NATIONAL TRANSPORTATION SAFETY BOARD

8 〔图〕插图 PB88-916306

NATIONAL TRANSPORTATION SAFETY BOARD

〔图〕ONALNAT/SAFETYBOARD\n 〔图〕出\n WASHINGTON, D.C. 20594

〔图〕插图

RAILROAD ACCIDENT REPORT

REAR-END COLLISION OF AMTRAK/MASSACHUSETTS BAY TRANSPORTATION AUTHORITY COMMUTER TRAINS, BOSTON, MASSACHUSETTS, NOVEMBER 12, 1987

〔图〕插图 NTSB/RAR-88/05

〔图〕插图 REPRODUCED BY U.S. DEPARTMENT OF COMMERCE NATIONAL TECHICAL INFORMATION SERVICE SPRINGFIELD, VA. 22161

UNITED STATES GOVERNMENT

TECHNICAL REPORT DOCUMENTATION PAGE

NTSB Form 1765.2 (Rev. 5/88)

The National Transportation Safety Board determines that the probable cause of the accident was the display of an improper wayside signal aspect resulting from a signal system that was improperly designed; the failure of the engineer of Amtrak/Massachusetts Bay Transportation Authority train 8114 to operate in compliance with a restricting cab signal indication; and Amtrak supervisors' failure to properly supervise operating employees and to followup on reported signal failures.

CONTENTS

EXECUTIVE SUMMARY $\ldots$ v

INVESTIGATION

The Accident $\ldots$ 1

Injuries $\ldots$ 7

Damage $\ldots$ 8

Personnel Information $\ldots$ 9

Train Information $\ldots$ 9

Signal System $\ldots$ 10

Method of Operation $\ldots$ 13

Emergency Response $\ldots$ 17

Disaster Preparedness $\ldots$ 17

Meteorological Information $\ldots$ 18

Tests and Research $\ldots$ 18

Sight Distance $\ldots$ 18

Stopping Distance $\ldots$ 18

Signal Relay $\ldots$ 20

Căb Signal System $\ldots$ 21

Air Brake $\ldots$ 22

Radio $\ldots$ 22

ANALYSIS

The Accident $\ldots$ 23

Positive Separation of Trains $\ldots$ 25

Oversight of Train Operations $\ldots$ 27

Signal System $\ldots$ 28

Emergency Response/Disaster Preparedness $\ldots$ 29

CONCLUSIONS

Findings $\ldots$ 30

Probable Cause $\ldots$ 30

RECOMMENDATIONS $\ldots$ 31

APPENDIXES

Appendix A-Investigation $\ldots$ 33

Appendix B--Crewmember Information $\ldots$ 35

Appendix C--Interior Damage $\ldots$ 37

Appendix D--FRA/DCP Agreement Excerpts $\ldots$ 41

Appendix E--DCP/US&S Agreement Excerpts $\ldots$ 43

EXECUTIVE SUMMARY

On November 12, 1987, National Railroad Passenger Corporation (Amtrak)/Massachusetts Bay Transportation Authority (MBTA) commuter train 8110 was standing partially berthed at the Back Bay Station platform in Boston, Massachusetts, when it was struck from the rear by Amtrak/MBTA commuter train 8114.

The safety issues discussed in this report include the effectiveness of the current audible indicator to alert crewmembers to a changing cab signal display, requirement for the design of signal circuits, implementing emergency preparedness plans, and the training of operating personnel.

The National Transportation Safety Board determines that the probable cause of the accident was the display of an improper wayside signal aspect resulting from a signal system that was improperly designed; the failure of the engineer of Amtrak/Massachusetts Bay Transportation Authority train 8114 to operate in compliance with a restricting cab signal indication; and Amtrak supervisors' failure to properly supervise operating employees and to followup on reported signal failures.

NATIONAL TRANSPORTATION SAFETY BOARD WASHINGTON, D.C. 20594

RAILROAD ACCIDENT REPORT

NATIONAL TRANSPORTATION

REAR-END COLLISION OF AMTRAK/ MASSACHUSETTS BAY TRANSPORTATION AUTHORITY COMMUTER TRAINS AT BACK BAY STATION BOSTON, MASSACHUSETTS NOVEMBER 12, 1987

INVESTIGATION

The Accident

At 6:50 a.m., on November 12, 1987, National Railroad Passenger Corporation (Amtrak)/Massachusetts Bay Transportation Authority (MBTA) regularly-scheduled, commuter train 8110 departed Attleboro, Massachusetts for Boston. (See figure 1.) Before departing Attleboro, the engineer performed an airbrake test, radio check, and was provided with a certificate that the cab signal system had been tested. A snowfall occurred that morning, and train 8110 departed Attleboro 8 minutes late due to difficulty lining the track switches.

Train 8110's engineer stated that in addition to making normal station stops, the Boston train dispatcher directed the engineer by radio to make an unscheduled stop at Forest Hills to pick up two maintenance-of-way employees and transport them to Plains. The maintenance-of-way employees were being positioned to keep the Plains interlocking's switches clear of snow and ice.

The engineer testified that train 8110 handled normally in both power and braking modes during the inbound trip to Boston. Various crewmembers came into the control compartment during the trip. According to the engineer, every time train, 8110 approached a wayside signal, he called the aspect of that signal and received an acknowledgment from the crewmember who was in the control compartment with him. He stated that he realized he was following another train (8910) after departing Hyde Park station and that it was routine for train 8110 to follow train 8910 by timetable schedule.

2

〔图〕SouthStation (BostonBack BaySignal 2262-2Ruggles StForest HillsHyde ParkReadvilleRoute 128Canton JctSharonMansfieldAttle

Figure 1. --Attleboro/Boston route.

The engineer stated that as train 8110 approached wayside signal 2262-2, he observed the wayside signal displaying an approach aspect and that his cab signal was displaying a clear aspect. The engineer said he made a minimum brake pipe reduction before reaching the wayside signal to "set up" his brakes in order to provide a smoother ride to the passengers. The engineer further stated that as the control unit passed wayside signal 2262-2, he made a full service brake pipe.

3

reduction$^{1}$ and acknowledged the audible indication of the speed control system (SCS).$^{2}$ According to the engineer, the cab signal indication degraded from a clear aspect to a restricting aspect, improved to an approach aspect for about 5 seconds, then degraded to a restricting aspect. The engineer reported he acknowledged the SCS again when the cab signal degraded the second time to avoid a penalty brake application. Since the brake handle was already in suppression$^{3}$ he did not make any adjustment to its position.

The engineer later stated that he had encountered this same set of circumstances before at this location; "... [it has] happened to me enough times to tell me there's a guy [train] sitting in the station at Back Bay." When the engineer encountered this situation before, he had substantially reduced his speed. He further stated, "I know I'd better get myself down [train speed] whenever I can, and I just hold on to it [brake reduction] until I get it [train speed] way down." The engineer testified that in one instance, less than 5 days before this accident, he had entered Back Bay station with signal 2262-2 displaying an approach aspect and had observed a train departing the block. The engineer also testified that on previous occasions, he had verbally reported this cab signal occurrence to an Amtrak transportation manager, a train dispatcher, and a tower operator. According to the engineer, the transportation manager indicated he would follow up on the report and "get back" to the engineer; however, the transportation manager never did. In addition, the engineer stated he had discussed the situation informally with other engineers who operated over this route.

The engineer said that as train 8110 rounded the curve approaching the Back Bay station platform, he observed train 8910 stopped at the platform. (See figure 2.) Because only about two car lengths of platform space remained behind train 8910, the engineer of train 8110 stopped his train short of the platform to prevent any passengers from detraining. Train 8110's engineer then radioed train 8910's engineer to request that train 8910 pull forward. After train 8910's engineer complied with that request, train 8110's engineer pulled his train forward so that the head 3 1/2 cars were stopped adjacent to the station platform.

According to train 8110's engineer, he was informed by train 8910's engineer that it was probable they were about to encounter a considerable delay. Train 8910 was being held at the Back Bay station due to terminal congestion at South station caused by snow and icy track switch conditions. This information was relayed to train 8110's passengers along with the information that the rail rapid transit system (Orange line) was still operating from Back Bay station. By 7:50 a.m., approximately 615 passengers had detrained through the forward cars to the station platform.

Train 8114 is a regularly-scheduled commuter train that operates between Attleboro and Boston, Massachusetts. Following an air brake test, cab signal test, and a radio check, train 8114 departed Attleboro about 7:13 a.m.

4

Train 8114's engineer testified that the train responded normally in the power mode but was "sluggish" in braking, and that he made allowance for this when making station stops. The engineer explained:

By sluggish, I mean with heavy snow, [the brakes] take a little bit longer time, I believe, to set themselves up and get warm. And it seems on a dry sunny day, they obviously operated better... than they do on a day like this. So I would have to say, although they probably operated perfectly, it is just with the conditions the way they were, it takes a little longer.

At Route 128 station, train 8114 picked up a deadheading conductor who came into the operating compartment with the engineer. The engineer testified (see appendix A) that he informed the deadheading conductor after departing the Route 128 station that the train was operating on a clear signal; the engineer did not call any more signals until "the first signal that affected the movement [of] my train." According to the engineer, that signal was wayside signal 2262-2, which he stated he called at approach and the deadheading conductor acknowledged. The engineer stated he observed the cab signal displaying an approach aspect after his control unit passed wayside signal 2262-2. The deadheading conductor recalled the engineer informing him that they were operating on a clear signal when he entered the operating compartment, and he recalled the engineer calling wayside signal 2262-2 at approach; however, he did not recall the engineer calling nonrestricting wayside signals or any cab signal indications.

The engineer testified that after train 8114's control unit passed wayside signal 2262-2, he made a gradual brake application to a full service brake pipe reduction. He further testified, "You have 6 seconds to acknowledge a cab signal without having the brake on properly [in suppression]...so I put the brake on gradually so it is a smoother application of the brakes." The engineer said that he had received a letter of commendation from the Boston and Maine Railroad (his former employer) based on passenger compliments about his smooth braking manner and comfortable ride.

Train 8114's engineer testified that on intermittent occasions he also had observed cab signal incidents at Back Bay station as described by the engineer of train 8110. According to train 8114's engineer, he had reported verbally the cab signal incidents to an Amtrak trainmaster. Additionally, train 8114's engineer said that on a previous occasion, he had entered Back Bay station on a restricting cab signal aspect, found the station platform empty, stopped his train, and after waiting a moment, the cab signal improved to a clear aspect. The engineer stated he had never seen another train at Back Bay station after having passed signal 2262-2 with that signal displaying an approach aspect.

As train 8114 proceeded toward Back Bay station, the engineer estimated "about 2/3 of the way into the tunnel." he observed what he described as a "wall of smoke." The engineer stated that this was an unusual occurrence and that his attention was focused on it to the extent that he did not look at the train's speedometer, air brake gauges, or cab signal. The engineer stated the brake handle was still in suppression while traveling through the smoke "until I had seen one marker light, possibly just as I was seeing the second one, and then I threw it into emergency." The engineer estimated train 8114's speed at 20 mph when he first realized there was a train ahead. The engineer shouted a warning to the deadheading conductor, then he braced for the collision.

At 8:05, train 8114 collided with the rear end of train 8110 340 feet west of the Back Bay station platform near the apex of a 9° 30' curve to the right. (See figure 3.)

〔图〕插图 〔图〕$$ \hat{L} $$\n

Figure 2.

1. 0% GRADE

PROFILE TRACK 2

SCALE:

HORZ. 1" = 50' WSDT. 1" = 60'

$$2220 + 0$$

![To BostonPLATFORMS.TC.S304342POINT of IMPACT]C343331PLATFORM3352225+0TRAir! No.8110MP 227.5010542220+01403S.CTUNNEL WALL403340' to ST.--250'to T.S.N\n](5/c30bHCsB7t5ziiaOum9G8B/pdf_78ab0cf185284213efdf3845e35acd1e_1a605fb1f323d2f9186e64e48455d6bc7490560193474857/tmp_zip_img/1342e22e-72f4-49d7-a3a0-434f03de1f59.png)

Figure 2.--Plan view of accident site.

7

〔图〕插图

Figure 3. --Accident location.

After the collision, the crewmembers of train 8114 assisted the passengers of the train to a concrete walkway in the tunnel where they walked eastward until reaching the rear coach of train 8110. At that point, a crewmember guided the passengers aboard train 8110. The uninjured passengers then proceeded through train 8110 to detrain on the Back Bay station platform. Train 8110's conductor immediately established an area in a passenger car of his train for assembling those passengers who required medical attention.

Injuries

• Estimate provided by MBTA

8

Forty persons were transported from the scene to area hospitals--34 were transported by emergency medical service (EMS) personnel, and 6 were transported by Amtrak and MBTA police. Two persons were admitted to a hospital (one passenger and the engineer of train 8114), 38 persons were treated for minor lacerations and multiple contusions. Twenty of the injured were transported in ambulances, and 14 were transported by a bus that had been procured by MBTA police. The bus was used as a temporary treatment facility and then as a transport unit.

Damage

The control car (1403) and east truck of the first coach car (403) of train 8114 were derailed. In addition, three cars (430, 413, and 415) sustained diaphragm and wheel damage, although they did not derail. The locomotive unit (1054), rear coach car (335) and west truck on the second rear coach car (331) of train 8110 were derailed. Damage was estimated as follows:

There was major crush damage to control car 1403 of train 8114. (See figure 4.) At the engineer's control position the cab was displaced 4.5 feet rearward, the floor was displaced 17 inches upward, and sheet metal displacement extended 2.5 feet beyond the left outboard side. (See appendix C.)

〔图〕1103\n

Figure 4. Damage to the control car (1403) of train 8114.

9

Personnel Information

The engineers, conductors, and assistant conductors on both trains were qualified by Amtrak for their respective positions and were current on the operating rules and instructions. The engineers of both trains were in compliance with the Hours of Service Law $^{4}$ before reporting for duty on the day or the accident.

Following the accident, the train dispatcher and the crewmembers from both trains were taken to Massachusetts General Hospital where blood and urine samples were collected for toxicological testing in accordance with Title 49 Code of Federal Regulations Part 219. The first sample was collected at 11 a.m. Only blood samples were collected from the two injured crewmembers. The sample from the engineer of train 8114 was collected last at 3 p.m.

All the samples were sent to the Center for Human Toxicology in Salt Lake City, Utah, for toxicological analysis. Tests were performed for the presence of ethanol, amphetamines, barbiturates, benzodiazepines, cannabinoids, cocaine, methaqualone, opiates, and phencyclidine. Negative test results were obtained from all the samples except for the flagman of train 8114 who tested positive for codeine in the urine at 235 ng/ml. The flagman indicated he was taking a medically prescribed cough syrup, and he subsequently provided a prescription for "Tussi-Organidin-codeine" with the prescribed dosage of 2 teaspoonfuls four times a day. The prescription was dated November 5, 1987, and authorized four refills. Amtrak's chief medical officer determined that the positive toxicological test result was within the therapeutic range and took no exception with the flagman having performed duty on the morning of the accident.

Train Information

Commuter trains operating on this route are configured for "push/pull service." In this arrangement a locomotive unit is positioned at one end of the train consist and a control car is positcined at the other. Power is provided by the locomotive which the engineer can control either directly from the locomotive or remotely from the control car. When the engineer is operating from the control car, the train is in "push" mode; conversely, when the engineer is operating from the locomotive, the train is in "pull" mode. This configuration allows trains to make round trips without repositioning the locomotive unit at the front of the train consist. Trains 8110 and 8114 were in the push mode at the time of collision.

Train 8110 consisted of a diesel-electric locomotive unit, six coach cars, and a control car. Train 8114 consisted of a diesel-electric locomotive unit, five coach cars, and two control cars. The locomotive units from each train were 4-axle, 3,000 horsepower, model F40PH-2C passenger units that were manufactured by the Electro-Motive Division of General Motors Corporation in 1987. They were equipped with blended dynamic 5 and schedule 26-L automatic air brakes with electropneumatic interface and pressure maintaining feature; four-aspect continuous cab signal system with speed control,$^{6}$ suppression braking, and audible indicator (the audible indicator emits the

10

same sound regardless of what aspect the cab signal degrades to) overspeed control; Barco speed recorder; and four-channel Motorola radio.

Train 8110's coach cars were manufactured by the Pullman-Standard Company in 1978-1979; they had not been rebuilt. They were all 85-foot high-strength low-alloy steel sill with aluminum body, single level push-pull trailer coaches with seating capacity for 99 passengers. Train 8114's coach cars were manufactured by the Budd Company between 1952-1955 and were rebuilt by Morrison-Knudsen Company in 1982. They were all 85-foot stainless steel single level push-pull trailer coaches with seating capacity for 99 passengers. All the coach cars from both trains were equipped with New York Air Brake Company (NYAB) schedule 26C GSX-3 air brake equipment with electro-pneumatic interface.

Train 8110's control car was manufactured by the Pullman-Standard Company between 1978-1979; it had not been rebuilt. It was an 85-foot high-strength alloy steel sill with aluminum body, single level push-pull control trailer with seating capacity for 95 passengers. It was equipped with NYAB schedule 26C; GSX-3 air brakes with electro-pneumatic interface and NYAB controller; sanding system that allowed the operator to release sand manually to the rail head and provided for automatic sand release during an emergency air brake application; Westinghouse Air Brake Company (WABCO) cab signal system with speed control, suppression braking, and an audible alarm that functioned in the same manner as the locomotive's; four-channel Motorola radio; and Barco speed recorder.

Train 8114's control cars were manufactured by the Budd Company between 1952-1955 and were rebuilt by the Morrison-Knudsen Company in 1982. They were 85-foot stainless steel single level push-pull control trailers with seating capacity for 92 passengers. They were equipped with NYAB schedule 26C GSX-3 air brakes with electro-pneumatic interface and NYAB controller; sanding system that allowed the operator to manually release sand to the rail head and provided automatic sand release during an emergency air brake application; WABCO 55 decelostat slide system; WABCO continuous cab signal system with speed control, suppression braking, and audible alarm that functioned in the same manner as the locomotive's; overspeed control; four-channel Motorola radio; and Barco speed recorder.

Signal System

The signal system along the Attleboro to Boston route was installed as a result of the Northeast Corridor improvement Project (NEC.P). The NECIP was part of the Railroad Revitalization and Regulatory Reform Act of 1976 (4R Act) (Title 45 U.S. Code 801) which was enacted to facilitate compatibility with improved high-speed rail service.

The Federal Railroad Administration's (FRA) project manager for the Northeast Corridor signal systems testified that after Congress passed the 4R Act, the FRA was given the task of implementing the NECIP. The project manager further testified that FRA did not have sufficient staff available to manage the "design and construction of the project." Subsequently, on October 26, 1976, the FRA contracted DeLeuw, Cather/Parsons (DCP) for "architect-engineering services for systems engineering, program management, design, construction supervision, inspection, administration, procurement of long lead items and related services for the Northeast Corridor Improvement Program." (See appendix D.) According to the FRA's project manager, DCP was the "prime designer" of the signal system for the NECIP. The U.S. Government, as represented by the FRA, could at all reasonable times inspect or otherwise evaluate the work being performed under the contract. FRA's project manager testified that the FRA assured the technical accuracy and professional quality of the design for the signal system through "spot checking."

11

DCP in turn subcontracted with the Union Switch & Signal Division (US&S) of American Standard, Inc., for the design/manufacture of the signal system between Boston, Massachusetts, and New York, New York. (See appendix E.)

Amtrak's senior director of communications and signals testified that Amtrak "had the responsibility to receive the [signal] equipment and to install it and also to do the final testing." The final field operational testing of the signal system began on September 28, 1987; phasing-in of the signal system began October 2, 1987; the signal system was put into full operation at 5 a.m. on October 5, 1987.

The area in which the accident occurred is equipped with a traffic control system (TCS) and continuous automatic cab signal signal system with speed control and suppression braking. The main tracks are signaled for movement in either direction. Portions of the area are equipped to display wayside signal aspects from searchlight signal heads, while other portions are equipped to display signal aspects from color position signal heads.

After the collision, with trains 8110 and 8114 still occupying the block governed by wayside signal 2262-2, Amtrak's Boston division senior signal engineer observed wayside signal 2262-2 displaying an aspect indicating approach. He stated that the wayside signal should have been displaying an aspect indicating stop and proceed in that situation. Tests conducted at that time by Amtrak showed steady electrical energy in the rail which the senior signal engineer testified would have resulted in a restricting cab signal indication. Amtrak signal officials ordered signal shunts7 placed on the track in the area of the accident to simulate occupancy before the involved trains were moved. The placing of these shunts held the signal circuitry in the configuration that existed at the time of the accident for later observations and tests.

Coded track circuits were used in the signal system. The code$^{8}$ rates and resulting cab signal indications for the entire system were:

Wayside signal 2262-2 governs train movement eastward to Cove interlocking. The signal block consists of three track circuits, signal section 2262, and cut sections$^{9}$ 2271 and 2276. (See figure 5.) A track circuit is usually reset upon receipt of code from an adjacent signal block with a lower code rate. The receiving signal block or cut section attempts to send back energy; however, when the track relay does not detect an incoming code, it disconnects itself. When the delivering track circuit is no longer occupied, the code is sent back, and the track relay is reset. This method requires that the adjoining signal block be unoccupied in order for the code to be generated and transmitted through the rails. At signal location 2262-2, rather than disconnect itself when no

<——Westward to New Haven

Eastward to Boston — —▷

〔图〕CoveSignal 2262-2SIGNAL BLOCK226222712276Poiat of ImpectBack Bay Station\n (NOT TO SCALE - CURVES NOT SHOWN)

Figure 5.–Signal block section at the accident site.

13

incoming code was detected, the track circuit was designed to send back steady energy. This allowed the track circuit to attempt to internally reset before the entire signal block was clear. The signal circuitry was designed so that as the rear of a train cleared the limits of section 2262, the track circuit in 2271 would reset track circuit 2262. According to US&S's manager for Northeast Corridor engineering, this reset feature "was put in there to prevent a lockout $^{10}$ of the system and it was anticipated that at most, it would work maybe once behind the train." He further testified:

[The reset feature] was not in the original contract and in analyzing the circuit operation, we [US&S] realized that the ABS sections would get into a lockout situation every now and then without it [reset feature] because of the way the codes might be arranged on reset. So we discussed it with DCP and were told to go ahead and put that [reset feature] in.

Postaccident tests conducted by Amtrak with the Safety Board, FRA, MBTA, and US&S in attendance determined that a cyclic action was generated in the wayside signal relays when the equipment attempted to reset the track circuit while the signal block was still occupied. The cyclic action would continue until the rear of a train passed Cove interlocking which is just east of Back Bay Station. After the accident, the cycle was measured at 42 times per minute with the original relay and resistor/capacitor (RC) unit that were in place at the time of the accident. With a new relay and a new RC unit, the cycle was measured at 37 times per minute.

When the reset feature was cycling at 37 times per minute, the wayside signal displayed an aspect: indicating stop and proceed; however, when the cyclic rate increased to 42 times per minute, the wayside signal displayer an aspect: indicating approach. Amtrak's senior director of communications and signals stated that the increase in the rate was due to deterioration of a contact in the relay because of the cyclic action. On November 16, 1987, Amtrak filed a False Proceed Signal Report (FRA form F-6180-14) as required in 49 CFR Part 233. In the Nature and Cause of Failure/Corrective Action Taken section of that report Amtrak stated:

Investigation disclosed that Automatic Signal 2262.2 had displayed "Approach" with Train No. 8110 (and Train No. 8910 ahead of Train No. 8110) in the block instead of "Stop and Proceed" as intended. Further tests indicated that the cab signal of Cab Car 1403 did assume the "Restricting" aspect immediately upon passing Signal 2262.2. The "Approach" aspect on Signal 2262.2 was caused by the cyclic action of the reset scheme with steady energy on the track. The circuits were changed to eliminate the steady energy from the track when circuits ahead in the same block are occupied, and the reset scheme is being rmodified. The signal system then functioned as intended.

Method of Operation

Treins are operated over this line by a TCS that is controlled by the Antrak Section D train dispatcher at Boston, train orders, wayside signals, and by automatic cab signal system with speed control.

Between Cove and Readville, a distance of 8.8 miles, there are three main tracks. All three tracks are signaled for movement in either direction. The maximum authorized track speed is 100 miles per hour (mph). However, between the eastern limits of Cove interlocking and mile post 227,

141

which includes the entire Back Bay station area, there is a permanent speed restriction of 30 mph. The maximum allowable speed for MBTA passenger cars is limited by Amtrak special instruction 1157-G-1 to 80 mph at all locations.

The MBTA contracts operation of the commuter rail service to Amtrak. Amtrak provides employees and managerial services; the MBTA owns the equipment, track, stations, and real estate.

Amtrak operating rules (AMT-1) as approved on April 29, 1979, and reissued on February 6, 1984, and Amtrak timetable No. 6 (Schedules and Special Instructions) for the Northeast Corridor were in effect at the time of the accident. Timetable directions are eastward to Boston and westward to New Haven, Connecticut.

Rule 27 states in part:

Absent or imperfectly displayed signals must be reported to the Train Dispatcher or Operator as soon as practicable, without delay to the train.

Rule 34 states in part:

Employees located in the operating compartment of an engine must communicate to each other in an audible and clear manner the indication by name of each signal affecting movement of their train or engine as soon as the signal is clearly visible or audible. It is the responsibility of the Engineer to have each employee comply with these requirements, including himself.

It is the Engineer's responsibility to have each employee located in the operating compartment, maintain a vigilant lookout for signals and conditions along the track which affes the movement of the engine or train.

After the name of a signal has been communicated to other employees involved, it must continue to be observed until passed and any change of indication communicated in the required manner.

Rule 101 states in part:

If an event occurs or conditions are found which may interfere with the safe passage of trains at Normal Speed and no protection has been provided, employees must immediately provide flag protection.

Rule 285 states in part:

15

Rule 550 states in part:

The Cab Signal System apparatus must be tested at least once in each 24 hour period. . . . The test must be made prior to departure of an engine from its initial terminal to determine if apparatus is in service and functioning properly . . . . When test of Cab Signal System apparatus is made by an employee other than the Engineer, the prescribed form stating that the Cab Signal System apparatus has been tested must be filled out in its entirety and must accompany the engine to its final terminal.

Train 8114's engineer had the properly prepared form that certified the cab signal system had been tested by a machinist.

Rule 551 states in part:

The Cab Signal System is interconnected with the fixed signal system so that the Cab Signal must conform with the fixed signal within three seconds after the engine passes fixed signal governing the entrance of the engine or train into the block in the direction for which the track and engine are equipped and Engineer will be governed as follows:

(c) When Cab Signal aspect changes to Restricting, the Engineer must take action at once to reduce train to Restricted Speed.$^{12}$

(e) If the Calo Signal and fixed signal do not conform when train enters the block, the more restrictive signal will govern. The Engineer will notify the Train Dispatcher or Operator by radio or by message as soon thereafter as will not cause delay to train, giving location and track on which non-conformity occurred.

(f) When Cab Signal aspect "flips" (momentarily changing aspect and then returning to original aspect), Engineer will, by radio or as soon thereafter as will not cause delay to train, forward a message . . . to the Train Dispatcher reporting the occurrence:

Operating rule 561 states:

Engineer, in addition to verbally reporting flips, failures, non-conformities, and other unusual occurrences of Cab Signal System apparatus as required by these rules, will report the same occurrences on the prescribed form.

16

Rule 900 states in part:

To perform service in the capacity of a Conductor or Engineer employees must be qualified on the physical characteristics of the portion(s) of railroad involved. To remain qualified an employee must have worked at least one trip in train or engine service during the previous twelve (12) months whether or not in the capacity of a Conductor or Engineer.

Rule 907 states in part:

[Engineers] must be qualified on type of engine to which assigned including any devices or auxiliaries attached thereto.

[Engineers] will be responsible for the observance of all signals, controlling movements accordingly and the regularity of speed between stations, exercise discretion, care and vigilance in moving the enmine with or without cars to prevent injury to persons, damage to property and lading, avoiding collisions and derailments.

If anything withdraws attention from constant lookout ahead, or weather conditions make observations of signals or warnings in any way doubtful, they must at once so regulate speed as to make train progress entirely safe.

The Engineer is responsible for the vigilance and conduct of other employees on the engine. He will see that they are familiar with their duties and instruct them if necessary.

The engineers of trains 8110 and 8114 stated that they had observed cab signal flips in the accident area before the morning of the accident and had verbally reported these occurrences to various Amtrak operating supervisors. Neither engineer filled out the required written forms. Train 8114's engineer testified that he had first reported the cab signal flips when he began operating over this district about 3 weeks before the accident. Train 8114's engineer further testified that an Amtrak supervisor to whom he could relay problems often rode with him "and I never had reason to fill out forms and go further." Train 8110's engineer testified that it was not required to tile a written report-"just verbal, by telephone or radio."

Amtrak's Boston division transportation superintendent testified that significant changes were made in grade, curvature, and physical characteristics on the district during the several years it was closed for the renovation project. Engineers, conductors, and train dispatchers were qualified on the district by viewing a video tape and taking a trip in a high-rail vehicle.$^{13}$ The signal system was not operational at the time these qualifications took place. This method of qualification was done so that personnel training requirements would coincide with the physical completion of the NECIP. The transportation superintendent further testified that those individuals who did not have the opportunity to ride on the high-rail vehicle were given pilots. The engineers of both trains involved in this accident testified that they were qualified by viewing the video tape and riding in the high-rail vehicle.

17

Emergency Response

At 8:09 a.m., the first EMS team arrived at the scene. The Boston EMS is attached to the Boston Department of Health and Hospitals, and as such, is separate from the Boston Fire Department. A command post was established on Dartmouth Street near the entrance to Back Bay station. At 8:17 a.m., a "phase five" disaster alert 14 was issued and a triage center was established inside the station concourse. EMS response to the scene included:

The Boston fire department received notification at 8:14 a.m. when fire alarm box 13-1546 was sounded at Back Bay station. The district fire chief arrived at the scene at 8:20 a.m. and established a command post inside the Back Bay Terminal Concourse. Firefighters hand carried first-aid kits, stretchers, tools, and ladders into the tunnel to assist the passengers. The fire department response included:

The last patient was transported from the scene at 10:04 a.m. The incident was declared secured and the command post was deactivated at 10:17 a.m.

Disaster Preparedness

On April 22, 1987, the MBTA hosted a meeting and familiarization tour of the nine new rail stations on the renovated line and their respective rights-of-way (including the Back Bay station) for Boston safety officials. The meeting was attended by the Boston police department, MBTA police, Boston Housing Authority, Boston Health Department, and representatives of other local agencies. The MBTA also provided monthly emergency training to all area fire departments and rescue and ambulance services.

On October 1, 1987, Amtrak provided the Boston City fire department with emergency evacuation procedures that were developed to provide for an efficient and timely response to an emergency in a rail tunnel.

18

The city of Boston conducted disaster drills at 6-month intervals. The participants included police, fire, civil defense, hospital, rescue, and ambulance service personnel. The last drill before this accident involved a mock classroom explosion.

The city of Boston did not have a city-wide disaster plan. A commission was established before this accident by the Massachusetts Office of Emergency Preparedness, Boston police and fire departments, and Boston EMS to devise a comprehensive disaster management plan. The director of field operations for Boston's EMS testified that at the time of the accident, a city-wide disaster plan existed but that it had not been approved. A joint agreement was in effect at the time of the accident among fire, police, and emergency medical services to coordinate efforts; however, separate command posts were established at the accident scene by the responding agencies.

Meteorological Information

At 8 a.m. on November 12, 1987, the Boston area was experiencing a snow storm with accumulations of 3 to 6 inches, heavy gusty winds, 32°F temperature, and poor visibility.

Tests and Research

Sight Distance.--Beginning at 9 a.m. on November 15, 1987, sight distance tests were conducted using two sets of equipment identical to the equipment involved in the accident. The locomotive on the standing equipment was positioned at the point of impact.

*The marker lights were on the rear of the standing equipment. It was not possible to quantify the density of the smoke reported to be in the tunnel before the collision. There was no smoke in the tunnel during the tests.

Stopping Distance--Both trains were in push mode with both engineers operating from their control cars. Rail surface conditions were similar. Other than a weight difference, the equipment on the two trains involved in the accident were similar. Poth trains had the same braking ratio.$^{15}$ The striking train had an additional control car in the consist. Both control cars of train 81.14 were equipped with devices that apply sand at the wheel/rail interface to improve adhesion. The improved adhesion provides greater tractive and braking ability. Comparisons of the speed tape recordings from both trains were made at the Safety Board's laboratory in Washington D. C., to determine stopping distances. (See figure 6.) Data from the speed tapes were

Speed of Control Car (mph)

SPEED-DISTANCE COMPARISON OF TRAIN NO. 8110 AND TRAIN NO. 8114

〔图〕插图

Figure 6. --Speed-distance comparison of train No. 8110 and train No. 8114.

20

digitized using an optical readout station, then converted to scale. The speed tape trace from train 8114's control car appeared to cross below the 0 mph mark. The 0 point on the speed curve was determined from the last stop train 8114 made before the collision, and the data was adjusted accordingly. The majority of the information retrieved was read directly from this scaled data, the remainder of the information was extrapolated by approximating a smooth curve over a portion of data. The smooth curve was used to project an available stopping point. From the scaled and extrapolated data it was determined that train 8110 could have made the transition from 75.6 mph to 0.0 mph in 3,850 feet. The distance for train 8114 was an actual distance covered, not a projected distance. Train 8114 decelerated from 75.6 mph to 0.0 mph in 6,020 feet. The collision occurred 6,480 feet from signal 2262-2.

Signal Relay. → On November 14, 1987, shunts were applied to the rails simulating the track occupancy conditions at the time of the accident. A pronounced rhythmic sound could be heard outside the bungalow that housed the signal equipment. The FRA, Amtrak, and MBTA, with the Safety Board and US&S observing, conducted tests at that time, and it was determined by signal personnel that the sound was emitting from the 2TBPR relay as track circuit 2271 was attempting to reset track circuit 2262. Relay and RC unit substitutions were made with the following results:

Bench tests and teardown inspections, with representatives from the Safety Board, Amtrak, MBTA, and US&S in attendance, were conducted at Amtrak's signal shop in Lancaster, Pennsylvania, on November 19, 1987. The 2TBPR relay from the accident location and corresponding relays from adjacent track locations were tested and inspected. The 2TBPR relay was determined to be a model PN 150 B with serial number 2583442. The initial examination indicated that the 2TBPR relay was in good condition with no visible damage, missing, or broken parts. Electrical measurements found the 2TBPR relay to be well within shop specifications. The 2TBPR relay energized at 2.3 volts, 0.024 amps and deenergized at 1.02 volts, 0.010 amps. A new relay energized at 2.3 volts, 0.023 amps and deenergized at 1.14 volts, 0.011 amps. Contact resistance was measured using a Simpson 262 meter and was found to be 0.002 ohms or less.

A multi-pen chart recorder was connected to the number 1, number 2, and number 3 front contacts and release time was measured using the same capacitor-resistor snub that was used in the field circuit of this relay. It was determined that the number 2 contact on 2TBPR had eroded to the point that it would break about 60 milliseconds before the release time of the number 1 contact. The same test on a similar relay that had been removed from an adjacent track determined there was a 40 millisecond delay; tests on a new relay indicated that the number 1 and number 2 contacts opened at approximately the same time. The 2TBPR relay reportedly operated more often than the other relays tested because of scheduled train stops at Back Bay station. After completing the electrical tests, the 2TBPR relay was opened and the contact settings were measured; all contacts except number 1 and number 2 were within specification limits. The compression on number 1 front was 0.032 inches closed and 0.033 inches open; the compression on number 2 front was 0.023 inches closed and 0.024 inches open. The original compression should have been 0.038 to 0.040 inches. A visual examination indicated that the relay had experienced arcing, and that the number 2 front contact had experienced more arcing than the number 1 front contact. US&S's NECIP engineering manager testified that the number 2 front contact was breaking at "100 hertz energy an innumerable number of times and that would cause arcing which eroded the contact."

21

Beginning on December 10, 1987, further tests were conducted at Antrak's Lancaster signal shop. A new relay was placed in a test application that was similar to the actual application at the accident site before the collision. Continuous track occupancy was simulated. Six days later, on the morning of December 10, the track repeater picked up (energized); Amtrak's senior director of communications and signals stated that an improper signal display would have resulted at that time from the improperly energized track repeater.

US&S also constructed similar circuits for testing. Instead of waiting for the contacts to erode during operation they were artificially shimmed open. US&S reported:

The difference in contact wear between the two employed contacts of the 2TBPR relay created a time difference in the openings of these contacts. This time difference with steady input energy to this circuit (per the field conditions), resulted in the TFBPR relay circuit not being opened by the one contact of the TBPR while the PSU was disconnected by the other contact of the TBPR. The latter caused the immediate re-energization of the TBPR relay. As this circuit action repeated itself, the TPR became improperly energized.

Cab Signal System. - Tests of the cab signal equipment from the control car (1403) of train 8114 were conducted at the Boston Engine Terminal on November 24, 1987, using Amtrak's portable cab signal test loop. Due to the extent of damage to control car 1403, the cab signal equipment was removed and installed on control car 1400. The only cab signal equipment components that were not tested were the instrument cases and wiring. Representatives from the Safety Board, FRA, MBTA, Amtrak, and US&S were present, and the representatives concurred that the track receivers, amplifier, decoders, all relays (including the master relay), speed governor, brake valve, timing valve, N-1 valve, HB5 relay air valve, and all other components of the cab signal system, including all functions of air brake control, operated as designed. Amplifier pick up sensitivity was measured to operate the cab signal equipment with 1.23 amps of current in the test loop. The equipment was tested for grounds; it was found that all wiring had in excess of 250,000 ohms to car body.

During the shop test, a penalty full service brake application was initiated 7.45 seconds after the audible alarm indicated a cab signal change to a more restrictive indication. The audible alarm sounded at 45 mph when the cab signal degraded to approach limited, at 30 mph when the cab signal degraded to approach, and at 20 mph when the cab signal degraded to restricting. Compressed air is routed through a whistle arrangement to produce the audible alarm. The same sound is produced regardless of the aspect to which the cab signal degrades. Wheel diameter on the test unit was measured, and the overspeed wheel wear switch was set for corresponding 33-inch diameter wheels with the overspeed point at 1457 hertz or 93 mph. The overspeed control initiated a penalty full service brake pipe application at:

22

A test was conducted to determine if a 15-pound brake pipe reduction would delay the initiation of a penalty brake application; as soon as the audible alarm sounded, the brake handle was moved to make a 15-pound brake pipe reduction, the penalty brake application still occurred 7.45 seconds from the time the audible alarm first sounded.

With wayside signal 2262-2 displaying an improper approach aspect, tests were conducted on the track circuitry that affects the cab signal system at the accident location. The track circuits in each cut section were tested; the cable conductors were tested, the codes were checked, and track current was measured. Each test indicated the cab signal would have displayed an aspect indicating restricting in control car 1403 of train 8114 as it passed wayside signal 2262-2. During the sight distance testing with the original 2TBPR relay and RC unit in place, the cab signal immediately displayed an aspect indicating restricting as the test train went by wayside signal 2262-2. During the test train's second run, the cab signal amplifier was purposely misadjusted to the highest possible gain, and the cab signal immediately went to restricting as the train passed wayside signal 2262-2. According to Amtrak's senior director of communications and signals:

The reason for that [restrictive cab signal indication] is that the cyclic action could only take place upon the receipt of the steady energy. But as soon at the first axle went into the track circuit . . . the cyclic action was broken up. Cab signal equipment on an engine control car will look at 75 code or 120 code or 180 code to display . . . the cab signals, and it has to see that valid code. If it sees no energy or if it sees steady energy . . . then it will go to restricting.

Air Brake. -- Before the trains involved in the collision were moved, the air brake systems were tested. The FRA, Amtrak, and MBTA examined the trains and determined that all angle cocks were properly positioned, there were no missing or broken brake shoes, and all brake shoes were within proper wear limits. Control car 1403 of train 8114 had sustained extensive damage in the collision, therefore, its brake pipe was isolated before any pressure tests. The airbrakes applied and released on both trains without binding or fouling being observed; piston travel was checked and no piston had travel in excess of that allowed in 49 CFR Part 232. Brake pipe pressure was 110 pounds per square inch (psi), and main reservoir pressure was 140 psi. During the brake pipe leakage and continuity test, the brake pipes held within FRA tolerance at less than 5 psi leakage per minute. The sanding system delivered sand to the rail head during an emergency application of the air brakes from train 8114's locomotive and entrained control car (1400). Sand was observed on the rail head to the rear of train 8114. The dynamic brake was cut in and operative on both locomotives. Spalls measuring less than 3/4 incin in length were observed around the periphery of the wheel tread on control car 1403. All required periodic inspections were within limits on the locomotives, control cars, and passenger cars from both trains.

Radio. The radios from both locomotives and both operating control cars were checked and found to be in good operating condition. The radios were within tolerances for power output, modulation deviation, receiver sensitivity, and antenna circuits on all channels. MBTA's chief mechanical officer reported that at 8:05 a.m. on November 12, 1987, he received a radio transmission stating, "There was an emergency at Back Bay station. [The] person on train 8110 stated that they were [struck in the rear]. Tower 1 asked all to clear the airways. " The transmission was received outside the tunnel on a hand-held radio approximately 1 mile from the accident location.

23

ANALYSIS

The Accident

Train 8110 entered the signal block governed by wayside signal 2262-2 ahead of train 8114. Wayside signal 2262-2 displayed a false proceed indication (approach aspect) to train 8110 because with train 8910 in the signal block, wayside signal 2262-2 should have displayed a stop and proceed aspect (train 8110's cab signal went to restricting). Further, field tests conducted after the accident established that wayside signal 2262-2 displayed false proceed indications with a train in the signal block. The investigation determined that the signal failure resulted from excessive wear on the contacts of the 2TBPR relay because of a unique design feature of the signal systems.

Although the Safety Board concluded that the wayside signal system had failed, it still needed to determine the role of this failure in the accident. One reason for this need is that the engineer of train 8110 had also received a false approach aspect at the faulty wayside signal (2262-2) with another train (8910) in the signal block ahead (at the station), but had stopped his train without striking the standing train. The engineer of train 8110 stated that after passing wayside signal 2262-2 which was displaying an approach aspect, his cab signal had degraded from clear to restricting, went to approach momentarily, and then back to restricting. The engineer of train 8110 stated that both times the cab signal degraded, he received an audible alert which he acknowledged. Upon receiving the restricting indications, he put his train into full service brake and got his speed "way down."

Thus, the Safety Board had to address the issue of why the engineer of train 8114 did not stop short of a collision when the engineer of train 8110 did stop under apparently similar conditions. There were several possible circumstances that could have caused the engineer of train 8114 to not stop his train short of a collision. First, his cab signal may not have displayed a restricting indication when he passed wayside signal 2262-2. Second, train 8114 may have required a greater distance to stop than 8110 or otherwise had insufficient distance in which to stop. Third, the engineer of train 8114 may have operated his train in a manner different from that of the engineer of train 8110. The Safety Board thoroughly analyzed these three possibilities.

The engineer of train 8110 had received restricting cab signal indications after passing wayside signal 2262-2 with its approach aspect. Postaccident tests clearly indicate that at the time both trains passed wayside signal 2262-2, the rails had to have had steady energy (no-code) for the signal to falsely display the approach aspect rather than the stop and proceed aspect it should have displayed. The cab control units from which both trains (8114 and 8110) were being operated were similar units with identical cab signal apparatus (including display units, antennae, and alerter devices). Thus, as train 8114 passed wayside signal 2262-2, only if the cab signal system was malfunctioning could it have dis-layed an aspect other than restricting.

However, train 8114's cab signal was properly tested before departing Attleboro on the morning of the accident. Further, exhaustive bench tests and examinations performed on the cab signal system and on train 8114's control car (1403) cab signal equipment components included shunting sensitivity, conductivity, resistance, amplification, electro-magnetic induction, electrical ground, crossed wiring, and applied voltage tests. These tests indicated the cab signal system on the control car was functioning properly and displayed a restricting aspect after passing wayside signal 2.262-2, while wayside signal 2262-2 was displaying a false proceed aspect. The same methodology for testing the wayside signal was used in testing the cab signal. The same field testing equipment was used by the same signal personnel, and in every test, the wayside signal was replicated to display a false proceed aspect (approach when it should have been stop and proceed), and in every test, the cab signal displayed a restricting aspect. The cab signal components from train 8114's control car (1403) were installed on a similar control car (1400) for testing. After each

24

individual component and the overall cab signal system successfully passed all the tests, including a full loop and cycle test, and received the required certifications, the components were left on control car 1400 where they remain in service. In field tests performed with the originally installed signal equipment displaying a false proceed wayside signal indication, the cab signal consistently went to restricting when the control car passed wayside signal 2262-2.

Therefore, the Safety Board concludes that train 8114's cab signal system was functioning properly and displayed a restricting aspect after passing wayside signai 2262-2 (which was displaying a false proceed aspect) on the morning of the accident.

The engineer of train 8114 stated that although the trains were “sluggish,” they “probably operated perfectly, but with conditions the way they were (snow),” it takes a little longer to stop, and he made allowances for this when making station stops. “further, to the extent that the air brakes could be tested, all tests indicated no prior brake malfunctions.

Speed tape comparisons were consistent with the testimony of the engineers and indicated that each engineer had a different method of train handling. The engineer of train 8110 began to apply service braking 53 feet (0.5 seconds) before reaching wayside signal 2262-2. When the engineer of train 8110 observed the cab signal degrade to restricting after the control car passed wayside signal 2262-2, he continued the brake application to the maximum service braking available and simultaneously reduced throttle, which resulted in a sharp deceleration rate and an available stopping point 2,630 feet short of the point of collision. Train 8114 did not begin to decelerate until 480 feet (4.3 seconds) past signal 2262-2. After the engineer of train 8114 applied maximum service braking, the deceleration rate still did not drop as sharply as that of train 8110. Since both trains had the same braking ratio, train 8114 would have had a braking advantage over train 8110 because train 8114 had an extra control car that applied sand to the rail head. The Safety Board concludes that the primary difference in stopping distance was the use of locomotive power by the engineer of 8114 after he had applied the trains' brakes in a manner (in suppression) that satisfied the requirements of the automatic train control system. Using train 8110's braking curve, without any braking advantage factored in, train 8114 could have stopped 2,150 feet short of the point of collision by using train 8110's braking method. The collision occurred at about 1.1 mph.

Train 8110's engineer was calling and receiving acknowledgment from crewmembers of all signal indications, including cab signal indications. When he heard the audible cab signal alarm, he immediately visually confirmed the restricting cab signal aspect.

The engineer of train 8114 did not call every all signal indication. He did hear the audible alarm when the cab signal degraded after passing signal 2262-2, but he did not call or receive acknowledgment of that cab signal indication. After passing wayside signal 2262-2 at approach and receiving a restricting cab signal indication, train 8114's engineer gradually applied service braking and reduced throttle. When he saw a train standing on the track ahead, he initiated an emergency brake application. However, the Safety Board concluded that because the engineer did not immediately reduce throttle to idle but slowly reduced it, there was insufficient distance to stop short of the collision.

The stated position of train 8114's engineer was that normally he attempted to provide a smooth ride to the passengers aboard his train; he had previously received a commeration on his method of train handling. Train 8114's speed tape indicated that the engineer employed the same train handling methods when closing on Back Bay station that he had used when preparing to stop at other stations on the morning of the accident. The Safety Board believes that train 8114's engineer may have assumed, based on the false approach aspect displayed by the wayside signal, that the cab signal had degraded to approach (rather than restricting) without visually confirming

25

the aspect, and thus continued to use power while braking. The Safety Board believes that had train 8114's engineer looked at the cab signal when it changed to restricting and initiated the same stopping procedure as the engineer of train 8110, he could have stopped the train short of a collision as there was sufficient distance available to do so. However, the Safety Board believes that the engineer of train 8114 did not look at the cab signal when the train passed wayside signal 2262-2 and thus failed to recognize that it had degraded to restricting. Thus, the Safety Board concludes that the failure of the wayside signal to display the correct aspect and the failure of the engineer of train 8114 to operate his train in compliance with the restricting cab signal were both causal factors in this accident.

The audible alarm produced when the cab signal degrades is identical for all aspects. The Safety Board believes that a different warning sound should be produced by the audible indicator when a cab signal changes to its most restrictive aspect. Perhaps a computer-generated voice announcing the indication the cab signal has changed to may be the most effective way to notify the engineer. This may have alerted the engineer of train 8114 to the imminent danger ahead and caused him to handle his train differently, possibly preventing the accident.

Positive Separation of Trains

The automatic train control system on train 8114 did not provide positive separation between trains 8114 and 8110. These same types of automatic train control systems are being used on most Amtrak locomotives operating on the Northeast Corridor. Further, they are being installed on those locomotives that are not equipped with such devices as a result of Safety Recommendation R-87-1 issued to Amtrak following the collision at Chase, Maryland, on January 4, 1987.$^{16}$

R-87-1

Immediately initiate a program which will assure that all locomotives operating on the high speed passenger train trackage of the Northeast Corridor are equipped with a device which will control the train automatically as required by the signal if the engineer fails to do so.

These automatic train control systems will stop the train if the engineer fails to take appropriate action. However, they also will permit a train to be operated at speeds up to 20 mph, through stop and proceed or stop wayside signal indications, if the train speed has been reduced below 20 mph and the engineer has also acknowledged (by pushing a button, lever, or other such device) the audio warning of the cab signal change. That is, if the engineer acknowledges the cab signal change and reduces the speed of his train to below 20 mph, the train will not be automatically stopped by the automatic train control system. Further, the suppression feature of the system will permit the engineer to use power and brakes even when a situation requires braking only.

Because of these limitations, the automatic train control systems do not comply fully with the intent of R-87-1. However, the Safety Board also acknowledges that they appear to be the best currently available means of train control on the Northeast Corridor. Thus, Safety Recommendation R-87-1 is classified "Open-Acceptable Alternate Action" pending the completion of Amtrak's program to have these types of devices installed on all locomotives operating on the main lines of the Northeast Corridor.

26

However, because the Safety Board recognized the limitations of these automatic train control devices and the alternate need for a system that will provide for positive separation of trains, it issued Safety Recommendation R-87-16 to the FRA following its investigation of a rear-and collision between a commuter train and a Conrail freight train at Brighton, Massachusetts, on May 7, 1986.17

R-87-16

Promulgate Federal standards to require the installation and operation of a train control system on mainline tracks which will provide for positive separation of all trains.

The installation and operation of an Advanced Train Control System (ATCS) system can provide for positive separation of trains operating on the same tracks.

As cited in the Brighton accident report, "The railroad industry is involved in an Advanced Train Control Systems (ATCS) Project which is adapting modern technology to train operating problems." That report further states:

The railroad supply industry is moving rapidly to perfect and furnish railroad companies with the hardware and software to implement ATCS. The ATCS is comprised of four elements: a data communications network system; computers and display screens on locomotives; a transponder network or a satellite communications system; and a central computer for dispatching purposes.

The Safety Board is concerned that the FRA has not been involved sufficiently in the oversight of the ATCS project to ensure its operational safety or to expedite its development and implementation into service. The Safety Board issued Safety Recommendation R-87-16 to facilitate and hasten the development and implementation of a much needed system to separate trains.

As of the date of this accident, the FRA had not responded to the Board's recommendation. Consequently, on November 25, 1987, the Board again requested to be informed of what efforts were being made to implement this safety recommendation. The Board has yet to receive a response from the FRA regarding its intentions with respect to Safety Recommendation R-87-16.

The Safety Board believes that the installation of an ATCS could have prevented the accident at Back Bay station, as well as other collisions between trains. The Safety Board is concerned that such collisions may continue to occur and strongly urges the FRA to implement Safety Recommendation R-87-16.

However, the Safety Board also recognizes that the development and installation of an ATCS system with the positive train separation feature is a long-term project and is especially unlikely to be implemented on the Northeast Corridor for many years (given the very large investment by Amtrak in its current system). Therefore, the Safety Board believes that Amtrak should explore thoroughly and evaluate all possible means of modifying the current automatic train control system to minimize or eliminate its limitations.

27

Oversight of Train Operations

During the 5 weeks this route had been operational, there had been numerous violations of operating rules by the train crews. These violations included:

● Train §110's engineer had not reported all previously observed imperfectly displayed signals (Rule 27).

· The engineer and deadheading conductor on train 8114 were not communicating all signal indications that affected the movement of their train, nor was a vigilant lookout for signals maintained (Rule 34).

1. Train 8110's engineer failed to provide protection for his train after an occurrence which may have interfered with the safe passage of trains at normal speed (Rule 101).

● Train 8114's engineer did not govern his train by the more restrictive signal when the cab signal and fixed signal (wayside signal 2262-2) did not conform, nor did he take action at once to reduce to restricted speed when the cab signal aspect changed to restricting (Rule 55:1).

· Verbal reports of cab signal flips were not being subsequently reported on the prescribed forms.

Corpliance with these rules could have prevented the accident. The Safety Board believes that for operational rules to be effective, the rules must be enforced uniformly and consistently. Further, Amtrak supervisors, to whom the verbal reports of cab signs flips were made, did not ascertain that the prescribed forms were being prepared. When supervisors ignore or condone violations of rules, employees are sent a message that casts doubt on the management's concern for conformance with the rules system. This message may have been enhanced by the failure of Amtrak supervisors to followup properly on the reports of cab signal problems. The Safety Board believes that the circumstances of this accident indicate that noncompliance with operating rules was a result of deficient supervisory oversight.

Engineers, conductors, operating supervisors, instructors, and train dispatches were unconventionally qualified on the accident district's physical characteristics. Taking a trip in a high-rait vehicle and viewing a video may familiarize personnel with the district for train dispatching purposes; however, engineers and conductors make critical speed and stopping decisions based on train weight, length, power, braking capability, and grade. Since the video Amtrak used was not connected to any signal, throttle, or braking situations, there was no opportunity to practice or become familiar with train handling skills as related to that specific raitroad district. Thus, the engineers were allowed to operate trains carrying passengers without first having operated trains, under supervision, on this newly and completely renovated territory. There was little opportunity to train or quality personnel on the new signal system because the signal system was not operational at the time the traincrews were qualified. This was particularly unfortunate since these engineers never operated trains over territory in which signal blocks were subdivided into sections that allowed cab signal aspects to change within the block at intermediate code change points. Thus, questions that later arose about signal system operations, when the signal system actually performed as intended, were confused with instances where the signal system was apparently malfunctioning. While the Safety Board supports classroom training, it further believes that training must be conducted in a way in which employees can demonstrate their knowledge and ability to operate trains over the territory in which they will be operating. This includes being familiar with the signal system as well as the geography and topography. Had the crews of these

28

trains been properly trained on the territory with the new signal system operating, it is far less likely that the engineers would have mistaken proper cab signal changes at the intermediate code change points for cab signal problems. Thus, when the engineers experienced and reported to their supervisors the actual problems encountered with wayside signal 2262-2, their supervisors may have explored properly the reports of the actual malfunctions. Further, it is also possible that properly conducted qualifications (including operating trains in accordance with an actual operating schedule) of the operating personnel with the new signal system operating might have resulted in the detection of the malfunctioning signal before the opening of the line for passenger service.

Signal System

The track circuits misinterpreted the cycling reset feature as a code and improperly displayed an approach aspect on the wayside signal when a stop and proceed aspect was required and intended.

This is contrary to the intent of 49 CFR 236.205 which states:

The circuits shall be so installed that each signal governing train movements into a block will display its most restrictive aspect when any of the following conditions obtain within the block: (a) Occupancy by a train, locomotive, or car, ...

Further, one of the basic tenents of signal design and operation is that in the event either the signal system or a system component does not function as intended, then the system will "fail safe." To this end, signal systems are required to be designed on the closed circuit principle as defined by 49 CFR 296.786.

The principle of circuit design where a normally energized electric circuit $v$ which, on being interrupted or deenergized, will cause the controlled function $v$ to assume its most restrictive condition.

While the signal system involved in this accident appears to have been designed on the closed circuit principle, the Safety Board concludes that this requirement was of itself not sufficient to preclude the signal system from failing in an unsafe manner.

While the signal hardware was standard and has been available off-the-shelf for many years, the application was unique. The Safety Board could not identify any location, other than the district in which the accident occurred, where track circuits are designed to reset before the entire signal block is clear. On December 22, 1987, the Safety Board issued a recommendation to the Department of Transportation (DOT):

R-87-71

Determine if there are signal systems in use on the nation's rail rapid transit systems designed and constructed to similar specifications as signal 2262-2 on the Massachusetts Bay Transportation Authority signal system, inspect any similar signal systems found for defective electrical circuitry conditions, and remove these signal systems from service until the defective conditions are corrected.

The DOT responded on March 24, 1988, that the track circuit design in question was "unique to the Northeast. Corridor and more specifically to the general area of the accident" and that it was

29

"confident that no other intercity railroad installations exist." With respect to rapid transit, the DOT replied:

The Urban Mass Transportation Administration's (UMTA) Office of Safety will notify all UMTA grantees that may have the type of signal problem covered in the NTSB report. While UMTA does not have the authority to require the removal, repair or replacement of a guarantees signalization equipment directly, they will instruct their grantees to inspect their own signals and take whatever actions are necessary to ensure the safety of their own operations. Further, UMTA will ask for a report of what local investigations and actions were taken as a result of the MBTA findings by the NTSB and will carefully evaluate the responses received for adequacy.

Based on the DOT's reply, on April 22, 1988, the Safety Board classified Safety Recommendation R-87-71 "Open-Acceptable Action" awaiting the results of UMTA's report.

Multiple opportunities were available to US&S, DCP, and the FRA during the design phase of the signal system to identify the problem with the uniquely designed reset feature before the signal hardware was delivered for installation. The agreement between US&S and DCP contained provisions for extensive reviews of circuit design, systems assurance, quality control, reliability and maintainability, system safety, and training. Although tests were performed in these areas, the failure rode went undetected. DCP should have recognized that the introduction of a unique feature into the design of the signal system warranted extra attention to determine that this would not create unanticipated problems in the system. DCP should have required US&S to have built a mock-up of that portion of the signal system affected by the reset feature or required US&S to have performed a very detailed hazard mode and effects analysis that included the introduction of the unique reset feature. Had DCP built a mock-up and performed an analysis, using the programmed traffic conditions, it should have learned that the reset feature would have resulted in extraordinary relay cycling that could lead to excessive contact wear. Further, the FRA's responsibilities should have caused it to recognize DCP's failure to review adequately this unique design feature. The Safety Board believes that the FRA should have been more vigorous in its oversight and enforcement of the provisions of its agreement with DCP. This could have resulted in the identification of the failure mode before the signal system was installed.

Emergency Response/Disaster Preparedness

The Safety Board believes that the response of the emergency personnel to the accident site was very good, especially considering the adverse weather conditions. An adequate emergency force arrived promptly at the scene with sufficient equipment, the injured passengers and crewmembers were dispatched to hospitals in a timely manner, and triage was well organized and efficient. The emergency forces are to be commended.

There were multiple command posts established by various responding emergency forces. In its investigation of the accident at Brighton, Massachusetts, on May 7, 1986, the Safety Board encouraged the Boston emergency forces to move forward on the development of their disaster preparedness plan to be in a posture to respond quickly and effectively to any disaster. The Safety Board notes that a commission was established and a comprehensive disaster plan was drafted; however, that disaster plan has not been adopted. Even though the dynamics involved in this accident produced only relatively minor injuries, the Safety Board believes that the adoption and implementation of a city-wide disaster plan should be expedited.

30

CONCLUSIONS

Findings

1. Wayside signal 2262-2 was consistently failing in an unsafe manner before the collision by displaying a false proceed aspect.

1. Restricting cab signal aspects were displayed to the engineers of trains 8110 and 8114 when they passed wayside signal 2262-2.

1. Train 8114's engineer did not operate in a manner consistent with a restricting cab signal indication.

1. Train 8114's engineer could have avoided the collision by complying with the restricting cab signal indication.

1. Train 8114's engineer should have been alert for inconsistent signals and then operated by the most restrictive indication when the cab signal and wayside signal did not agree.

1. Amtrak's training on the physical characteristics of the accident district was insufficient to properly acquaint operating crewmembers with the complete function of the new signal system and train handling techniques for that district.

1. The engineers of both trains failed to adhere strictly to the operating rules.

1. Amtrak supervisors were not requiring strict adherence to all operating rules as evidenced by their failure to require or confirm that the proper forms were being completed by operating personnel who were reporting cab signal flips.

1. An inadequate signal circuit design escaped detection during FRA's oversight and review of the NECIP.

1. Even though the speed control system functioned as designed, it did not provide for the positive separation of trains 8110 and 8114.

Probable Cause

The National Transportation Safety Board determines that the probable cause of the accident was the display of an improper wayside signal aspect: resulting from a signal system that was improperly designed; the failure of the engineer of Amtrak/Massachusetts Bay Transportation Authority train 8114 to operate in compliance with a restricting cabo signal indication; and Amtrak supervisors' failure to properly supervise operating employees and to followup on reported signal failures.

31

RECOMMENDATIONS

As a result of this investigation, the National Transportation Safety Board reiterated the following recommendation to the Federal Railroad Administration:

R-87-16

Promulgate Federal standards to require the installation and operation of a train control system on mainline tracks which will provide for positive separation of all trains.

Also as a result of its investigation, the Safety Board made the following recornendations:

--to the Federal Railroad Administration:

Expand Title 49 Code of Federal Regulations Part 236 to require that signal circuits be designed so that they can not be reset until the entire signal block is unoccupied. (Class II, Priority Action) (R-88-78)

Expand Title 49 Code of Federal Regulations 236.513 to require that when a cab signal changes to display a more restrictive aspect, the audible indicator will produce a different warning sound when the cab signal displays its most restrictive aspect. (Class II, Priority Action) (R-88-79)

--to the city of Boston:

Expedite the adoption and implementation of an interagency city-wide disaster preparedness plan. (Class II, Priority Action) (R-88-80)

--to the National Railroad Passenger Corporation (Amtrak):

When requiring train crew personnel to qualify on the physical characteristics of a particular territory, either train those personnel in simulated operational situations with a system that immediately integrates a trainee's responses to power and braking or perform the qualifying test on the same type of equipment and in the actual operational environment that those employees will encounter later. (Class II, Priority Action) (R-88-81)

Evaluate thoroughly all possible means of modifying the current automatic train control (speed control) system used on locomotives on the Northeast Corridor to eliminate the features of the system that may permit an engineer to operate a train by a stop aspect of a wayside signal. (Class II, Priority Action) (R-88-§2)

3:2

BY THE NATIONAL TRANSPORTATION SAFETY BOARD

/s/ JAMES L. KOLSTAD Acting Chairman

/s/ JIM BURNETT Member

/s/ JOHN K. LAUBER Member

/s/ JOSEPH T. NALL Member

/s/ LEMOINE V. DICKINSON, JR. Member

November 10, 1988

33

APPENDIXES

APPENDIX A

INVESTIGATION

1. Investigation

The National Transportation Safety Board was notified of the accident about 8:30 a.m. on November 12, 1987. The Safety Board immediately dispatched four investigators from its Washington D.C., headquarters and one investigator each from its Atlanta, Georgia, and New York, New York, field offices.

Groups were formed to investigate operational, human performance, signal and train control, survival factors, and vehicular aspects of the accident. Parties to the investigation during the on-scene phase of the investigation included the Federal Railroad Administration, National Railroad Passenger Corporation, Massachusetts Bay Transportation Authority, United Transportation Union, Brotherhood of Locomotive Engineers, and Union Switch and Signal. After the on-scene phase of the investigation was completed it was determined that DeLeuw Cather/Parsons had knowledge that would contribute to the development of pertinent evidence and was subsequently offered and accepted party status.

2. Deposition Proceeding

The Safety Board convened a 2-day staff conducted deposition proceeding on April 6, 1987, in Boston, Massachusetts, as part of its investigation of this accident. Sworn testimony was taken from 14 witnesses. All parties to the investigation participated in the deposition proceeding.

35

APPENDIX B

CREW MEMBER INFORMATION

James P. Corcoran, Engineer (Train 8114)

Mr. James P. Corcoran, 39, was employed by the Penn Central Transportation Company on May 12, 1969, as a locomotive fireman and was promoted to locomotive engineer on June 8, 1976. He was hired as a locomotive engineer by the Boston and Maine Corporation on April 1, 1977, and subsequently transferred to the National Railroad Passenger Corporation (Amtrak) on January 1, 1987, as a locomotive engineer when Amtrak took over operation of commuter rail service for the Massachusetts Bay Transportation Authority. At the time of the accident he was qualified as both a passenger and freight engineer, and was current on the examinations required for the Amtrak operating and air brake rules. He passed his last medical examination on November 17, 1986.

Frank R. Eck, Engineer (Train 8110)

Mr. Frank R. Eck, 51, was employed by the New York, New Haven and Hartford Railroad on August 11, 1963, as a locomotive firernan and was promoted to locomotive engineer on January 20, 1972. He was hired as a locomotive engineer by the Boston and Maine Corporation on July 1, 1977, and subsequently transferred to the National Railroad Passenger Corporation (Amtrak) on January 1, 1987, as a locomotive engineer when Amtrak took over operation of commuter rail service for the Massachusetts Bay Transportation Authority. At the time of the accident he was qualified as both a passenger and freight engineer, and was current on the examinations required for the Amtrak operating and air brake rules. He passed his last medical examination in January 1987.

37

APPENDIX C

INTERIOR DAMAGE

The seats were mounted to the floor and side wall of the car. The seatbacks were immobile. The seats were equipped with metal tubular grab bars on the upper inboard corners of the seatbacks. Half the seats faced forward and half were rearward facing seats. The overhead luggage racks, which contained no restraints to prevent spillage of contents, were located above the seats and extended the length of the car.

For reference purposes, the seat rows were numbered from front to rear starting from the direction of travel. Individual sews were identified as A through D from left to right. Only those seats that were damaged or were remarkable in other ways were documented. The following seats were displaced or damaged:

Control Car 1403

Coach Car 403

APPENDIX C

38

Control Car 1400

Evidence of emergency triage was found near the rear seats of this car. Bandage material and blood splatters were scattered about the floor.

39

APPENDIX C

〔图〕插图

Figure 1.--Blood on facing seatback.

〔图〕.\n

Figure 2.--Seatback cushion (forward) facing).

41

APPENDIX D

FRM/DCP AGREEMENT EXCERPTS

U.S. Department of Transportation contract FR-76048 required DeLeuw, Cather/Parsons (DCP) to:

Signals and Communications; ... provide engineering services necessary to provide a highly reliable, modern high-speed signalling system capable of supporting train operating requirements of the Northeast Corridor.

Responsibility for Design; [DCP] shall be responsible for the professional quality and technical accuracy of each design, drawing, specification, or other design-related product or any services performed, produced or provided pursuant to this contract. [DCP] shall so guide and coordinate such designs, drawings, specifications, and other design-related products and services that, when the NECIP is completed, the Northeast Corridor (NEC) will function properly and well as an integrated system. In doing so, [DCP] shall assure that each subsystem of the NEC functions properly and well as an integrated subsystem.

Technical Direction; [DCP] will not proceed with any portion of the work to be performed pursuant to this contract until [DCP] has received a work release therefor from the COTR.†

Quality Control; [DCP] shall be responsible for continued implementation of the program for maintaining control of the quality of all long-lead materials [signal system] and all work performed by construction contracting firms under contract to FRA or Amtrak and Amtrak force account personnel in constructing the NECIP improvements and subsequently testing them. [DCP] shall also be responsible for continued implementation of the program for auditing construction and other activities. [DCP] shall maintain current approved Quality Control/Quality Assurance Plans. All work shall be reviewed by [DCP] for compliance with the drawings, specifications, standards, and directives that define the products and the system performance including final acceptance.

43

APPENDIX E

DCP/US&S AGREEMENT EXCERPTS

Contract MC-79-175 required Union Switch & Signal (US&S) to:

General Scope; Design a signal system and furnish all equipment/material necessary for its installation . . . for the Northeast Corridor Improvement Project. [US&S] services shall include: all professional, technical, manufacturing and support services and provide all materials necessary to determine the existing conditions, evaluate those conditions and provide final designs in the form of installation drawings and installation cost estimates; implementing the design by furnishing interlocking housing completely wired with relays, other signal apparatus, and foundations; and furnishing signal equipment to be installed outside the interlocking houses and between interlockings. [US&S's] design and furnishing of signal equipment shall be coordinated through DCP with scheduled NECIP work by others.

Circuit Drawings; [US&S] shall prepare circuit drawings for the wiring of all housesings, interconnection of housesings, equipment and appliances with the signal cable system, and automatic block signal system.

Circuit Design; [US&S] shall prepare complete circuit designs in accordance with typical circuit drawings and drawing format. [US&S] may vary circuit design from that shown on the typical drawings, subject to approval by DCP.

Systems Assurance: [US&S] shall establish and implement a Systems Assurance Program. The Program shall, as a minimum, cover the three disciplines of Quality Control, Reliability and Maintuinability, and System Safety, with respect to the following phases of signal system development: (i) design, (ii) manufacturing. ...

Quality Control; [US&S] Quality Control Plan shall state the methods to be used to assure the quality of all equipment, supplies, and technical quality documentation to be furnished reets all applicable standards and specifications. ...

Reliability and Maintainability; [US&S] shall establish and implement a reliability and maintainability program which includes but is not limited to:

-- Preparing and submitting to DCP for approval a final reliability and maintainability program plan.

-- Contaring the manufacturers of hardware to be procured for the signal system and obtaining the experienced failure rates of the articles, life expectancy, recommended maintenance concept, and recommended application data and limitations related to use.

• Identifying the critical circuits and equipments within the signal system noting their criticality and prioritizing a listing for their analysis. If there is a major modification to the circuit, it shall require analysis of the modifications to provide their reliability characteristics.

... Establishing a system for the detection and correction of reliability problems. This will involve identifying the means for a positive data collection system for failures at the level of subassemblies and components that will result in attention to the necessary engineer review process to evaluate corrective action(s). Periodic

44

evaluations should be organized to determine early trends in hardware failures and immediate notification to DCP of corrective action(s) to be taken.

System Safety; [US&S] shall prepare the System Safety Plan based upon the preliminary system safety plan and DCP comments during contract negotiations. DCP will review and approve the plan.

● Perform analyses including PHAs$^{1}$ and HMEAs$^{2}$ for a representative interlocking. One typical interlocking shall be recommended by the contractor for use on the total project work for approval by DCP. These analyses shall be performed in sufficient detail and to the subsystem/component level required to assure that all potentially safety-critical failure modes are identified and corrective action acceptable to DCP is accomplished.

-- Identify safety test requirements and provide safety procedures for the conduct of tests for hazardous failure modes.

Training: [US&S] shall develop and submit to DCP the materials for a course of instruction for training of railroad maintenance personnel. This course shall include adjustment of energy levels, adjustment and field repair of equipment and preventive maintenance routines. The course shall also include principles of circuit logic inherent in the system design to be utilized for the location and repair of malfunctioning elements of the system. --Training materials shall include: system, subsystem and component descriptions, component locations, removal and reinstallation, functional characteristics, theory of operation, field-level preventive and corrective maintenance procedures and shop-level corrective maintenance instructions.