    (ii) An operational restriction is issued associated with a 
highway-rail grade crossing warning system malfunction as required by 
Sec. Sec.  234.105, 234.106, or 234.107;
    (iii) An after-arrival mandatory directive has been issued and the 
train or trains to be waited on has not yet passed the location of the 
receiving train;
    (iv) Any movable bridge within the route ahead is not in a position 
to allow permissive indication for a train movement pursuant to Sec.  
236.312; and
    (v) A hazard detector integrated into the PTC system that is 
required by paragraph (c) of this section, or otherwise provided for in 
the applicable PTCSP, detects an unsafe condition or transmits an 
alarm; and
    (5) Limit the speed of passenger and freight trains to 59 miles per 
hour and 49 miles per hour, respectively, in areas without broken rail 
detection or equivalent safeguards.
    (b) PTC system installation. (1) After December 31, 2015, a PTC 
system certified under Sec.  236.1015 shall be installed by the host 
railroad on each:
    (i) Main line over which is transported any quantity of poison- or 
toxic-by-inhalation (PIH) hazardous materials, as defined in Sec. Sec.  
171.8, 173.115 and 173.132 of this title;
    (ii) Main line used for regularly provided intercity or commuter 
passenger service, except as provided in Sec.  236.1019; and
    (iii) Additional line of railroad as required by the applicable 
FRA-approved PTCSP, this subpart, or an FRA order requiring 
installation of a PTC system.
    (2) For the purposes of paragraph (b)(1)(i) of this section, the 
information necessary to determine whether a Class I railroad's track 
segment shall be equipped with a PTC system shall be determined and 
reported as follows:
    (i) The traffic density threshold of 5 million gross tons shall be 
based upon calendar year 2008 gross tonnage.
    (ii) The presence or absence of any quantity of PIH hazardous 
materials shall be determined by whether one or more cars containing 
such product(s) was transported over the line segment in calendar year 
2008.
    (3) To the extent increases in freight rail traffic occur 
subsequent to calendar year 2008 that might affect the requirement to 
install a PTC system on any line not yet equipped, the railroad shall 
seek to amend its PTCIP by promptly filing an RFA in accordance with 
Sec.  236.1021. The following criteria apply:
    (i) To the extent rail traffic exceeds 5 million gross tons in any 
year after 2008, the tonnage shall be calculated for the preceding two 
calendar years in determining whether a PTCIP or its amendment is 
required.
    (ii) To the extent PIH traffic is carried on a line segment as a 
result of a request for rail service or rerouting warranted under part 
172 of this title, and if the line carries in excess of 5 million gross 
tons of rail traffic as determined under this paragraph. This does not 
apply when temporary rerouting is authorized in accordance with 
paragraph (g) of this section.
    (iii) Once a railroad is notified by FRA that its RFA filed in 
accordance with this paragraph has been approved, the railroad shall 
equip the line with the applicable PTC system by December 31, 2015, or 
within 24 months, whichever is later.
    (4) If a railroad has filed, and FRA has approved, its initial 
PTCIP, a railroad may file an RFA to request review of the requirement 
to install PTC on a line segment where a PTC system is required, but 
has not yet been installed, based upon changes in rail traffic such as 
reductions in total traffic volume or cessation of local PIH service. 
Any such RFA shall be accompanied by estimated traffic projections for 
the next 5 years (e.g., as a result of planned rerouting, 
coordinations, location of new business on the line). Where the request 
involves prior or planned rerouting of PIH traffic, the railroad must 
provide a supporting analysis that takes into consideration the 
requirements of subpart I, part 172 of this title, including any 
railroad-specific and interline routing impacts. FRA may approve the 
RFA if FRA finds that it would be consistent with safety and in the 
public interest.
    (5) After December 31, 2015, no intercity or commuter rail 
passenger service shall continue or commence

[[Page 36014]]

until a PTC system certified under this subpart has been installed and 
made operative.
    (c) Hazard detectors. (1) All hazard detectors integrated into a 
signal or train control system on or after October 16, 2008, shall be 
integrated into PTC systems required by this subpart; and their 
warnings shall be appropriately and timely enforced as described in the 
applicable PTCSP.
    (2) The applicable PTCSP may provide for receipt and presentation 
to the locomotive engineer and other train crew of warnings from 
additional hazard detectors using the PTC data network, onboard 
displays, and audible alerts. If the PTCSP so provides, the action to 
be taken by the system and by the crew members shall be specified.
    (3) The PTCDP (as applicable) and PTCSP for any service described 
in Sec.  236.1007 to be conducted above 90 miles per hour shall include 
a hazard analysis describing the hazards relevant to the specific 
route(s) in question (e.g., potential for track obstruction due to 
events such as falling rock or undermining of the track structure due 
to high water or displacement of a bridge over navigable waters), the 
basis for decisions concerning hazard detectors provided, and the 
manner in which such additional hazard detectors will be interfaced 
with the PTC system.
    (d) Event recorders. (1) Each lead locomotive, as defined in part 
229, of a train equipped and operating with a PTC system required by 
this subpart must be equipped with an operative event recorder, which 
shall:
    (i) Record safety-critical train control data routed to the 
locomotive engineer's display that the engineer is required to comply 
with;
    (ii) Specifically include text messages conveying mandatory 
directives and maximum authorized speeds; and
    (iii) Include the display format, content, and data retention 
duration requirements specified in the PTC safety plan submitted and 
approved pursuant to this paragraph. If such train control data can be 
calibrated against other data required by this part, it may, at the 
election of the railroad, be retained in a separate memory module.
    (2) Each lead locomotive, as defined in part 229, manufactured and 
in service after October 1, 2009, that is equipped and operating with a 
PTC system required by this subpart, shall be equipped with an event 
recorder memory module meeting the crash hardening requirements of 
Sec.  229.135 of this chapter.
    (3) Nothing in this subpart excepts compliance with any of the 
event recorder requirements contained in Sec.  229.135 of this chapter.
    (e) Switch position. The following requirements apply with respect 
to determining proper switch position under this section. When a main 
line switch position is unknown or improperly aligned for a train's 
route in advance of the train's movement, the PTC system will provide 
warning of the condition associated with the following enforcement:
    (1) A PTC system must enforce restricted speed over any switch:
    (i) Where train movements are made with the benefit of the 
indications of a wayside or cab signal system or other similar 
appliance, method, device, or system of equivalent safety proposed to 
FRA and approved by the Associate Administrator in accordance with this 
part; and
    (ii) Where wayside or cab signal system or other similar appliance, 
method, device, or system of equivalent safety requires the train to be 
operated at restricted speed.
    (2) A PTC system must enforce a positive stop short of any main 
line switch, and any switch on a siding where the allowable speed is in 
excess of 20 miles per hour, if movement of the train over the switch:
    (i) Is made without the benefit of the indications of a wayside or 
cab signal system or other similar appliance, method, device, or system 
of equivalent safety proposed to FRA and approved by the Associate 
Administrator in accordance with this part; or
    (ii) Would create an unacceptable risk. Unacceptable risk includes 
conditions when traversing the switch, even at low speeds, could result 
in direct conflict with the movement of another train (including a 
hand-operated crossover between main tracks, a hand-operated crossover 
between a main track and an adjoining siding or auxiliary track, or a 
hand-operated switch providing access to another subdivision or branch 
line, etc.).
    (3) A PTC system required by this subpart shall be designed, 
installed, and maintained to perform the switch position detection and 
enforcement described in paragraphs (e)(1) and (e)(2) of this section, 
except as provided for and justified in the applicable, FRA-approved 
PTCDP or PTCSP.
    (4) The control circuit or electronic equivalent for any movement 
authorities over any switches, movable-point frogs, or derails shall be 
selected through circuit controller or functionally equivalent device 
operated directly by switch points, derail, or by switch locking 
mechanism, or through relay or electronic device controlled by such 
circuit controller or functionally equivalent device, for each switch, 
movable-point frog, or derail in the route governed. Circuits or 
electronic equivalent shall be arranged so that any movement 
authorities can only be provided when each switch, movable-point frog, 
or derail in the route governed is in proper position, and shall be in 
accordance with subparts A through G of this part unless it is 
otherwise provided in a PTCSP approved under this subpart.
    (f) Train-to-train collision. A PTC system shall be considered to 
be configured to prevent train-to-train collisions within the meaning 
of paragraph (a) of this section if trains are required to be operated 
at restricted speed and if the onboard PTC equipment enforces the upper 
limits of the railroad's restricted speed rule (15 or 20 miles per 
hour). This application applies to:
    (1) Operating conditions under which trains are required by signal 
indication or operating rule to:
    (i) Stop before continuing; or
    (ii) Reduce speed to restricted speed and continue at restricted 
speed until encountering a more favorable indication or as provided by 
operating rule.
    (2) Operation of trains within the limits of a joint mandatory 
directive.
    (g) Temporary rerouting. A train equipped with a PTC system as 
required by this subpart may be temporarily rerouted onto a track not 
equipped with a PTC system and a train not equipped with a PTC system 
may be temporarily rerouted onto a track equipped with a PTC system as 
required by this subpart in the following circumstances:
    (1) Emergencies. In the event of an emergency--including conditions 
such as derailment, flood, fire, tornado, hurricane, or other similar 
circumstance outside of the railroad's control--that would prevent 
usage of the regularly used track if:
    (i) The rerouting is applicable only until the emergency condition 
ceases to exist and for no more than 14 consecutive calendar days, 
unless otherwise extended by approval of the Associate Administrator;
    (ii) The railroad provides written or telephonic notification to 
the applicable Regional Administrator of the information listed in 
paragraph (i) within one business day of the beginning of the rerouting 
made in accordance with this paragraph; and
    (iii) The conditions under paragraph (j) are followed.
    (2) Planned maintenance. In the event of planned maintenance that 
would

[[Page 36015]]

prevent usage of the regularly used track if:
    (i) The maintenance period does not exceed 30 days;
    (ii) A request is filed with the applicable Regional Administrator 
in accordance with paragraph (i) of this section no less than 10 
business days prior to the planned rerouting; and
    (iii) the conditions contained in paragraph (j) of this section are 
followed.
    (h) Rerouting requests. (1) For the purposes of paragraph (g)(2) of 
this section, the rerouting request shall be self-executing unless the 
applicable Regional Administrator responds with a notice disapproving 
of the rerouting or providing instructions to allow rerouting. Such 
instructions may include providing additional information to the 
Regional Administrator or Associate Administrator prior to the 
commencement of rerouting. Once the Regional Administrator responds 
with a notice under this paragraph, no rerouting may occur until the 
Regional Administrator or Associate Administrator provides his or her 
approval.
    (2) In the event the temporary rerouting described in paragraph 
(g)(2) of this section is to exceed 30 consecutive calendar days:
    (i) The railroad shall provide a request in accordance with 
paragraphs (i) and (j) of this section with the Associate Administrator 
no less than 10 business days prior to the planned rerouting; and
    (ii) The rerouting contemplated by this paragraph shall not 
commence until receipt of approval from the Associate Administrator.
    (i) Content of rerouting request. Each notice or request referenced 
in paragraph (g) of this section must indicate:
    (1) The dates that such temporary rerouting will occur;
    (2) The number and types of trains that will be rerouted;
    (3) The location of the affected tracks; and
    (4) A description of the necessity for the temporary rerouting.
    (j) Rerouting conditions. Rerouting of operations under paragraph 
(g) of this section may only occur if:
    (1) An absolute block is established in advance of each rerouted 
train movement; and
    (2) Each rerouted train movement shall not exceed 59 miles per hour 
for passenger and 49 miles per hour for freight.
    (k) Rerouting cessation. The applicable Regional Administrator may 
order a railroad to cease any rerouting provided under paragraph (g) or 
(h) of this section.

Sec.  236.1006  Equipping locomotives operating in PTC territory.

    (a) Except as provided in paragraph (b) of this section, each train 
operating on any track segment equipped with a PTC system shall be 
controlled by a locomotive equipped with an on-board PTC apparatus that 
is fully operative and functioning in accordance with the applicable 
PTCSP approved under this subpart.
    (b) Exceptions. (1) Prior to December 31, 2015, each train 
controlled by a locomotive not equipped with an onboard PTC apparatus 
is permitted to operate.
    (2) Prior to December 31, 2013, each train controlled by a 
locomotive equipped with an onboard PTC apparatus that is not fully 
operative is permitted only if:
    (i) The subject locomotive failed initialization at the point of 
origin for the train or at the location where the locomotive was added 
to the train;
    (ii) The railroad has included in its FRA approved PTC 
Implementation Plan a system for identifying PTC system reliability 
exceptions and responding with appropriate remedial actions, the 
railroad executes that plan, and the documentation for execution of the 
plan is currently available to FRA upon request; and
    (iii) The percentage of controlling locomotives operating out of 
each railroad's initial terminals after receiving a failed 
initialization and over a track segment equipped with a PTC system, 
does not during each calendar month exceed:
    (A) 20 percent until December 31, 2011;
    (B) 15 percent from the end of the period in paragraph (A) to 
December 31, 2012; and
    (C) 10 percent from the end of the period in paragraph (B) to 
December 31, 2013.
    (3) A train controlled by a locomotive with an onboard PTC 
apparatus that has failed en route is permitted to operate in 
accordance with Sec.  236.1029.
    (4) A train operated by a Class II or Class III railroad, including 
a tourist or excursion railroad, and controlled by a locomotive not 
equipped with an onboard PTC apparatus is permitted to operate on a PTC 
operated track segment:
    (i) That either:
    (A) Has no regularly scheduled intercity or passenger rail 
passenger transportation traffic; or
    (B) Has regularly scheduled intercity or passenger rail passenger 
transportation traffic and the applicable PTCIP permits the operation 
of a train operated by a Class II or III railroad and controlled by a 
locomotive not equipped with an onboard PTC apparatus;
    (ii) Where operations are restricted to less than four such 
unequipped trains per day, whereas a train conducting a ``turn'' 
operation (e.g., moving to a point of interchange to drop off or pick 
up cars and returning to the track owned by a Class II or III railroad) 
is considered two trains for this purpose; and
    (iii) Where each movement shall either:
    (A) Not exceed 20 miles in length; or
    (B) To the extent any movement exceeds 20 miles in length, such 
movement is not permitted without the controlling locomotive being 
equipped with an onboard PTC system after December 31, 2020, and each 
applicable Class II or III railroad shall report to FRA its progress in 
equipping each necessary locomotive with an onboard PTC apparatus to 
facilitate continuation of the movement. The progress reports shall be 
filed not later than December 31, 2017 and, if all necessary 
locomotives are not yet equipped, on December 31, 2019.
    (c) When a train movement is conducted under the exceptions 
described in paragraph (b)(4) of this section, that movement shall be 
made in accordance with Sec.  236.1029.

Sec.  236.1007  Additional requirements for high-speed service.

    (a) A PTC railroad that conducts a passenger operation at or 
greater than 60 miles per hour or a freight operation at or greater 
than 50 miles per hour shall have installed a PTC system including or 
working in concert with technology that includes all of the safety-
critical functional attributes of a block signal system meeting the 
requirements of this part, including appropriate fouling circuits and 
broken rail detection (or equivalent safeguards).
    (b) In addition to the requirements of paragraph (a), a host 
railroad that conducts a freight or passenger operation at more than 90 
miles per hour shall:
    (1) Have an approved PTCSP establishing that the system was 
designed and will be operated to meet the failsafe operation criteria 
described in Appendix C to this part; and
    (2) Prevent unauthorized or unintended entry onto the main line 
from any track not equipped with a PTC system compliant with this 
subpart by placement of split-point derails or equivalent means 
integrated into the PTC system; and
    (3) Comply with Sec.  236.1029(c).

[[Page 36016]]

    (c) In addition to the requirements of paragraphs (a) and (b), a 
host railroad that conducts a freight or passenger operation at more 
than 125 miles per hour shall have an approved PTCSP accompanied by a 
document (``HSR-125'') establishing that the system:
    (1) Will be operated at a level of safety comparable to that 
achieved over the 5-year period prior to the submission of the PTCSP by 
other train control systems that perform PTC functions required by this 
subpart, and which have been utilized on high-speed rail systems with 
similar technical and operational characteristics in the United States 
or in foreign service, provided that the use of foreign service data 
must be approved by the Associate Administrator before submittal of the 
PTCSP; and
    (2) Has been designed to detect incursions into the right-of-way, 
including incidents involving motor vehicles diverting from adjacent 
roads and bridges, where conditions warrant.
    (d) In addition to the requirements of paragraphs (a) through (c) 
of this section, a host railroad that conducts a freight or passenger 
operation at more than 150 miles per hour, which is governed by a Rule 
of Particular Applicability, shall have an approved PTCSP accompanied 
by a HSR-125 developed as part of an overall system safety plan 
approved by the Associate Administrator.

Sec.  236.1009  Procedural requirements.

    (a) PTC Implementation Plan (PTCIP). (1) By April 16, 2010, each 
host railroad that is required to implement and operate a PTC system in 
accordance with Sec.  236.1005(b) shall develop and submit in 
accordance with Sec.  236.1011(a) a PTCIP for implementing a PTC system 
required under Sec.  236.1005. Filing of the PTCIP shall not exempt the 
required filings of a PTCSP, PTCDP, or Type Approval.
    (2) After April 16, 2010, a host railroad shall file:
    (i) A PTCIP if it becomes a host railroad of a main line track; or
    (ii) A request for amendment (``RFA'') of its current and approved 
PTCIP in accordance with Sec.  236.1021 if it intends to:
    (A) Initiate a new category of service (i.e., passenger or 
freight); or
    (B) Add, subtract, or otherwise materially modify one or more lines 
of railroad for which installation of a PTC system is required.
    (3) If the host railroad is a freight railroad, and the subject 
trackage would require installation and operation of a PTC system in 
accordance with Sec. Sec.  236.1005(b)(2) or (b)(3), then a PTCIP 
required to be filed in accordance with this paragraph (a)(1) or (a)(2) 
of this section must be jointly filed with each entity providing 
regularly scheduled intercity or commuter rail passenger transportation 
over that subject trackage. If railroads are unable to jointly file a 
PTCIP in accordance with paragraphs (a)(1) and (a)(3) of this section, 
then they each shall:
    (i) Separately file a PTCIP in accordance with paragraph (a)(1);
    (ii) Notify the Associate Administrator that the subject railroads 
were unable to agree on a PTCIP to be jointly filed;
    (iii) Provide the Associate Administrator with a comprehensive list 
of all issues not in agreement between the railroads that would prevent 
the subject railroads from jointly filing the PTCIP; and
    (iv) Confer with the Associate Administrator to develop and submit 
a PTCIP mutually acceptable to all subject railroads.
    (b) Type Approval. A host railroad, or one or more system suppliers 
and one or more host railroads, shall file prior to or simultaneously 
with the filing made in accordance with paragraph (a) of this section:
    (1) An unmodified Type Approval previously issued by the Associate 
Administrator in accordance with Sec.  236.1013 or Sec.  236.1031(b) 
with its associated docket number;
    (2) A PTCDP requesting a Type Approval for:
    (i) A PTC system that does not have a Type Approval; or
    (ii) A PTC system with a previously issued Type Approval that 
requires one or more variances;
    (3) A PTCSP subject to the conditions set forth in paragraph (c) of 
this section, with or without a Type Approval; or
    (4) A document attesting that a Type Approval is not necessary 
since the host railroad has no territory for which a PTC system is 
required under this subpart.
    (c) PTCSP and PTC System Certification. The following apply to each 
PTCSP and PTC System Certification.
    (1) A PTC System Certification for a PTC system may be obtained by 
submitting an acceptable PTCSP. If the PTC system is the subject of a 
Type Approval, the safety case elements contained in the PTCDP may be 
incorporated by reference into the PTCSP, subject to finalization of 
the human factors analysis contained in the PTCDP.
    (2) Each PTCSP requirement under Sec.  236.1015 shall be supported 
by information and analysis sufficient to establish that the 
requirements of this subpart have been satisfied.
    (3) If the Associate Administrator finds that the PTCSP and 
supporting documentation support a finding that the system complies 
with this part, the Associate Administrator may approve the PTCSP. If 
the Associate Administrator approves the PTCSP, the railroad shall 
receive PTC System Certification for the subject PTC system and shall 
implement the PTC system according to the PTCSP.
    (4) A required PTC system shall not:
    (i) Be used in service until it receives from FRA a PTC System 
Certification; and
    (ii) Receive a PTC System Certification unless FRA receives and 
approves an applicable:
    (A) PTCIP and PTCSP; or
    (B) Request for Expedited Certification (REC) as defined by Sec.  
236.1031(a).
    (d) Plan contents. (1) No PTCIP shall receive approval unless it 
complies with Sec.  236.1011. No railroad shall receive a Type Approval 
or PTC System Certification unless the applicable PTCDP or PTCSP, 
respectively, comply with Sec. Sec.  236.1013 and 236.1015, 
respectively.
    (2) All materials filed in accordance with this subpart must be in 
the English language, or have been translated into English and attested 
as true and correct.
    (3) Each filing referenced in this section may include a request 
for full or partial confidentiality in accordance with Sec.  209.11 of 
this chapter. If confidentiality is requested as to a portion of any 
applicable document, then in addition to the filing requirements under 
Sec.  209.11 of this chapter, the person filing the document shall also 
file a copy of the original unredacted document, marked to indicate 
which portions are redacted in the document's confidential version 
without obscuring the original document's contents.
    (e) Supporting documentation and information. (1) Issuance of a 
Type Approval or PTC System Certification is contingent upon FRA's 
confidence in the implementation and operation of the subject PTC 
system. This confidence may be based on FRA-monitored field testing or 
an independent assessment performed in accordance with Sec.  236.1035 
or Sec.  236.1017, respectively.
    (2) Upon request by FRA, the railroad requesting a Type Approval or 
PTC System Certification must engage in field testing or independent 
assessment performed in accordance with Sec.  236.1035 or Sec.  
236.1017, respectively, to support the assertions made in any of the 
plans submitted under this subpart. These assertions include any of the

[[Page 36017]]

plans' content requirements under this subpart.
    (f) FRA conditions, reconsiderations, and modifications. (1) As 
necessary to ensure safety, FRA may attach special conditions to 
approving a PTCIP or issuing a Type Approval or PTC System 
Certification.
    (2) After granting a Type Approval or PTC System Certification, FRA 
may reconsider the Type Approval or PTC System Certification upon 
revelation of any of the following factors concerning the contents of 
the PTCIP, PTCDP or PTCSP:
    (i) Potential error or fraud;
    (ii) Potentially invalidated assumptions determined as a result of 
in-service experience or one or more unsafe events calling into 
question the safety analysis supporting the approval.
    (3) During FRA's reconsideration in accordance with this paragraph, 
the PTC system may remain in use if otherwise consistent with the 
applicable law and regulations and FRA may impose special conditions 
for use of the PTC system.
    (4) After FRA's reconsideration in accordance with this paragraph, 
FRA may:
    (i) Dismiss its reconsideration and continue to recognize the 
existing FRA approved Type Approval;
    (ii) Allow continued operations under such conditions the Associate 
Administrator deems necessary to ensure safety; or
    (iii) Revoke the Type Approval or PTC System Certification and 
direct the railroad to cease operations where PTC systems are required 
under this subpart.
    (g) FRA access. The Associate Administrator, or that person's 
designated representatives, shall be afforded reasonable access to 
monitor, test, and inspect processes, procedures, facilities, 
documents, records, design and testing materials, artifacts, training 
materials and programs, and any other information used in the design, 
development, manufacture, test, implementation, and operation of the 
system, as well as interview any personnel:
    (1) Associated with a PTC system for which a Type Approval or PTC 
System Certification has been requested or provided; or
    (2) To determine whether a railroad has been in compliance with 
this subpart.
    (h) Foreign regulatory entity verification. Information that has 
been certified under the auspices of a foreign regulatory entity 
recognized by the Associate Administrator may, at the Associate 
Administrator's sole discretion, be accepted as independently Verified 
and Validated and used to support each railroad's development of the 
PTCSP.

Sec.  236.1011  PTCIP content requirements.

    (a) Contents. A PTCIP filed pursuant to this subpart shall, at a 
minimum, describe:
    (1) The technology that will be employed;
    (2) How the PTC railroad intends to comply with Sec.  236.1009(c);
    (3) How the PTC system will provide for interoperability of the 
system between the host and all tenant railroads on the lines required 
to be equipped with PTC systems under this subpart and:
    (i) Include copies of relevant provisions of any agreements, 
executed by all applicable railroads, in place to achieve 
interoperability;
    (ii) List all technologies used to obtain interoperability; and
    (iii) Identify any railroads with respect to which interoperability 
agreements or compatible technology have not been achieved as of the 
time the plan is filed, the practical obstacles that were encountered 
that prevented resolution, and the further steps planned to overcome 
those obstacles;
    (4) How, to the extent practical, the PTC system will be 
implemented to address areas of greater risk to the public and railroad 
employees before areas of lesser risk;
    (5) The sequence and schedule in which line segments will be 
equipped and the basis for those decisions, and shall at a minimum 
address the following risk factors by line segment:
    (i) Segment traffic characteristics such as typical annual 
passenger and freight train volume and volume of poison- or toxic-by-
inhalation (PIH or TIH) shipments (loads, residue);
    (ii) Segment operational characteristics such as current method of 
operation (including presence or absence of a block signal system), 
number of tracks, and maximum allowable train speeds, including planned 
modifications; and
    (iii) Route attributes bearing on risk, including ruling grades and 
extreme curvature;
    (6) The following information relating to rolling stock:
    (i) What rolling stock will be equipped with PTC technology;
    (ii) The schedule to equip that rolling stock by December 31, 2015; 
and
    (iii) Unless the tenant railroad is filing its own PTCIP, the host 
railroad's PTCIP shall:
    (A) Attest that the host railroad has made a formal written request 
to each tenant railroad requesting identification of each rolling stock 
to be PTC system equipped and the date each will be equipped; and
    (B) Include each tenant railroad's response to the host railroad's 
written request made in accordance with paragraph (a)(6)(iii)(A) of 
this section;
    (7) The number of wayside devices required for each line segment 
and the installation schedule to complete wayside equipment 
installation by December 31, 2015;
    (8) which track segments the railroad considers mainline and non-
mainline track. If the PTCIP includes a MTEA, as defined by Sec.  
236.1019, the PTCIP should identify the tracks included in the MTEA as 
main line track with a reference to the MTEA; and
    (9) to the extent the railroad determines that risk-based 
prioritization required by paragraph (a)(4) of this section is not 
practical, the basis for this determination; and
    (b) Additional Class I railroad PTCIP requirements. Each Class I 
railroad shall include:
    (1) In its PTCIP a strategy for full deployment of its PTC system, 
describing the criteria that it will apply in identifying additional 
rail lines on its own network, and rail lines of entities that it 
controls or engages in joint operations with, for which full or partial 
deployment of PTC technologies is appropriate, beyond those required to 
be equipped under this subpart. Such criteria shall include 
consideration of the policies established by 49 U.S.C. 20156 (railroad 
safety risk reduction program), and regulations issued thereunder, as 
well as non-safety business benefits that may accrue.
    (2) In the Technology Implementation Plan of its Risk Reduction 
Program, when first required to be filed in accordance with 49 U.S.C. 
20156 and any regulation promulgated thereunder, a specification of 
rail lines selected for full or partial deployment of PTC under the 
criteria identified in its PTCIP.
    (3) Nothing in this paragraph shall be construed to create an 
expectation or requirement than additional rail lines beyond those 
required to be equipped by this subpart must be equipped or that such 
lines will be equipped during the period of primary implementation 
ending December 31, 2015.
    (4) As used in this paragraph, ``partial implementation'' of a PTC 
system refers to use, pursuant to subpart H of this part, of technology 
embedded in PTC systems that does not employ all of the functionalities 
required by this subpart.
    (c) FRA review. Within 90 days of receipt of a PTCIP, the Associate 
Administrator will approve or disapprove of the plan and notify in

[[Page 36018]]

writing the affected railroad or other entity. If the PTCIP is not 
approved, the notification will include the plan's deficiencies. Within 
30 days of receipt of that notification, the railroad or other entity 
that submitted the plan shall correct all deficiencies and resubmit the 
plan in accordance with Sec.  236.1009 and paragraph (a) of this 
section, as applicable.
    (d) Subpart H. A railroad that elects to install a PTC system when 
not required to do so may elect to proceed under this subpart or under 
subpart H.
    (e) Upon receipt of a PTCIP, PTCDP, or PTCSP, FRA posts on its 
public Web site notice of receipt and reference to the public docket in 
which a copy of the filing has been placed. FRA may consider any public 
comment on each document to the extent practicable within the time 
allowed by law and without delaying implementation of PTC systems.

Sec.  236.1013  PTCDP content requirements and Type Approval.

    (a) For a PTC system to obtain a Type Approval from FRA, the PTCDP 
shall be filed in accordance with Sec.  236.1009 and shall include:
    (1) A complete description of the PTC system, including a list of 
all PTC system components and their physical relationships in the 
subsystem or system;
    (2) A description of the railroad operation or categories of 
operations on which the PTC system is designed to be used, including 
train movement density (passenger, freight), operating speeds, track 
characteristics, and railroad operating rules;
    (3) An operational concepts document, including a list with 
complete descriptions of all functions which the PTC system will 
perform to enhance or preserve safety;
    (4) A document describing the manner in which the PTC architecture 
satisfies safety requirements;
    (5) A description of the safety assurance concepts that are to be 
used for system development, including an explanation of the design 
principles and assumptions;
    (6) A preliminary human factors analysis, including a complete 
description of all human-machine interfaces and the impact of 
interoperability requirements on the same;
    (7) An analysis of the applicability to the PTC system of the 
requirements of subparts A-G of this part that may no longer apply or 
are satisfied by the PTC system using an alternative method, and a 
complete explanation of the manner in which those requirements are 
otherwise fulfilled;
    (8) A description of the necessary security measures for the 
system;
    (9) A description of target safety levels (e.g., MTTHE for major 
subsystems as defined in subpart H), including requirements for system 
availability and a description of all backup methods of operation and 
any critical assumptions associated with the target levels;
    (10) A complete description of how the PTC system will enforce 
authorities and signal indications;
    (11) A description of the deviation required under Sec.  
236.1029(c), if applicable; and
    (12) A complete description of how the PTC system will appropriate 
and timely enforce all integrated hazard detectors in accordance with 
Sec.  236.1005(c)(3), if applicable.
    (b) If the Associate Administrator finds that the system described 
in the PTCDP would satisfy the requirements for PTC systems under this 
subpart and that the applicant has made a reasonable showing that a 
system built to the stated requirements would achieve the level of 
safety mandated for such a system under Sec.  236.1015, the Associate 
Administrator may grant a numbered Type Approval for the system.
    (c) Each Type Approval shall be valid for a period of 5 years, 
subject to automatic and indefinite extension provided that at least 
one PTC System Certification using the subject PTC system has been 
issued within that period and not revoked.
    (d) A PTCSP submitted under this subpart may reference and utilize 
in accordance with this subpart any Type Approval previously issued by 
the Associate Administrator to any railroad, provided that the 
railroad:
    (1) Maintains a continually updated PTCPVL pursuant to Sec.  
236.1023; and
    (2) Provides the applicable licensing information.
    (e) A railroad submitting a PTCDP under this subpart must show that 
the supplier from which they are procuring the PTC system has 
established and can maintain a quality control system for PTC system 
design and manufacturing acceptable to the Associate Administrator.
    (f) The Associate Administrator may prescribe special conditions, 
amendments, and restrictions to any Type Approval as necessary for 
safety.

Sec.  236.1015  PTCSP content requirements and PTC System 
Certification.

    (a) Before placing a PTC system required under this part in 
service, the host railroad must submit to FRA a PTCSP and receive a PTC 
System Certification. If the Associate Administrator finds that the 
PTCSP and supporting documentation support a finding that the system 
complies with this part, the Associate Administrator approves the PTCSP 
and issues a PTC System Certification. Receipt of a PTC System 
Certification affirms that the PTC system has been reviewed and 
approved by FRA in accordance with, and meets the requirements of, this 
part.
    (b) A PTCSP submitted in accordance with this subpart shall:
    (1) Include the applicable FRA approved PTCIP and, if applicable, 
the PTCDP and Type Approval;
    (2)(i) Specifically and rigorously document each variance, 
including the significance of each variance between the PTC system and 
its applicable operating conditions as described in the applicable 
PTCIP and any applicable PTCDP from that as described in the PTCSP, and 
attest that are no other such variances; or
    (ii) Attest that there are no variances between the PTC system and 
its applicable operating conditions as described in the applicable 
PTCIP and any applicable PTCDP from that as described in the PTCSP; and
    (3) Attest that the system was otherwise built in accordance with 
the applicable PTCDP and PTCSP and achieves the level of safety 
represented therein.
    (c) A PTCSP shall include the same information required for a PTCDP 
under Sec.  236.1013(a). If a PTCDP has been filed and approved prior 
to filing of the PTCSP, PTCSP may incorporate the PTCDP by reference, 
with the exception that a final human factors analysis shall be 
provided. The PTCSP shall contain the following additional elements:
    (1) A hazard log consisting of a comprehensive description of all 
safety-relevant hazards not previously addressed by the vendor to be 
addressed during the life cycle of the PTC system, including maximum 
threshold limits for each hazard (for unidentified hazards, the 
threshold shall be exceeded at one occurrence);
    (2) A risk assessment of the as-built PTC system described;
    (3) A hazard mitigation analysis, including a complete and 
comprehensive description of each hazard and the mitigation techniques 
used;
    (4) A complete description of the safety assessment and 
Verification and Validation processes applied to the PTC system, their 
results, and whether these processes address the safety principles 
described in Appendix C to this part directly, using other safety 
criteria, or not at all;

[[Page 36019]]

    (5) A complete description of the railroad's training plan for 
railroad and contractor employees and supervisors necessary to ensure 
safe and proper installation, implementation, operation, maintenance, 
repair, inspection, testing, and modification of the PTC system;
    (6) A complete description of the specific procedures and test 
equipment necessary to ensure the safe and proper installation, 
implementation, operation, maintenance, repair, inspection, testing, 
and modification of the PTC system on the railroad and establish 
safety-critical hazards are appropriately mitigated. These procedures, 
including calibration requirements, shall be consistent with or explain 
deviations from the equipment manufacturer's recommendations;
    (7) A complete description of any additional warning to be placed 
in the Operations and Maintenance Manual in the same manner specified 
in Sec.  236.919 and all warning labels to be placed on equipment as 
necessary to ensure safety;
    (8) A complete description of the configuration or revision control 
measures designed to ensure that the railroad or its contractor does 
not adversely affect the safety-functional requirements and that 
safety-critical hazard mitigation processes are not compromised as a 
result of any such change;
    (9) A complete description of all initial implementation testing 
procedures necessary to establish that safety-functional requirements 
are met and safety-critical hazards are appropriately mitigated;
    (10) A complete description of all post-implementation testing 
(validation) and monitoring procedures, including the intervals 
necessary to establish that safety-functional requirements, safety-
critical hazard mitigation processes, and safety-critical tolerances 
are not compromised over time, through use, or after maintenance 
(adjustment, repair, or replacement) is performed;
    (11) A complete description of each record necessary to ensure the 
safety of the system that is associated with periodic maintenance, 
inspections, tests, adjustments, repairs, or replacements, and the 
system's resulting conditions, including records of component failures 
resulting in safety-relevant hazards (see Sec.  236.1033);
    (12) A safety analysis to determine whether, when the system is in 
operation, any risk remains of an unintended incursion into a roadway 
work zone due to human error. If the analysis reveals any such risk, 
the PTCDP and PTCSP shall describe how that risk will be mitigated;
    (13) A more detailed description of any alternative arrangements as 
already provided under Sec.  236.1011(a)(10);
    (14) A complete description of how the PTC system will enforce 
authorities and signal indications, unless already completely provided 
for in the PTCDP;
    (15) A description of how the PTCSP complies with Sec.  
236.1019(e), if applicable;
    (16) A description of the deviation required under Sec.  
236.1029(c), if applicable and unless already completely provided for 
in the PTCDP;
    (17) A complete description of how the PTC system will appropriate 
and timely enforce all integrated hazard detectors in accordance with 
Sec.  236.1005;
    (18) An emergency and planned maintenance temporary rerouting plan 
indicating how operations on the subject PTC system will take advantage 
of the benefits provided under Sec.  236.1005(g)-(k); and
    (19) Any alternative arrangements for each rail at-grade crossing 
not adhering to the table under Sec.  236.1005(a)(1)(i).
    (d) The following additional requirements apply to:
    (1) Non-vital overlay. A PTC system proposed as an overlay on the 
existing method of operation and not built in accordance with the 
safety assurance principles set forth in Appendix C of this part must, 
to the satisfaction of the Associate Administrator, be shown to:
    (i) Reliably execute the functions set forth in Sec.  236.1005;
    (ii) Obtain at least 80 percent reduction of the risk associated 
with accidents preventable by the functions set forth in Sec.  
236.1005, when all effects of the change associated with the PTC system 
are taken into account. The supporting risk assessment shall evaluate 
all intended changes in railroad operations coincident with the 
introduction of the new system; and
    (iii) Maintain a level of safety for each subsequent system 
modification that is equal to or greater than the level of safety for 
the previous PTC systems.
    (2) Vital overlay. A PTC system proposed on a newly constructed 
track or as an overlay on the existing method of operation and is built 
in accordance with the safety assurance principles set forth in 
Appendix C of this part must, to the satisfaction of the Associate 
Administrator, be shown to:
    (i) Reliably execute the functions set forth in Sec.  236.1005; and
    (ii) Have sufficient documentation to demonstrate that the PTC 
system, as built, fulfills the safety assurance principles set forth in 
Appendix C of this part. The supporting risk assessment may be 
abbreviated as that term is used in subpart H of this part.
    (3) Stand-alone. A PTC system proposed on a newly constructed 
track, an existing track for which no signal system exists, as a 
replacement for an existing signal or train control system, or to 
otherwise intend to replace or materially modify the existing method of 
operation, shall:
    (i) Demonstrate to reliably execute the functions required by Sec.  
236.1005; and
    (ii) Have a PTCSP establishing, with a high degree of confidence, 
that the system will not introduce new hazards that have not been 
mitigated. The supporting risk assessment shall evaluate all intended 
changes in railroad operations in relation to the introduction of the 
new system and shall examine in detail the direct and indirect effects 
of all changes in the method of operations.
    (4) Mixed systems. If a PTC system combining overlay, stand-alone, 
vital, or non-vital characteristics is proposed, the railroad shall 
confer with the Associate Administrator regarding appropriate 
structuring of the safety case and analysis.
    (e) When determining whether the PTCSP fulfills the requirements 
under paragraph (d) of this section, the Associate Administrator may 
consider all available evidence concerning the reliability and 
availability of the proposed system and any and all safety consequences 
of the proposed changes. In any case where the PTCSP lacks data 
regarding safety impacts of the proposed changes, the Associate 
Administrator may request the necessary data from the applicant. If the 
requested data is not provided, the Associate Administrator may find 
that potential hazards could or will arise.
    (f) If a PTCSP applies to a system designed to replace an existing 
certified PTC system, the PTCSP will be approved provided that the 
PTCSP establishes with a high degree of confidence that the new system 
will provide a level of safety not less than the level of safety 
provided by the system to be replaced.
    (g) When reviewing the issue of the potential data errors (for 
example, errors arising from data supplied from other business systems 
needed to execute the braking algorithm, survey data needed for 
location determination, or mandatory directives issued through the 
computer-aided dispatching system), the PTCSP must include a careful 
identification of each of the risks and a discussion of each applicable 
mitigation. In an appropriate case, such as a case in which the 
residual risk after mitigation is substantial or the underlying method 
of operation will be significantly altered, the Associate

[[Page 36020]]

Administrator may require submission of a quantitative risk assessment 
addressing these potential errors.

Sec.  236.1017  Independent third party Verification and Validation.

    (a) The PTCSP must be supported by an independent third-party 
assessment when the Associate Administrator concludes that it is 
necessary based upon the same criteria set forth in Sec.  236.913 of 
this chapter, with the exception that consideration of the methodology 
used in the risk assessment (Sec.  236.913(g)(2)(vii)) shall apply only 
to the extent that a comparative risk assessment was required. To the 
extent practicable, FRA makes this determination not later than review 
of the PTCIP and the accompanying PTCDP or PTCSP. If an independent 
assessment is required, the assessment may apply to the entire system 
or a designated portion of the system.
    (b) If a PTC system is to undergo an independent assessment in 
accordance with this section, it may submit to the Associate 
Administrator a written request that FRA confirm whether a particular 
entity would be considered an independent third party pursuant to this 
section. The request should include supporting information in 
accordance with paragraph (c) of this section. FRA may request further 
information to make a determination or provide its determination in 
writing.
    (c) As used in this section, ``independent third party'' means a 
technically competent entity responsible to and compensated by the 
railroad (or an association on behalf of one or more railroads) that is 
independent of the PTC system supplier and vendor. An entity that is 
owned or controlled by the supplier or vendor, that is under common 
ownership or control with the supplier or vendor, or that is otherwise 
involved in the development of the PTC system is not considered 
``independent'' within the meaning of this section.
    (d) The independent third party assessment must, at a minimum, 
consist of the activities and result in the production of documentation 
meeting the requirements of Appendix F to this part, unless excepted by 
this part or by FRA order or waiver.
    (e) Information provided that has been certified under the auspices 
of a foreign railroad regulatory entity recognized by the Associate 
Administrator may, at the Associate Administrator's discretion, be 
accepted as having been independently verified.

Sec.  236.1019  Main line track exceptions.

    (a) Scope and procedure. This section pertains exclusively to 
exceptions from the rule that trackage over which scheduled intercity 
and commuter passenger service is provided is considered main line 
track requiring installation of a PTC system. One or more intercity or 
commuter passenger railroads, or freight railroads conducting joint 
passenger and freight operation over the same segment of track may file 
a main line track exclusion addendum (``MTEA'') to its PTCIP requesting 
to designate track as not main line subject to the condition that such 
trackage may not be trackage otherwise required to be equipped (e.g., 
because of tonnage and PIH traffic) and to the further conditions set 
forth in paragraphs (b) and (c) of this section. No track shall be 
designated as yard or terminal unless it is identified in a MTEA that 
is part of an FRA approved PTCIP.
    (b) Passenger terminal exception. FRA will consider an exception in 
the case of trackage used exclusively as yard or terminal tracks by or 
in support of regularly scheduled intercity or commuter passenger 
service where the MTEA describes in detail the physical boundaries of 
the trackage in question, its use and characteristics (including track 
and signal charts) and all of the following apply:
    (1) The maximum authorized speed for all movements is not greater 
than 20 miles per hour, and that maximum is enforced by any available 
onboard PTC equipment within the confines of the yard or terminal;
    (2) Interlocking rules are in effect prohibiting reverse movements 
other than on signal indications without dispatcher permission; and
    (3) No freight operations are permitted.
    (c) Limited operations exception. FRA will consider an exception in 
the case of trackage used for limited operations by at least one 
passenger railroad subject to at least one of the following conditions:
    (1) All trains are limited to restricted speed;
    (2) Temporal separation of passenger and other trains is maintained 
as provided in paragraph (d) of this section; or
    (3) Passenger service is operated under a risk mitigation plan 
submitted by all railroads involved in the joint operation and approved 
by FRA. The risk mitigation plan must be supported by a risk assessment 
establishing that the proposed mitigations will achieve a level of 
safety not less than the level of safety that would obtain if the 
operations were conducted under paragraph (c)(1) or (c)(2) of this 
section.
    (d) Temporal separation. As used in this section, temporal 
separation means the processes or physical arrangements, or both, in 
place to assure that limited passenger and freight operations do not 
operate on any segment of shared track during the same period. The use 
of exclusive authorities under mandatory directives is not, by itself, 
sufficient to establish that temporal separation is achieved. 
Procedures to ensure temporal separation shall include verification 
checks between passenger and freight and effective physical means to 
positively ensure segregation of passenger and freight operations in 
accordance with this paragraph.
    (e) PTCSP requirement. No PTCSP filed after the approval of a PTCIP 
with an MTEA shall be approved by FRA unless it attests that no 
changes, except for those included in a FRA approved RFA, have been 
made to the information in the PTCIP and MTEA required by paragraph (b) 
or (c) of this section.
    (f) Designation modifications. If subsequent to approval of its 
PTCIP or PTCSP the railroad seeks to modify which track or tracks 
should be designated as main line or not main line, it shall request 
modification of its PTCIP or PTCSP, as applicable, in accordance with 
Sec.  236.1021.

Sec.  236.1021  Discontinuances, material modifications, and 
amendments.

    (a) No changes, as defined by this section, to a PTC system, PTCIP, 
PTCDP, or PTCSP, shall be made unless:
    (1) The railroad files a request for amendment (``RFA'') to the 
applicable PTCIP, PTCDP, or PTCSP with the Associate Administrator; and
    (2) The Associate Administrator approves the RFA.
    (b) After approval of a RFA in accordance with paragraph (a) of 
this section, the railroad shall immediately adopt and comply with the 
amendment.
    (c) In lieu of a separate filing under part 235 of this chapter, a 
railroad may request approval of a discontinuance or material 
modification of a signal or train control system by filing a RFA to its 
PTCIP, PTCDP, or PTCSP with the Associate Administrator.
    (d) A RFA made in accordance with this section will not be approved 
by FRA unless the request includes:
    (1) The information listed in Sec.  235.10 of this chapter and the 
railroad provides FRA upon request any additional information necessary 
to evaluate the RFA (see Sec.  235.12), including:
    (2) The proposed modifications;
    (3) The reasons for each modification;
    (4) The changes to the PTCIP, PTCDP or PTCSP, as applicable;

[[Page 36021]]

    (5) Each modification's effect on PTC system safety;
    (6) An approximate timetable for filing of the PTCDP, PTCSP, or 
both, if the amendment pertains to a PTCIP; and
    (7) An explanation of whether each change to the PTCSP is planned 
or unplanned.
    (A) Unplanned changes that affect the Type Approval's PTCDP require 
submission and approval in accordance with Sec.  236.1013 of a new 
PTCDP, followed by submission and approval in accordance with Sec.  
236.1015 of a new PTCSP for the PTC system.
    (B) Unplanned changes that do not affect the Type Approval's PTCDP 
require submission and approval of a new PTCSP.
    (C) Unplanned changes are changes affecting system safety that have 
not been documented in the PTCSP. The impact of unplanned changes on 
PTC system safety has not yet been determined.
    (D) Planned changes may be implemented after they have undergone 
suitable regression testing to demonstrate, to the satisfaction of the 
Associate Administrator, they have been correctly implemented and their 
implementation does not degrade safety.
    (E) Planned changes are changes affecting system safety in the 
PTCSP and have been included in all required analysis under Sec.  
236.1017. The impact of these changes on the PTC system's safety has 
been incorporated as an integral part of the approved PTCSP safety 
analysis.
    (e) If the RFA includes a request for approval of a discontinuance 
or material modification of a signal or train control system, FRA will 
publish a notice in the Federal Register of the application and will 
invite public comment in accordance with part 211 of this chapter.
    (f) When considering the RFA, FRA will review the issue of the 
discontinuance or material modification and determine whether granting 
the request is in the public interest and consistent with railroad 
safety, taking into consideration all changes in the method of 
operation and system functionalities, both within normal PTC system 
availability and in the case of a system failed state (unavailable), 
contemplated in conjunction with installation of the PTC system. The 
railroad submitting the RFA must, at FRA's request, perform field 
testing in accordance with Sec.  236.1035 or engage in Verification and 
Validation in accordance with Sec.  236.1017.
    (g) FRA may issue at its discretion a new Type Approval number for 
a PTC system modified under this section.
    (h) Changes requiring filing of an RFA. Except as provided by 
paragraph (i), an RFA shall be filed to request the following:
    (1) Discontinuance of a PTC system, or other similar appliance or 
device;
    (2) Decrease of the PTC system's limits;
    (3) Modification of a safety critical element of a PTC system; or
    (4) Modification of a PTC system that affects the safety critical 
functionality of any other PTC system with which it interoperates.
    (i) Discontinuances not requiring the filing of an RFA. It is not 
necessary to file an RFA for the following discontinuances:
    (1) Removal of a PTC system from track approved for abandonment by 
formal proceeding;
    (2) Removal of PTC devices used to provide protection against 
unusual contingencies such as landslide, burned bridge, high water, 
high and wide load, or tunnel protection when the unusual contingency 
no longer exists;
    (3) Removal of the PTC devices that are used on a movable bridge 
that has been permanently closed by the formal approval of another 
government agency and is mechanically secured in the closed position 
for rail traffic; or
    (4) Removal of the PTC system from service for a period not to 
exceed six months that is necessitated by catastrophic occurrence such 
as derailment, flood, fire, or hurricane.
    (j) Changes not requiring the filing of an RFA. When the resultant 
change to the PTC system will comply with an approved PTCSP of this 
part, it is not necessary to file for approval to decrease the limits 
of a system when it involves the:
    (1) Decrease of the limits of a PTC system when interlocked 
switches, derails, or movable-point frogs are not involved;
    (2) Removal of an electric or mechanical lock from hand-operated 
switch in a PTC system where train speed over switch does not exceed 20 
miles per hour; or
    (3) Removal of an electric lock from hand-operated switch in a PTC 
system where trains are not permitted to clear the main track at such 
switch and the electric lock has not been a part of the conditional 
approval of a PTCSP.
    (k) Modifications not requiring the filing of an RFA. When the 
resultant arrangement will comply with an approved PTCSP of this part, 
it is not necessary to file an application for approval of the 
following modifications:
    (1) A modification that is required to comply with an order of the 
Federal Railroad Administration or any section of part 236 of this 
title;
    (2) Installation of devices used to provide protection against 
unusual contingencies such as landslide, burned bridges, high water, 
high and wide loads, or dragging equipment;
    (3) Elimination of existing track other than a second main track;
    (4) Extension or shortening of a passing siding;
    (5) A line relocation;
    (6) Installation of new track; or
    (7) The temporary or permanent arrangement of existing systems 
necessitated by highway rail separation construction. Temporary 
arrangements shall be removed within six months following completion of 
construction.

Sec.  236.1023  Errors and malfunctions.

    (a) Except as provided in paragraph (g) of this section, when any 
PTC system, subsystem, component, product, or process fails, 
malfunctions, or otherwise experiences a defect that decreases, or 
eliminates, any safety functionality, its vendor--regardless of whether 
any railroad has indicated whether it experienced the same--shall 
notify FRA and the affected railroads of the following:
    (1) The nature and specificity of the failure, malfunction, or 
defect;
    (2) The vendor's procedures for responding to the issue until the 
failure, malfunction, or defect is cured;
    (3) Any corrective action required;
    (4) The risk mitigation actions to be taken pending resolution of 
the failure cause and issuance of the corrective action; and
    (5) The estimated time to correct the failure.
    (b) Any railroad implementing or operating a PTC system, subsystem, 
component, product, or process that fails, malfunctions, or otherwise 
experiences a defect that decreases, or eliminates, any safety or 
interoperability functionality, shall:
    (1) Notify the applicable vendor and FRA of the failure, 
malfunction, or defect that decreased or eliminated the safety 
functionality; and
    (2) Keep the applicable vendor and FRA apprised on a continual 
basis of the status of any and all subsequent failures.
    (c) Each railroad implementing a PTC system on its property shall 
maintain a PTC Product Vendor List (PTCPVL) continually updated to 
include all vendors of each PTC system, subsystem, component, product, 
and process currently used in its PTC system. The PTCPVL shall be made 
available to FRA upon request and without undue delay.
    (d) The railroad shall specify to FRA--and the applicable vendor if

[[Page 36022]]

appropriate--its procedures for action upon notification of a safety 
critical upgrade, patch, or revision for the PTC system, subsystem, 
component, product, or process, and until the revision has been 
installed.
    (e) Each notification required by this section shall:
    (1) Be made within 7 days after the vendor or railroad discovers 
the failure, malfunction, or defect. However, a report that is due on a 
Saturday or a Sunday may be delivered on the following Monday and one 
that is due on a holiday may be delivered on the next workday;
    (2) Be transmitted in a manner and form acceptable to the Associate 
Administrator and by the most expeditious method available; and
    (3) Include as much available and applicable information as 
possible, including:
    (i) PTC system name and model;
    (ii) Identification of the part, component, or system involved. The 
identification must include the part number;
    (iii) Nature of the failure, malfunctions, or defects;
    (iv) Mitigation to ensure the safety of the crews and public; and
    (v) The estimated time to correct the failure.
    (f) Whenever any investigation of an accident or service difficulty 
report shows that an article is unsafe because of a manufacturing or 
design defect, the manufacturer shall, upon request of the Associate 
Administrator, report to the Associate Administrator the results of its 
investigation and any action taken or proposed by the manufacturer to 
correct that defect.
    (g) The requirements of this section do not apply to failures, 
malfunctions, or defects that:
    (1) Are caused by improper maintenance or improper usage; or
    (2) Have been previously identified to the FRA, vendor, and 
applicable railroads.
    (h) Any railroad experiencing a failure of a system resulting in a 
more favorable aspect than intended or another condition hazardous to 
movement of a train shall comply with the reporting requirements, 
including the making of a telephonic report of an accident or incident 
under part 233 of this chapter. Filing of one or more reports under 
part 233 of this chapter does not exempt a railroad or vendor from the 
reporting requirements contained in paragraphs (a) through (e) of this 
section.

Sec.  236.1027  Exclusions.

    (a) The requirements of this subpart apply to each office 
automation system that performs safety-critical functions within, or 
affects the safety performance of, the PTC system. For purposes of this 
section, ``office automation system'' means any centralized or 
distributed computer-based system that directly or indirectly controls 
the active movement of trains in a rail network.
    (b) Changes or modifications to PTC systems otherwise excluded from 
the requirements of this subpart by this section do not exclude those 
PTC systems from the requirements of this subpart if the changes or 
modifications result in a degradation of safety or a material decrease 
in safety-critical functionality.
    (c) Primary train control systems cannot be integrated with 
locomotive electronic systems unless the complete integrated systems:
    (1) Have been shown to be designed on fail safe principles;
    (2) Have demonstrated to operate in a fail safe mode;
    (3) Have a manual fail safe fallback and override to allow the 
locomotive to be brought to a safe stop in the event of any loss of 
electronic control; and
    (4) Are included in the approved and applicable PTCDP and PTCSP.
    (d) PTC systems excluded by this section from the requirements of 
this subpart remain subject to subparts A through H of this part as 
applicable.

Sec.  236.1029  PTC system use and en route failures.

    (a) When any safety-critical PTC system component fails to perform 
its intended function, the cause must be determined and the faulty 
component adjusted, repaired, or replaced without undue delay. Until 
repair of such essential components are completed, a railroad shall 
take appropriate action as specified in its PTCSP.
    (b) Where a PTC onboard apparatus on a lead locomotive that is 
operating in or is to be operated within a PTC system fails or is 
otherwise cut-out while en route (i.e., after the train has departed 
it's initial terminal), the train may only continue in accordance with 
the following:
    (1) The train may proceed at restricted speed, or if a block signal 
system is in operation according to signal indication at medium speed, 
to the next available point where communication of a report can be made 
to a designated railroad officer of the host railroad;
    (2) Upon completion and communication of the report required in 
paragraph (b)(1) of this section, or where immediate electronic report 
of said condition is appropriately provided by the PTC system itself, a 
train may continue to a point where an absolute block can be 
established in advance of the train in accordance with the following:
    (i) Where no block signal system is in use, the train may proceed 
at restricted speed, or
    (ii) Where a block signal system is in operation according to 
signal indication, the train may proceed at a speed not to exceed 
medium speed.
    (3) Upon reaching the location where an absolute block has been 
established in advance of the train, as referenced in paragraph (b)(2) 
of this section, the train may proceed in accordance with the 
following:
    (i) Where no block signal system is in use, the train may proceed 
at medium speed; however, if the involved train is a passenger train or 
a train hauling any amount of PIH material, it may only proceed at a 
speed not to exceed 30 miles per hour.
    (ii) Where a block signal system is in use, a passenger train may 
proceed at a speed not to exceed 59 miles per hour and a freight train 
may proceed at a speed not to exceed 49 miles per hour.
    (iii) Except as provided in paragraph (c), where a cab signal 
system with an automatic train control system is in operation, the 
train may proceed at a speed not to exceed 79 miles per hour.
    (c) In order for a PTC train that operates at a speed above 90 
miles per hour to deviate from the operating limitations contained in 
paragraph (b) of this section, the deviation must be described and 
justified in the FRA approved PTCDP or PTCSP, or the Order of 
Particular Applicability, as applicable.
    (d) Each railroad shall comply with all provisions in the 
applicable PTCDP and PTCSP for each PTC system it uses and shall 
operate within the scope of initial operational assumptions and 
predefined changes identified.
    (e) The normal functioning of any safety-critical PTC system must 
not be interfered with in testing or otherwise without first taking 
measures to provide for the safe movement of trains, locomotives, 
roadway workers, and on-track equipment that depend on the normal 
functioning of the system.
    (f) The PTC system's onboard apparatus shall be so arranged that 
each member of the crew assigned to perform duties in the locomotive 
can view a PTC display and execute any functions necessary to that crew 
member's duties. The locomotive engineer shall not be required to 
perform functions related to the PTC system while the train is moving 
that have the potential to distract the locomotive engineer from 
performance of other safety-critical duties.

[[Page 36023]]

Sec.  236.1031  Previously approved PTC systems.

    (a) Any PTC system fully implemented and operational prior to 
[insert effective date of final rule], may receive PTC System 
Certification if the applicable PTC railroad, or one or more system 
suppliers and one or more PTC railroads, submits a Request for 
Expedited Certification (REC) letter to the Associate Administrator. 
The REC letter must do one of the following:
    (1) Reference a product safety plan (PSP) recognized or approved by 
FRA under subpart H of this part and include a document fulfilling the 
requirements under Sec. Sec.  236.1011 and 236.1013 not already 
included in the PSP;
    (2) Attest that the PTC system has been approved by FRA and in 
operation for at least 5 years and has already received an assessment 
of Verification and Validation from an independent third party under 
part 236 or a waiver supporting such operation; or
    (3) Attest that the PTC railroad has implemented and is operating a 
PTC system required by a FRA order issued prior to [insert effective 
date of final rule].
    (b) If a REC letter conforms to paragraph (a)(1) of this section, 
the Associate Administrator, at his or her sole discretion, may also 
issue a new Type Approval for the PTC system.
    (c) In order to receive a Type Approval or PTC System Certification 
under paragraph (a) or (b) of this section, the PTC system must be 
shown to reliably execute the functionalities required by Sec. Sec.  
236.1005 and 236.1007 and otherwise conform to this subpart.
    (d) Previous approval or recognition of a train control system, 
together with an established service history, may, at the request of 
the PTC railroad, and consistent with available safety data, be 
credited toward satisfaction of the safety case requirements set forth 
in this part for the PTCSP with respect to all functionalities and 
implementations contemplated by the approval or recognition.
    (e) To the extent that the PTC system proposed for implementation 
under this subpart is different in significant detail from the system 
previously approved or recognized, the changes shall be fully analyzed 
in the PTCDP or PTCSP as would be the case absent prior approval or 
recognition.
    (f) As used in this section--
    (1) Approved refers to approval of a Product Safety Plan under 
subpart H of this part.
    (2) Recognized refers to official action permitting a system to be 
implemented for control of train operations under an order or waiver, 
after review of safety case documentation for the implementation.
    (g) Upon receipt of a REC, FRA will consider all safety case 
information to the extent feasible and appropriate, given the specific 
facts before the agency. Nothing in this section limits re-use of any 
applicable safety case information by a party other than the party 
receiving:
    (1) A prior approval or recognition referred to in this section; or
    (2) A Type Approval or PTC System Certification under this subpart.

Sec.  236.1033  Communications and security requirements.

    (a) All wireless communications between the office, wayside, and 
onboard components in a PTC system shall provide cryptographic message 
integrity and authentication.
    (b) Cryptographic keys required under paragraph (a) shall:
    (1) Use an algorithm approved by the National Institute of 
Standards (NIST) or a similarly recognized and FRA approved standards 
body;
    (2) Be distributed using manual or automated methods, or a 
combination of both; and
    (3) Be revoked:
    (i) If compromised by unauthorized disclosure of the cleartext key; 
or
    (ii) When the key algorithm reaches its lifespan as defined by the 
standards body responsible for approval of the algorithm.
    (c) The cleartext form of the cryptographic keys shall be protected 
from unauthorized disclosure, modification, or substitution, except 
during key entry when the cleartext keys and key components may be 
temporarily displayed to allow visual verification. When encrypted keys 
or key components are entered, the cryptographically protected 
cleartext key or key components shall not be displayed.
    (d) Access to cleartext keys shall be protected by a tamper 
resistant mechanism.
    (e) Each railroad electing to also provide cryptographic message 
confidentiality shall:
    (1) Comply with the same requirements for message integrity and 
authentication under this section; and
    (2) Only use keys meeting or exceeding the security strength 
required to protect the data as defined in the railroad's PTCSP and 
required under Sec.  236.1017(a)(8).
    (f) Each railroad, or its vendor, shall have a prioritized service 
restoration and mitigation plan for scheduled and unscheduled 
interruptions of service. This plan shall be included in the PTCDP or 
PTCSP as required by Sec. Sec.  236.1013 or 236.1015, as applicable, 
and made available to FRA upon request, without undue delay, for 
restoration of communication services that support PTC system services.
    (g) Each railroad may elect to impose more restrictive requirements 
than those in this section, consistent with interoperability 
requirements specified in the PTCSP for the system.

Sec.  236.1035  Field testing requirements.

    (a) Before any field testing of an uncertified PTC system, or a 
product of an uncertified PTC system, or any regression testing of a 
certified PTC system is conducted on the general rail system, the 
railroad requesting the testing must provide:
    (1) A complete description of the PTC system;
    (2) An operational concepts document;
    (3) A complete description of the specific test procedures, 
including the measures that will be taken to protect trains and on-
track equipment;
    (4) An analysis of the applicability of the requirements of 
subparts A-G of this part to the PTC system that will not apply during 
testing;
    (5) The date the proposed testing shall begin;
    (6) The test locations; and
    (7) The effect on the current method of the PTC system under test 
operation.
    (b) FRA may impose additional testing conditions that it believes 
may be necessary for the safety of train operations.
    (c) Relief from regulations other than from subparts A-G of this 
part that the railroad believes are necessary to support the field 
testing, must be requested in accordance with part 211 of this title.

Sec.  236.1037  Records retention.

    (a) Each railroad with a PTC system required to be installed under 
this subpart shall maintain at a designated office on the railroad:
    (1) A current copy of each FRA approved Type Approval, if any, 
PTCDP, and PTCSP that it holds;
    (2) Adequate documentation to demonstrate that the PTCSP and PTCDP 
meet the safety requirements of this subpart, including the risk 
assessment;
    (3) An Operations and Maintenance Manual, pursuant to Sec.  
236.1039; and
    (4) Training and testing records pursuant to Sec.  236.1043(b).
    (b) Results of inspections and tests specified in the PTCSP and 
PTCDP must be recorded pursuant to Sec.  236.110.
    (c) Each contractor providing services relating to the testing, 
maintenance, or

[[Page 36024]]

operation of a PTC system required to be installed under this subpart 
shall maintain at a designated office training records required under 
Sec.  236.1039(b).
    (d) After the PTC system is placed in service, the railroad shall 
maintain a database of all safety-relevant hazards as set forth in the 
PTCSP and PTCDP and those that had not been previously identified in 
either document. If the frequency of the safety-relevant hazards 
exceeds the threshold set forth in either of these documents, then the 
railroad shall:
    (1) Report the inconsistency in writing by mail, facsimile, e-mail, 
or hand delivery to the Director, Office of Safety Assurance and 
Compliance, FRA, 1200 New Jersey Ave., SE., Mail Stop 25, Washington, 
DC 20590, within 15 days of discovery. Documents that are hand 
delivered must not be enclosed in an envelope;
    (2) Take prompt countermeasures to reduce the frequency of each 
safety-relevant hazard to below the threshold set forth in the PTCSP 
and PTCDP; and
    (3) Provide a final report when the inconsistency is resolved to 
the FRA Director, Office of Safety Assurance and Compliance, on the 
results of the analysis and countermeasures taken to reduce the 
frequency of the safety-relevant hazard(s) below the threshold set 
forth in the PTCSP and PTCDP.

Sec.  236.1039  Operations and Maintenance Manual.

    (a) The railroad shall catalog and maintain all documents as 
specified in the PTCDP and PTCSP for the installation, maintenance, 
repair, modification, inspection, and testing of the PTC system and 
have them in one Operations and Maintenance Manual, readily available 
to persons required to perform such tasks and for inspection by FRA and 
FRA-certified State inspectors.
    (b) Plans required for proper maintenance, repair, inspection, and 
testing of safety-critical PTC systems must be adequate in detail and 
must be made available for inspection by FRA and FRA-certified State 
inspectors where such PTC systems are deployed or maintained. They must 
identify all software versions, revisions, and revision dates. Plans 
must be legible and correct.
    (c) Hardware, software, and firmware revisions must be documented 
in the Operations and Maintenance Manual according to the railroad's 
configuration management control plan and any additional configuration/
revision control measures specified in the PTCDP and PTCSP.
    (d) Safety-critical components, including spare equipment, must be 
positively identified, handled, replaced, and repaired in accordance 
with the procedures specified in the PTCDP and PTCSP.
    (e) Each railroad shall designate in its Operations and Maintenance 
Manual an appropriate railroad officer responsible for issues relating 
to scheduled interruptions of service contemplated by Sec.  236.1029.

Sec.  236.1041  Training and qualification program, general.

    (a) Training program for PTC personnel. Employers shall establish 
and implement training and qualification programs for PTC systems 
subject to this subpart. These programs must meet the minimum 
requirements set forth in the PTCDP and PTCSP in Sec. Sec.  236.1039 
through 236.1045 as appropriate, for the following personnel:
    (1) Persons whose duties include installing, maintaining, 
repairing, modifying, inspecting, and testing safety-critical elements 
of the railroad's PTC systems, including central office, wayside, or 
onboard subsystems;
    (2) Persons who dispatch train operations (issue or communicate any 
mandatory directive that is executed or enforced, or is intended to be 
executed or enforced, by a train control system subject to this 
subpart);
    (3) Persons who operate trains or serve as a train or engine crew 
member subject to instruction and testing under part 217 of this 
chapter, on a train operating in territory where a train control system 
subject to this subpart is in use;
    (4) Roadway workers whose duties require them to know and 
understand how a train control system affects their safety and how to 
avoid interfering with its proper functioning; and
    (5) The direct supervisors of persons listed in paragraphs (a)(1) 
through (a)(4) of this section.
    (b) Competencies. The employer's program must provide training for 
persons who perform the functions described in paragraph (a) of this 
section to ensure that they have the necessary knowledge and skills to 
effectively complete their duties related to operation and maintenance 
of the PTC system.

Sec.  236.1043  Task analysis and basic requirements.

    (a) Training structure and delivery. As part of the program 
required by Sec.  236.1041, the employer shall, at a minimum:
    (1) Identify the specific goals of the training program with regard 
to the target population (craft, experience level, scope of work, 
etc.), task(s), and desired success rate;
    (2) Based on a formal task analysis, identify the installation, 
maintenance, repair, modification, inspection, testing, and operating 
tasks that must be performed on a railroad's PTC systems. This includes 
the development of failure scenarios and the actions expected under 
such scenarios;
    (3) Develop written procedures for the performance of the tasks 
identified;
    (4) Identify the additional knowledge, skills, and abilities above 
those required for basic job performance necessary to perform each 
task;
    (5) Develop a training and evaluation curriculum that includes 
classroom, simulator, computer-based, hands-on, or other formally 
structured training designed to impart the knowledge, skills, and 
abilities identified as necessary to perform each task;
    (6) Prior to assignment of related tasks, require all persons 
mentioned in Sec.  236.1041(a) to successfully complete a training 
curriculum and pass an examination that covers the PTC system and 
appropriate rules and tasks for which they are responsible (however, 
such persons may perform such tasks under the direct onsite supervision 
of a qualified person prior to completing such training and passing the 
examination);
    (7) Require periodic refresher training and evaluation at intervals 
specified in the PTCDP and PTCSP that includes classroom, simulator, 
computer-based, hands-on, or other formally structured training and 
testing, except with respect to basic skills for which proficiency is 
known to remain high as a result of frequent repetition of the task; 
and
    (8) Conduct regular and periodic evaluations of the effectiveness 
of the training program specified in Sec.  236.1041(a)(1) verifying the 
adequacy of the training material and its validity with respect to 
current railroads PTC systems and operations.
    (b) Training records. Employers shall retain records which 
designate persons who are qualified under this section until new 
designations are recorded or for at least one year after such persons 
leave applicable service. These records shall be kept in a designated 
location and be available for inspection and replication by FRA and 
FRA-certified State inspectors.

Sec.  236.1045  Training specific to office control personnel.

    (a) Any person responsible for issuing or communicating mandatory 
directives in territory where PTC systems are or

[[Page 36025]]

will be in use must be trained in the following areas, as applicable:
    (1) Instructions concerning the interface between the computer-
aided dispatching system and the train control system, with respect to 
the safe movement of trains and other on-track equipment;
    (2) Railroad operating rules applicable to the train control 
system, including provision for movement and protection of roadway 
workers, unequipped trains, trains with failed or cut-out train control 
onboard systems, and other on-track equipment; and
    (3) Instructions concerning control of trains and other on-track 
equipment in case the train control system fails, including periodic 
practical exercises or simulations, and operational testing under part 
217 of this chapter to ensure the continued capability of the personnel 
to provide for safe operations under the alternative method of 
operation.
    (b) [Reserved]

Sec.  236.1047  Training specific to locomotive engineers and other 
operating personnel.

    (a) Operating personnel. Training provided under this subpart for 
any locomotive engineer or other person who participates in the 
operation of a train in train control territory must be defined in the 
PTCDP as well as the PTCSP. The following elements must be addressed:
    (1) Familiarization with train control equipment onboard the 
locomotive and the functioning of that equipment as part of the system 
and in relation to other onboard systems under that person's control;
    (2) Any actions required of the onboard personnel to enable, or 
enter data to, the system, such as consist data, and the role of that 
function in the safe operation of the train;
    (3) Sequencing of interventions by the system, including pre-
enforcement notification, enforcement notification, penalty application 
initiation and post-penalty application procedures;
    (4) Railroad operating rules and testing (part 217) applicable to 
the train control system, including provisions for movement and 
protection of any unequipped trains, or trains with failed or cut-out 
train control onboard systems and other on-track equipment;
    (5) Means to detect deviations from proper functioning of onboard 
train control equipment and instructions regarding the actions to be 
taken with respect to control of the train and notification of 
designated railroad personnel; and
    (6) Information needed to prevent unintentional interference with 
the proper functioning of onboard train control equipment.
    (b) Locomotive engineer training. Training required under this 
subpart for a locomotive engineer, together with required records, must 
be integrated into the program of training required by part 240 of this 
chapter.
    (c) Full automatic operation. The following special requirements 
apply in the event a train control system is used to effect full 
automatic operation of the train:
    (1) The PTCDP and PTCSP must identify all safety hazards to be 
mitigated by the locomotive engineer.
    (2) The PTCDP and PTCSP must address and describe the training 
required with provisions for the maintenance of skills proficiency. As 
a minimum, the training program must:
    (i) As described in Sec.  236.1047(a)(2), develop failure scenarios 
which incorporate the safety hazards identified in the PTCDP and PTCSP 
including the return of train operations to a fully manual mode;
    (ii) Provide training, consistent with Sec.  236.1047(a), for safe 
train operations under all failure scenarios and identified safety 
hazards that affect train operations;
    (iii) Provide training, consistent with Sec.  236.1047(a), for safe 
train operations under manual control; and
    (iv) Consistent with Sec.  236.1047(a), ensure maintenance of 
manual train operating skills by requiring manual starting and stopping 
of the train for an appropriate number of trips and by one or more of 
the following methods:
    (A) Manual operation of a train for a 4-hour work period;
    (B) Simulated manual operation of a train for a minimum of 4 hours 
in a Type I simulator as required; or
    (C) Other means as determined following consultation between the 
railroad and designated representatives of the affected employees and 
approved by FRA. The PTCDP and PTCSP must designate the appropriate 
frequency when manual operation, starting, and stopping must be 
conducted, and the appropriate frequency of simulated manual operation.
    (d) Conductor training. Training required under this subpart for a 
conductor, together with required records, must be integrated into the 
program of training required under this chapter.

Sec.  236.1049  Training specific to roadway workers.

    (a) Roadway worker training. Training required under this subpart 
for a roadway worker must be integrated into the program of instruction 
required under part 214, subpart C of this chapter (``Roadway Worker 
Protection''), consistent with task analysis requirements of Sec.  
236.1039. This training must provide instruction for roadway workers 
who provide protection for themselves or roadway work groups.
    (b) Training subject areas. (1) Instruction for roadway workers 
must ensure an understanding of the role of processor-based signal and 
train control equipment in establishing protection for roadway workers 
and their equipment.
    (2) Instruction for all roadway workers working in territories 
where PTC is required under this subpart must ensure recognition of 
processor-based signal and train control equipment on the wayside and 
an understanding of how to avoid interference with its proper 
functioning.
    (3) Instructions concerning the recognition of system failures and 
the provision of alternative methods of on-track safety in case the 
train control system fails, including periodic practical exercises or 
simulations and operational testing under part 217 of this chapter to 
ensure the continued capability of roadway workers to be free from the 
danger of being struck by a moving train or other on-track equipment.
    11. Revise Appendix B to part 236 to read as follows:

Appendix B to Part 236--Risk Assessment Criteria

    The safety-critical performance of each product for which risk 
assessment is required under this part must be assessed in 
accordance with the following minimum criteria or other criteria if 
demonstrated to the Associate Administrator for Safety to be equally 
suitable:
    (a) How are risk metrics to be expressed? The risk metric for 
the proposed product must describe with a high degree of confidence 
the accumulated risk of a train control system that operates over 
the designated life-cycle of the product. Each risk metric for the 
proposed product must be expressed with an upper bound, as estimated 
with a sensitivity analysis, and the risk value selected must be 
demonstrated to have a high degree of confidence.
    (b) How does the risk assessment handle interaction risks for 
interconnected subsystems/components? The risk assessment of each 
safety-critical system (product) must account not only for the risks 
associated with each subsystem or component, but also for the risks 
associated with interactions (interfaces) between such subsystems.
    (c) What is the main principle in computing risk for the 
previous and current conditions? The risk for the previous condition 
must be computed using the same metrics as for the new system being 
proposed. A full risk assessment must

[[Page 36026]]

consider the entire railroad environment where the product is being 
applied, and show all aspects of the previous condition that are 
affected by the installation of the product, considering all faults, 
operating errors, exposure scenarios, and consequences that are 
related as described in this part. For the full risk assessment, the 
total societal cost of the potential numbers of accidents assessed 
for both previous and new system conditions must be computed for 
comparison. An abbreviated risk assessment must, as a minimum, 
clearly compute the MTTHE for all of the hazardous events identified 
for both previous and current conditions. The comparison between 
MTTHE for both conditions is to determine whether the product 
implementation meets the safety criteria as required by Subpart H or 
Subpart I as applicable.
    (d) What major system characteristics must be included when 
relevant to risk assessment? Each risk calculation must consider the 
total signaling and train control system and method of operation, as 
subjected to a list of hazards to be mitigated by the signaling and 
train control system. The methodology requirements must include the 
following major characteristics, when they are relevant to the 
product being considered:
    (1) Track plan infrastructure, switches, rail crossings at grade 
and highway-rail grade crossings as applicable;
    (2) Train movement density for freight, work, and passenger 
trains where applicable and computed over a time span of not less 
than 12 months;
    (3) Train movement operational rules, as enforced by the 
dispatcher, roadway worker/Employee in Charge, and train crew 
behaviors;
    (4) Wayside subsystems and components;
    (5) Onboard subsystems and components;
    (6) Consist contents such as hazardous material, oversize loads; 
and
    (7) Operating speeds if the provisions of Part 236 cite 
additional requirements for certain type of train control systems to 
be used at such speeds for freight and passenger trains.
    (e) What other relevant parameters must be determined for the 
subsystems and components? In order to derive the frequency of 
hazardous events (or MTTHE) applicable for a product, subsystem or 
component included in the risk assessment, the railroad may use 
various techniques, such as reliability and availability 
calculations for subsystems and components, Fault Tree Analysis 
(FTA) of the subsystems, and results of the application of safety 
design principles as noted in Appendix C. Such failure frequency is 
to be derived for both fail-safe and non-fail-safe subsystems or 
components. The lower bounds of the MTTF or MTBF determined from the 
system sensitivity analysis, which account for all necessary and 
well justified assumptions, may be used to represent the estimate of 
MTTHE for the associated non-fail-safe subsystem or component in the 
risk assessment.
    (f) How are processor-based subsystems/components assessed? (1) 
An MTTHE value must be calculated for each processor-based subsystem 
or component, or both, indicating the safety-critical behavior of 
the integrated hardware/software subsystem or component, or both. 
The human factor impact must be included in the assessment, whenever 
applicable, to provide the integrated MTTHE value. The MTTHE 
calculation must consider the rates of failures caused by permanent, 
transient, and intermittent faults accounting for the fault coverage 
of the integrated hardware/software subsystem or component, phased-
interval maintenance, and restoration of the detected failures.
    (2) Software fault/failure analysis must be based on the proper 
assessment of the design and implementation of the application code, 
its operating/executive program, and associated device drivers, 
historical performance data, analytical methods and experimental 
safety-critical performance testing performed on the subsystem or 
component. The software assessment process must demonstrate through 
repeatable predictive results that all software defects have been 
identified and corrected by process with a high degree of 
confidence.
    (g) How are non-processor-based subsystems/components assessed? 
(1) The safety-critical behavior of all non-processor-based 
components, which are part of a processor-based system or subsystem, 
must be quantified with an MTTHE metric. The MTTHE assessment 
methodology must consider failures caused by permanent, transient, 
and intermittent faults, phase-interval maintenance and restoration 
of operation after failures and the effect of fault coverage of each 
non-processor-based subsystem or component.
    (2) MTTHE compliance verification and validation must be based 
on the assessment of the design for adequacy by a documented 
verification and validation process, historical performance data, 
analytical methods and experimental safety-critical performance 
testing performed on the subsystem or component. The non-processor-
based quantification compliance must be demonstrated to have a high 
degree of confidence.
    (h) What assumptions must be documented for risk assessment? (1) 
The railroad shall document any assumptions regarding the derivation 
of risk metrics used. For example, for the full risk assessment, all 
assumptions made about each value of the parameters used in the 
calculation of total cost of accidents should be documented. For 
abbreviated risk assessment, all assumptions made for MTTHE 
derivation using existing reliability and availability data on the 
current system components should be documented. The railroad shall 
document these assumptions in such a form as to permit later 
automated comparisons with in-service experience.
    (2) The railroad shall document any assumptions regarding human 
performance. The documentation shall be in such a form as to 
facilitate later comparisons with in-service experience.
    (3) The railroad shall document any assumptions regarding 
software defects. These assumptions shall be in a form which permits 
the railroad to project the likelihood of detecting an in-service 
software defect. These assumptions shall be documented in such a 
form as to permit later automated comparisons with in-service 
experience.
    (4) The railroad shall document all of the identified safety-
critical fault paths to a mishap as predicted by the safety analysis 
methodology. The documentation shall be in such a form as to 
facilitate later comparisons with in-service faults.

    12. Revise Appendix C to read as follows:

Appendix C to Part 236--Safety Assurance Criteria and Processes

    (a) What is the purpose of this appendix? This appendix provides 
safety criteria and processes that the designer must use to develop 
and validate the product that meets safety requirements of this 
part. FRA uses the criteria and processes set forth in this appendix 
to evaluate the validity of safety targets and the results of system 
safety analyses provided in the RSPP, PSP, PTCIP, PTCDP, and PTCSP 
documents as appropriate. An analysis performed under this appendix 
must:
    (1) Address each of the safety principles of paragraph (b) of 
this appendix, or explain why they are not relevant, and
    (2) Employ a validation and verification process pursuant to 
paragraph (c) of this appendix.
    (b) What safety principles must be followed during product 
development? The designer shall address each of the following safety 
considerations principles when designing and demonstrating the 
safety of products covered by subpart H or I of this part. In the 
event that any of these principles are not followed, the PSP or 
PTCDP or PTCSP shall state both the reason(s) for departure and the 
alternative(s) utilized to mitigate or eliminate the hazards 
associated with the design principle not followed.
    (1) System safety under normal operating conditions. The system 
(all its elements including hardware and software) must be designed 
to assure safe operation with no hazardous events under normal 
anticipated operating conditions with proper inputs and within the 
expected range of environmental conditions. All safety-critical 
functions must be performed properly under these normal conditions. 
Absence of specific operator actions or procedures will not prevent 
the system from operating safely. The designer must identify and 
categorize all hazards that may lead to unsafe system operation. 
Hazards categorized as unacceptable or undesirable, which is 
determined by hazard analysis, must be eliminated by design. Those 
undesirable hazards that cannot be eliminated should be mitigated to 
the acceptable level as required by this part.
    (2) System safety under failures.
    (i) It must be shown how the product is designed to eliminate or 
mitigate or eliminate unsafe systematic failures--those conditions 
which can be attributed to human error that could occur at various 
stages throughout product development. This includes unsafe errors 
in the software due to human error in the software specification, 
design or coding phases, or both; human errors that could impact 
hardware design; unsafe conditions that could occur because of an 
improperly designed human-machine interface; installation and 
maintenance errors; and errors associated with making modifications.

[[Page 36027]]

    (ii) The product must be shown to operate safely under 
conditions of random hardware failure. This includes single as well 
as multiple hardware failures, particularly in instances where one 
or more failures could occur, remain undetected (latent) and react 
in combination with a subsequent failure at a later time to cause an 
unsafe operating situation. In instances involving a latent failure, 
a subsequent failure is similar to there being a single failure. In 
the event of a transient failure, and if so designed, the system 
should restart itself if it is safe to do so. Frequency of attempted 
restarts must be considered in the hazard analysis required by Sec.  
236.907(a)(8).
    (iii) There shall be no single point failures in the product 
that can result in hazards categorized as unacceptable or 
undesirable. Occurrence of credible single point failures that can 
result in hazards must be detected and the product must achieve a 
known safe state before falsely activating any physical appliance.
    (iv) If one non-self-revealing failure combined with a second 
failure can cause a hazard that is categorized as unacceptable or 
undesirable, then the second failure must be detected and the 
product must achieve a known safe state before falsely activating 
any physical appliance.
    (v) Another concern of multiple failures involves common mode 
failures in which two or more subsystems or components intended to 
compensate one another to perform the same function all fail by the 
same mode and result in unsafe conditions. This is of particular 
concern in instances in which two or more elements (hardware or 
software, or both) are used in combination to ensure safety. If a 
common mode failure exists, then any analysis performed under this 
appendix cannot rely on the assumption that failures are 
independent. Examples include: The use of redundancy in which two or 
more elements perform a given function in parallel and when one 
(hardware or software) element checks/monitors another element (of 
hardware or software) to help ensure its safe operation. Common mode 
failure relates to independence, which must be ensured in these 
instances. When dealing with the effects of hardware failure, the 
designer shall address the effects of the failure not only on other 
hardware, but also on the execution of the software, since hardware 
failures can greatly affect how the software operates.
    (3) Closed loop principle. System design adhering to the closed 
loop principle requires that all conditions necessary for the 
existence of any permissive state or action be verified to be 
present before the permissive state or action can be initiated. 
Likewise the requisite conditions shall be verified to be 
continuously present for the permissive state or action to be 
maintained. This is in contrast to allowing a permissive state or 
action to be initiated or maintained in the absence of detected 
failures. In addition, closed loop design requires that failure to 
perform a logical operation, or absence of a logical input, output 
or decision shall not cause an unsafe condition, i.e., system safety 
does not depend upon the occurrence of an action or logical 
decision.
    (4) Safety assurance concepts. The product design must include 
one or more of the following Safety Assurance Concepts as described 
in IEEE-1483 standard to ensure that failures are detected and the 
product is placed in a safe state. One or more different principles 
may be applied to each individual subsystem or component, depending 
on the safety design objectives of that part of the product.
    (i) Design diversity and self-checking concept. This concept 
requires that all critical functions be performed in diverse ways, 
using diverse software operations and/or diverse hardware channels, 
and that critical hardware be tested with Self-Checking routines. 
Permissive outputs are allowed only if the results of the diverse 
operations correspond, and the Self-Checking process reveals no 
failures in either execution of software or in any monitored input 
or output hardware. If the diverse operations do not agree or if the 
checking reveals critical failures, safety-critical functions and 
outputs must default to a known safe state.
    (ii) Checked redundancy concept. The Checked Redundancy concept 
requires implementation of two or more identical, independent 
hardware units, each executing identical software and performing 
identical functions. A means is to be provided to periodically 
compare vital parameters and results of the independent redundant 
units, requiring agreement of all compared parameters to assert or 
maintain a permissive output. If the units do not agree, safety-
critical functions and outputs must default to a known safe state.
    (iii) N-version programming concept. This concept requires a 
processor-based product to use at least two software programs 
performing identical functions and executing concurrently in a 
cycle. The software programs must be written by independent teams, 
using different tools. The multiple independently written software 
programs comprise a redundant system, and may be executed either on 
separate hardware units (which may or may not be identical) or 
within one hardware unit. A means is to be provided to compare the 
results and output states of the multiple redundant software 
systems. If the system results do not agree, then the safety-
critical functions and outputs must default to a known safe state.
    (iv) Numerical assurance concept. This concept requires that the 
state of each vital parameter of the product or system be uniquely 
represented by a large encoded numerical value, such that permissive 
results are calculated by pseudo-randomly combining the 
representative numerical values of each of the critical constituent 
parameters of a permissive decision. Vital algorithms must be 
entirely represented by data structures containing numerical values 
with verified characteristics, and no vital decisions are to be made 
in the executing software, only by the numerical representations 
themselves. In the event of critical failures, the safety-critical 
functions and outputs must default to a known safe state.
    (v) Intrinsic fail-safe design concept. Intrinsically fail-safe 
hardware circuits or systems are those that employ discrete 
mechanical and/or electrical components. The fail-safe operation for 
a product or subsystem designed using this principle concept 
requires a verification that the effect of every relevant failure 
mode of each component, and relevant combinations of component 
failure modes, be considered, analyzed, and documented. This is 
typically performed by a comprehensive failure modes and effects 
analysis (FMEA) which must show no residual unmitigated failures. In 
the event of critical failures, the safety-critical functions and 
outputs must default to a known safe state.
    (5) Human factor engineering principle. The product design must 
sufficiently incorporate human factors engineering that is 
appropriate to the complexity of the product; the educational, 
mental, and physical capabilities of the intended operators and 
maintainers; the degree of required human interaction with the 
component; and the environment in which the product will be used.
    (6) System safety under external influences. The product must be 
shown to operate safely when subjected to different external 
influences, including:
    (i) Electrical influences such as power supply anomalies/
transients, abnormal/improper input conditions (e.g., outside of 
normal range inputs relative to amplitude and frequency, unusual 
combinations of inputs) including those related to a human operator, 
and others such as electromagnetic interference or electrostatic 
discharges, or both;
    (ii) Mechanical influences such as vibration and shock; and
    (iii) Climatic conditions such as temperature and humidity.
    (7) System safety after modifications. Safety must be ensured 
following modifications to the hardware or software, or both. All or 
some of the concerns identified in this paragraph may be applicable 
depending upon the nature and extent of the modifications. Such 
modifications must follow all of the concept, design, implementation 
and test processes and principles as documented in the PSP for the 
original product. Regression testing must be comprehensive and 
documented to include all scenarios which are affected by the change 
made, and the operating modes of the changed product during normal 
and failure state (fallback) operation.
    (c) What standards are acceptable for verification and 
validation? (1) The standards employed for verification or 
validation, or both, of products subject to this subpart must be 
sufficient to support achievement of the applicable requirements of 
subpart H and subpart I of this part.
    (2) U.S. Department of Defense Military Standard (MIL-STD) 882C, 
``System Safety Program Requirements'' (January 19, 1993), is 
recognized as providing appropriate risk analysis processes for 
incorporation into verification and validation standards.
    (3) The following standards designed for application to 
processor-based signal and train control systems are recognized as 
acceptable with respect to applicable elements of safety analysis 
required by subpart H and subpart I of this part. The latest 
versions of the standards listed below should be used unless 
otherwise provided.

[[Page 36028]]

    (i) IEEE standards as follows:
    (A) IEEE 1483-2000, Standard for the Verification of Vital 
Functions in Processor-Based Systems Used in Rail Transit Control.
    (B) IEEE 1474.2-2003, Standard for user interface requirements 
in communications based train control (CBTC) systems.
    (C) IEEE 1474.1-2004, Standard for Communications-Based Train 
Control (CBTC) Performance and Functional Requirements.
    (ii) CENELEC Standards as follows:
    (A) EN50129: 2003, Railway Applications: Communications, 
Signaling, and Processing Systems-Safety Related Electronic Systems 
for Signaling; and
    (B) EN50155:2001/A1:2002, Railway Applications: Electronic 
Equipment Used in Rolling Stock.
    (iii) ATCS Specification 200 Communications Systems 
Architecture.
    (iv) ATCS Specification 250 Message Formats.
    (v) AREMA 2009 Communications and Signal Manual of Recommended 
Practices, Part 16, Part 17, 21, and 23.
    (vi) Safety of High Speed Ground Transportation Systems. 
Analytical Methodology for Safety Validation of Computer Controlled 
Subsystems. Volume II: Development of a Safety Validation 
Methodology. Final Report September 1995. Author: Jonathan F. 
Luedeke, Battelle. DOT/FRA/ORD-95/10.2.
    (vii) IEC 61508 (International Electrotechnical Commission), 
Functional Safety of Electrical/Electronic/Programmable/Electronic 
Safety (E/E/P/ES) Related Systems, Parts 1-7 as follows:
    (A) IEC 61508-1 (1998-12) Part 1: General requirements and IEC 
61508-1 Corr. (1999-05) Corrigendum 1-Part 1: General Requirements.
    (B) IEC 61508-2 (2000-05) Part 2: Requirements for electrical/
electronic/programmable electronic safety-related systems.
    (C) IEC 61508-3 (1998-12) Part 3: Software requirements and IEC 
61508-3 Corr.1 (1999-04) Corrigendum 1-Part3: Software requirements.
    (D) IEC 61508-4 (1998-12) Part 4: Definitions and abbreviations 
and IEC 61508-4 Corr.1 (1999-04) Corrigendum 1-Part 4: Definitions 
and abbreviations.
    (E) IEC 61508-5 (1998-12) Part 5: Examples of methods for the 
determination of safety integrity levels and IEC 61508-5 Corr.1 
(1999-04) Corrigendum 1 Part 5: Examples of methods for 
determination of safety integrity levels.
    (F) IEC 61508-6 (2000-04) Part 6: Guidelines on the applications 
of IEC 61508-2 and -3.
    (G) IEC 61508-7 (2000-03) Part 7: Overview of techniques and 
measures.
    (H) IEC62278: 2002, Railway Applications: Specification and 
Demonstration of Reliability, Availability, Maintainability and 
Safety (RAMS);
    (I) IEC62279: 2002 Railway Applications: Software for Railway 
Control and Protection Systems;
    (4) Use of unpublished standards, including proprietary 
standards, is authorized to the extent that such standards are shown 
to achieve the requirements of this part. However, any such 
standards shall be available for inspection and replication by FRA 
and for public examination in any public proceeding before the FRA 
to which they are relevant.

    13. A new Appendix F to part 236 is added to read as follows:

Appendix F to Part 236--Requirements of Mandatory Independent Third-
Party Assessment of PTC System Safety Verification and Validation

    (a) This appendix provides minimum requirements for mandatory 
independent third-party assessment of PTC system safety verification 
and validation pursuant to subpart H or I of this part. The goal of 
this assessment is to provide an independent evaluation of the PTC 
system manufacturer's utilization of safety design practices during 
the PTC system's development and testing phases, as required by the 
applicable PSP, PTCDP, and PTCSP, the applicable requirements of 
subpart H or I of this part, and any other previously agreed-upon 
controlling documents or standards.
    (b) The supplier may request advice and assistance of the 
independent third-party reviewer concerning the actions identified 
in paragraphs (c) through (g) of this appendix. However, the 
reviewer should not engage in design efforts in order to preserve 
the reviewer's independence and maintain the supplier's proprietary 
right to the PTC system.
    (c) The supplier shall provide the reviewer access to any and 
all documentation that the reviewer requests and attendance at any 
design review or walkthrough that the reviewer determines as 
necessary to complete and accomplish the third party assessment. The 
reviewer may be accompanied by representatives of FRA as necessary, 
in FRA's judgment, for FRA to monitor the assessment.
    (d) The reviewer shall evaluate with respect to safety and 
comment on the adequacy of the processes which the supplier applies 
to the design and development of the PTC system. At a minimum, the 
reviewer shall compare the supplier processes with acceptable 
methodology and employ any other such tests or comparisons if they 
have been agreed to previously with FRA. Based on these analyses, 
the reviewer shall identify and document any significant safety 
vulnerabilities which are not adequately mitigated by the supplier's 
(or user's) processes. Finally, the reviewer shall evaluate the 
adequacy of the railroad's applicable PSP or PTCSP, and any other 
documents pertinent to the PTC system being assessed.
    (e) The reviewer shall analyze the Preliminary Hazard Analysis 
(PHA) for comprehensiveness and compliance with industry, national, 
or international standards.
    (f) The reviewer shall analyze all Fault Tree Analyses (FTA), 
Failure Mode and Effects Criticality Analysis (FMECA), and other 
hazard analyses for completeness, correctness, and compliance with 
industry, national, or international standards.
    (g) The reviewer shall randomly select various safety-critical 
software modules, as well as safety-critical hardware components if 
required by FRA for audit to verify whether the vendors and 
industry, national, or international standards were followed. The 
number of modules audited must be determined as a representative 
number sufficient to provide confidence that all unaudited modules 
were developed in compliance industry, national, or international 
standards
    (h) The reviewer shall evaluate and comment on the plan for 
installation and test procedures of the PTC system for revenue 
service.
    (i) The reviewer shall prepare a final report of the assessment. 
The report shall be submitted to the railroad prior to the 
commencement of installation testing and contain at least the 
following information:
    (1) Reviewer's evaluation of the adequacy of the PSP or PTCSP 
including the supplier's MTTHE and risk estimates for the PTC 
system, and the supplier's confidence interval in these estimates;
    (2) PTC system vulnerabilities, potentially hazardous failure 
modes, or potentially hazardous operating circumstances which the 
reviewer felt were not adequately identified, tracked or mitigated;
    (3) A clear statement of position for all parties involved for 
each PTC system vulnerability cited by the reviewer;
    (4) Identification of any documentation or information sought by 
the reviewer that was denied, incomplete, or inadequate;
    (5) A listing of each applicable vendor, industry, national or 
international standard, process, or procedure which was not properly 
followed;
    (6) Identification of the hardware and software verification and 
validation procedures for the PTC system's safety-critical 
applications, and the reviewer's evaluation of the adequacy of these 
procedures;
    (7) Methods employed by PTC system manufacturer to develop 
safety-critical software, such as use of structured language, code 
checks, modularity, or other similar generally acceptable 
techniques; and
    (8) If directed by FRA, methods employed by PTC system 
manufacturer to develop safety-critical hardware.

Karen J. Rae,
Deputy Administrator.
[FR Doc. E9-17184 Filed 7-15-09; 4:15 pm]

BILLING CODE 4910-06-P