Railroad Locomotive Safety Standards
Part 229
Railroad Locomotive Safety Standards
Subpart A General (Sections 229.1 - 229.19)
Subpart B Inspections and Tests (Sections 229.21 - 229.33)
Subpart C Safety Requirements (Sections 229.41 - 229.135)
Subpart D Design Requirements (Section 229.141)
229 App A Appendix A to Part 229
229 App B Appendix B to Part 229
Authority: Authority: 49 U.S.C. 20102-03, 20133, 20137-38, 20143, 20701-03, 21301-02, 21304; 49 CFR 1.49(c),(m).
Source: 45 FR 21109, Mar. 31, 1980, unless otherwise noted.
Part 229 Subpart A
General
229.1 Scope.
229.3 Applicability.
229.4 Information collection.
229.5 Definitions.
229.7 Prohibited acts.
229.9 Movement of non-complying locomotives.
229.11 Locomotive identification.
229.13 Control of locomotives.
229.14 Non-MU control cab locomotives.
229.17 Accident reports.
229.19 Prior waivers.
229.1
Scope.
This part prescribes minimum Federal safety standards for all locomotives except those propelled by steam power.
Applicability.
(a) Except as provided in paragraphs (b) through (e) of this section, this part applies to all standard gage railroads.
(b) This part does not apply to:
(1) A railroad that operates only on track inside an installation which is not part of the general railroad system of transportation; or
(2) Rapid transit operations in an urban area that are not connected with the general railroad system of transportation.
(c) Paragraphs (a) and (b) of § 229.125 do not apply to Tier II passenger equipment as defined in § 238.5 of this chapter (i.e., passenger equipment operating at speeds exceeding 125 mph but not exceeding 150 mph).
(d) On or after November 8, 1999, paragraphs (a)(1) and (b)(1) of § 229.141 do not apply to "passenger equipment" as defined in § 238.5 of this chapter, unless such equipment is excluded from the requirements of §§ 238.203 through 238.219, and § 238.223 of this chapter by operation of § 238.201(a)(2) of this chapter.
(e) Paragraphs (a)(2) through (a)(4), and (b)(2) through (b)(4) of § 229.141 do not apply to "passenger equipment" as defined in § 238.5 of this chapter that is placed in service for the first time on or after September 8, 2000, unless such equipment is excluded from the requirements of §§ 238.203 through238.219, and § 238.223 of this chapter by operation of § 238.201(a)(2) of this chapter.
[54 FR 33229, Aug. 14, 1989; 64 FR 25540, May 12, 1999]
229.5
Definitions.
As used in this part—
AAR means the Association of American Railroads.
Acceptable quality level (AQL). The AQL is expressed in terms of percent defective or defects per 100 units. Lots having a quality level equal to a specified AQL will be accepted approximately 95 percent of the time when using the sampling plans prescribed for that AQL.
Alerter means a device or system installed in the locomotive cab to promote continuous, active locomotive engineer attentiveness by monitoring select locomotive engineer-induced control activities. If fluctuation of a monitored locomotive engineer-induced control activity is not detected within a predetermined time, a sequence of audible and visual alarms is activated so as to progressively prompt a response by the locomotive engineer. Failure by the locomotive engineer to institute a change of state in a monitored control, or acknowledge the alerter alarm activity through a manual reset provision, results in a penalty brake application that brings the locomotive or train to a stop.
Anti-climbers means the parts at the ends of adjoining rail vehicles in a train that are designed to engage when subjected to large buff loads to prevent the override of one vehicle by another.
Assignment address means a unique identifier of the RCL that insures that only the OCU's linked to a specific RCL can command that RCL.
Associate Administrator for Safety means the Associate Administrator for Safety, Federal Railroad Administration, or that person's delegate as designated in writing.
Break means a fracture resulting in complete separation into parts.
Build date means the date on which the completed locomotive is shipped by the manufacturer or remanufacturer to the customer, or if the railroad manufactures or remanufactures the locomotive itself, the date on which the locomotive is released from the manufacture or remanufacture facility.
Cab means that portion of the superstructure designed to be occupied by the crew operating the locomotive.
Carrier means railroad, as that term is in this section.
Collision posts means structural members of the end structures of a rail vehicle that extend vertically from the underframe to which they are securely attached and that provide protection to occupied compartments from an object penetrating the vehicle during a collision.
Controlling locomotive means a locomotive from where the operator controls the traction and braking functions of the locomotive or locomotive consist, normally the lead locomotive.
Corner posts means structural members located at the intersection of the front or rear surface with the side surface of a rail vehicle and which extend vertically from the underframe to the roof.
Commuter service means the type of railroad service described under the heading “Commuter Operations” in 49 CFR part 209, Appendix A.
Commuter work train is a non-revenue service train used in the administration and upkeep service of a commuter railroad.
Control cab locomotive means a locomotive without propelling motors but with one or more control stands.
Controlling remote distributed power locomotive means the locomotive in a distributed power consist that receives the coded signal from the lead locomotive consist of the train whether commanded automatically by the distributed power system or manually by the locomotive engineer.
Crack means a fracture without complete separation into parts, except that castings with shrinkage cracks or hot tears that do not significantly diminish the strength of the member are not considered to be cracked.
Cruise control means a device that controls locomotive power output to obtain a targeted speed. A device that functions only at or below 30 miles per hour is NOT considered a “cruise control” for purposes of this part.
Data element means one or more data point or value reflecting on-board train operations at a particular time. Data may be actual or “passed through” values or may be derived from a combination of values from other sources.
dB(A) means the sound pressure level in decibels measured on the A-weighted scale.
Dead locomotive means—
(1) A locomotive, other than a control cab locomotive, that does not have any traction device supplying tractive power; or
(2) A control cab locomotive that has a locked and unoccupied cab.
Decibel (dB) means a unit of measurement of sound pressure levels.
Defective means, for purposes of section 229.129 of this part, a locomotive equipped with an audible warning device that produces a maximum sound level in excess of 110 dB(A) and/or a minimum sound level below 96 dB(A), as measured 100 feet forward of the locomotive in the direction of travel.
Designated service means exclusive operation of a locomotive under the following conditions:
(1) The locomotive is not used as an independent unit or the controlling unit in a consist of locomotives except when moving for the purposes of servicing or repair within a single yard area;
(2) The locomotive is not occupied by operating or deadhead crews outside a single yard area; and
(3) The locomotive is stenciled “Designated Service—DO NOT OCCUPY.”
Design standard means a criterion adopted by an industry or voluntary consensus standards body, which addresses the design of a locomotive with respect to its crashworthiness and crashworthiness features.
Distributed power system means a system that provides control of a number of locomotives dispersed throughout a train from a controlling locomotive located in the lead position. The system provides control of the rearward locomotives by command signals originating at the lead locomotive and transmitted to the remote (rearward) locomotives.
DMU locomotive means a diesel-powered multiple unit operated locomotive with one or more propelling motors designed to carry passenger traffic.
Excessive noise report means a report by a locomotive cab occupant that the locomotive is producing an unusual level of noise that significantly interferes with normal cab communications or that is a concern with respect to hearing conservation.
Electronic air brake means a brake system controlled by a computer which provides the means for control of the locomotive brakes or train brakes or both.
Event recorder means a device, designed to resist tampering, that monitors and records data, as detailed in §229.135(b), over the most recent 48 hours of operation of the electrical system of the locomotive on which the device is installed. However, a device, designed to resist tampering, that monitors and records the specified data only when the locomotive is in motion meets this definition if the device was installed prior to November 5, 1993 and if it records the specified data for the last eight hours the locomotive was in motion.
Event recorder memory module means that portion of the event recorder used to retain the recorded data as detailed in §229.135(b).
FRA means the Federal Railroad Administration.
Fuel tank, external means a fuel containment vessel that extends outside the car body structure of a locomotive.
Fuel tank, internal means a fuel containment vessel that does not extend outside the car body structure of a locomotive.
High voltage means an electrical potential of more than 150 volts.
Initial terminal means a location where a train is originally assembled.
In-service event recorder means an event recorder that was successfully tested as prescribed in §229.27(d) and whose subsequent failure to operate as intended, if any, is not actually known by the railroad operating the locomotive on which it is installed.
Lateral means the horizontal direction perpendicular to the direction of travel.
Lead locomotive means the first locomotive proceeding in the direction of movement.
Lite locomotive means a locomotive or a consist of locomotives not attached to any piece of equipment or attached only to a caboose.
Locomotive means a piece of on-track equipment other than hi-rail, specialized maintenance, or other similar equipment—
(1) With one or more propelling motors designed for moving other equipment;
(2) With one or more propelling motors designed to carry freight or passenger traffic or both; or
(3) Without propelling motors but with one or more control stands.
Locomotive cab means the compartment or space on board a locomotive where the control stand is located and which is normally occupied by the engineer when the locomotive is operated.
Locomotive Control Unit (LCU) means a system onboard an RCL that communicates via a radio link which receives, processes, and confirms commands from the OCU, which directs the locomotive to execute them.
Longitudinal means in a direction parallel to the normal direction of travel.
Lot means a collection of locomotives, equipped with the same horn model, configuration, and location, and the same air pressure and delivery system, which has been manufactured or processed under essentially the same conditions.
Mandatory directive means any movement authority or speed restriction that affects a railroad operation.
Manufacture means the act of constructing a locomotive.
Modesty lock means a latch that can be operated in the normal manner only from within the sanitary compartment, that is designed to prevent entry of another person when the sanitary compartment is in use. A modesty lock may be designed to allow deliberate forced entry in the event of an emergency.
Monocoque design locomotive means a locomotive design where the shell or skin acts as a single unit with the supporting frame to resist and transmit the loads acting on the locomotive.
MU locomotive means a multiple unit operated electric locomotive—
(1) With one or more propelling motors designed to carry freight or passenger traffic or both; or
(2) Without propelling motors but with one or more control stands and a means of picking-up primary power such as a pantograph or third rail.
Narrow-nose locomotive means a locomotive with a short hood that spans substantially less than the full width of the locomotive.
Occupied service means the operation of a locomotive when the cab is physically occupied by a person.
Operator Control Unit (OCU) means a mobile unit that communicates via a radio link the commands for movement (direction, speed, braking) or for operations (bell, horn, sand) to an RCL.
Other short-haul passenger service means the type of railroad service described under the heading “Other short-haul passenger service” in 49 CFR part 209, appendix A.
Permanent deformation means the undergoing of a permanent change in shape of a structural member of a rail vehicle.
Potable water means water that meets the requirements of 40 CFR part 141, the Environmental Protection Agency's Primary Drinking Water Regulations, or water that has been approved for drinking and washing purposes by the pertinent state or local authority having jurisdiction. For purposes of this part, commercially available, bottled drinking water is deemed potable water.
Powered axle is an axle equipped with a traction device.
Power car means a rail vehicle that propels a Tier II passenger train or is the lead vehicle in a Tier II passenger train, or both.
Qualified mechanical inspector means a person who has received instruction and training that includes “hands-on” experience (under appropriate supervision or apprenticeship) in one or more of the following functions: troubleshooting, inspection, testing, maintenance or repair of the specific locomotive equipment for which the person is assigned responsibility. This person shall also possess a current understanding of what is required to properly repair and maintain the locomotive equipment for which the person is assigned responsibility. Further, the qualified mechanical inspector shall be a person whose primary responsibility includes work generally consistent with the functions listed in this definition.
Railroad means all forms of non-highway ground transportation that run on rails or electromagnetic guideways, including:
(1) Commuter or other short-haul rail passenger service in a metropolitan or suburban area, and
(2) High speed ground transportation systems that connect metropolitan areas, without regard to whether they use new technologies not associated with traditional railroads. Such term does not include rapid transit operations within an urban area that are not connected to the general railroad system of transportation.
Remanufacture means the act of constructing a remanufactured locomotive.
Remanufactured locomotive means a locomotive rebuilt or refurbished from a previously used or refurbished underframe (“deck”), containing fewer than 25% previously used components (measured by dollar value of the components). For calculation purposes, the percentage of previously used components is determined with equivalent value of new parts and is calculated using dollar values from the same year as the new parts used to remanufacture the locomotive.
Remote Control Locomotive (RCL) means a remote control locomotive that, through use of a radio link can be operated by a person not physically within the confines of the locomotive cab. For purposes of this part, the term RCL does not refer to a locomotive or group of locomotives remotely controlled from the lead locomotive of a train, as in a distributed power arrangement.
Remote Control Operator (RCO) means a person who utilizes an OCU in connection with operations involving a RCL with or without cars.
Remote Control Pullback Protection means a function of a RCL that enforces speeds and stops in the direction of pulling movement.
Roof rail means the longitudinal structural member at the intersection of the side wall and the roof sheathing.
Sand delivery system means a permanently stationed or fixed device designed to deliver sand to locomotive sand boxes that do not require the sand to be manually delivered or loaded. A sand delivery system will be considered permanently stationed if it is at a location at least five days a week for at least eight hours per day.
Sanitary means lacking any condition in which any significant amount of filth, trash, or human waste is present in such a manner that a reasonable person would believe that the condition might constitute a health hazard; or of strong, persistent, chemical or human waste odors sufficient to deter use of the facility, or give rise to a reasonable concern with respect to exposure to hazardous fumes. Such conditions include, but are not limited to, a toilet bowl filled with human waste, soiled toilet paper, or other products used in the toilet compartment, that are present due to a defective toilet facility that will not flush or otherwise remove waste; visible human waste residue on the floor or toilet seat that is present due to a toilet that overflowed; an accumulation of soiled paper towels or soiled toilet paper on the floor, toilet facility, or sink; an accumulation of visible dirt or human waste on the floor, toilet facility, or sink; and strong, persistent chemical or human waste odors in the compartment.
Sanitation compartment means an enclosed compartment on a railroad locomotive that contains a toilet facility for employee use.
Self-monitoring event recorder means an event recorder that has the ability to monitor its own operation and to display an indication to the locomotive operator when any data required to be stored are not stored or when the stored data do not match the data received from sensors or data collection points.
Semi-monocoque design locomotive means a locomotive design where the skin or shell acts, to some extent, as a single unit with the supporting frame to resist and transmit the loads acting on the locomotive.
Semi-permanently coupled means coupled by means of a drawbar or other coupling mechanism that requires tools to perform the uncoupling operation.
(1) The exact level of speed/tractive effort characteristic requested, on a scale of zero (0) to one hundred percent (100%) of the output variable or
(2) A value converted from a percentage to a comparable 0 to 8 digital signal.
Tier II means operating at speeds exceeding 125 mph but not exceeding 150 mph.
Time means either “time-of-day” or “elapsed time” (from an arbitrarily determined event) as determined by the manufacturer. In either case, the recorder must be able to convert to an accurate time-of-day with the time zone stated unless it is Greenwich mean time (UTC).
Toilet facility means a system that automatically or on command of the user removes human waste to a place where it is treated, eliminated, or retained such that no solid or non-treated liquid waste is thereafter permitted to be released into the bowl, urinal, or room and that prevents harmful discharges of gases or persistent offensive odors.
Transfer service means a freight train that travels between a point of origin and a point of final destination not exceeding 20 miles and that is not performing switching service.
Ultimate strength means the load at which a structural member fractures or ceases to resist any load.
Unsanitary means having any condition in which any significant amount of filth, trash, or human waste is present in such a manner that a reasonable person would believe that the condition might constitute a health hazard; or strong, persistent, chemical or human waste odors sufficient to deter use of the facility, or give rise to a reasonable concern with respect to exposure to hazardous fumes. Such conditions include, but are not limited to, a toilet bowl filled with human waste, soiled toilet paper, or other products used in the toilet compartment, that are present due to a defective toilet facility that will not flush or otherwise remove waste; visible human waste residue on the floor or toilet seat that is present due to a toilet that overflowed; an accumulation of soiled paper towels or soiled toilet paper on the floor, toilet facility, or sink; an accumulation of visible dirt or human waste on the floor, toilet facility, or sink; and strong, persistent chemical or human waste odors in the compartment.
Upper 99% confidence limit means the noise level below which 99% of all noise level measurements must lie.
Washing system means a system for use by railroad employees to maintain personal cleanliness that includes a secured sink or basin, water, antibacterial soap, and paper towels; or antibacterial waterless soap and paper towels; or antibacterial moist towelettes and paper towels; or any other combination of suitable antibacterial cleansing agents.
Wide-nose locomotive means a locomotive with a short hood that spans the full width of the locomotive.
[70 FR 37938, June 30, 2005, as amended at 71 FR 36911, June 28, 2006; 71 FR 47666, Aug. 17, 2006; 71 FR 61857, Oct. 19, 2006; 71 FR 63136, Oct. 27, 2006; 72 FR 59223, Oct. 19, 2007; 77 FR 21342, Apr. 9, 2012]
229.7
Prohibited acts and penalties.
(a) Federal Rail Safety Laws (49 U.S.C. 20701-20703) make it unlawful for any carrier to use or permit to be used on its line any locomotive unless the entire locomotive and its appurtenances—
(1) Are in proper condition and safe to operate in the service to which they are put, without unnecessary peril to life or limb; and
(2) Have been inspected and tested as required by this part.
(b) Any person (including but not limited to a railroad; any manager, supervisor, official, or other employee or agent of a railroad; any owner, manufacturer, lessor, or lessee of railroad equipment, track, or facilities; any employee of such owner, manufacturer, lessor, lessee, or independent contractor) who violates any requirement of this part or of the Federal Rail Safety Laws or causes the violation of any such requirement is subject to a civil penalty of at least $650, but not more than $25,000 per violation, except that: Penalties may be assessed against individuals only for willful violations, and, where a grossly negligent violation or a pattern of repeated violations has created an imminent hazard of death or injury to persons, or has caused death or injury, a penalty not to exceed $105,000 per violation may be assessed. Each day a violation continues shall constitute a separate offense. Appendix B of this part contains a statement of agency civil penalty policy.
(c) Any person who knowingly and willfully falsifies a record or report required by this part is subject to criminal penalties under 49 U.S.C. 21311.
[77 FR 21342, Apr. 9, 2012, as amended at 77 FR 24421, Apr. 24, 2012]
229.9
Movement of non-complying locomotives.
(a) Except as provided in paragraphs (b), (c), §229.125(g), and §229.131(b) and (c)(1), a locomotive with one or more conditions not in compliance with this part may be moved only as a lite locomotive or a dead locomotive after the carrier has complied with the following:
(1) A qualified person shall determine—
(i) That it is safe to move the locomotive; and
(ii) The maximum speed and other restrictions necessary for safely conducting the movement;
(2)(i) The engineer in charge of the movement of the locomotive shall be notified in writing and inform all other crew members in the cab of the presence of the non-complying locomotive and the maximum speed and other restrictions determined under paragraph (a)(1)(ii) of this section.
(ii) A copy of the tag described in paragraph (a)(3) of this section may be used to provide the notification required by paragraph (a)(2)(i) of this section.
(3) A tag bearing the words “non-complying locomotive” and containing the following information, shall be securely attached to the control stand on each MU or control cab locomotive and to the isolation switch or near the engine start switch on every other type of locomotive—
(i) The locomotive number;
(ii) The name of the inspecting carrier;
(iii) The inspection location and date;
(iv) The nature of each defect;
(v) Movement restrictions, if any;
(vi) The destination; and
(vii) The signature of the person making the determinations required by this paragraph.
(b) A locomotive that develops a non-complying condition enroute may continue to utilize its propelling motors, if the requirements of paragraph (a) are otherwise fully met, until the earlier of—
(1) The next calendar day inspection, or
(2) The nearest forward point where the repairs necessary to bring it into compliance can be made.
(c) A non-complying locomotive may be moved lite or dead within a yard, at speeds not in excess of 10 miles per hour, without meeting the requirements of paragraph (a) of this section if the movement is solely for the purpose of repair. The carrier is responsible to insure that the movement may be safely made.
(d) A dead locomotive may not continue in use following a calendar day inspection as a controlling locomotive or at the head of a train or locomotive consist.
(e) A locomotive does not cease to be a locomotive because its propelling motor or motors are inoperative or because its control jumper cables are not connected.
(f) Nothing in this section authorizes the movement of a locomotive subject to a Special Notice for Repair unless the movement is made in accordance with the restrictions contained in the Special Notice.
(g) Paragraphs (a), (b), and (c) of this section shall not apply to sanitation conditions covered by §§229.137 and 229.139. Sections 229.137 and 229.139 set forth specific requirements for the movement and repair of locomotives with defective sanitation compartments.[45 FR 21109, Mar. 31, 1980, as amended at 61 FR 8887, Mar. 6, 1996; 67 FR 16050, Apr. 4, 2002; 72 FR 59223, Oct. 19, 2007]
229.11
Locomotive identification.
(a) The letter "F'' shall be legibly shown on each side of every locomotive near the end which for identification purposes will be known as the front end.
(b) The locomotive number shall be displayed in clearly legible numbers on each side of each locomotive.
229.13
Control of locomotives.
Except when a locomotive is moved in accordance with §229.9, whenever two or more locomotives are coupled in remote or multiple control, the propulsion system, the sanders, and the power brake system of each locomotive shall respond to control from the cab of the controlling locomotive. If a dynamic brake or regenerative brake system is in use, that portion of the system in use shall respond to control from the cab of the controlling locomotive.
229.14
Non-MU control cab locomotives.
On each non-MU control cab locomotive, only those components added to the passenger car that enable it to serve as a lead locomotive, control the locomotive actually providing tractive power, and otherwise control the movement of the train, are subject to this part.
229.15
Remote Control locomotives.
(a) Design and operation. (1) Each locomotive equipped with a locomotive control unit (LCU) shall respond only to the operator control units (OCUs) assigned to that receiver.
(2) If one or more OCUs are assigned to a LCU, the LCU shall respond only to the OCU that is in primary command. If a subsequent OCU is assigned to a LCU, the previous assignment will be automatically cancelled.
(3) If more than one OCU is assigned to a LCU, the secondary OCUs' man down feature, bell, horn, and emergency brake application functions shall remain active. The remote control system shall be designed so that if the signal from the OCU to the RCL is interrupted for a set period not to exceed five seconds, the remote control system shall cause:
(i) A full service application of the locomotive and train brakes; and
(ii) The elimination of locomotive tractive effort.
(4) Each OCU shall be designed to control only one RCL at a time. OCU's having the capability to control more than one RCL shall have a means to lock in one RCL “assignment address” to prevent simultaneous control over more than one locomotive.
(5) If an OCU is equipped with an “on” and “off” switch, when the switch is moved from the “on” to the “off” position, the remote control system shall cause:
(i) A full service application of the locomotive train brakes; and
(ii) The elimination of locomotive tractive effort.
(6) Each RCL shall have a distinct and unambiguous audible or visual warning device that indicates to nearby personnel that the locomotive is under active remote control operation.
(7) When the main reservoir pressure drops below 90 psi while the RCL is moving, the RCL shall initiate a full service application of the locomotive and train brakes, and eliminate locomotive tractive effort.
(8) When the air valves and the electrical selector switch on the RCL are moved from manual to remote control mode or from remote control to manual mode, an emergency application of the locomotive and train brakes shall be initiated.
(9) Operating control handles located in the RCL cab shall be removed, pinned in place, protected electronically, or otherwise rendered inoperable as necessary to prevent movement caused by the RCL's cab controls while the RCL is being operated by remote control.
(10) The RCL system (both the OCU and LCU), shall be designed to perform a self-diagnostic test of the electronic components of the system. The system shall be designed to immediately effect a full service application of the locomotive and train brakes and the elimination of locomotive tractive effort in the event a failure is detected.
(11) Each RCL shall be tagged at the locomotive control stand throttle indicating the locomotive is being used in a remote control mode. The tag shall be removed when the locomotive is placed back in manual mode.
(12) Each OCU shall have the following controls and switches and shall be capable of performing the following functions:
(i) Directional control;
(ii) Throttle or speed control;
(iii) Locomotive independent air brake application and release;
(iv) Automatic train air brake application and release control;
(v) Audible warning device control (horn);
(vi) Audible bell control, if equipped;
(vii) Sand control (unless automatic);
(viii) Bi-directional headlight control;
(ix) Emergency air brake application switch;
(x) Generator field switch or equivalent to eliminate tractive effort to the locomotive;
(xi) Audio/visual indication of wheel slip, only if an audio/visual indication is not provided by the RCL;
(xii) Activate the audio indication of movement that is located on the RCL for a duration of at least 3 seconds; and
(xiii) [Reserved]
(xiv) Require at least two separate actions by the RCO to begin movement of the RCL.
(13) Each OCU shall be equipped with the following features:
(i) A harness with a breakaway safety feature;
(ii) An operator alertness device that requires manual resetting or its equivalent. The alertness device shall incorporate a timing sequence not to exceed 60 seconds. Failure to reset the switch within the timing sequence shall cause a service application of the locomotive and train brakes, and the elimination of locomotive tractive effort; and,
(iii) A tilt feature that, when tilted to a predetermined angle, shall cause:
(A) An emergency application of the locomotive and train brakes, and the elimination of locomotive tractive effort; and
(B) If the OCU is equipped with a tilt bypass system that permits the tilt protection feature to be temporarily disabled, this bypass feature shall deactivate within 60 seconds on the primary OCU and within 60 seconds for all secondary OCUs, unless reactivated by the RCO.
(14) Each OCU shall be equipped with one of the following control systems:
(i) An automatic speed control system with a maximum 15 mph speed limiter; or
(ii) A graduated throttle and brake. A graduated throttle and brake control system built after September 6, 2012, shall be equipped with a speed limiter to a maximum of 15 mph.
(15) RCL systems built after September 6, 2012, shall be equipped to automatically notify the railroad in the event the RCO becomes incapacitated or OCU tilt feature is activated.
(16) RCL systems built prior to September 6, 2012, not equipped with automatic notification of operator incapacitated feature may not be utilized in one-person operation.
(b) Inspection, testing, and repair.
(1) Each time an OCU is linked to a RCL, and at the start of each shift, a railroad shall test:
(i) The air brakes and the OCU's safety features, including the tilt switch and alerter device; and
(ii) The man down/tilt feature automatic notification.
(2) An OCU shall not continue in use with any defective safety feature identified in paragraph (b)(1) of this section.
(3) A defective OCU shall be tracked under its own identification number assigned by the railroad. Records of repairs shall be maintained by the railroad and made available to FRA upon request.
(4) Each time an RCL is placed in service and at the first practical time after the start of each shift, but no more than 2 hours after the start of that shift, locomotives that utilize a positive train stop system, such as remote control pullback protection, shall perform a conditioning run over a track that the positive train stop system is being utilized on to ensure that the system functions as intended.
[77 FR 21342, Apr. 9, 2012, as amended at 77 FR 75056, Dec. 19, 2012]
229.17
Accident reports.
(a) In the case of an accident due to a failure from any cause of a locomotive or any part or appurtenance of a locomotive, or a person coming in contact with an electrically energized part or appurtenance, that results in serious injury or death of one or more persons, the carrier operating the locomotive shall immediately report the accident by toll free telephone, Area Code 800-424-0201. The report shall state the nature of the accident, number of persons killed or seriously injured, the place at which it occurred, the location at which the locomotive or the affected parts may be inspected by the FRA, and the name, title and phone number of the person making the call. The locomotive or the part or parts affected by the accident shall be preserved intact by the carrier until after the FRA inspection.
(b) Written confirmation of the oral report required by paragraph (a) of this section shall be immediately mailed to the Federal Railroad Administration, RRS-25, Washington, D.C. 20590, and contain a detailed description of the accident, including to the extent known, the causes and the number of persons killed and injured. The written report required by this paragraph is in addition to the reporting requirements of 49 CFR part 225.
[79 FR 21636, Apr. 17, 2014]
229.19
Prior waivers.
Waivers from any requirement of this part, issued prior to June 8, 2012, shall terminate on the date specified in the letter granting the waiver. If no date is specified, then the waiver shall automatically terminate on June 8, 2017.
[77 FR 21343, Apr. 9, 2012]
229.20
Electronic recordkeeping.
(a) For purposes of compliance with the recordkeeping requirements of this part, except for the daily inspection record maintained on the locomotive required by §229.21, the cab copy of Form FRA F 6180-49-A required by §229.23, the fragmented air brake maintenance record required by §229.27, and records required under §229.9, a railroad may create, maintain, and transfer any of the records required by this part through electronic transmission, storage, and retrieval provided that all of the requirements contained in this section are met.
(b) Design requirements. Any electronic record system used to create, maintain, or transfer a record required to be maintained by this part shall meet the following design requirements:
(1) The electronic record system shall be designed such that the integrity of each record is maintained through appropriate levels of security such as recognition of an electronic signature, or other means, which uniquely identify the initiating person as the author of that record. No two persons shall have the same electronic identity;
(2) The electronic system shall ensure that each record cannot be modified, or replaced, once the record is transmitted;
(3) Any amendment to a record shall be electronically stored apart from the record which it amends. Each amendment to a record shall uniquely identify the person making the amendment;
(4) The electronic system shall provide for the maintenance of inspection records as originally submitted without corruption or loss of data; and
(5) Policies and procedures shall be in place to prevent persons from altering electronic records, or otherwise interfering with the electronic system.
(c) Operational requirements. Any electronic record system used to create, maintain, or transfer a record required to be maintained by this part shall meet the following operating requirements:
(1) The electronic storage of any record required by this part shall be initiated by the person performing the activity to which the record pertains within 24 hours following the completion of the activity; and
(2) For each locomotive for which records of inspection or maintenance required by this part are maintained electronically, the electronic record system shall automatically notify the railroad each time the locomotive is due for an inspection, or maintenance that the electronic system is tracking. The automatic notification tracking requirement does not apply to daily inspections.
(d) Accessibility and availability requirements. Any electronic record system used to create, maintain, or transfer a record required to be maintained by this part shall meet the following access and availability requirements:
(1) Except as provided in §229.313(c)(2), the carrier shall provide FRA with all electronic records maintained for compliance with this part for any specific locomotives at any mechanical department terminal upon request;
(2) Paper copies of electronic records and amendments to those records that may be necessary to document compliance with this part, shall be provided to FRA for inspection and copying upon request. Paper copies shall be provided to FRA no later than 15 days from the date the request is made; and,
(3) Inspection records required by this part shall be available to persons who performed the inspection and to persons performing subsequent inspections on the same locomotive.
[77 FR 21343, Apr. 9, 2012, as amended at 77 FR 75056, Dec. 19, 2012]
Part 229 SUBPART B
Inspections and Tests
229.21 Daily inspection.
229.23 Periodic inspection: General.
229.25 Tests: Every periodic inspection.
229.27 Annual tests.
229.29 Biennial tests.
229.31 Main reservoir tests.
229.33 Out-of-use credit.
(a) Except for MU locomotives, each locomotive in use shall be inspected at least once during each calendar day. A written report of the inspection shall be made. This report shall contain the name of the carrier; the initials and number of the locomotive; the place, date and time of the inspection; a description of the non-complying conditions disclosed by the inspection; and the signature of the employee making the inspection. Except as provided in §§229.9, 229.137, and 229.139, any conditions that constitute non-compliance with any requirement of this part shall be repaired before the locomotive is used. Except with respect to conditions that do not comply with §229.137 or §229.139, a notation shall be made on the report indicating the nature of the repairs that have been made. Repairs made for conditions that do not comply with §229.137 or §229.139 may be noted on the report, or in electronic form. The person making the repairs shall sign the report. The report shall be filed and retained for at least 92 days in the office of the carrier at the terminal at which the locomotive is cared for. A record shall be maintained on each locomotive showing the place, date and time of the previous inspection.
(b) Each MU locomotive in use shall be inspected at least once during each calendar day and a written report of the inspection shall be made. This report may be part of a single master report covering an entire group of MU's. If any non-complying conditions are found, a separate, individual report shall be made containing the name of the carrier; the initials and number of the locomotive; the place, date, and time of the inspection; the non-complying conditions found; and the signature of the inspector. Except as provided in §§229.9, 229.137, and 229.139, any conditions that constitute non-compliance with any requirement of this part shall be repaired before the locomotive is used. Except with respect to conditions that do not comply with §229.137 or §229.139, a notation shall be made on the report indicating the nature of the repairs that have been made. Repairs made for conditions that do not comply with §229.137 or §229.139 may be noted on the report, or in electronic form. A notation shall be made on the report indicating the nature of the repairs that have been made. The person making the repairs shall sign the report. The report shall be filed in the office of the carrier at the place where the inspection is made or at one central location and retained for at least 92 days.
(c) Each carrier shall designate qualified persons to make the inspections required by this section.
[45 FR 21109, Mar. 31, 1980, as amended at 50 FR 6953, Feb. 19, 1985; 67 FR 16050, Apr. 4, 2012]
(a) Each locomotive shall be inspected at each periodic inspection to determine whether it complies with this part. Except as provided in §229.9, all non-complying conditions shall be repaired before the locomotive is used. Except as provided in §229.33 and paragraph (b) of this section, the interval between any two periodic inspections may not exceed 92 days. Periodic inspections shall only be made where adequate facilities are available. At each periodic inspection, a locomotive shall be positioned so that a person may safely inspect the entire underneath portion of the locomotive.
(b) For each locomotive equipped with advanced microprocessor-based on-board electronic condition monitoring controls:
(1) The interval between periodic inspections shall not exceed 184 days; and
(2) At least once each 33 days, the daily inspection required by §229.21, shall be performed by a qualified mechanical inspector as defined by §229.5. A record of the inspection that contains the name of the person performing the inspection and the date that it was performed shall be maintained in the locomotive cab until the next periodic inspection is performed.
(c) Each new locomotive shall receive an initial periodic inspection before it is used.
(d) At the initial periodic inspection, the date and place of the last tests performed that are the equivalent of the tests required by §§229.27, 229.29, and 229.31 shall be entered on Form FRA F 6180-49A. These dates shall determine when the tests first become due under §§229.27, 229.29, and 229.31. Out of use credit may be carried over from Form FRA F 6180-49 and entered on Form FRA F 6180-49A.
(e) Each periodic inspection shall be recorded on Form FRA F 6180-49A. The form shall be signed by the person conducting the inspection and certified by that person's supervisor that the work was done. The form shall be displayed under a transparent cover in a conspicuous place in the cab of each locomotive. A railroad maintaining and transferring records as provided for in §229.20 shall print the name of the person who performed the inspections, repairs, or certified work on the Form FRA F 6180-49A that is displayed in the cab of each locomotive.
(f) At the first periodic inspection in each calendar year, the carrier shall remove from each locomotive Form FRA F 6180-49A covering the previous calendar year. If a locomotive does not receive its first periodic inspection in a calendar year before April 2, or July 3 if it's a locomotive equipped with advanced microprocessor-based on-board electronic condition monitoring controls, because it is out of use, the form shall be promptly replaced. The Form FRA F 6180-49A covering the preceding year for each locomotive, in or out of use, shall be signed by the railroad official responsible for the locomotive and filed as required in §229.23(f). The date and place of the last periodic inspection and the date and place of the last tests performed under §§229.27, 229.29, and 229.31 shall be transferred to the replacement Form FRA F 6180-49A.
(g) The railroad mechanical officer who is in charge of a locomotive shall maintain in his office a secondary record of the information reported on Form FRA F 6180-49A. The secondary record shall be retained until Form FRA F 6180-49A has been removed from the locomotive and filed in the railroad office of the mechanical officer in charge of the locomotive. If the Form FRA F 6180-49A removed from the locomotive is not clearly legible, the secondary record shall be retained until the Form FRA F 6180-49A for the succeeding year is filed. The Form F 6180-49A removed from a locomotive shall be retained until the Form FRA F 6180-49A for the succeeding year is filed.
(h) The railroad shall maintain, and provide employees performing inspections under this section with, a list of the defects and repairs made on each locomotive since the date that the last inspection required by this section was performed;
(i) The railroad shall provide employees performing inspections under this section with a document containing all tests conducted since the last periodic inspection, and procedures needed to perform the inspection.
[77 FR 21344, Apr. 9, 2012, as amended at 77 FR 75056, Dec. 19, 2012]
229.25
Tests: Every periodic inspection.
Each periodic inspection shall include the following:
(a) All mechanical gauges used by the engineer to aid in the control or braking of the train or locomotive, except load meters used in conjunction with an auxiliary brake system, shall be tested by comparison with a dead-weight tester or a test gauge designed for this purpose.
(b) All electrical devices and visible insulation shall be inspected.
(c) All cable connections between locomotives and jumpers that are designed to carry 600 volts or more shall be thoroughly cleaned, inspected, and tested for continuity.
(d) Event recorder. A microprocessor-based self-monitoring event recorder, if installed, is exempt from periodic inspection under paragraphs (d)(1) through (5) of this section and shall be inspected annually as required by §229.27(c). Other types of event recorders, if installed, shall be inspected, maintained, and tested in accordance with instructions of the manufacturer, supplier, or owner thereof and in accordance with the following criteria:
(1) A written or electronic copy of the instructions in use shall be kept at the point where the work is performed and a hard-copy version, written in the English language, shall be made available upon request to FRA.
(2) The event recorder shall be tested before any maintenance work is performed on it. At a minimum, the event recorder test shall include cycling, as practicable, all required recording elements and determining the full range of each element by reading out recorded data.
(3) If the pre-maintenance test reveals that the device is not recording all the specified data and that all recordings are within the designed recording elements, this fact shall be noted, and maintenance and testing shall be performed as necessary until a subsequent test is successful.
(4) When a successful test is accomplished, a copy of the data-verification results shall be maintained in any medium with the maintenance records for the locomotive until the next one is filed.
(5) A railroad's event recorder periodic maintenance shall be considered effective if 90 percent of the recorders on locomotives inbound for periodic inspection in any given calendar month are still fully functional; maintenance practices and test intervals shall be adjusted as necessary to yield effective periodic maintenance.
(e) Remote control locomotive. Remote control locomotive system components that interface with the mechanical devices of the locomotive shall be tested including, but not limited to, air pressure monitoring devices, pressure switches, and speed sensors.
(f) Alerters. The alerter shall be tested, and all automatic timing resets shall function as intended.
[45 FR 21109, Mar. 31, 1980, as amended at 58 FR 36614, July 8, 1993; 60 FR 27905, May 26, 1995; 66 FR 4192, Jan. 17, 2001; 70 FR 37939, June 30, 2005; 77 FR 21344, Apr. 9, 2012]
229.27
Annual tests.
(a) All testing under this section shall be performed at intervals that do not exceed 368 calendar days.
(b) Load meters that indicate current (amperage) being applied to traction motors shall be tested. Each device used by the engineer to aid in the control or braking of the train or locomotive that provides an indication of air pressure electronically shall be tested by comparison with a test gauge or self-test designed for this purpose. An error greater than five percent or greater than three pounds per square inch shall be corrected. The date and place of the test shall be recorded on Form FRA F 6180-49A, and the person conducting the test and that person's supervisor shall sign the form.
(c) A microprocessor-based event recorder with a self-monitoring feature equipped to verify that all data elements required by this part are recorded, requires further maintenance and testing only if either of the following conditions exist:
(1) The self-monitoring feature displays an indication of a failure. If a failure is displayed, further maintenance and testing must be performed until a subsequent test is successful. When a successful test is accomplished, a record, in any medium, shall be made of that fact and of any maintenance work necessary to achieve the successful result. This record shall be available at the location where the locomotive is maintained until a record of a subsequent successful test is filed; or,
(2) A download of the event recorder, taken within the preceding 30 days and reviewed for the previous 48 hours of locomotive operation, reveals a failure to record a regularly recurring data element or reveals that any required data element is not representative of the actual operations of the locomotive during this time period. If the review is not successful, further maintenance and testing shall be performed until a subsequent test is successful. When a successful test is accomplished, a record, in any medium, shall be made of that fact and of any maintenance work necessary to achieve the successful result. This record shall be kept at the location where the locomotive is maintained until a record of a subsequent successful test is filed. The download shall be taken from information stored in the certified crashworthy crash hardened event recorder memory module if the locomotive is so equipped.
[77 FR 21345, Apr. 9, 2012]
229.29
Air brake system calibration, maintenance, and testing.
(a) A locomotive's air brake system shall receive the calibration, maintenance, and testing as prescribed in this section. The level of maintenance and testing and the intervals for receiving such maintenance and testing of locomotives with various types of air brake systems shall be conducted in accordance with paragraphs (d) through (f) of this section. Records of the maintenance and testing required in this section shall be maintained in accordance with paragraph (g) of this section.
(b) Except for DMU or MU locomotives covered under §238.309 of this chapter, the air flow method (AFM) indicator shall be calibrated in accordance with §232.205(c)(1)(iii) at intervals not to exceed 92 days, and records shall be maintained as prescribed paragraph (g)(1) of this section.
(c) Except for DMU or MU locomotives covered under §238.309 of this chapter, the extent of air brake system maintenance and testing that is required on a locomotive shall be in accordance with the following levels:
(1) Level one: Locomotives shall have the filtering devices or dirt collectors located in the main reservoir supply line to the air brake system cleaned, repaired, or replaced.
(2) Level two: Locomotives shall have the following components cleaned, repaired, and tested: brake cylinder relay valve portions; main reservoir safety valves; brake pipe vent valve portions; and, feed and reducing valve portions in the air brake system (including related dirt collectors and filters).
(3) Level three: Locomotives shall have the components identified in this paragraph removed from the locomotive and disassembled, cleaned and lubricated (if necessary), and tested. In addition, all parts of such components that can deteriorate within the inspection interval as defined in paragraphs (d) through (f) of this section shall be replaced and tested. The components include: all pneumatic components of the locomotive equipment's brake system that contain moving parts, and are sealed against air leaks; all valves and valve portions; electric-pneumatic master controllers in the air brake system; and all air brake related filters and dirt collectors.
(d) Except for MU locomotives covered under §238.309 of this chapter, all locomotives shall receive level one air brake maintenance and testing as described in this section at intervals that do not exceed 368 days.
(e) Locomotives equipped with an air brake system not specifically identified in paragraphs (f)(1) through (3) of this section shall receive level two air brake maintenance and testing as described in this section at intervals that do not exceed 368 days and level three air brake maintenance and testing at intervals that do not exceed 736 days.
(f) Level two and level three air brake maintenance and testing shall be performed on each locomotive identified in this paragraph at the following intervals:
(1) At intervals that do not exceed 1,104 days for a locomotive equipped with a 26-L or equivalent brake system;
(2) At intervals that do not exceed 1,472 days for locomotives equipped with an air dryer and a 26-L or equivalent brake system and for locomotives not equipped with an air compressor and that are semi-permanently coupled and dedicated to locomotives with an air dryer; or
(3) At intervals that do not exceed 1,840 days for locomotives equipped with CCB-1, CCB-2, CCB-26, EPIC 1 (formerly EPIC 3102), EPIC 3102D2, EPIC 2, KB-HS1, or Fastbrake brake systems.
(g) Records of the air brake system maintenance and testing required by this section shall be generated and maintained in accordance with the following:
(1) The date of AFM indicator calibration shall be recorded and certified on Form F6180-49A.
(2) The date and place of the cleaning, repairing and testing required by this section shall be recorded on Form FRA F 6180-49A, and the work shall be certified. A record of the parts of the air brake system that are cleaned, repaired, and tested shall be kept in the railroad's files or in the cab of the locomotive.
(3) At its option, a railroad may fragment the work required by this section. In that event, a separate record shall be maintained under a transparent cover in the cab. The air record shall include: the locomotive number; a list of the air brake components; and the date and place of the inspection and testing of each component. The signature of the person performing the work and the signature of that person's supervisor shall be included for each component. A duplicate record shall be maintained in the railroad's files.
[77 FR 21345, Apr. 9, 2012, as amended at 77 FR 75057, Dec. 19, 2012]
229.31
Main reservoir tests.
(a) Before it is placed in service, each main reservoir other than an aluminum reservoir shall be subjected to a pneumatic or hydrostatic pressure of at least 25 percent more than the maximum working pressure fixed by the chief mechanical officer. The test date, place, and pressure shall be recorded on Form FRA F 6180-49A, block eighteen. Except as provided in paragraph (c) of this section, at intervals that do not exceed 736 calendar days, each main reservoir other than an aluminum reservoir shall be subjected to a hydrostatic pressure of at least 25 percent more than the maximum working pressure fixed by the chief mechanical officer. The test date, place, and pressure shall be recorded on Form FRA F 6180-49A, and the person performing the test and that person's supervisor shall sign the form.
(b) Except as provided in paragraph (c) of this section, each main reservoir other than an aluminum reservoir shall be hammer tested over its entire surface while the reservoir is empty at intervals that do not exceed 736 calendar days. The test date and place shall be recorded on Form FRA F 6180-49A, and the person performing the test and that person's supervisor shall sign the form.
(c) Each welded main reservoir originally constructed to withstand at least five times the maximum working pressure fixed by the chief mechanical officer may be drilled over its entire surface with telltale holes that are three-sixteenths of an inch in diameter. The holes shall be spaced not more than 12 inches apart, measured both longitudinally and circumferentially, and drilled from the outer surface to an extreme depth determined by the formula—
D = (.6PR/S-0.6P)
Where:
D = extreme depth of telltale holes in inches but in no case less than one-sixteenth inch;
P = certified working pressure in pounds per square inch;
S = one-fifth of the minimum specified tensile strength of the material in pounds per square inch; and
R = inside radius of the reservoir in inches.
One row of holes shall be drilled lengthwise of the reservoir on a line intersecting the drain opening. A reservoir so drilled does not have to meet the requirements of paragraphs (a) and (b) of this section, except the requirement for a pneumatic or hydrostatic test before it is placed in use. Whenever any such telltale hole shall have penetrated the interior of any reservoir, the reservoir shall be permanently withdrawn from service. A reservoir now in use may be drilled in lieu of the tests provided for by paragraphs (a) and (b) of this section, but shall receive a hydrostatic test before it is returned to use or may receive a pneumatic test if conducted by the manufacturer in an appropriately safe environment.
(d) Each aluminum main reservoir before being placed in use and at intervals that do not exceed 736 calendar days thereafter, shall be—
(1) Cleaned and given a thorough visual inspection of all internal and external surfaces for evidence of defects or deterioration; and
(2) Subjected to a hydrostatic pressure at least twice the maximum working pressure fixed by the chief mechanical officer, but not less than 250 p.s.i. The test date, place, and pressure shall be recorded on Form FRA F 6180-49A, and the person conducting the test and that person's supervisor shall sign the form.
[45 FR 21109, Mar. 31, 1980, as amended at 71 FR 61857, Oct. 19, 2006]
229.33
Out-of-use credit.
When a locomotive is out of use for 30 or more consecutive days or is out of use when it is due for any test or inspection required by §229.23, 229.25, 229.27, 229.29, or 229.31, an out-of-use notation showing the number of out-of-use days shall be made on an inspection line on Form FRA F 6180-49A. A supervisory employee of the carrier who is responsible for the locomotive shall attest to the notation. If the locomotive is out of use for one or more periods of at least 30 consecutive days each, the interval prescribed for any test or inspection under this part may be extended by the number of days in each period the locomotive is out of use since the last test or inspection in question. A movement made in accordance with §229.9 is not a use for purposes of determining the period of the out-of-use credit.
Part 229 Subpart C
Safety Requirements
General Requirements
229.41 Protection against personal injury.
229.43 Exhaust and battery gases.
229.45 General condition.
Brake System
229.46 Brakes: General.
229.47 Emergency brake value.
229.49 Main reservoir system.
229.51 Aluminum main reservoirs.
229.53 Brake gauges.
229.55 Piston travel.
229.57 Foundation brake gear.
229.59 Leakage.
Draft System
229.61 Draft system.
Suspension System
229.63 Lateral motion.
229.64 Plain bearings.
229.65 Spring rigging.
229.67 Trucks.
229.69 Side bearings.
229.71 Clearance above top of rail.
229.73 Wheel sets.
229.75 Wheels and tire defects.
Electrical System
229.77 Current collectors.
229.79 Third rail shoes.
229.81 Emergency pole; shoe insulation.
229.83 Insulation or grounding of metal parts.
229.85 Doors and cover plates marked "Danger''.
229.87 Hand-operated switches.
229.89 Jumpers; cable connections.
229.91 Motors and generators.
Internal Combustion Equipment
229.93 Safety cut-off device.
229.95 Venting.
229.97 Grounding fuel tanks.
229.99 Safety hangers.
229.101 Engines.
Steam Generators
229.103 Safe working pressure; factor of safety.
229.105 Steam generator number.
229.107 Pressure gauge.
229.109 Safety valves.
229.111 Water-flow indicator.
229.113 Warning notice.
Cabs and Cab Equipment
229.115 Slip/slide alarms.
229.117 Speed indicators.
229.119 Cabs, floors, and passageways.
229.121 Locomotive cab noise.
229.123 Pilots, snowplows, end plates.
229.125 Headlights and auxiliary lights.
229.127 Cab lights.
229.129 Audible warning device.
229.131 Sanders.
229.133 Interim locomotive conspicuity measures-auxiliary external lights.
229.135 Event recorders.
229.137 Sanitation, general requirements.
229.139 Sanitation, servicing requirements.
229.41
General Requirements
Protection against personal injury.
Fan openings, exposed gears and pinions, exposed moving parts of mechanisms, pipes carrying hot gases and high-voltage equipment, switches, circuit breakers, contactors, relays, grid resistors, and fuses shall be in non-hazardous locations or equipped with guards to prevent personal injury.
229.43
Exhaust and battery gases.
(a) Products of combustion shall be released entirely outside the cab and other compartments. Exhaust stacks shall be of sufficient height or other means provided to prevent entry of products of combustion into the cab or other compartments under usual operating conditions.
(b) Battery containers shall be vented and batteries kept from gassing excessively.
229.45
General condition.
All systems and components on a locomotive shall be free of conditions that endanger the safety of the crew, locomotive or train. These conditions include: insecure attachment of components, including third rail shoes or beams, traction motors and motor gear cases, and fuel tanks; fuel, oil, water, steam, and other leaks and accumulations of oil on electrical equipment that create a personal injury hazard; improper functioning of components, including slack adjusters, pantograph operating cylinders, circuit breakers, contactors, relays, switches, and fuses; and cracks, breaks, excessive wear and other structural infirmities of components, including quill drives, axles, gears, pinions, pantograph shoes and horns, third rail beams, traction motor gear cases, and fuel tanks.
229.46
Brake System
Brakes: General.
(a) Before each trip, the railroad shall know the following:
(1) The locomotive brakes and devices for regulating pressures, including but not limited to the automatic and independent brake control systems, operate as intended; and
(2) The water and oil have been drained from the air brake system of all locomotives in the consist.
(b) A locomotive with an inoperative or ineffective automatic or independent brake control system will be considered to be operating as intended for purposes of paragraph (a) of this section, if all of the following conditions are met:
(1) The locomotive is in a trailing position and is not the controlling locomotive in a distributed power train consist;
(2) The railroad has previously determined, in conjunction with the locomotive and/or airbrake manufacturer, that placing such a locomotive in trailing position adequately isolates the non-functional valves so as to allow safe operation of the brake systems from the controlling locomotive;
(3) If deactivation of the circuit breaker for the air brake system is required, it shall be specified in the railroad's operating rules;
(4) A tag shall immediately be placed on the isolation switch of the locomotive giving the date and location and stating that the unit may only be used in a trailing position and may not be used as a lead or controlling locomotive;
(5) The tag required in paragraph (b)(4) of this section remains attached to the isolation switch of the locomotive until repairs are made; and
(6) The inoperative or ineffective brake control system is repaired prior to or at the next periodic inspection.
[77 FR 21346, Apr. 9, 2012]
229.47
Emergency brake value.
(a) Except for locomotives with cabs designed for occupancy by only one person, each road locomotive shall be equipped with a brake pipe valve that is accessible to a member of the crew, other than the engineer, from that crew member's position in the cab. On car body type locomotives, a brake pipe valve shall be attached to the wall adjacent to each end exit door. The words “Emergency Brake Valve” shall be legibly stenciled or marked near each brake pipe valve or shall be shown on an adjacent badge plate.
(b) DMU, MU, and control cab locomotives operated in road service shall be equipped with an emergency brake valve that is accessible to another crew member in the passenger compartment or vestibule. The words “Emergency Brake Valve” shall be legibly stenciled or marked near each valve or shall be shown on an adjacent badge plate.
[45 FR 21109, Mar. 31, 1980, as amended at 71 FR 61857, Oct. 19, 2006]
229.49
Main reservoir system.
(a)(1) The main reservoir system of each locomotive shall be equipped with at least one safety valve that shall prevent an accumulation of pressure of more than 15 pounds per square inch above the maximum working air pressure fixed by the chief mechanical officer of the carrier operating the locomotive.
(2) Except for non-equipped MU locomotives built prior to January 1, 1981, each locomotive that has a pneumatically actuated system of power controls shall be equipped with a separate reservoir of air under pressure to be used for operating those power controls. The reservoir shall be provided with means to automatically prevent the loss of pressure in the event of a failure of main air pressure, have storage capacity for not less than three complete operating cycles of control equipment and be located where it is not exposed to damage.
(b) A governor shall be provided that stops and starts or unloads and loads the air compressor within 5 pounds per square inch above or below the maximum working air pressure fixed by the carrier.
(c) Each compressor governor used in connection with the automatic air brake system shall be adjusted so that the compressor will start when the main reservoir pressure is not less than 15 pounds per square inch above the maximum brake pipe pressure fixed by the carrier and will not stop the compressor until the reservoir pressure has increased at least 10 pounds.
229.51
Aluminum main reservoirs.
(a) Aluminum main reservoirs used on locomotives shall be designed and fabricated as follows:
(1) The heads and shell shall be made of Aluminum Association Alloy No. 5083-0, produced in accordance with American Society of Mechnical Engineers (ASME) Specification SB-209, as defined in the "ASME Boiler and Pressure Vessel Code'' (1971 edition), section II, Part B, page 123, with a minimum tensile strength of 40,000 p.s.i. (40 k.s.i.).
(2) Each aluminum main reservoir shall be designed and fabricated in accordance with the "ASME Boiler and Pressure Vessel Code,'' section VIII, Division I (1971 edition), except as otherwise provided in this part.
(3) An aluminum main reservoir shall be constructed to withstand at least five times its maximum working pressure or 800 p.s.i., whichever is greater.
(4) Each aluminum main reservoir shall have at least two inspection openings to permit complete circumferential visual observation of the interior surface. On reservoirs less than 18 inches in diameter, the size of each inspection opening shall be at least that of 11/2-inch threaded iron pipe, and on reservoirs 18 or more inches in diameter, the size of each opening shall be at least that of 2-inch threaded iron pipe.
(b) The following publications, which contain the industry standards incorporated by reference in paragraph (a) of this section, may be obtained from the publishers and are also on file in the Office of Safety of the Federal Railroad Administration, Washington, DC 20590. Sections II and VIII of the "ASME Boiler and Pressure Vessel Code'' (1971 edition) are published by the American Society of Mechanical Engineers, United Engineering Center, 345 East 47th Street, New York, New York 10017.
229.53
Brake gauges.
All mechanical gauges and all devices providing indication of air pressure electronically that are used by the engineer to aid in the control or braking of the train or locomotive shall be located so that they may be conveniently read from the engineer's usual position during operation of the locomotive. A gauge or device shall not be more than five percent or three pounds per square inch in error, whichever is less.
[66 FR 4104, January 17, 2001]
229.55
Piston travel.
(a) Brake cylinder piston travel shall be sufficient to provide brake shoe clearance when the brakes are released.
(b) When the brakes are applied on a standing locomotive, the brake cylinder piston travel may not exceed 11/2 inches less than the total possible piston travel. The total possible piston travel for each locomotive shall be entered on Form FRA F 6180-49A.
(c) The minimum brake cylinder pressure shall be 30 pounds per square inch.
229.57
Foundation brake gear.
A lever, rod, brake beam, hanger, or pin may not be worn through more than 30 percent of its cross-sectional area, cracked, broken, or missing. All pins shall be secured in place with cotters, split keys, or nuts. Brake shoes shall be fastened with a brake shoe key and aligned in relation to the wheel to prevent localized thermal stress in the edge of the rim or the flange.
229.59
Leakage.
(a) Leakage from the main air reservoir and related piping may not exceed an average of 3 pounds per square inch per minute for 3 minutes after the pressure has been reduced to 60 percent of the maximum pressure.
(b) Brake pipe leakage may not exceed 5 pounds per square inch per minute.
(c) With a full service application at maximum brake pipe pressure and with communication to the brake cylinders closed, the brakes shall remain applied at least 5 minutes.
(d) Leakage from control air reservoir, related piping, and pneumatically operated controls may not exceed an average of 3 pounds per square inch per minute for 3 minutes.
229.61
Draft System
Draft system.
(a) A coupler may not have any of the following conditions:
(1) A distance between the guard arm and the knuckle nose of more than 51/8 inches on standard type couplers (MCB contour 1904) or more than 55/16 inches on D&E couplers.
(2) A crack or break in the side wall or pin bearing bosses outside of the shaded areas shown in Figure 1 or in the pulling face of the knuckle.
(3) A coupler assembly without anti-creep protection.
(4) Free slack in the coupler or drawbar not absorbed by friction devices or draft gears that exceeds one-half inches.
(5) A broken or cracked coupler carrier.
(6) A broken or cracked yoke.
(7) A broken draft gear.
(b) A device shall be provided under the lower end of all drawbar pins and articulated connection pins to prevent the pin from falling out of place in case of breakage.
229.63
Suspension System
Lateral motion.
(a) Except as provided in paragraph (b), the total uncontrolled lateral motion between the hubs of the wheels and boxes, between boxes and pedestals or both, on any pair of wheels may not exceed 1 inch on non-powered axles and friction bearing powered axles, or 3/4 inch on all other powered axles.
(b) The total uncontrolled lateral motion may not exceed 11/4 inches on the center axle of three-axle trucks.
229.64
Plain bearings.
A plain bearing box shall contain visible free oil and may not be cracked to the extent that it will leak oil.
229.65
Spring rigging.
(a) Protective construction or safety hangers shall be provided to prevent spring planks, spring seats or bolsters from dropping to track structure in event of a hanger or spring failure.
(b) An elliptical spring may not have its top (long) leaf broken or any other three leaves broken, except when that spring is part of a nest of three or more springs and none of the other springs in the nest has its top leaf or any other three leaves broken. An outer coil spring or saddle may not be broken. An equalizer, hanger, bolt, gib, or pin may not be cracked or broken. A coil spring may not be fully compressed when the locomotive is at rest.
(c) A shock absorber may not be broken or leaking clearly formed droplets of oil or other fluid.
229.67
Trucks.
(a) The male center plate shall extend into the female center plate at least 3/4 inch. On trucks constructed to transmit tractive effort through the center plate or center pin, the male center plate shall extend into the female center plate at least 11/2 inches. Maximum lost motion in a center plate assemblage may not exceed 1/2 inch.
(b) Each locomotive shall have a device or securing arrangement to prevent the truck and locomotive body from separating in case of derailment.
(c) A truck may not have a loose tie bar or a cracked or broken center casting, motor suspension lug, equalizer, hanger, gib or pin. A truck frame may not be broken or have a crack in a stress area that may affect its structural integrity.
229.69
Side bearings.
(a) Friction side bearings with springs designed to carry weight may not have more than 25 percent of the springs in any one nest broken.
(b) Friction side bearings may not be run in contact unless designed to carry weight. Maximum clearance of side bearings may not exceed one-fourth inch on each side or a total of one-half inch on both sides, except where more than two side bearings are used under the same rigid superstructure. The clearance on one pair of side bearings under the same rigid superstructure shall not exceed one-fourth inch on each side or a total of one-half inch on both sides; the other side bearings under the same rigid superstructure may have one-half inch clearance on each side or a total of 1 inch on both sides. These clearances apply where the spread of the side bearings is 50 inches or less; where the spread is greater, the side bearing clearance may only be increased proportionately.
229.71
Clearance above top of rail.
No part or appliance of a locomotive except the wheels, flexible nonmetallic sand pipe extension tips, and trip cock arms may be less than 21/2 inches above the top of rail.
229.73
Wheel sets.
(a) The variation in the circumference of wheels on the same axle may not exceed 1/4 inch (two tape sizes) when applied or turned.
(b) The maximum variation in the diameter between any two wheel sets in a three-powered-axle truck may not exceed 3/4 inch, except that when shims are used at the journal box springs to compensate for wheel diameter variation, the maximum variation may not exceed 1/4 inch. The maximum variation in the diameter between any two wheel sets on different trucks on a locomotive that has three-powered-axle trucks may not exceed 1/4 inch. The diameter of a wheel set is the average diameter of the two wheels on an axle.
(c) On standard gauge locomotives, the distance between the inside gauge of the flanges on non-wide flange wheels may not be less than 53 inches or more than 53 1/2 inches. The distance between the inside gauge of the flanges on wide flange wheels may not be less than 53 inches or more than 53 1/4 inches.
(d) The distance back to back of flanges of wheels mounted on the same axle shall not vary more than 1/4 inch.
229.75
Wheels and tire defects.
Wheels and tires may not have any of the following conditions:
(a) A single flat spot that is 21/2 inches or more in length, or two adjoining spots that are each two or more inches in length.
(b) A gouge or chip in the flange that is more than 11/2 inches in length and 1/2 inch in width.
(c) A broken rim, if the tread, measured from the flange at a point five-eighths inch above the tread, is less than 33/4 inches in width.
(d) A shelled-out spot 21/2 inches or more in length, or two adjoining spots that are each two or more inches in length.
(e) A seam running lengthwise that is within 33/4 inches of the flange.
(f) A flange worn to a 7/8 inch thickness or less, gauged at a point 3/8 inch above the tread.
(g) A tread worn hollow 5/16 inch or more on a locomotive in road service or 3/8 inch or more on a locomotive in switching service.
(h) A flange height of 11/2 inches or more measured from tread to the top of the flange.
(i) Tires less than 11/2 inches thick.
(j) Rims less than 1 inch thick on a locomotive in road service or less than 3/4 inch on a locomotive in yard service.
(k) A crack or break in the flange, tread, rim, plate, or hub.
(l) A loose wheel or tire.
(m) Fusion welding may not be used on tires or steel wheels of locomotives, except for the repair of flat spots and worn flanges on locomotives used exclusively in yard service. A wheel that has been welded is a welded wheel for the life of the wheel.
Electrical System
229.77
Current collectors.
(a) Pantographs shall be so arranged that they can be operated from the engineer's normal position in the cab. Pantographs that automatically rise when released shall have an automatic locking device to secure them in the down position.
(b) Each pantograph operating on an overhead trolley wire shall have a device for locking and grounding it in the lowest position, that can be applied and released only from a position where the operator has a clear view of the pantograph and roof without mounting the roof.
229.79
Third rail shoes.
When locomotives are equipped with both third rail and overhead collectors, third-rail shoes shall be deenergized while in yards and at stations when current collection is exclusively from the overhead conductor.
229.81
Emergency pole; shoe insulation.
(a) Each locomotive equipped with a pantograph operating on an overhead trolley wire shall have an emergency pole suitable for operating the pantograph. Unless the entire pole can be safely handled, the part of the pole which can be safely handled shall be marked to so indicate. This pole shall be protected from moisture when not in use.
(b) Each locomotive equipped with third-rail shoes shall have a device for insulating the current collecting apparatus from the third rail.
229.83
Insulation or grounding of metal parts.
All unguarded noncurrent-carrying metal parts subject to becoming charged shall be grounded or thoroughly insulated.
229.85
All doors and cover plates guarding high voltage equipment shall be marked "Danger-High Voltage'' or with the word "Danger'' and the normal voltage carried by the parts so protected.
229.87
Hand-operated switches.
All hand-operated switches carrying currents with a potential of more than 150 volts that may be operated while under load shall be covered and shall be operative from the outside of the cover. Means shall be provided to show whether the switches are open or closed. Switches that should not be operated while under load shall be legibly marked with the words "must not be operated under load'' and the voltage carried.
229.89
Jumpers; cable connections.
(a) Jumpers and cable connections between locomotives shall be so located and guarded to provide sufficient vertical clearance. They may not hang with one end free.
(b) Cable and jumper connections between locomotive may not have any of the following conditions:
(1) Broken or badly chafed insulation.
(2) Broken plugs, receptacles or terminals.
(3) Broken or protruding strands of wire.
229.91
Motors and generators.
A motor or a generator may not have any of the following conditions:
(a) Be shorted or grounded.
(b) Throw solder excessively.
(c) Show evidence of coming apart.
(d) Have an overheated support bearing.
(e) Have an excessive accumulation of oil.
Internal Combustion Equipment
229.93
Safety cut-off device.
The fuel line shall have a safety cut-off device that-
(a) Is located adjacent to the fuel supply tank or in another safe location;
(b) Closes automatically when tripped and can be reset without hazard; and
(c) Can be hand operated from clearly marked locations, one inside the cab and one on each exterior side of the locomotive.
229.95
Venting.
Fuel tank vent pipes may not discharge on the roof nor on or between the rails.
229.97
Grounding fuel tanks.
Fuel tanks and related piping shall be electrically grounded.
229.99
Safety hangers.
Drive shafts shall have safety hangers.
229.101
Engines.
(a) The temperature and pressure alarms, controls and related switches of internal combustion engines shall function properly.
(b) Whenever an engine has been shut down due to mechanical or other problems, a distinctive warning notice giving reason for the shut-down shall be conspicuously attached near the engine starting control until repairs have been made.
(c) Wheel slip/slide protection shall be provided on a locomotive with an engine displaying a warning notice whenever required by §229.115(b).
Steam Generators
229.103
Safe working pressure; factor of safety.
The safe working pressure for each steam generator shall be fixed by the chief mechanical officer of the carrier. The minimum factor of safety shall be four. The fixed safe working pressure shall be indicated on FRA Form F 6180-49A.
229.105
Steam generator number.
An identification number shall be marked on the steam generator's separator and that number entered on FRA Form F 6180-49A.
229.107
Pressure gauge.
(a) Each steam generator shall have an illuminated steam gauge that correctly indicates the pressure. The steam pressure gauge shall be graduated to not less than one and one-half times the allowed working pressure of the steam generator.
(b) Each steam pressure gauge on a steam generator shall have a siphon that prevents steam from entering the gauge. The pipe connection shall directly enter the separator and shall be steam tight between the separator and the gauge.
229.109
Safety valves.
Every steam generator shall be equipped with at least two safety valves that have a combined capacity to prevent an accumulation of pressure of more than five pounds per square inch above the allowed working pressure. The safety valves shall be independently connected to the separator and located as closely to the separator as possible without discharging inside of the generator compartment. The ends of the safety valve discharge lines shall be located or protected so that discharged steam does not create a hazard.
229.111
Water-flow indicator.
(a) Steam generators shall be equipped with an illuminated visual return water-flow indicator.
(b) Steam generators shall be equipped with an operable test valve or other means of determining whether the steam generator is filled with water. The fill test valve may not discharge steam or hot water into the steam generator compartment.
229.113
Warning notice.
Whenever any steam generator has been shut down because of defects, a distinctive warning notice giving reasons for the shut-down shall be conspicuously attached near the steam generator starting controls until the necessary repairs have been made. The locomotive in which the steam generator displaying a warning notice is located may continue in service until the next periodic inspection.
(a) Periodic steam generator inspection. Except as provided in §229.33, each steam generator shall be inspected and tested in accordance with paragraph (d) of this section at intervals not to exceed 92 days, unless the steam generator is isolated in accordance with paragraph (b) of this section. All non-complying conditions shall be repaired or the steam generator shall be isolated as prescribed in paragraph (b) of this section before the locomotive is used.
(b) Isolation of a steam generator. A steam generator will be considered isolated if the water suction pipe to the water pump and the leads to the main switch (steam generator switch) are disconnected, and the train line shut-off-valve is wired closed or a blind gasket is applied. Before an isolated steam generator is returned to use, it shall be inspected and tested pursuant to paragraph (d) of this section.
(c) Forms. Each periodic steam generator inspection and test shall be recorded on Form FRA F 6180-49A required by paragraph §229.23. When Form FRA F 6180-49A for the locomotive is replaced, data for the steam generator inspections shall be transferred to the new Form FRA F6180-49A.
(d) Tests and requirements. Each periodic steam generator inspection and test shall include the following tests and requirements:
(1) All electrical devices and visible insulation shall be inspected.
(2) All automatic controls, alarms, and protective devices shall be inspected and tested.
(3) Steam pressure gauges shall be tested by comparison with a dead-weight tester or a test gauge designed for this purpose. The siphons to the steam gauges shall be removed and their connections examined to determine that they are open.
(4) Safety valves shall be set and tested under steam after the steam pressure gauge is tested.
(e) Annual steam generator tests. Each steam generator that is not isolated in accordance with paragraph (b) of this section, shall be subjected to a hydrostatic pressure at least 25 percent above the working pressure and the visual return water-flow indicator shall be removed and inspected. The testing under this paragraph shall be performed at intervals that do not exceed 368 calendar days.
[77 FR 21346, Apr. 9, 2012]
Cabs and Cab Equipment
229.115
Slip/slide alarms.
(a) Except for MU locomotives, each locomotive used in road service shall be equipped with a device that provides an audible or visual alarm in the cab of either slipping or sliding wheels on powered axles under power. When two or more locomotives are coupled in multiple or remote control, the wheel slip/slide alarm of each locomotive shall be shown in the cab of the controlling locomotive.
(b) Except as provided in §229.9, an equipped locomotive may not be dispatched in road service, or continue in road service following a daily inspection, unless the wheel slip/slide protective device of whatever type-
(1) Is functioning for each powered axle under power; and
(2) Would function on each powered axle if it were under power.
(c) Effective January 1, 1981, all new locomotives capable of being used in road service shall be equipped with a device that detects wheel slip/slide for each powered axle when it is under power. The device shall produce an audible or visual alarm in the cab.
229.117
Speed indicators.
(a) After December 31, 1980, each locomotive used as a controlling locomotive at speeds in excess of 20 miles per hour shall be equipped with a speed indicator which is-
(1) Accurate within 3 miles per hour of actual speed at speeds of 10 to 30 miles per hour and accurate within 5 miles per hour at speeds above 30 miles per hour; and
(2) Clearly readable from the engineer's normal position under all light conditions.
(b) Each speed indicator required shall be tested as soon as possible after departure by means of speed test sections or equivalent procedures.
229.119
Cabs, floors, and passageways.
(a) Cab seats shall be securely mounted and braced. Cab doors shall be equipped with a secure and operable latching device.
(b) Cab windows of the lead locomotive shall provide an undistorted view of the right-of-way for the crew from their normal position in the cab. (See also, Safety Glazing Standards, 49 CFR part 223, 44 FR 77348, Dec. 31, 1979.)
(c) Floors of cabs, passageways, and compartments shall be kept free from oil, water, waste or any obstruction that creates a slipping, tripping or fire hazard. Floors shall be properly treated to provide secure footing.
(d) The cab shall be provided with proper ventilation and with a heating arrangement that maintains a temperature of at least 50 degrees Fahrenheit 6 inches above the center of each seat in the cab.
(e) Similar locomotives with open end platforms coupled in multiple control and used in road service shall have a means of safe passage between them; no passageway is required through the nose of car body locomotives. There shall be a continuous barrier across the full width of the end of a locomotive or a continuous barrier between locomotives.
(f) Containers shall be provided for carrying fusees and torpedoes. A single container may be used if it has a partition to separate fusees from torpedoes. Torpedoes shall be kept in a closed metal container.
229.121
Locomotive cab noise.
(a) After August 31, 1980, the permissible exposure to a continuous noise in a locomotive cab shall not exceed an eight-hour time-weighted average of 90dB(A), with a doubling rate of 5dB(A) as indicated in the table. Continuous noise is any sound with a rise time of more than 35 milliseconds to peak intensity and a duration of more than 500 milliseconds to the time when the level is 20dB below the peak.
Duration permitted (hours) Sound level (dB(A))
----------------------------------------------------
12 87
8 90
6 92
4 95
2 100
1 1/2 102
1 105
1/2 110
1/4 or less 115
(b) When the continuous noise exposure is composed of two or more periods of noise exposure of different levels, their combined effect shall be considered. Exposure to different levels for various periods of time shall be computed according to the following formula:
Where:
D = noise dose.
T = the duration of exposure (in hours) at a given continuous noise level.
L = the limit (in hours) for the level present during the time T (from the table).
If the value of D exceeds 1, the exposure exceeds permissible levels.
(c) Exposure to continuous noise shall not exceed 115dB(A).
(d) Noise measurements shall be made under typical operating conditions using a sound level meter conforming, at a minimum, to the requirements of ANSI S1.4-1971, Type 2, and set to an A-weighted slow response or with an audiodosimeter of equivalent accuracy and precision.
(e) In conducting sound level measurements with a sound level meter, the microphone shall be oriented vertically and positioned approximately 15 centimeters from and on axis with the crew member's ear. Measurements with an audiodosimeter shall be conducted in accordance with manufacturer's procedures as to microphone placement and orientation.
229.123
Pilots, snowplows, end plates.
(a) Each lead locomotive shall be equipped with a pilot, snowplow, or end plate that extends across both rails. The minimum clearance above the rail of the pilot, snowplow or end plate shall be 3 inches. Except as provided in paragraph (b) of this section, the maximum clearance shall be 6 inches. When the locomotive is equipped with a combination of the equipment listed in this paragraph, each extending across both rails, only the lowest piece of that equipment must satisfy clearance requirements of this section.
(b) To provide clearance for passing over retarders, locomotives utilized in hump yard or switching service at hump yard locations may have pilot, snowplow, or end plate maximum height of 9 inches.
(1) Each locomotive equipped with a pilot, snowplow, or end plate with clearance above 6 inches shall be prominently stenciled at each end of the locomotive with the words “9-inch Maximum End Plate Height, Yard or Trail Service Only.”
(2) When operated in switching service in a leading position, locomotives with a pilot, snowplow, or end plate clearance above 6 inches shall be limited to 10 miles per hour over grade crossings.
(3) Train crews shall be notified in writing of the restrictions on the locomotive, by label or stencil in the cab, or by written operating instruction given to the crew and maintained in the cab of the locomotive.
(4) Pilot, snowplow, or end plate clearance above 6 inches shall be noted in the remarks section of Form FRA 6180-49a.
(5) Locomotives with a pilot, snowplow, or end plate clearance above 6 inches shall not be placed in the lead position when being moved under section §229.9.
[77 FR 21347, Apr. 9, 2012]
229.125
Headlights and auxiliary lights.
(a) Each lead locomotive used in road service shall illuminate its headlight while the locomotive is in use. When illuminated, the headlight shall produce a peak intensity of at least 200,000 candela and produce at least 3,000 candela at an angle of 7.5 degrees and at least 400 candela at an angle of 20 degrees from the centerline of the locomotive when the light is aimed parallel to the tracks. If a locomotive or locomotive consist in road service is regularly required to run backward for any portion of its trip other than to pick up a detached portion of its train or to make terminal movements, it shall also have on its rear a headlight that meets the intensity requirements above. Each headlight shall be aimed to illuminate a person at least 800 feet ahead and in front of the headlight. For purposes of this section, a headlight shall be comprised of either one or two lamps.
(1) If a locomotive is equipped with a single-lamp headlight, the single lamp shall produce a peak intensity of at least 200,000 candela and shall produce at least 3,000 candela at an angle of 7.5 degrees and at least 400 candela at an angle of 20 degrees from the centerline of the locomotive when the light is aimed parallel to the tracks. The following operative lamps meet the standard set forth in this paragraph: a single incandescent PAR-56, 200-watt, 30-volt lamp; a single halogen PAR-56, 200-watt, 30-volt lamp; a single halogen PAR-56, 350-watt, 75-volt lamp, or a single lamp meeting the intensity requirements given above.
(2) If a locomotive is equipped with a dual-lamp headlight, a peak intensity of at least 200,000 candela and at least 3,000 candela at an angle of 7.5 degrees and at least 400 candela at an angle of 20 degrees from the centerline of the locomotive when the light is aimed parallel to the tracks shall be produced by the headlight based either on a single lamp capable of individually producing the required peak intensity or on the candela produced by the headlight with both lamps illuminated. If both lamps are needed to produce the required peak intensity, then both lamps in the headlight shall be operational. The following operative lamps meet the standard set forth in this paragraph (a)(2): A single incandescent PAR-56, 200-watt, 30-volt lamp; a single halogen PAR-56, 200-watt, 30-volt lamp; a single halogen PAR-56, 350-watt, 75-volt lamp; two incandescent PAR-56, 350-watt, 75-volt lamps; or lamp(s) meeting the intensity requirements given above.
(i) A locomotive equipped with the two incandescent PAR-56, 350-watt, 75 volt lamps which has an en route failure of one lamp in the headlight fixture, may continue in service as a lead locomotive until its next daily inspection required by §229.21 only if:
(A) Auxiliary lights burn steadily;
(B) Auxiliary lights are aimed horizontally parallel to the longitudinal centerline of the locomotive or aimed to cross no less than 400 feet in front of the locomotive.
(C) Second headlight lamp and both auxiliary lights continue to operate.
(ii) [Reserved]
(b) Each locomotive or locomotive consist used in yard service shall have two headlights, one located on the front of the locomotive or locomotive consist and one on its rear. Each headlight shall produce at least 60,000 candela and shall be arranged to illuminate a person at least 300 feet ahead and in front of the headlight.
(c) Headlights shall be provided with a device to dim the light.
(d) Effective December 31, 1997, each lead locomotive operated at a speed greater than 20 miles per hour over one or more public highway-rail crossings shall be equipped with operative auxiliary lights, in addition to the headlight required by paragraph (a) or (b) of this section. A locomotive equipped on March 6, 1996 with auxiliary lights in conformance with §229.133 shall be deemed to conform to this section until March 6, 2000. All locomotives in compliance with §229.133(c) shall be deemed to conform to this section. Auxiliary lights shall be composed as follows:
(1) Two white auxiliary lights shall be placed at the front of the locomotive to form a triangle with the headlight.
(i) The auxiliary lights shall be at least 36 inches above the top of the rail, except on MU locomotives and control cab locomotives where such placement would compromise the integrity of the car body or be otherwise impractical. Auxiliary lights on such MU locomotives and control cab locomotives shall be at least 24 inches above the top of the rail.
(ii) The auxiliary lights shall be spaced at least 36 inches apart if the vertical distance from the headlight to the horizontal axis of the auxiliary lights is 60 inches or more.
(iii) The auxiliary lights shall be spaced at least 60 inches apart if the vertical distance from the headlight to the horizontal axis of the auxiliary lights is less than 60 inches.
(2) Each auxiliary light shall produce a peak intensity of at least 200,000 candela or shall produce at least 3,000 candela at an angle of 7.5 degrees and at least 400 candela at an angle of 20 degrees from the centerline of the locomotive when the light is aimed parallel to the tracks. Any of the following operative lamps meet the standard set forth in this paragraph: an incandescent PAR-56, 200-watt, 30-volt lamp; a halogen PAR-56, 200-watt, 30-volt lamp; a halogen PAR-56, 350-watt, 75-volt lamp; an incandescent PAR-56, 350-watt, 75-volt lamp; or a single lamp having equivalent intensities at the specified angles.
(3) The auxiliary lights shall be aimed horizontally within 15 degrees of the longitudinal centerline of the locomotive.
(e) Auxiliary lights required by paragraph (d) of this section may be arranged
(1) To burn steadily or
(2) Flash on approach to a crossing.
If the auxiliary lights are arranged to flash;
(i) They shall flash alternately at a rate of at least 40 flashes per minute and at most 180 flashes per minute,
(ii) The railroad's operating rules shall set a standard procedure for use of flashing lights at public highway-rail grade crossings, and
(iii) The flashing feature may be activated automatically, but shall be capable of manual activation and deactivation by the locomotive engineer.
(f) Auxiliary lights required by paragraph (d) of this section shall be continuously illuminated immediately prior to and during movement of the locomotive, except as provided by railroad operating rules, timetable or special instructions, unless such exception is disapproved by FRA. A railroad may except use of auxiliary lights at a specific public highway-rail grade crossing by designating that exception in the railroad's operating rules, timetable, or a special order. Any exception from use of auxiliary lights at a specific public grade crossing can be disapproved for a stated cause by FRA's Associate Administrator for Safety or any one of FRA's Regional Administrators, after investigation by FRA and opportunity for response from the railroad.
(g) Movement of locomotives with defective auxiliary lights.
(1) A lead locomotive with only one failed auxiliary light must be repaired or switched to a trailing position before departure from the place where an initial terminal inspection is required for that train.
(2) A locomotive with only one auxiliary light that has failed after departure from an initial terminal, must be repaired not later than the next calendar inspection required by §229.21.
(3) A lead locomotive with two failed auxiliary lights may only proceed to the next place where repairs can be made. This movement must be consistent with §229.9.
(h) Any locomotive subject to Part 229, that was built before December 31, 1948, and that is not used regularly in commuter or intercity passenger service, shall be considered historic equipment and excepted from the requirements of paragraphs (d) through (h) of this section.
[45 FR 21109, Mar. 31, 1980, as amended at 61 FR 8887, Mar. 6, 1996; 68 FR 49717, Aug. 19, 2003; 69 FR 12537, Mar. 16, 2004; 77 FR 21347, Apr. 9, 2012]
229.127
Cab lights.
(a) Each locomotive shall have cab lights which will provide sufficient illumination for the control instruments, meters, and gauges to enable the engine crew to make accurate readings from their normal positions in the cab. These lights shall be located, constructed, and maintained so that light shines only on those parts requiring illumination and does not interfere with the crew's vision of the track and signals. Each controlling locomotive shall also have a conveniently located light that can be readily turned on and off by the persons operating the locomotive and that provides sufficient illumination for them to read train orders and timetables.
(b) Cab passageways and compartments shall have adequate illumination.
229.129
Audible warning device.
(a) After August 31, 1980, each lead locomotive shall be provided with an audible warning device that produces a minimum sound level of 96db(A) at 100 feet forward of the locomotive in its direction of travel. The device shall be arranged so that it can be conveniently operated from the engineer's normal position in the cab.
(b) Measurement of the sound level shall be made using a sound level meter conforming, at a minimum, to the requirements of ANSI S1.4-1971, Type 2, and set to an A-weighted slow response. While the locomotive is on level tangent track, the microphone shall be positioned 4 feet above the ground at the center line of the track, and shall be oriented with respect to the sound source in accordance with the manufacturer's recommendations.
(c) A 4dB(A) measurement tolerance is allowable for a given measurement.
229.131
Sanders.
Except for MU locomotives, each locomotive shall be equipped with operable sanders that deposit sand on each rail in front of the first power operated wheel set in the direction of movement.
229.133
Interim locomotive conspicuity measures-auxiliary external lights.
(a) A locomotive at the head of a train or other movement is authorized to be equipped with auxiliary external lights, additional to the headlight required by §229.125, for the purpose of improved conspicuity. A locomotive that is equipped with auxiliary external lights in conformance with the specifications or performance standards set forth in paragraph (b) of this section on the date of issuance of a final rule that requires additional or other external lights on locomotives for improved conspicuity, as required by section 202(u) of the Federal Railroad Safety Act of 1970, shall be deemed to conform to the requirements of the final rule for four years following the date of issuance of that final rule.
(b) Each qualifying arrangement of auxiliary external lights shall conform to one of the following descriptions:
(1) Ditch lights.
(i) Ditch lights shall consist of two white lights, each producing a steady beam of at least 200,000 candela, placed at the front of the locomotive, at least 36 inches above the top of the rail.
(ii) Ditch lights shall be spaced at least 36 inches apart if the vertical distance from the headlight to the horizontal axis of the ditch lights is 60 inches or more.
(iii) Ditch lights shall be spaced at least 60 inches apart if the vertical distance from the headlight to the horizontal axis of the ditch lights is less than 60 inches.
(iv) Ditch lights shall be focused horizontally within 45 degrees of the longitudinal centerline of the locomotive.
(2) Strobe lights.
(i) Strobe lights shall consist of two white stroboscopic lights, each with "effective intensity,'' as defined by the Illuminating Engineering Society's Guide for Calculating the Effective Intensity of Flashing Signal Lights (November 1964), of at least 500 candela.
(ii) The flash rate of strobe lights shall be at least 40 flashes per minute and at most 180 flashes per minute.
(iii) Strobe lights shall be placed at the front of the locomotive, at least 48 inches apart, and at least 36 inches above the top of the rail.
(3) Crossing lights.
(i) Crossing lights shall consist of two white lights, placed at the front of the locomotive, at least 36 inches above the top of the rail.
(ii) Crossing lights shall be spaced at least 36 inches apart if the vertical distance from the headlight to the horizontal axis of the ditch lights is 60 inches or more.
(iii) Crossing lights shall be spaced at least 60 inches apart if the vertical distance from the headlight to the horizontal axis of the ditch lights is less than 60 inches.
(iv) Each crossing light shall produce at least 200,000 candela, either steadily burning or alternately flashing.
(v) The flash rate of crossing lights shall be at least 40 flashes per minute and at most 180 flashes per minute.
(vi) Crossing lights shall be focused horizontally within 15 degrees of the longitudinal centerline of the locomotive.
(4) Oscillating light.
(i) An oscillating light shall consist of:
(A) One steadily burning white light producing at least 200,000 candela in a moving beam that depicts a circle or a horizontal figure "8'' to the front, about the longitudinal centerline of the locomotive; or
(B) Two or more white lights producing at least 200,000 candela each, at one location on the front of the locomotive, that flash alternately with beams within five degrees horizontally to either side of the longitudinal centerline of the locomotive.
(ii) An oscillating light may incorporate a device that automatically extinguishes the white light if display of a light of another color is required to protect the safety of railroad operations.
c)(1) Any lead locomotive equipped with oscillating lights as described in paragraph (b)(4) that were ordered for installation on that locomotive prior to January 1, 1996, is considered in compliance with 229.125(d)(1)through(3).
(2) Any lead locomotive equipped with strobe lights as described in paragraph (b)(2) and operated at speeds no greater than 40 miles per hour, is considered in compliance with 229.125(d)(1)through(3) until the locomotive is retired or rebuilt, whichever comes first.
(3) Any lead locomotive equipped with two white auxiliary lights spaced at least 44 inches apart on at least one axis which was equipped with these auxiliary lights before May 30, 1994, will be considered in compliance with 229.125(d)(1)through(3) until the locomotive is retired or rebuilt, whichever comes first.
[58 FR 6902, Feb. 3, 1993, as amended at 59 FR 24963, May 13, 1994; 59 FR 39705, Aug. 4, 1994; 61 FR 8881, Mar. 06, 1996]
229.135
Event recorders.
(a) Duty to equip and record. Except as provided in paragraphs (c) and (d) of this section, a train operated faster than 30 miles per hour shall have an in-service event recorder, of the type described in paragraph (b) of this section, in the lead locomotive. The presence of the event recorder shall be noted on Form FRA F6180-49A (by writing the make and model of event recorder with which the locomotive is equipped) under the REMARKS section, except that an event recorder designed to allow the locomotive to assume the lead position only if the recorder is properly functioning is not required to have its presence noted on Form FRA F6180-49A. For the purpose of this section, “train” includes a locomotive or group of locomotives with or without cars. The duty to equip the lead locomotive may be met with an event recorder located elsewhere than the lead locomotive provided that such event recorder monitors and records the required data as though it were located in the lead locomotive. The event recorder shall record the most recent 48 hours of operation of the electrical system of the locomotive on which it is installed.
(b) Equipment requirements. Event recorders shall monitor and record data elements required by this paragraph with at least the accuracy required of the indicators displaying any of the required elements to the engineer.
(1) A lead locomotive originally ordered before October 1, 2006, and placed in service before October 1, 2009, including a controlling remote distributed power locomotive, a lead manned helper locomotive, a DMU locomotive, and an MU locomotive, except as provided in paragraphs (c) and (d) of this section, shall have an in-service event recorder that records the following data elements:
(i) Train speed;
(ii) Selected direction of motion;
(iii) Time;
(iv) Distance;
(v) Throttle position;
(vi) Applications and operations of the train automatic air brake;
(vii) Applications and operations of the independent brake;
(viii) Applications and operations of the dynamic brake, if so equipped; and
(ix) Cab signal aspect(s), if so equipped and in use.
(2) A locomotive originally manufactured before October 1, 2006, and equipped with an event recorder that uses magnetic tape as its recording medium shall have the recorder removed from service on or before October 1, 2009 and replaced with an event recorder with a certified crashworthy event recorder memory module that meets the requirements of appendix D of this part and that records at least the same number of data elements as the recorder it replaces.
(3) A lead locomotive, a lead manned helper locomotive, and a controlling remotely distributed power locomotive, other than a DMU or MU locomotive, originally ordered on or after October 1, 2006 or placed in service on or after October 1, 2009, shall be equipped with an event recorder with a certified crashworthy event recorder memory module that meets the requirements of Appendix D of this part. The certified event recorder memory module shall be mounted for its maximum protection. (Although other mounting standards may meet this standard, an event recorder memory module mounted behind and below the top of the collision posts and above the platform level is deemed to be mounted “for its maximum protection.”) The event recorder shall record, and the certified crashworthy event recorder memory module shall retain, the following data elements:
(i) Train speed;
(ii) Selected direction of motion;
(iii) Time;
(iv) Distance;
(v) Throttle position;
(vi) Applications and operations of the train automatic air brake, including emergency applications. The system shall record, or provide a means of determining, that a brake application or release resulted from manipulation of brake controls at the position normally occupied by the locomotive engineer. In the case of a brake application or release that is responsive to a command originating from or executed by an on-board computer (e.g., electronic braking system controller, locomotive electronic control system, or train control computer), the system shall record, or provide a means of determining, the involvement of any such computer;
(vii) Applications and operations of the independent brake;
(viii) Applications and operations of the dynamic brake, if so equipped;
(ix) Cab signal aspect(s), if so equipped and in use;
(x) End-of-train (EOT) device loss of communication front to rear and rear to front;
(xi) Electronic controlled pneumatic braking (ECP) message (and loss of such message), if so equipped;
(xii) EOT armed, emergency brake command, emergency brake application;
(xiii) Indication of EOT valve failure;
(xiv) EOT brake pipe pressure (EOT and ECP devices);
(xv) EOT marker light on/off;
(xvi) EOT “low battery” status;
(xvii) Position of on/off switch for headlights on lead locomotive;
(xviii) Position of on/off switch for auxiliary lights on lead locomotive;
(xix) Horn control handle activation;
(xx) Locomotive number;
(xxi) Locomotive automatic brake valve cut in;
(xxii) Locomotive position in consist (lead or trail);
(xxiii) Tractive effort;
(xxiv) Cruise control on/off, if so equipped and in use; and
(xxv) Safety-critical train control data routed to the locomotive engineer's display with which the engineer is required to comply, specifically including text messages conveying mandatory directives and maximum authorized speed. The format, content, and proposed duration for retention of such data shall be specified in the Product Safety Plan or PTC Safety Plan submitted for the train control system under subparts H or I, respectively, of part 236 of this chapter, subject to FRA approval under this paragraph. If it can be calibrated against other data required by this part, such train control data may, at the election of the railroad, be retained in a separate certified crashworthy memory module.
(4) A DMU locomotive and an MU locomotive originally ordered on or after October 1, 2006 or placed in service on or after October 1, 2009, shall be equipped with an event recorder with a certified crashworthy event recorder memory module that meets the requirements of Appendix D of this part. The certified event recorder memory module shall be mounted for its maximum protection. (Although other mounting standards may meet this standard, an event recorder memory module mounted behind the collision posts and above the platform level is deemed to be mounted “for its maximum protection.”) The event recorder shall record, and the certified crashworthy event recorder memory module shall retain, the following data elements:
(i) Train speed;
(ii) Selected direction of motion;
(iii) Time;
(iv) Distance;
(v) Throttle position;
(vi) Applications and operations of the train automatic air brake, including emergency applications. The system shall record, or provide a means of determining, that a brake application or release resulted from manipulation of brake controls at the position normally occupied by the locomotive engineer. In the case of a brake application or release that is responsive to a command originating from or executed by an on-board computer (e.g., electronic braking system controller, locomotive electronic control system, or train control computer), the system shall record, or provide a means of determining, the involvement of any such computer;
(vii) Applications and operations of the independent brake, if so equipped;
(viii) Applications and operations of the dynamic brake, if so equipped;
(ix) Cab signal aspect(s), if so equipped and in use;
(x) Emergency brake application(s);
(xi) Wheel slip/slide alarm activation (with a property-specific minimum duration);
(xii) Lead locomotive headlight activation switch on/off;
(xiii) Lead locomotive auxiliary lights activation switch on/off;
(xiv) Horn control handle activation;
(xv) Locomotive number;
(xvi) Locomotive position in consist (lead or trail);
(xvii) Tractive effort;
(xviii) Brakes apply summary train line;
(xix) Brakes released summary train line;
(xx) Cruise control on/off, if so equipped and used; and
(xxi) Safety-critical train control data routed to the locomotive engineer's display with which the engineer is required to comply, specifically including text messages conveying mandatory directives and maximum authorized speed. The format, content, and proposed duration for retention of such data shall be specified in the Product Safety Plan or PTC Safety Plan submitted for the train control system under subparts H or I, respectively, of part 236 of this chapter, subject to FRA approval under this paragraph. If it can be calibrated against other data required by this part, such train control data may, at the election of the railroad, be retained in a separate certified crashworthy memory module.
(5) A locomotive equipped with an event recorder that is remanufactured, as defined in this part, on or after October 1, 2007, shall be equipped with an event recorder with a certified crashworthy event recorder memory module that meets the requirements of appendix D to this part and is capable of recording, at a minimum, the same data as the recorder that was on the locomotive before it was remanufactured.
(6) An event recorder originally manufactured after January 1, 2010, that is installed on any locomotive identified in paragraph (b)(1) of this section shall be an event recorder with a certified crashworthy event recorder memory module that meets the requirements of appendix D to this part and that is capable of recording, at a minimum, the same data as the event recorder that was previously on the locomotive.
(c) Removal from service. Notwithstanding the duty established in paragraph (a) of this section to equip certain locomotives with an in-service event recorder, a railroad may remove an event recorder from service and, if a railroad knows that an event recorder is not monitoring or recording required data, shall remove the event recorder from service. When a railroad removes an event recorder from service, a qualified person shall record the date that the device was removed from service on Form FRA F6180-49A, under the REMARKS section, unless the event recorder is designed to allow the locomotive to assume the lead position only if the recorder is properly functioning.
(d) Response to defective equipment. Notwithstanding the duty established in paragraph (a) of this section to equip certain locomotives with an in-service event recorder, a locomotive on which the event recorder has been taken out of service as provided in paragraph (c) of this section may remain as the lead locomotive only until the next calendar-day inspection. A locomotive with an inoperative event recorder is not deemed to be in improper condition, unsafe to operate, or a non-complying locomotive under §§229.7 and 229.9, and, other than the requirements of appendix D of this part, the inspection, maintenance, and testing of event recorders are limited to the requirements set forth in §§229.25(e) and 229.27(d).
(e) Preserving accident data. If any locomotive equipped with an event recorder, or any other locomotive-mounted recording device or devices designed to record information concerning the functioning of a locomotive or train, is involved in an accident/incident that is required to be reported to FRA under part 225 of this chapter, the railroad that was using the locomotive at the time of the accident shall, to the extent possible, and to the extent consistent with the safety of life and property, preserve the data recorded by each such device for analysis by FRA. This preservation requirement permits the railroad to extract and analyze such data, provided the original downloaded data file, or an unanalyzed exact copy of it, shall be retained in secure custody and shall not be utilized for analysis or any other purpose except by direction of FRA or the National Transportation Safety Board. This preservation requirement shall expire one (1) year after the date of the accident unless FRA or the Board notifies the railroad in writing that the data are desired for analysis.
(f) Relationship to other laws. Nothing in this section is intended to alter the legal authority of law enforcement officials investigating potential violation(s) of State criminal law(s), and nothing in this chapter is intended to alter in any way the priority of National Transportation Safety Board investigations under 49 U.S.C. 1131 and 1134, nor the authority of the Secretary of Transportation to investigate railroad accidents under 49 U.S.C. 5121, 5122, 20107, 20111, 20112, 20505, 20702, 20703, and 20902.
(g) Disabling event recorders. Except as provided in paragraph (c) of this section, any individual who willfully disables an event recorder is subject to civil penalty and to disqualification from performing safety-sensitive functions on a railroad as provided in §218.55 of this chapter, and any individual who tampers with or alters the data recorded by such a device is subject to a civil penalty as provided in appendix B of part 218 of this chapter and to disqualification from performing safety-sensitive functions on a railroad if found unfit for such duties under the procedures in part 209 of this chapter.
[45 FR 21109, Mar. 31, 1980, as amended at 75 FR 2697, Jan. 15, 2010]
229.137
Sanitation, general requirements.
(a) Sanitation compartment. Except as provided in paragraph (b) of this section, all lead locomotives in use shall be equipped with a sanitation compartment. Each sanitation compartment shall be:
(1) Adequately ventilated;
(2) Equipped with a door that:
(i) Closes, and
(ii) Possesses a modesty lock by [18 months after publication of the final rule];
(3) Equipped with a toilet facility, as defined in this part;
(4) Equipped with a washing system, as defined in this part, unless the railroad otherwise provides the washing system to employees upon reporting for duty or occupying the cab for duty, or where the locomotive is equipped with a stationary sink that is located outside of the sanitation compartment;
(5) Equipped with toilet paper in sufficient quantity to meet employee needs, unless the railroad otherwise provides toilet paper to employees upon reporting for duty or occupying the cab for duty; and
(6) Equipped with a trash receptacle, unless the railroad otherwise provides portable trash receptacles to employees upon reporting for duty or occupying the cab for duty.
(b) Exceptions.
(1) Paragraph (a) of this section shall not apply to:
(i) Locomotives engaged in commuter service or other short-haul passenger service and commuter work trains on which employees have ready access to railroad-provided sanitation facilities outside of the locomotive or elsewhere on the train, that meet otherwise applicable sanitation standards, at frequent intervals during the course of their work shift;
(ii) Locomotives engaged in switching service on which employees have ready access to railroad-provided sanitation facilities outside of the locomotive, that meet otherwise applicable sanitation standards, at frequent intervals during the course of their work shift;
(iii) Locomotives engaged in transfer service on which employees have ready access to railroad-provided sanitation facilities outside of the locomotive, that meet otherwise applicable sanitation standards, at frequent intervals during the course of their work shift;
(iv) Locomotives of Class III railroads engaged in operations other than switching service or transfer service, that are not equipped with a sanitation compartment as of June 3, 2002. Where an unequipped locomotive of a Class III railroad is engaged in operations other than switching or transfer service, employees shall have ready access to railroad-provided sanitation facilities outside of the locomotive that meet otherwise applicable sanitation standards, at frequent intervals during the course of their work shift, or the railroad shall arrange for enroute access to such facilities;
(v) Locomotives of tourist, scenic, historic, or excursion railroad operations, which are otherwise covered by this part because they are not propelled by steam power and operate on the general railroad system of transportation, but on which employees have ready access to railroad-provided sanitation facilities outside of the locomotive, that meet otherwise applicablesanitation standards, at frequent intervals during the course of their work shift; and
(vi) Except as provided in § 229.14 of this part, control cab locomotives designed for passenger occupancy and used in intercity push-pull service that are not equipped with sanitation facilities, where employees have ready access to railroad-provided sanitation in other passenger cars on the train at frequent intervals during the course of their work shift.
(2) Paragraph (a)(3) of this section shall not apply to:
(i) Locomotives of a Class I railroad which, prior to [the effective date of this section], were equipped with a toilet facility in which human waste falls via gravity to a holding tank where it is stored and periodically emptied, which does not conform to the definition of toilet facility set forth in this section. For these locomotives, the requirements of this section pertaining to the type of toilet facilities required shall be effective as these toilets become defective or are replaced with conforming units, whichever occurs first. All other requirements set forth in this section shall apply to these locomotives as of June 3, 2002; and
(ii) With respect to the locomotives of a Class I railroad which, prior to June 3, 2002, were equipped with a sanitation system other than the units addressed by paragraph (b)(2)(i) of this section, that contains and removes human waste by a method that does not conform with the definition of toilet facility as set forth in this section, the requirements of this section pertaining to the type of toilet facilities shall apply on locomotives in use on July 1, 2003. However, the Class I railroad subject to this exception shall not deliver locomotives with such sanitation systems to other railroads for use, in the lead position, during the time between June 3, 2002, and July 1, 2003. All other requirements set forth in this section shall apply to the locomotives of this Class I railroad as of June 3, 2002.
(c) Defective, unsanitary toilet facility; prohibition in lead position. Except as provided in paragraphs (c)(1) through (5) of this section, if the railroad determines during the daily inspection required by § 229.21 that a locomotive toilet facility is defective or is unsanitary, or both, the railroad shall not use the locomotive in the lead position. The railroad may continue to use a lead locomotive with a toilet facility that is defective or unsanitary as of the daily inspection only where all of the following conditions are met:
(1) The unsanitary or defective condition is discovered at a location where there are no other suitable locomotives available for use, ie., where it is not possible to switch another locomotive into the lead position, or the location is not equipped to clean the sanitation compartment if unsanitary or repair the toilet facility if defective;
(2) The locomotive, while noncompliant, did not pass through a location where it could have been cleaned if unsanitary, repaired if defective, or switched with another compliant locomotive, since its last daily inspection required by this part;
(3) Upon reasonable request of a locomotive crewmember operating a locomotive with a defective or unsanitary toilet facility, the railroad arranges for access to a toilet facility outside the locomotive that meets otherwise applicable sanitation standards;
(4) If the sanitation compartment is unsanitary, the sanitation compartment door shall be closed and adequate ventilation shall be provided in the cab so that it is habitable; and
(5) The locomotive shall not continue in service in the lead position beyond a location where the defective or unsanitary condition can be corrected or replaced with another compliant locomotive, or the next daily inspection required by this part, whichever occurs first.
(d) Defective, unsanitary toilet facility; use in trailing position. If the railroad determines during the daily inspection required by § 229.21 that a locomotive toilet facility is defective or is unsanitary, or both, the railroad may use the locomotive in trailing position. If the railroad places the locomotive in trailing position, they shall not haul employees in the unit unless the sanitation compartment is made sanitary prior to occupancy. If the toilet facility is defective and the unit becomes occupied, the railroad shall clearly mark the defective toilet facility as unavailable for use.
(e) Defective, sanitary toilet facility; use in switching, transfer service. If the railroad determines during the daily inspection required by § 229.21 that a locomotive toilet facility is defective, but sanitary, the railroad may use the locomotive in switching service, as set forth in paragraph (b)(1)(ii) of this section, or in transfer service, as set forth in paragraph (b)(1)(iii) of this section for a period not to exceed 10 days. In this instance, the railroad shall clearly mark thedefective toilet facility as unavailable for use. After expiration of the 10-day period, the locomotive shall be repaired or used in the trailing position.
(f) Lack of toilet paper, washing system, trash receptacle. If the railroad determines during the daily inspection required by § 229.21 that the lead locomotive is not equipped with toilet paper in sufficient quantity to meet employee needs, or a washing system as required by paragraph (a)(4) of this section, or a trash receptacle as required by paragraph (a)(6) of this section, the locomotive shall be equipped with these items prior to departure.
(g) Inadequate ventilation. If the railroad determines during the daily inspection required by § 229.21 that the sanitation compartment of the lead locomotive in use is not adequately ventilated as required by paragraph (a)(1) of this section, the railroad shall repair the ventilation prior to departure, or place the locomotive in trailing position, in switching service as set forth in paragraph (b)(1)(ii) of this section, or in transfer service as set forth in paragraph (b)(1)(iii) of this section.
(h) Door closure and modesty lock. If the railroad determines during the daily inspection required by § 229.21 that the sanitation compartment on the lead locomotive is not equipped with a door that closes, as required by paragraph (a)(2)(i) of this section, the railroad shall repair the door prior to departure, or place the locomotive in trailing position, in switching service as set forth in paragraph (b)(1)(ii) of this section, or in transfer service as set forth in paragraph (b)(1)(iii) of this section. If the railroad determines during the daily inspection required by § 229.21 that the modesty lock required by paragraph (a)(2)(ii) of this section is defective, the modesty lock shall be repaired pursuant to the requirements of § 229.139(e).
(i) Equipped units; retention and maintenance. Except where a railroad downgrades a locomotive to service in which it will never be occupied, where a locomotive is equipped with a toilet facility as of [the effective date of the final rule], the railroad shall retain and maintain the toilet facility in the locomotive consistent with the requirements of this part, including locomotives used in switching service pursuant to paragraph (b)(1)(ii) of this section, and in transfer service pursuant to paragraph (b)(1)(iii) of this section.
(j) Newly manufactured units; in-cab facilities. All locomotives manufactured after June 3, 2002, except switching units built exclusively for switching service and locomotives built exclusively for commuter service, shall be equipped with a sanitation compartment accessible to cab employees without exiting to the out-of-doors for use. No railroad may use a locomotive built after June 3, 2002, that does not comply with this subsection.
(k) Potable water. The railroad shall utilize potable water where the washing system includes the use of water.
Source: [67 FR 16032, April 04, 2002]
229.139
Sanitation, servicing requirements.
(a) The sanitation compartment of each lead locomotive in use shall be sanitary.
(b) All components required by § 229.137(a) for the lead locomotive in use shall be present consistent with the requirements of this part, and shall operate as intended such that:
(1) All mechanical systems shall function;
(2) Water shall be present in sufficient quantity to permit flushing;
(3) For those systems that utilize chemicals for treatment, the chemical (chlorine or other comparable oxidizing agent) used to treat waste must be present; and
(4) No blockage is present that prevents waste from evacuating the bowl.
(c) The sanitation compartment of each occupied locomotive used in switching service pursuant to § 229.137(b)(1)(ii), in transfer service pursuant to § 229.137(b)(1)(iii), or in a trailing position when the locomotive is occupied, shall be sanitary.
(d) Where the railroad uses a locomotive pursuant to § 229.137(e) in switching or transfer service with a defective toilet facility, such use shall not exceed 10 calendar days from the date on which the defective toilet facility became defective. The date on which the toilet facility becomes defective shall be entered on the daily inspection report.
(e) Where it is determined that the modesty lock required by § 229.137(a)(2) is defective, the railroad shall repair the modesty lock on or before the next 92-day inspection required by this part.
Source: [67 FR 16032, April 04, 2002]
229.140
Alerters.
(a) Except for locomotives covered by part 238 of this chapter, each of the following locomotives shall be equipped with a functioning alerter as described in paragraphs (b) through (d) of this section:
(1) A locomotive that is placed in service for the first time on or after June 10, 2013, when used as a controlling locomotive and operated at speeds in excess of 25 mph.
(2) All controlling locomotives operated at speeds in excess of 25 mph on or after January 1, 2017.
(b) The alerter on locomotives subject to paragraph (a) of this section shall be equipped with a manual reset and the alerter warning timing cycle shall automatically reset as the result of any of the following operations, and at least three of the following automatic resets shall be functional at any given time:
(1) Movement of the throttle handle;
(2) Movement of the dynamic brake control handle;
(3) Movement of the operator's horn activation handle;
(4) Movement of the operator's bell activation switch;
(5) Movement of the automatic brake valve handle; or
(6) Bailing the independent brake by depressing the independent brake valve handle.
(c) All alerters shall provide an audio alarm upon expiration of the timing cycle interval. An alerter on a locomotive that is placed in service for the first time on or after June 10, 2013, shall display a visual indication to the operator at least five seconds prior to an audio alarm. The visual indication on an alerter so equipped shall be visible to the operator from their normal position in the cab.
(d) Alerter warning timing cycle interval shall be within 10 seconds of the calculated setting utilizing the formula (timing cycle specified in seconds = 2400 ÷ track speed specified in miles per hour). For locomotives operating at speeds below 20 mph, the interval shall be between 110 seconds and 130 seconds.
(e) Any locomotive that is equipped with an alerter shall have the alerter functioning and operating as intended when the locomotive is used as a controlling locomotive.
(f) A controlling locomotive equipped with an alerter shall be tested prior to departure from each initial terminal, or prior to being coupled as the lead locomotive in a locomotive consist by allowing the warning timing cycle to expire that results in an application of the locomotive brakes at a penalty rate.
[77 FR 21348, Apr. 9, 2012, as amended at 77 FR 75057, Dec. 19, 2012]
Part 229 Subpart D
Design Requirements
229.141
Body structure, MU locomotives.
(a) MU locomotives built new after April 1, 1956 that are operated in trains having a total empty weight of 600,000 pounds or more shall have a body structure designed to meet or exceed the following minimum specifications:
(1) The body structure shall resist a minimum static end load of 800,000 pounds at the rear draft stops ahead of the bolster on the center line of draft, without developing any permanent deformation in any member of the body structure.
(2) An anti-climbing arrangement shall be applied at each end that is designed so that coupled MU locomotives under full compression shall mate in a manner that will resist one locomotive from climbing the other. This arrangement shall resist a vertical load of 100,000 pounds without exceeding the yield point of its various parts or its attachments to the body structure.
(3) The coupler carrier and its connections to the body structure shall be designed to resist a vertical downward thrust from the coupler shank of 100,000 pounds for any horizontal position of the coupler, without exceeding the yield points of the materials used. When yielding type of coupler carrier is used, an auxiliary arrangement shall be provided that complies with these requirements.
(4) The outside end of each locomotive shall be provided with two main vertical members, one at each side of the diaphragm opening; each main member shall have an ultimate shear value of not less than 300,000 pounds at a point even with the top of the underframe member to which it is attached. The attachment of these members at bottom shall be sufficient to develop their full shear value. If reinforcement is used to provide the shear value, the reinforcement shall have full value for a distance of 18 inches up from the underframe connection and then taper to a point approximately 30 inches above the underframe connection.
(5) The strength of the means of locking the truck to the body shall be at least the equivalent of an ultimate shear value of 250,000 pounds.
(b) MU locomotives built new after April 1, 1956 that are operated in trains having a total empty weight of less than 600,000 pounds shall have a body structure designed to meet or exceed the following minimum specifications:
(1) The body structure shall resist a minimum static end load of 400,000 pounds at the rear draft stops ahead of the bolster on the center line of draft, without developing any permanent deformation in any member of the body structure.
(2) An anti-climbing arrangement shall be applied at each end that is designed so that coupled locomotives under full compression shall mate in a manner that will resist one locomotive from climbing the other. This arrangement shall resist a vertical load of 75,000 pounds without exceeding the yield point of its various parts or its attachments to the body structure.
(3) The coupler carrier and its connections to the body structure shall be designed to resist a vertical downward thrust from the coupled shank of 75,000 pounds for any horizontal position of the coupler, without exceeding the yield points of the materials used. When a yielding type of coupler carrier is used, an auxiliary arrangement shall be provided that complies with these requirements.
(4) The outside end of each MU locomotive shall be provided with two main vertical members, one at each side of the diaphragm opening; each main member shall have an ultimate shear value of not less than 200,000 pounds at a point even with the top of the underframe member to which it is attached. The attachment of these members at bottom shall be sufficient to develop their full shear value, the reinforcement shall have full value for a distance of 18 inches up from the underframe connection and then taper to a point approximately 30 inches above the underframe connection.
(5) The strength of the means of locking the truck to the body shall be at least the equivalent of an ultimate shear value of 250,000 pounds.
(a) The requirements of this subpart apply to all safety-critical electronic locomotive control systems, subsystems, and components (i.e., “products” as defined in §229.305), except for the following:
(1) Products that are fully developed prior to June 8, 2012.
(2) Products that are under development as of October 9, 2012, and are fully developed prior to October 9, 2017.
(3) Products that comingle locomotive control systems with safety critical processor based signal and train control systems;
(4) Products that are used during on-track testing within a test facility; and
(5) Products that are used during on-track testing outside a test facility, if approved by FRA. To obtain FRA approval of on-track testing outside of a test facility, a railroad shall submit a request to FRA that provides:
(i) Adequate information regarding the function and history of the product that it intends to use;
(ii) The proposed tests;
(iii) The date, time and location of the tests; and
(iv) The potential safety consequences that will result from operating the product for purposes of testing.
(b) Railroads and vendors shall identify all products identified in paragraph (a)(2) of this section to FRA by February 9, 2013.
(c) The exceptions provided in paragraph (a) of this section do not apply to products or product changes that result in degradation of safety, or a material increase in safety-critical functionality.
[77 FR 21348, Apr. 9, 2012, as amended at 77 FR 75057, Dec. 19, 2012]
(a) A railroad shall develop a Safety Analysis (SA) for each product subject to this subpart prior to the initial use of such product on their railroad.
(b) The SA shall:
(1) establish and document the minimum requirements that will govern the development and implementation of all products subject to this subpart, and be based on good engineering practice and should be consistent with the guidance contained in appendix F of this part in order to establish that a product's safety-critical functions will operate with a high degree of confidence in a fail-safe manner;
(2) Include procedures for immediate repair of safety-critical functions; and
(3) Be made available to FRA upon request.
(c) Each railroad shall comply with the SA requirements and procedures related to the development, implementation, and repair of a product subject to this subpart.
229.309
Safety-critical changes and failures.
(a) Whenever a planned safety-critical design change is made to a product that is in use by a railroad and subject to this subpart, the railroad shall:
(1) Notify FRA's Associate Administrator for Safety of the design changes made by the product supplier;
(2) Ensure that the SA is updated as required;
(3) Conduct all safety-critical changes in a manner that allows the change to be audited;
(4) Specify all contractual arrangements with suppliers and private equipment owners for notification of any and all electronic safety-critical changes as well as safety-critical failures in the suppliers and private equipment owners' system, subsystem, or components, and the reasons for that change or failure from the suppliers or equipment owners, whether or not the railroad has experienced a failure of that safety critical system, sub-system, or component;
(5) Specify the railroad's procedures for action upon receipt of notification of a safety-critical change or failure of an electronic system, sub-system, or component, and until the upgrade or revision has been installed; and
(6) Identify all configuration/revision control measures designed to ensure that safety-functional requirements and safety-critical hazard mitigation processes are not compromised as a result of any such change, and that any such change can be audited.
(b) Product suppliers and private equipment owners shall report any safety-critical changes and previously unidentified hazards to each railroad using the product or equipment.
(c) Private equipment owners shall establish configuration/revision control measures for control of safety-critical changes and identification of previously unidentified hazards.
(a) Prior to the initial planned use of a product subject to this subpart, a railroad shall inform the Associate Administrator for Safety/Chief Safety Officer, FRA, 1200 New Jersey Avenue SE., Mail Stop 25, Washington, DC 20590 of the intent to place this product in service. The notification shall provide a description of the product, and identify the location where the complete SA documentation described in §229.307, the testing records contained in §229.313, and the training and qualification program described in §229.319 is maintained.
(b) FRA may review or audit the SA within 60 days of receipt of the notification or anytime after the product is placed in use. If FRA has not notified the railroad of its intent to review or audit the SA within the 60-day period, the railroad may assume that FRA does not intend to review or audit, and place the product in use. FRA reserves the right, however, to conduct a review or audit at a later date.
(c) A railroad shall maintain and make available to FRA upon request all railroad or vendor documentation used to demonstrate that the product meets the safety requirements of the SA for the life-cycle of the product.
(d) After a product is placed in service, the railroad shall maintain a database of all safety-relevant hazards encountered with the product. The database shall include all hazards identified in the SA and those that had not been previously identified in the SA. If the frequency of the safety-relevant hazards exceeds the threshold set forth in the SA, then the railroad shall:
(1) Report the inconsistency by mail, facsimile, email, or hand delivery to the Director, Office of Safety Assurance and Compliance, FRA, 1200 New Jersey Ave. SE., Mail Stop 25, Washington, DC 20590, within 15 days of discovery;
(2) Take immediate countermeasures to reduce the frequency of the safety-relevant hazard(s) below the threshold set forth in the SA; and
(3) Provide a final report to FRA's Director, Office of Safety Assurance and Compliance, on the results of the analysis and countermeasures taken to reduce the frequency of the safety-relevant hazard(s) below the calculated probability of failure threshold set forth in the SA when the problem is resolved. For hazards not identified in the SA the threshold shall be exceeded at one occurrence.
(a) Results of product testing conducted by a railroad as required by this subpart shall be recorded on preprinted forms provided by the railroad, or stored electronically. Electronic recordkeeping or automated tracking systems, subject to the provisions contained in paragraph (e) of this section, may be utilized to store and maintain any testing or training record required by this subpart. Results of product testing conducted by a vendor or private equipment owner in support of a SA shall be provided to the railroad as part of the SA.
(b) The testing records shall contain all of the following:
(1) The name of the railroad;
(2) The location and date that the test was conducted;
(3) The equipment tested;
(4) The results of tests;
(5) The repairs or replacement of equipment;
(6) Any preventative adjustments made; and
(7) The condition in which the equipment is left.
(c) Each record shall be:
(1) Signed by the employee conducting the test, or electronically coded, or identified by the automated test equipment number;
(2) Filed in the office of a supervisory official having jurisdiction, unless otherwise noted; and
(3) Available for inspection and copying by FRA.
(d) The results of the testing conducted in accordance with this subpart shall be retained as follows:
(1) The results of tests that pertain to installation or modification of a product shall be retained for the life-cycle of the product tested and may be kept in any office designated by the railroad;
(2) The results of periodic tests required for the maintenance or repair of the product tested shall be retained until the next record is filed and in no case less than one year; and
(3) The results of all other tests and training shall be retained until the next record is filed and in no case less than one year.
(e) Electronic or automated tracking systems used to meet the requirements contained in paragraph (a) of this section shall be capable of being reviewed and monitored by FRA at any time to ensure the integrity of the system. FRA's Associate Administrator for Safety may prohibit or revoke a railroad's authority to utilize an electronic or automated tracking system in lieu of preprinted forms if FRA finds that the electronic or automated tracking system is not properly secured, is inaccessible to FRA, or railroad employees requiring access to discharge their assigned duties, or fails to adequately track and monitor the equipment. The Associate Administrator for Safety will provide the affected railroad with a written statement of the basis for the decision prohibiting or revoking the railroad from utilizing an electronic or automated tracking system.
(a) The railroad shall maintain all documents pertaining to the installation, maintenance, repair, modification, inspection, and testing of a product subject to this part in one Operations and Maintenance Manual (OMM).
(1) The OMM shall be legible and shall be readily available to persons who conduct the installation, maintenance, repair, modification, inspection, and testing, and for inspection by FRA.
(2) At a minimum, the OMM shall contain all product vendor operation and maintenance guidance.
(b) The OMM shall contain the plans and detailed information necessary for the proper maintenance, repair, inspection, and testing of products subject to this subpart. The plans shall identify all software versions, revisions, and revision dates.
(c) Hardware, software, and firmware revisions shall be documented in the OMM according to the railroad's configuration management control plan.
(d) Safety-critical components, including spare products, shall be positively identified, handled, replaced, and repaired in accordance with the procedures specified in the railroad's configuration management control plan.
(e) A railroad shall determine that the requirements of this section have been met prior to placing a product subject to this subpart in use on their property.
(a) A railroad shall establish and implement training and qualification program for products subject to this subpart prior to the product being placed in use. These programs shall meet the requirements set forth in this section and in §229.319.
(b) The program shall provide training for the individuals identified in this paragraph to ensure that they possess the necessary knowledge and skills to effectively complete their duties related to the product. These include:
(1) Individuals whose duties include installing, maintaining, repairing, modifying, inspecting, and testing safety-critical elements of the product;
(2) Individuals who operate trains or serve as a train or engine crew member subject to instruction and testing under part 217 of this chapter;
(3) Roadway and maintenance-of-way workers whose duties require them to know and understand how the product affects their safety and how to avoid interfering with its proper functioning; and
(4) Direct supervisors of the individuals identified in paragraphs (b)(1) through (3) of this section.
(c) When developing the training and qualification program required in this section, a railroad shall conduct a formal task analysis. The task analysis shall:
(1) Identify the specific goals of the program for each target population (craft, experience level, scope of work, etc.), task(s), and desired success rate;
(2) Identify the installation, maintenance, repair, modification, inspection, testing, and operating tasks that will be performed on the railroad's products, including but not limited to the development of failure scenarios and the actions expected under such scenarios;
(3) Develop written procedures for the performance of the tasks identified; and
(4) Identify any additional knowledge, skills, and abilities above those required for basic job performance necessary to perform each task.
(d) Based on the task analysis, a railroad shall develop a training curriculum that includes formally structured training designed to impart the knowledge, skills, and abilities identified as necessary to perform each task.
(e) All individuals identified in paragraph (b) of this section shall successfully complete a training curriculum and pass an examination that covers the product and appropriate rules and tasks for which they are responsible (however, such persons may perform such tasks under the direct onsite supervision of a qualified person prior to completing such training and passing the examination).
(f) A railroad shall conduct periodic refresher training at intervals to be formally specified in the program, except with respect to basic skills for which proficiency is known to remain high as a result of frequent repetition of the task.
(g) A railroad shall conduct regular and periodic evaluations of the effectiveness of the training program, verifying the adequacy of the training material and its validity with respect to the railroad's products and operations.
(h) A railroad shall maintain records that designate individuals who are qualified under this section until new designations are recorded or for at least one year after such persons leave applicable service. These records shall be maintained in a designated location and be available for inspection and replication by FRA.
229.319
Operating Personnel Training.
(a) The training required under §229.317 for any locomotive engineer or other person who participates in the operation of a train using an onboard electronic locomotive control system shall address all of the following elements and shall be specified in the training program.
(1) Familiarization with the electronic control system equipment onboard the locomotive and the functioning of that equipment as part of the system and in relation to other onboard systems under that person's control;
(2) Any actions required of the operating personnel to enable or enter data into the system and the role of that function in the safe operation of the train;
(3) Sequencing of interventions by the system, including notification, enforcement, penalty initiation and post penalty application procedures as applicable;
(4) Railroad operating rules applicable to control systems, including provisions for movement and protection of any unequipped trains, or trains with failed or cut-out controls;
(5) Means to detect deviations from proper functioning of onboard electronic control system equipment and instructions explaining the proper response to be taken regarding control of the train and notification of designated railroad personnel; and
(6) Information needed to prevent unintentional interference with the proper functioning of onboard electronic control equipment.
(b) The training required under this subpart for a locomotive engineer and conductor, together with required records, shall be integrated into the program of training required by parts 240 and 242 of this chapter.
229 Appendix A
Appendix A to Part 229-Form FRA 6180-49A
Editorial Note: Appendix A, published at 45 FR 21118, Mar. 31, 1980, as part of the original document, is not carried in the CFR. Copies of Form FRA F6180-49A are available by contacting the Federal Railroad Administration, Office of Standards and Procedures, 400 7th St., SW., Washington, DC 20590.
229 App B
Appendix B to Part 229 - Schedule of Civil Penalties
Section Violation Willful
-------------------------------------------------------------------------------
Subpart A - General
229.7 Prohibited acts: Safety deficiencies not governed
by specific regulations: To be assessed on relevant
facts $1,000- $2,000-
5,000 7,500
229.9 Movement of noncomplying locomotives (1) (1)
229.11 Locomotive identification 1,000 2,000
229.13 Control of locomotives 2,500 5,000
229.17 Accident reports 2,500 5,000
229.19 Prior Waivers (1) (1)
Subpart B - Inspection and tests
229.21 Daily inspection:
(a)(b):
(1) Inspection overdue 2,000 4,000
(2) Inspection report not made, improperly executed, or
not retained 1,000 2,000
(c) Inspection not performed by a qualified person 1,000 2,000
229.23 Periodic inspection General
(a)(b):
(1) Inspection overdue 2,500 5,000
(2) Inspection performed improperly or at a location
where the underneath portion cannot be safely
inspected 2,500 5,000
(c)(d):
(1) Form missing 1,000 2,000
(2) Form not properly displayed 1,000 2,000
(3) Form improperly executed 1,000 2,000
(e) Replace Form FRA F 6180-49A by April 2 1,000 2,000
(f) Secondary record of the information reported on
Form FRA F 6180.49A 1,000 2,000
229.25
(a) through (e)(4) Tests: Every periodic inspection 2,500 5,000
(e)(5) Ineffective maintenance 8,000 16,000
229.27 Annual tests 2,500 5,000
229.29 Biennial tests 2,500 5,000
229.31:
(a) Biennial hydrostatic tests of main reservoirs 2,500 5,000
(b) Biennial hammer tests of main reservoirs 2,500 5,000
(c) Drilled telltale holes in welded main reservoirs 2,500 5,000
(d) Biennial tests of aluminum main reservoirs 2,500 5,000
229.33 Out-of-use credit 1,000 2,000
Subpart C - Safety Requirements
229.41 Protection against personal injury 2,500 5,000
229.43 Exhaust and battery gases 2,500 5,000
229.45 General condition: To be assessed based on
relevant facts 1,000- 2,000-
5,000 7,500
229.46 Brakes: General 2,500 5,000
229.47 Emergency brake valve 2,500 5,000
229.49 Main reservoir system:
(a)(1) Main reservoir safety valve 2,500 5,000
(2) Pneumatically actuated control reservoir 2,500 5,000
(b)(c) Main reservoir governors 2,500 5,000
229.51 Aluminum main reservoirs 2,500 5,000
229.53 Brake gauges 2,500 5,000
229.55 Piston travel 2,500 5,000
229.57 Foundation brake gear 2,500 5,000
229.59 Leakage 2,500 5,000
229.61 Draft system 2,500 5,000
229.63 Lateral motion 2,500 5,000
229.64 Plain bearing 2,500 5,000
229.65 Spring rigging 2,500 5,000
229.67 Trucks 2,500 5,000
229.69 Side bearings 2,500 5,000
229.71 Clearance above top of rail 2,500 5,000
229.73 Wheel sets 2,500 5,000
229.75 Wheel and tire defects:
(a),(d) Slid flat or shelled spot(s):
(1) One spot 2 1/2" or more but less than 3" in length 2,500 5,000
(2) One spot 3" or more in length 5,000 7,500
(3) Two adjoining spots each of which is 2" or more
in length but less than 2 1/2" in length 2,500 5,000
(4) Two adjoining spots each of which are at least 2"
in length, if either spot is 2 1/2" or more in length 5,000 7,500
(b) Gouge or chip in flange of:
(1) more than 1 1/2" but less than 1 5/8" in length;
and more than 1/2" but less than 5/8" in width 2,500 5,000
(2) 1 5/8" or more in length and 5/8" or more in width 5,000 7,500
(c) Broken rim 5,000 7,500
(e) Seam in tread 2,500 5,000
(f) Flange thickness of:
(1) 7/8" or less but more than 13/16" 2,500 5,000
(2) 13/16" or less 5,000 7,500
(g) Tread worn hollow 2,500 5,000
(h) Flange height of:
(1) 1 1/2" or greater but less than 1 5/8" 2,500 5,000
(2) 1 5/8" or more 5,000 7,000
(i) Tire thickness 2,500 5,000
(j) Rim thickness:
(1) Less than 1" in road service and 3/4" in yard
service 2,500 5,000
(2) 15/16" or less in road service and 11/16" in yard
service 5,000 7,500
(k) Crack of less than 1" 5,000 7,500
(1) Crack of less than 1" 2,500 5,000
(2) Crack of 1" or more 5,000 7,500
(3) Break 5,000 7,500
(l) Loose wheel or tire 5,000 7,500
(m) Welded wheel or tire 5,000 7,500
229.77 Current collectors 2,500 5,000
229.79 Third rail shoes and beams 2,000 4,000
229.81 Emergency pole; shoe insulation 2,500 5,000
229.83 Insulation or grounding 5,000 7,500
229.85 Door and cover plates marked "Danger'' 2,500 5,000
229.87 Hand operated switches 2,500 5,000
229.89 Jumpers; cable connections:
(a) Jumpers and cable connections; located and guarded 2,500 5,000
(b) Condition of jumpers and cable connections 2,500 5,000
229.91 Motors and generators 2,500 5,000
229.93 Safety cut-off device 2,500 5,000
229.95 Venting 2,500 5,000
229.97 Grounding fuel tanks 2,500 5,000
229.99 Safety hangers 2,500 5,000
229.101 Engines:
(a) Temperature and pressure alarms, controls,
and switches 2,500 5,000
(b) Warning notice 2,500 5,000
(c) Wheel slip/slide protection 2,500 5,000
229.103 Safe working pressure; factor of safety 2,500 5,000
229.105 Steam generator number 500 1,000
229.107 Pressure gauge 2,500 5,000
229.109 Safety valves 2,500 5,000
229.111 Water-flow indicator 2,500 5,000
229.113 Warning notice 2,500 5,000
229.115 Slip/slide alarms 2,500 5,000
229.117 Speed indicators 2,500 5,000
229.119 Cabs, floors, and passageways:
(a)(1) Cab set not securely mounted or braced 2,500 5,000
(2) Insecure or improper latching device 2,500 5,000
(b) Cab windows of lead locomotive 2,500 5,000
(c) Floors, passageways, and compartments 2,500 5,000
(d) Ventilation and heating arrangement 2,500 5,000
(e) Continuous barrier 2,500 5,000
(f) Containers for fuses and torpedoes 2,500 5,000
229.121 Locomotive cab noise 2,500 5,000
229.123 Pilots, snowplows, end plates 2,500 5,000
229.125 Headlights 2,500 5,000
(a) Headlights 2,500 5,000
(d) Auxiliary lights 2,500 5,000
229.127 Cab lights 2,500 5,000
229.129 Audible warning device 2,500 5,000
229.131 Sanders 1,000 2,000
229.135
(a) Lead locomotive without in-service event recorder 2,500 5,000
(b) Improper response to out of service event recorder 2,500 5,000
(c) Unauthorized removal from service 2,500 5,000
Failure to remove from service a recorder known to
have failed 2,500 5,000
(d) Failure to preserve data or unauthorized extraction
of data 2,500 5,000
(e) Tampering with device or data 2,500 7,500
229.137 Sanitation, general: (a) Sanitation compartment in lead unit, complete failure to provide required items 5,000 10,000
(1) Ventilation 2,500 5,000
(2) Door missing 2,000 4,000
(2)(i) Door doesn't close 1,000 2,000
(2)(ii) No modesty lock 1,000 2,000
(3) Not equipped with toilet in lead 5,000 10,000
(4) Not equipped with washing system 1,000 2,000
(5) Lack of paper 1,000 2,000
(6) Lack of trash receptacle 1,000 2,000
(b) Exceptions: (1)(i) Commuter service, failure to meet conditions
of exception 2,500 5,000
(1)(ii) Switching service, failure to meet conditions
of exception 2,500 5,000
(1)(iii) Transfer service, failure to meet conditions
of exception 2,500 5,000
(1)(iv) Class III, failure to meet conditions of
exception 2,500 5,000
(1)(v) Tourist, failure to meet conditions of
exception 2,500 5,000
(1)(vi) Control cab locomotive, failure to meet
conditions of exception 2,500 5,000
(2) Noncompliant toilet 5,000 10,000
(c) Defective/unsanitary toilet in lead unit 2,500 5,000
(1-5) Failure to meet conditions of exception 2,500 5,000
(d) Defective/unsanitary unit; failure to meet
conditions for trailing position 2,500 5,000
(e) Defective/sanitary unit; failure to meet
conditions for switching/transfer service 2,500 5,000
(f) Paper, washing, trash holder; failure to
equip prior to departure 2,500 5,000
(g) Inadequate ventilation; failure to repair
or move prior to departure 2,500 5,000
(h) Door closure/modesty lock; failure to repair
or move 1,000 2,000
(i) Failure to retain/maintain of equipped units 2,500 5,000
(j) Failure to equip new units/in-cab facility 2,500 5,000
(k) Failure to provide potable water 2,500 5,000
229.139 Servicing requirements:
(a) Lead occupied unit not sanitary 2,500 5,000
(b) Components not present/operating 2,500 5,000
(c) Occupied unit in switching, transfer service,
in trailing position not sanitary 2,500 5,000
(d) Defective unit used more than 10 days 2,500 5,000
(e) Failure to repair defective modesty lock 1,000 2,000
Subpart D - Design Requirements
229.141 Body structure, MU locomotives 2,500 5,000
1 A penalty may be assessed against an individual only for a willful violation. Generally, when two or more violations of these regulations are discovered with respect to a single locomotive that is used by a railroad, the appropriate penalties set forth above are aggregated up to a maximum of $10,000 per day. However, a failure to perform, with respect to a particular locomotive, any of the inspections and tests required under subpart B of this part will be treated as a violation separate and distinct from, and in addition to, any substantive violative conditions found on that locomotive. Moreover, the Administrator reserves the right to assess a penalty of up to $22,000 for any violation where circumstances warrant. See 49 CFR part 209, appendix A. fFailure to observe any condition for movement set forth in 229.9 will deprive the railroad of the benefit of the movement-for-repair provision and make the railroad and any responsible individuals liable for penalty under the particular regulatory section(s) concerning the substantive defect(s) present on the locomotive at the time of movement. Failure to comply with 229.19 will result in the lapse of any affected waiver.
[53 FR 52931, Dec. 29, 1988, as amended at 58 FR 36615, July 8, 1993; 63 FR 11618, March 10, 1998; 67 FR 16032, April 04, 2002]
229 App C
Appendix C to Part 229-FRA Locomotive Standards-Code of Defects
Editorial Note: Appendix C, published at 45 FR 21121, Mar. 31, 1980, as part of the original document, is not carried in the CFR.
Section 229.135(b) requires that certain locomotives be equipped with an event recorder that includes a certified crashworthy event recorder memory module. This appendix prescribes the requirements for certifying an event recorder memory module (ERMM) as crashworthy, including the performance criteria and test sequence for establishing the crashworthiness of the ERMM as well as the marking of the event recorder containing the crashworthy ERMM.
1. Each manufacturer that represents its ERMM as crashworthy shall, by marking it as specified in Section B of this appendix, certify that the ERMM meets the performance criteria contained in this appendix and that test verification data are available to a railroad or to FRA upon request.
2. The test verification data shall contain, at a minimum, all pertinent original data logs and documentation that the test sample preparation, test set up, test measuring devices and test procedures were performed by designated, qualified personnel using recognized and acceptable practices. Test verification data shall be retained by the manufacturer or its successor as long as the specific model of ERMM remains in service on any locomotive.
3. A crashworthy ERMM shall be marked by its manufacturer as specified in Section B of this appendix.
1. The outer surface of the event recorder containing a certified crashworthy ERMM shall be colored international orange. In addition, the outer surface shall be inscribed, on the surface allowing the most visible area, in black letters on an international orange background, using the largest type size that can be accommodated, with the words CERTIFIED DOT CRASHWORTHY, followed by the ERMM model number (or other such designation), and the name of the manufacturer of the event recorder. This information may be displayed as follows:
CERTIFIED DOT CRASHWORTHY
Event Recorder Memory Module Model Number
Manufacturer's Name
Marking “CERTIFIED DOT CRASHWORTHY” on an event recorder designed for installation in a railroad locomotive is the certification that all performance criteria contained in this appendix have been met and all functions performed by, or on behalf of, the manufacturer whose name appears as part of the marking, conform to the requirements specified in this appendix.
2. Retro-reflective material shall be applied to the edges of each visible external surface of an event recorder containing a certified crashworthy ERMM.
An ERMM is crashworthy if it has been successfully tested for survival under conditions of fire, impact shock, static crush, fluid immersion, and hydro-static pressure contained in one of the two tables shown in this section of appendix D. (See Tables 1 and 2.) Each ERMM must meet the individual performance criteria in the sequence established in Section D of this appendix. A performance criterion is deemed to be met if, after undergoing a test established in this appendix D for that criterion, the ERMM has preserved all of the data stored in it. The data set stored in the ERMM to be tested shall include all the recording elements required by §229.135(b). The following tables describe alternative performance criteria that may be used when testing an ERMM's crashworthiness. A manufacturer may utilize either table during its testing but may not combine the criteria contained in the two tables.
The purpose of this appendix is to provide recommended criteria for design and safety analysis that will maximize the safety of electronic locomotive control systems and mitigate potential negative safety effects. It seeks to promote full disclosure of potential safety risks to facilitate minimizing or eliminating elements of risk where practicable. It discuses critical elements of good engineering practice that the designer should consider when developing safety critical electronic locomotive control systems to accomplish this objective. The criteria and processes specified this appendix is intended to minimize the probability of failure to an acceptable level within the limitations of the available engineering science, cost, and other constraints. Railroads procuring safety critical electronic locomotive controls are encouraged to ensure that their vendor addresses each of the elements of this appendix in the design of the product being procured. FRA uses the criteria and processes set forth in this appendix (or other technically equivalent criteria and processes that may be recommended by industry) when evaluating analyses, assumptions, and conclusions provided in the SA documents.
In addition to the definitions contained in §229.305, the following definitions are applicable to this Appendix:
Hazard means an existing or potential condition that can result in an accident.
High degree of confidence, as applied to the highest level of aggregation, means there exists credible safety analysis supporting the conclusion that the risks associated with the product have been adequately mitigated.
Human factors refers to a body of knowledge about human limitations, human abilities, and other human characteristics, such as behavior and motivation, that shall be considered in product design.
Human-machine interface (HMI) means the interrelated set of controls and displays that allows humans to interact with the machine.
Risk means the expected probability of occurrence for an individual accident event (probability) multiplied by the severity of the expected consequences associated with the accident (severity).
Risk assessment means the process of determining, either quantitatively or qualitatively, the measure of risk associated with use of the product under all intended operating conditions.
System Safety Precedence means the order of precedence in which methods used to eliminate or control identified hazards within a system are implemented.
Validation means the process of determining whether a product's design requirements fulfill its intended design objectives during its development and life-cycle. The goal of the validation process is to determine “whether the correct product was built.”
Verification means the process of determining whether the results of a given phase of the development cycle fulfill the validated requirements established at the start of that phase. The goal of the verification process is to determine “whether the product was built correctly.”
The safety-critical assessment of each product should include all of its interconnected subsystems and components and, where applicable, the interaction between such subsystems. FRA recommends that such assessments contain the following:
(a) A complete description of the product, including a list of all product components and their physical relationship in the subsystem or system;
(b) A description of the railroad operation or categories of operations on which the product is designed to be used;
(c) An operational concepts document, including a complete description of the product functionality and information flows; as well as identifying which functions are intended to enhance or preserve safety and the manner in which the product architecture implements these functions;
(d) A safety requirements document, including a list with complete descriptions of all functions, which the product performs to enhance or preserve safety, and that describes the manner in which product architecture satisfies safety requirements;
(e) A hazard log consisting of a comprehensive description of all safety relevant hazards addressed during the life cycle of the product, including maximum threshold limits for each hazard (for unidentified hazards, the threshold shall be exceeded at one occurrence);
(f) A risk assessment and analysis.
(1) The risk metric for the proposed product should describe with a high degree of confidence the accumulated risk of a locomotive control system that operates over the intended product life. Each risk metric for the proposed product should be expressed with an upper bound, as estimated with a sensitivity analysis, and the risk value selected is demonstrated to have a high degree of confidence.
(2) Each risk calculation should consider the totality of the locomotive control system and its method of operation. The failure modes of each subsystem or component, or both, should be determined for the integrated hardware/software (where applicable) as a function of the Mean Time to Hazardous Events (MTTHE), failure restoration rates, and the integrated hardware/software coverage of all processor based subsystems or components, or both. Train operating and movement rules, along with components that are layered in order to enhance safety-critical behavior, should also be considered.
(3) An MTTHE value should be calculated for each subsystem or component, or both, indicating the safety-critical behavior of the integrated hardware/software subsystem or component, or both. The human factor impact should be included in the assessment, whenever applicable, to provide an integrated MTTHE value. The MTTHE calculation should consider the rates of failures caused by permanent, transient, and intermittent faults accounting for the fault coverage of the integrated hardware/software subsystem or component, phased-interval maintenance, and restoration of the detected failures.
(4) The analysis should clearly document:
(i) Any assumptions regarding the reliability or availability of mechanical, electric, or electronic components. Such assumptions include MTTF projections, as well as Mean Time To Repair (MTTR) projections, unless the risk assessment specifically explains why these assumptions are not relevant. The analysis should document these assumptions in such a form as to permit later comparisons with in-service experience (e.g., a spreadsheet). The analysis should also document any assumptions regarding human performance. The documentation should be in a form that facilitates later comparisons with in-service experience.
(ii) Any assumptions regarding software defects. These assumptions should be in a form which permits the railroad to project the likelihood of detecting an in-service software defect and later comparisons with in-service experience.
(iii) All of the identified safety-critical fault paths leading to a mishap as predicted by the SA. The documentation should be in a form that facilitates later comparisons with in-service faults.
(4) MTTHE compliance verification and validation should be based on the assessment of the design for verification and validation process, historical performance data, analytical methods and experimental safety critical performance testing performed on the subsystem or component. The compliance process shall be demonstrated to be compliant and consistent with the MTTHE metric and demonstrated to have a high degree of confidence.
(5) The safety-critical behavior of all non-processor based components, which are part of a processor-based system or subsystem, should be quantified with an MTTHE metric. The MTTHE assessment methodology should consider failures caused by permanent, transient, and intermittent faults, phase interval maintenance and restoration of failures and the effect of fault coverage of each non-processor-based subsystem or component. The MTTHE compliance verification and validation should be based on the assessment of the design for verification and validation process, historical performance data, analytical methods and experimental safety critical performance testing performed on the subsystem or component. The non-processor based quantification compliance should also be demonstrated to have a high degree of confidence.
(g) A hazard mitigation analysis, including a complete and comprehensive description of all hazards to be addressed in the system design and development, mitigation techniques used, and system safety precedence followed;
(h) A complete description of the safety assessment and verification and validation processes applied to the product and the results of these processes;
(i) A complete description of the safety assurance concepts used in the product design, including an explanation of the design principles and assumptions; the designer should address each of the following safety considerations when designing and demonstrating the safety of products covered by this part. In the event that any of these principles are not followed, the analysis should describe both the reason(s) for departure and the alternative(s) utilized to mitigate or eliminate the hazards associated with the design principle not followed.
(1) Normal operation. The system (including all hardware and software) should demonstrate safe operation with no hardware failures under normal anticipated operating conditions with proper inputs and within the expected range of environmental conditions. All safety-critical functions should be performed properly under these normal conditions. Absence of specific operator actions or procedures will not prevent the system from operating safely. Hazards categorized as unacceptable should be eliminated by design. Best effort should also be made by the designer to eliminate hazards that are undesirable. Those undesirable hazards that cannot be eliminated must be mitigated to an acceptable level.
(2) Systematic failure. It should be shown how the product is designed to mitigate or eliminate unsafe systematic failures—those conditions which can be attributed to human error that could occur at various stages throughout product development. This includes unsafe errors in the software due to human error in the software specification, design or coding phase, or both; human errors that could impact hardware design; unsafe conditions that could occur because of an improperly designed human-machine interface; installation and maintenance errors; and errors associated with making modifications.
(3) Random failure. The product should be shown to operate safely under conditions of random hardware failure. This includes single as well as multiple hardware failures, particularly in instances where one or more failures could occur, remain undetected (latent) and react in combination with a subsequent failure at a later time to cause an unsafe operating situation. In instances involving a latent failure, a subsequent failure is similar to there being a single failure. In the event of a transient failure, and if so designed, the system should restart itself if it is safe to do so. Frequency of attempted restarts should be considered in the hazard analysis. There should be no single point failures in the product that can result in hazards categorized as unacceptable or undesirable. Occurrence of credible single point failures that can result in hazards shall be detected and the product shall be detected and the product should achieve a known state that eliminates the possibility of false activation of any physical appliance. If one non-self-revealing failure combined with a second failure can cause a hazard that is categorized as unacceptable or undesirable, then the second failure should be detected and the product must achieve a known safe state that eliminates the possibility of false activation.
(4) Common Mode failure. Another concern of multiple failures involves common mode failure in which two or more subsystems or components intended to compensate one another to perform the same function all fail by the same mode and result in unsafe conditions. This is of particular concern in instances in which two or more elements (hardware or software, or both) are used in combination to ensure safety. If a common mode failure exists, then any analysis cannot rely on the assumption that failures are independent. Examples include: the use of redundancy in which two or more elements perform a given function in parallel and when one (hardware or software) element checks/monitors another element (of hardware or software) to help ensure its safe operation. Common mode failure relates to independence, which shall be ensured in these instances. When dealing with the effects of hardware failure, the designer should address the effects of the failure not only on other hardware, but also on the execution of the software, since hardware failures can greatly affect how the software operates.
(5) External influences. The product should operate safely when subjected to different external influences, including:
(i) Electrical influences such as power supply anomalies/transients, abnormal/improper input conditions (e.g., outside of normal range inputs relative to amplitude and frequency, unusual combinations of inputs) including those related to a human operator, and others such as electromagnetic interference or electrostatic discharges, or both;
(ii) Mechanical influences such as vibration and shock; and climatic conditions such as temperature and humidity.
(6) Modifications. Safety must be ensured following modifications to the hardware or software, or both. All or some of the concerns previously identified may be applicable depending upon the nature and extent of the modifications.
(7) Software. Software faults should not cause hazards categorized as unacceptable or undesirable.
(8) Closed Loop Principle. The product design should require positive action to be taken in a prescribed manner to either begin product operation or continue product operation.
(j) A human factors analysis, including a complete description of all human-machine interfaces, a complete description of all functions performed by humans in connection with the product to enhance or preserve safety, and an analysis of the physical ergonomics of the product on the operators and the safe operation of the system;
(k) A complete description of the specific training of railroad and contractor employees and supervisors necessary to ensure the safe and proper installation, implementation, operation, maintenance, repair, inspection, testing, and modification of the product;
(l) A complete description of the specific procedures and test equipment necessary to ensure the safe and proper installation, implementation, operation, maintenance, repair, inspection, test, and modification of the product. These procedures, including calibration requirements, should be consistent with or explain deviations from the equipment manufacturer's recommendations;
(m) A complete description of the necessary security measures for the product over its life-cycle;
(n) A complete description of each warning to be placed in the Operations and Maintenance Manual and of all warning labels required to be placed on equipment as necessary to ensure safety;
(o) A complete description of all initial implementation testing procedures necessary to establish that safety-functional requirements are met and safety-critical hazards are appropriately mitigated;
(p) A complete description of all post-implementation testing (validation) and monitoring procedures, including the intervals necessary to establish that safety-functional requirements, safety-critical hazard mitigation processes, and safety-critical tolerances are not compromised over time, through use, or after maintenance (repair, replacement, adjustment) is performed; and
(q) A complete description of each record necessary to ensure the safety of the system that is associated with periodic maintenance, inspections, tests, repairs, replacements, adjustments, and the system's resulting conditions, including records of component failures resulting in safety relevant hazards;
(r) A complete description of any safety-critical assumptions regarding availability of the product, and a complete description of all backup methods of operation; and
(s) The configuration/revision control measures designed to ensure that safety-functional requirements and safety-critical hazard mitigation processes are not compromised as a result of any change. Changes classified as maintenance require validation.
The product design should sufficiently incorporate human factors engineering that is appropriate to the complexity of the product; the gender, educational, mental, and physical capabilities of the intended operators and maintainers; the degree of required human interaction with the component; and the environment in which the product will be used. HMI design criteria minimize negative safety effects by causing designers to consider human factors in the development of HMIs. As used in this discussion, “designer” means anyone who specifies requirements for—or designs a system or subsystem, or both, for—a product subject to this part, and “operator” means any human who is intended to receive information from, provide information to, or perform repairs or maintenance on a safety critical locomotive control product subject to this part.
I. FRA recommends that system designers should:
(a) Design systems that anticipate possible user errors and include capabilities to catch errors before they propagate through the system;
(b) Conduct cognitive task analyses prior to designing the system to better understand the information processing requirements of operators when making critical decisions;(c) Present information that accurately represents or predicts system states; and
(d) Ensure that electronics equipment radio frequency emissions are compliant with appropriate Federal Communications Commission (FCC) regulations. The FCC rules and regulations are codified in Title 47 of the Code of Federal Regulations (CFR). The following documentation is applicable to obtaining FCC Equipment Authorization:
(1) OET Bulletin Number 61 (October, 1992 Supersedes May, 1987 issue) FCC Equipment Authorization Program for Radio Frequency Devices. This document provides an overview of the equipment authorization program to control radio interference from radio transmitters and certain other electronic products and how to obtain an equipment authorization.
(2) OET Bulletin 63: (October 1993) Understanding The FCC Part 15 Regulations for Low Power, Non-Licensed Transmitters. This document provides a basic understanding of the FCC regulations for low power, unlicensed transmitters, and includes answers to some commonly-asked questions. This edition of the bulletin does not contain information concerning personal communication services (PCS) transmitters operating under Part 15, Subpart D of the rules.
(3) Title 47 Code of Federal Regulations Parts 0 to 19. The FCC rules and regulations governing PCS transmitters may be found in 47 CFR, Parts 0 to 19.
(4) OET Bulletin 62 (December 1993) Understanding The FCC Regulations for Computers and other Digital Devices. This document has been prepared to provide a basic understanding of the FCC regulations for digital (computing) devices, and includes answers to some commonly-asked questions.
II. Human factors issues designers should consider with regard to the general functioning of a system include:
(a) Reduced situational awareness and over-reliance. HMI design shall give an operator active functions to perform, feedback on the results of the operator's actions, and information on the automatic functions of the system as well as its performance. The operator shall be “in-the loop.” Designers should consider at minimum the following methods of maintaining an active role for human operators:
(1) The system should require an operator to initiate action to operate the train and require an operator to remain “in-the-loop” for at least 30 minutes at a time;
(2) The system should provide timely feedback to an operator regarding the system's automated actions, the reasons for such actions, and the effects of the operator's manual actions on the system;
(3) The system should warn operators in advance when they require an operator to take action;
(4) HMI design should equalize an operator's workload; and
(5) HMI design should not distract from the operator's safety related duties.
(b) Expectation of predictability and consistency in product behavior and communications. HMI design should accommodate an operator's expectation of logical and consistent relationships between actions and results. Similar objects should behave consistently when an operator performs the same action upon them. End users have a limited memory and ability to process information. Therefore, HMI design should also minimize an operator's information processing load.
(1) To minimize information processing load, the designer should:
(i) Present integrated information that directly supports the variety and types of decisions that an operator makes;
(ii) Provide information in a format or representation that minimizes the time required to understand and act; and
(iii) Conduct utility tests of decision aids to establish clear benefits such as processing time saved or improved quality of decisions.
(2) To minimize short-term memory load, the designer should integrate data or information from multiple sources into a single format or representation (“chunking”) and design so that three or fewer “chunks” of information need to be remembered at any one time. To minimize long-term memory load, the designer should design to support recognition memory, design memory aids to minimize the amount of information that should be recalled from unaided memory when making critical decisions, and promote active processing of the information.
(3) When creating displays and controls, the designer shall consider user ergonomics and should:
(i) Locate displays as close as possible to the controls that affect them;
(ii) Locate displays and controls based on an operator's position;
(iii) Arrange controls to minimize the need for the operator to change position;
(iv) Arrange controls according to their expected order of use;
(v) Group similar controls together;
(vi) Design for high stimulus-response compatibility (geometric and conceptual);
(vii) Design safety-critical controls to require more than one positive action to activate (e.g., auto stick shift requires two movements to go into reverse);
(viii) Design controls to allow easy recovery from error; and
(ix) Design display and controls to reflect specific gender and physical limitations of the intended operators.
(4) Detailed locomotive ergonomics human machine interface guidance may be found in “Human Factors Guidelines for Locomotive Cabs” (FRA/ORD-98/03 or DOT-VNTSC-FRA-98-8).
(5) The designer should also address information management. To that end, HMI design should:
(i) Display information in a manner which emphasizes its relative importance;
(ii) Comply with the ANSI/HFS 100-2007, or more recent standard;
(iii) Utilize a display luminance that has a difference of at least 35cd/m2 between the foreground and background (the displays should be capable of a minimum contrast 3:1 with 7:1 preferred, and controls should be provided to adjust the brightness level and contrast level);
(iv) Display only the information necessary to the user;
(v) Where text is needed, use short, simple sentences or phrases with wording that an operator will understand and appropriate to the educational and cognitive capabilities of the intended operator;
(vi) Use complete words where possible; where abbreviations are necessary, choose a commonly accepted abbreviation or consistent method and select commonly used terms and words that the operator will understand;
(vii) Adopt a consistent format for all display screens by placing each design element in a consistent and specified location;
(viii) Display critical information in the center of the operator's field of view by placing items that need to be found quickly in the upper left hand corner and items which are not time-critical in the lower right hand corner of the field of view;
(ix) Group items that belong together;
(x) Design all visual displays to meet human performance criteria under monochrome conditions and add color only if it will help the user in performing a task, and use color coding as a redundant coding technique;
(xi) Limit the number of colors over a group of displays to no more than seven;
(xii) Design warnings to match the level of risk or danger with the alerting nature of the signal; and
(xiii) With respect to information entry, avoid full QWERTY keyboards for data entry.
(6) With respect to problem management, the HMI designer should ensure that the HMI design:
(i) enhances an operator's situation awareness;
(ii) supports response selection and scheduling; and
(iii) supports contingency planning.
(7) Designers should comply with FCC requirements for Maximum Permissible Exposure limits for field strength and power density for the transmitters operating at frequencies of 300 kHz to 100 GHz and specific absorption rate (SAR) limits for devices operating within close proximity to the body. The Commission's requirements are detailed in Parts 1 and 2 of the FCC's Rules and Regulations (47 CFR 1.1307(b), 1.1310, 2.1091, 2.1093). The FCC has a number of bulletins and supplements that offer guidelines and suggestions for evaluating compliance. These documents are not intended to establish mandatory procedures; other methods and procedures may be acceptable if based on sound engineering practice.
(i) OET Bulletin No. 65 (Edition 97-01, August 1997), “Evaluating Compliance With FCC Guidelines For Human Exposure To Radio frequency Electromagnetic Fields”;
(ii) OET Bulletin No 65 Supplement A, (Edition 97-01, August 1997), OET Bulletin No 65 Supplement B (Edition 97-01, August 1997); and
(iii) OET Bulletin No 65 Supplement C (Edition 01-01, June 2001). This bulletin provides assistance in determining whether proposed or existing transmitting facilities, operations, or devices comply with limits for human exposure to radio frequency RF fields adopted by the FCC.
The goal of this assessment is to provide an evaluation of the product manufacturer's utilization of safety design practices during the product's development and testing phases, as required by the applicable railroad's requirements, the requirements of this part, and any other previously agreed-upon controlling documents or standards. The standards employed for verification or validation, or both, of products shall be sufficient to support achievement of the applicable requirements of this part.
(a) The latest version of the following standards have been recognized by FRA as providing appropriate risk analysis processes for incorporation into verification and validation standards.
(1) U.S. Department of Defense Military Standard (MIL-STD) 882C, “System Safety Program Requirements” (January 19, 1993);
(2) The most recent CENLE/IEC Standards as follows:
(i) EN50126:/IEC 62278, Railway Applications: Communications, Signaling, and Processing Systems Specification and Demonstration of Reliability, Availability, Maintainability and Safety (RAMS);
(ii) EN50128/IEC 62279, Railway Applications: Communications, Signaling, and Processing Systems Software for Railway Control and Protection Systems;
(iii) EN50129, Railway Applications: Communications, Signaling, and Processing Systems-Safety Related Electronic Systems for Signaling; and
(iv) EN50155, Railway Applications: Electronic Equipment Used in Rolling Stock.
(3) ATCS Specification 140, Recommended Practices for Safety and Systems Assurance.
(4) ATCS Specification 130, Software Quality Assurance.
(5) Safety of High Speed Ground Transportation Systems. Analytical Methodology for Safety Validation of Computer Controlled Subsystems. Volume II: Development of a Safety Validation Methodology. Final Report September 1995. Author: Jonathan F. Luedeke, Battelle. DOT/FRA/ORD-95/10.2.
(6) IEC 61508 (International Electro-technical Commission), Functional Safety of Electrical/Electronic/Programmable/Electronic Safety (E/E/P/ES) Related Systems, Parts 1-7 as follows:
(i) IEC 61508-1 (1998-12) Part 1: General requirements and IEC 61508-1 Corr. (1999-05) Corrigendum 1-Part 1: General Requirements;
(ii) IEC 61508-2 (2000-05) Part 2: Requirements for electrical/electronic/programmable electronic safety-related systems;
(iii) IEC 61508-3 (1998-12) Part 3: Software requirements and IEC 61508-3 Corr.1(1999-04) Corrigendum 1-Part3: Software requirements;
(iv) IEC 61508-4 (1998-12) Part 4: Definitions and abbreviations and IEC 61508-4 Corr.1(1999-04) Corrigendum 1-Part 4: Definitions and abbreviations;
(v) IEC 61508-5 (1998-12) Part 5: Examples of methods for the determination of safety integrity levels and IEC 61508-5 Corr.1 (1999-04) Corrigendum 1 Part 5: Examples of methods for determination of safety integrity levels;
(vi) 1IEC 61508-6 (2000-04) Part 6: Guidelines on the applications of IEC 61508-2 and -3; and,
(vii) IEC 61508-7 (2000-03) Part 7: Overview of techniques and measures.
(7) ANSI/GEIA-STD-0010: Standard Best Practices for System Safety Program Development and Execution
(b) When using unpublished standards, including proprietary standards, the standards should be available for inspection and replication by the railroad and FRA and should be available for public examination.
(c) Third party assessments. The railroad, the supplier, or FRA may conclude it is necessary for a third party assessment of the system. A third party assessor should be “independent”. An “independent third party” means a technically competent entity responsible to and compensated by the railroad (or an association on behalf of one or more railroads) that is independent of the supplier of the product. An entity that is owned or controlled by the supplier, that is under common ownership or control with the supplier, or that is otherwise involved in the development of the product would not be considered “independent”.
(1) The reviewer should not engage in design efforts, in order to preserve the reviewer's independence and maintain the supplier's proprietary right to the product. The supplier should provide the reviewer access to any, and all, documentation that the reviewer requests and attendance at any design review or walk through that the reviewer determines as necessary to complete and accomplish the third party assessment. Representatives from FRA or the railroad might accompany the reviewer.
(2) Third party reviews can occur at a preliminary level, a functional level, or implementation level. At the preliminary level, the reviewer should evaluate with respect to safety and comment on the adequacy of the processes, which the supplier applies to the design, and development of the product. At a minimum, the reviewer should compare the supplier processes with industry best practices to determine if the vendor methodology is acceptable and employ any other such tests or comparisons if they have been agreed to previously with the railroad or FRA. Based on these analyses, the reviewer shall identify and document any significant safety vulnerabilities that are not adequately mitigated by the supplier's (or user's) processes. At the functional level, the reviewer evaluates the adequacy, and comprehensiveness, of the safety analysis, and any other documents pertinent to the product being assessed for completeness, correctness, and compliance with applicable standards. This includes, but is not limited to the Preliminary Hazard Analysis (PHA), the Hazard Log (HL), all Fault Tree Analyses (FTA), all Failure Mode and Effects Criticality Analysis (FMECA), and other hazard analyses. At the implementation level, the reviewer randomly selects various safety-critical software modules for audit to verify whether the system process and design requirements were followed. The number of modules audited shall be determined as a representative number sufficient to provide confidence that all un-audited modules were developed in similar manner as the audited module. During this phase the reviewer would also evaluate and comment on the adequacy of the plan for installation and test of the product for revenue service.
(d) Reviewer Report. Upon completion of an assessment, the reviewer prepares a final report of the assessment. The report should contain the following information:
(1) The reviewer's evaluation of the adequacy of the risk analysis, including the supplier's MTTHE and risk estimates for the product, and the supplier's confidence interval in these estimates;
(2) Product vulnerabilities which the reviewer felt were not adequately mitigated, including the method by which the railroad would assure product safety in the event of a hardware or software failure (i.e., how does the railroad or vendor assure that all potentially hazardous failure modes are identified?) and the method by which the railroad or vendor addresses comprehensiveness of the product design for the requirements of the operations it will govern (i.e., how does the railroad and/or vendor assure that all potentially hazardous operating circumstances are identified? Who records any deficiencies identified in the design process? Who tracks the correction of these deficiencies and confirms that they are corrected?);
(3) A clear statement of position for all parties involved for each product vulnerability cited by the reviewer;
(4) Identification of any documentation or information sought by the reviewer that was denied, incomplete, or inadequate;
(5) A listing of each design procedure or process which was not properly followed;
(6) Identification of the software verification and validation procedures for the product's safety-critical applications, and the reviewer's evaluation of the adequacy of these procedures;
(7) Methods employed by the product manufacturer to develop safety-critical software, such as use of structured language, code checks, modularity, or other similar generally acceptable techniques; and
(8) Methods by which the supplier or railroad addresses comprehensiveness of the product design which considers the safety elements.
[77 FR 21352, Apr. 9, 2012]
| File Type | application/msword |
| Last Modified By | Brogan, Robert (FRA) |
| File Modified | 2015-09-21 |
| File Created | 2015-01-28 |