NATIONAL

8 PB96-916304 NTSB/RAR-96/04

NATIONAL

TRANSPORTATION SAFETY BOARD

WASHINGTON, D.C. 20594

RAILROAD ACCIDENT REPORT

COLLISION OF WASHINGTON METROPOLITAN AREA TRANSIT AUTHORITY TRAIN T-111 WITH STANDING TRAIN AT SHADY GROVE PASSENGER STATION, GAITHERSBURG, MARYLAND JANUARY 6, 1996

〔图〕66676A\n Abstract: On January 6, 1996, Washington Metropolitan Area Transit Authority (WMATA), Metrorail subway train No. T-111 failed to come to a stop at the above-ground Shady Grove, Maryland, passenger station, the final station on the Metrorail Red Line. The four-car train ran by the station platform and continued about 470 feet into the Metrorail yard north of the station, where it struck a standing, unoccupied subway train that was awaiting assignment. The operator of train T-111 was fatally injured; the train's two passengers were not injured. Total property damages were estimated to be between $2.1 and $2.6 million.

The safety issues discussed in this report are adequacy and appropriateness of WMATA methods of management, decisionmaking, and communication; safety implications of the decision to eliminate routine manual train operation on the Metrorail system; effectiveness of using performance levels to control train speed; compatibility between railcar braking performance and design of the automatic train control system; and adequacy of WMATA and Montgomery County emergency response procedures.

As a result of its investigation, the National Transportation Safety Board issued recommendations to the Washington Metropolitan Area Transit Authority, the Federal Transit Administration, the American Public Transit Association, the Montgomery County Fire and Rescue Commission, and all jurisdictions providing primary and secondary response to Metrorail accidents or incidents.

The National Transportation Safety Board is an independent Federal agency dedicated to promoting aviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967, the agency is mandated by Congress through the Independent Safety Board Act of 1974 to investigate transportation accidents, determine the probable causes of the accidents, issue safety recommendations, study transportation safety issues, and evaluate the safety effectiveness of government agencies involved in transportation. The Safety Board makes public its actions and decisions through accident reports, safety studies, special investigation reports, safety recommendations, and statistical reviews.

Information about available publications may be obtained by contacting:

National Transportation Safety Board

Public Inquiries Section, RE-51

490 L'Enfant Plaza, S.W.

Washington, D.C. 20594

(202) 314-6551

Safety Board publications may be purchased, by individual copy or by subscription, from:

National Technical Information Service

5285 Port Royal Road

Springfield, Virginia 22161

(703) 487-4600

COLLISION OF WASHINGTON METROPOLITAN AREA

TRANSIT AUTHORITY TRAIN T-1 11 WITH STANDING TRAIN AT SHADY GROVE PASSENGER STATION, GAITHERSBURG, MARYLAND JANUARY 6, 1996

RAILROAD ACCIDENT REPORT

Adopted: October 29,1996 Notation 6676A

NATIONAL TRANSPORTATION SAFETY BOARD

Washington, D.C. 20594

CONTENTS

EXECUTIVE SUMMARY v

INVESTIGATION

Synopsis 1

Pre-accident Events $\ldots$ 1

The Accident 3

Injuries 7

Train Damage $\ldots$ 7

Personnel Information 10

Train Operator $\ldots$ 10

OCC Radio Controller $\ldots$ 11

OCC Button Controller 12

Train Information 12

Train T-111 $\ldots$ 12

Gap Train $\ldots$ 14

Site Description 14

Operations Information $\ldots$ 14

Operations Control Center (OCC) $\ldots$ 14

OCC Staffing 16

Signal and Train Control Information 16

Automatic Train Control 16

Train-Wayside Communication (TWC) $\ldots$ 17

Performance Levels 17

Railcar Braking System $\ldots$ 18

Wheel Flats and Tests of the Slip/Slide System 20

Meteorological Information 23

Medical and Pathological Information 23

Wreckage 24

Emergency Response 24

Communications Between OCC and Rescue Personnel 29

Training 29

Third Rail Schematic Availability 29

Warning Strobe and Alarm Devices 30

Accident Site Configuration/Control of Third Rail Power 30

Tests and Research 30

Sight Distance Tests 30

Signal System and Speed Command Tests .................................................................................................................................... 30

Brake Equipment Tests $\ldots$ 32

Train Stopping Distance Tests $\ldots$ 32

Gap Train Light Bulb Tests $\ldots$ 33

Train T-111 Inspection Test for Wheel Flats $\ldots$ 34

Other Information 34

Oversight of Metrorail 34

Management and Organizational Factors $\ldots$ 35

Manual Versus Automatic Operation on the Metrorail System $\ldots$ 35

Maximum Authorized Speed (MAS) 37

Station/Platform Overruns on the Metrorail System $\ldots$ 40

Training of OCC Controllers $\ldots$ 42

Gap Train Placement $\ldots$ 42

Metrorail Operating Rules $\ldots$ 43

Event Recorders $\ldots$ 44

Postaccident Policy/Rule Changes $\ldots$ 45

Gap Train Placement $\ldots$ 45

Maximum Speed in Increment Weather $\ldots$ 45

OCC Controller Training $\ldots$ 45

Previous Metrorail Fatal Accident $\ldots$ 46

ANALYSIS

General $\ldots$ 48

The Accident $\ldots$ 48

Elimination of Routine Manual Train Operation $\ldots$ 49

Use of Performance Levels to Control Train Speed $\ldots$ 51

Maximum Authorized Speed $\ldots$ 52

Railcar Braking Performance and Design of the ATC System $\ldots$ 52

Adherence to Operating Rule Change Procedures $\ldots$ 54

Gap Train Placement $\ldots$ 55

Metrorail Reliance on Oral Instructions $\ldots$ 55

WMATA Management, Decisionmaking, and Communication $\ldots$ 56

OCC Controller Training $\ldots$ 58

Performance of Controllers and Train Operator $\ldots$ 58

The OCC Environment $\ldots$ 58

Train Operator's Actions During the Accident Sequence $\ldots$ 60

Train Operator's Use of Prescription Medications $\ldots$ 61

Event Recorders $\ldots$ 62

Emergency Response $\ldots$ 62

Crashworthiness of Metrorail Cars $\ldots$ 65

Station/Platform Overruns on the Metrorail System $\ldots$ 65

CONCLUSIONS $\ldots$ 67

PROBABLE CAUSE $\ldots$ 69

RECOMMENDATIONS $\ldots$ 70

APPENDIXES

Appendix A--Investigation $\ldots$ 73

Appendix B--November 17, 1995, Notice to All OCC Personnel $\ldots$ 75

Appendix C--Train T-111 Speed Calculation Chart $\ldots$ 77

Appendix D--February 14, 1996, Memorandum, Subject: ATC Block Design $\ldots$ 79

Appendix E--Signal System and Speed Command Test Results $\ldots$ 81

Appendix F--Train Stopping Test Results $\ldots$ 85

Appendix G--November 20, 1995, Memorandum, Subject: Manual Train Operation $\ldots$ 87

Appendix H--Previous Safety Recommendations Issued to WMATA $\ldots$ 89

Appendix I--Amtrak Medication Information Brochure $\ldots$ 97

EXECUTIVE SUMMARY

A bout 10:40 p.m. on January 6, 1996, Washington Metropolitan Area Transit Authority (WMATA) Metrorail subway train No. T-111, operating on the “Red Line” segment of the Metrorail system, failed to stop as it entered the above-ground Shady Grove passenger station near Gaithersburg, Maryland, the final station on the Red Line. The four-car train ran by the station platform and continued about 470 feet into the Metrorail yard north of the station, where it struck a standing, unoccupied subway train that was awaiting assignment. The T-111 train operator was fatally injured; the train's two passengers were not injured. Total property damages were estimated to be between $2.1 and $2.6 million.

The Safety Board determines that the probable cause of this accident was the failure of Washington Metropolitan Area Transit Authority management and board of directors (1) to fully understand and address the design features and incompatibilities of the automatic train control system before establishing automatic train operation as the standard operating mode at all times and in all weather conditions, (2) to permit operating department employees, particularly Operations Control Center controllers and supervisors, to use their own experience, knowledge, and judgment to make decisions involving the safety of Metrorail operations, and (3) to effectively promulgate and enforce a prohibition against placing standby trains at terminal stations on the same track as incoming trains. Contributing to the

severity of the injuries to the train operator was the disproportionate amount of crush sustained by the lead cars of the colliding trains.

In its investigation of this accident, the Safety Board addressed the following safety issues:

● Adequacy and appropriateness of WMATA methods of management, decisionmaking, and communication;

● Safety implications of the decision to eliminate routine manual train operation on the Metrorail system;

● Effectiveness of using performance levels to control train speed;

● Compatibility between railcar braking performance and design of the automatic train control system; and

● Adequacy of WMATA and Montgomery County emergency response procedures.

As a result of its investigation of this accident, the Safety Board issued safety recommendations to the Washington Metropolitan Area Transit Authority, the Federal Transit Administration, the American Public Transit Association, the Montgomery County (Maryland) Fire and Rescue Commission, and all jurisdictions providing primary and secondary response to Metrorail accidents or incidents.

INVESTIGATION

Synopsis

About 10:40 p.m. on January 6, 1996, Washington Metropolitan Area Transit Authority (WMATA) Metrorail subway train No. T-111, operating on the “Red Line” segment of the Metrorail system, failed to stop as it entered the above-ground Shady Grove passenger station near Gaithersburg, Maryland, the final station on the Red Line. The four-car train ran by the station platform and continued about 470 feet into the Metrorail yard north of the station, where it struck a standing, unoccupied subway train (a 6-car “gap” train) that was awaiting assignment. The train operator was fatally injured; the two passengers on the train were uninjured.

Pre-accident Events

At 6:40 a.m. on Saturday, January 6, 1996, the National Weather Service issued a winter storm warning, extending through Saturday night and into Sunday, for northern Virginia and central and southern Maryland, including the Washington, D.C., metropolitan area. Snow was expected to begin Saturday evening, to become heavy at times after midnight, and to continue through Sunday. Total snow accumulations were expected to exceed 12 inches in many locations, including the Washington metropolitan area.

According to Safety Board interviews, WMATA $^{2}$ prepared for the predicted adverse weather by opening its snow command center at WMATA headquarters at 5:00 p.m. on January 6 and by holding a “snow meeting” of managers

and supervisors at 7:00 p.m. (See figure 1 for an overview of selected WMATA and Metrorail organizational elements.) After the emergency meeting, the WMATA deputy general manager for operations left the headquarters, saying that he would return later that evening. The assistant general manager for rail services and the general superintendent for rail transportation remained in the command center, which was located on a floor above the Metrorail Operations Control Center (OCC), from which teams of controllers monitor and direct operations throughout the Metrorail system.

A utility assistant superintendent $^{3}$ was scheduled to be the senior supervisor on duty in the OCC on January 6; however, because of the expected storm, the OCC superintendent elected to report for duty about 9:30 p.m. and to assume charge of the “midnight” shift, which began at 10:00 p.m. The OCC superintendent said that when he relieved the on-duty assistant superintendent, he asked for a status report and was told that the system was operating normally.

The employees who would work that evening as the OCC radio and button controllers on the Red Line reported for work about 9:45 p.m.$^{4}$ The button controller stated that it was a

2

〔图〕插图

Figure 1 -- Selected elements of WMATA organizational structure with emphasis on Metrorail Management

3

normal shift change, and that the system was not experiencing any problems.

All Metorrail trains were functioning in mode 1, or automatic train operation, which meant that train acceleration, speed, and braking were under the control of the automatic train control (ATC) system, with the train operator responsible primarily for monitoring train functions and ensuring safe operations. Under the automated system, button controllers in the OCC set the operating parameters for trains by assigning “performance levels” to trains operating over various route segments across the Metorrail system. These performance levels set a train’s acceleration rate and its top speed, within the boundaries of the maximum “design” or “limiting” speed for a particular route segment. (See “Automatic Train Control” section below for a detailed discussion of the ATC system, train operating modes, and performance levels.)

Under a WMATA policy promulgated in a November 17, 1995, "notice" from the OCC superintendent to OCC controllers (appendix B), controllers were not permitted to authorize train operators to change from mode 1 (automatic) to mode 2 (manual) train operation except in emergencies. Adjustments to train performance, such as those that may be necessitated by adverse weather conditions, were to be accommodated solely by changing performance levels in the affected areas.

Washington National Airport reported snow beginning at 9:10 p.m. The two Red Line controllers stated that radio transmissions and train operations were normal until some time after 10:00 p.m., when the OCC began to receive reports of trains overrunning station platforms because of slippery tracks. The button controller stated that he and the radio controller were concerned about the overruns and that, on several occasions between 10:00 and 10:30 p.m., he (the button controller) asked the OCC superintendent for permission to allow train operators to change to manual mode. He said that each time he asked, permission was denied. In Safety Board interviews, the OCC superintendent stated that, while he did not

recall any specific discussions or questions about changing operating modes, if he had been asked, he would have denied permission because he had been instructed not to authorize manual operation except in an emergency.

The Accident

At 10:18:07 p.m.,$^{5}$ the operator of train T-110 (the train immediately preceding accident train T-111) reported to the Red Line OCC radio controller that slippery tracks had caused his train to overrun the Twinbrook station platform by one car. (See figure 2.) The controller instructed the operator of train T-110 to continue to operate in automatic mode. At 10:22:50 p.m., the button controller entered a performance level of 8 (the most restrictive level) for trains servicing the Twinbrook Station on the outbound (toward Rockville) No. 2 track. For this route segment (between the Twinbrook and Rockville stations), performance level 8 limited a train's top speed to 49 mph, with one-half the normal rate of acceleration.

According to the system log (syslog),$^{6}$ radio transcripts, and the Metrorail maintenance and reliability system (MARS) report, the operator of accident train T-111 (immediately behind train T-110) had no problems servicing the first 21 of the 23 station stops between the Wheaton and Shady Grove stations. But at 10:27:35 p.m., while operating on No. 2 track, he radioed the OCC to report that his train had overrun the Twinbrook station by all four cars. According to the syslog, train T-111 had departed the previous station, White Flint, with a performance level of 3, which limited its top speed between White Flint and Twinbrook to 44

4

〔图〕0.40p.m.(est.)SHADY GROVEQolmion occuns(0:36 pm Trin spoedroucros /b mphROCKVILLERockville10:31 pmTrom munnPockvie stati

Figure 2 – WMATA Metrorail Red Line and route of train T-111

5

mph. When the train operator reported his overrun of the Twinbrook station, he was instructed by the OCC Red Line radio controller not to service the station (by discharging and picking up passengers) but to proceed to the next station, Rockville, while continuing to operate in automatic mode. The train operator proceeded under the performance level 8 that his train had been assigned as it passed through (overran) the Twinbrook station.

At 10:31:55 p.m., the operator of train T-111 called the Red Line controller to report that he had overrun the Rockville station platform by one car. Because the train was partially off the platform, its doors would not open automatically, although the train operator could override this protective system if necessary. The controller instructed the train operator to “drop [open] the left and right breakers” (to keep the doors from opening on the first car) and to service the station off the second, third, and fourth cars.

When train T-111 entered the Rockville station, the main train control system electronically transmitted to it the performance level 3 that was in effect for that station and that would have limited train T-111's top speed over the 2.68-mile route segment between the Rockville and Shady Grove stations to 59 mph, with a normal rate of acceleration. This performance level transmission was suspended while the train serviced the station. When the train finished servicing the station, the performance level was reestablished. But because the lead car of the train was outside the station limits, performance level 3 was lost and the train's speed control system defaulted to performance level 1 as the train departed the station.

At 10:35:30, shortly after leaving the Rockville station, the operator of train T-111 radioed the OCC to report console speed readouts of 75 limiting and 75 regulated.$^{7}$

Although the operator did not report his actual speed, Metrorail officials later calculated his speed at that time to be about 45 mph.8 (See appendix C.) The controller radioed to the train operator, “We understand this 111; continue on mode 1 [automatic] operation. The reason you have that maximum speed is because you had one car off the platform at Rockville.”

At 10:36:40 p.m., the train operator called the controller again and said, “I have 75/75/75,” which indicated that his actual speed had reached 75 mph. At 10:36:52 the controller answered, saying to the train operator, “Roger 111. Be advised I understand you have 75/75/75.”

The Red Line radio controller stated later that he was concerned about the train's speed. At 10:37:05, he called the train operator and asked, “Has your speed dropped down at this time, 111? You're approaching the station.” The train operator answered, “It's down to 35/35.”

The Red Line radio controller told Safety Board interviewers:

At this time I had a feeling the system was doing what it was supposed to do. It was slowing the train down to make the stop at Shady Grove. At this time, I didn't feel I had an emergency

6

〔图〕oPod NToLHLIMITING REGULATED TRAINpWoaMrsceu00困88EMERGENCYSTOP BUTTON0。。MASTER CONTROL HANDLE\n

Figure 3 – The operator's console on both Breda and Rohr Metrorail cars is a two-part console divided into a sloping indicator panel and a flat control panel section. The speed control blowup illustrates the Breda configuration.

7

where I could step in and override—put my job on the line—and tell the man to go manual.

The syslog indicated that when the train operator reported speeds of 35/35, his train was traveling in excess of 50 mph and was about 1,140 feet from the Shady Grove station passenger platform. According to WMATA speed calculations, train T-111 did not actually slow to 35 mph until after it passed the north end of the platform, moments before impact. At the time train T-111 should have come to a stop at the station platform 4-car marker, it was actually traveling at a calculated speed of 36 mph. The train proceeded on track 2, passed the A15-38 signal before the interlocking just north of the station, and struck the gap train approximately 470 feet from the end of the passenger platform. (See figure 4.) Safety Board deceleration calculations indicated that train T-111 was traveling between 22 and 29 mph when it struck the standing train.

At 10:40:15 p.m., the Shady Grove terminal supervisor, whose office is located at the north end of the station platform, reported to the OCC that a collision had occurred between train T-111 and the standing gap train. The OCC supervisor reported the accident to the general superintendent for rail transportation, who in turn relayed the information to the deputy general manager for operations.

Upon learning of the accident, the general superintendent for rail transportation and the deputy general manager for operations each departed for the accident scene. The general superintendent for rail transportation arrived on scene about 11:30 p.m. He said that, after ascertaining the status of all Metrorail employees, he examined the trains and track, accompanied by the general superintendent for car maintenance and the director of quality assurance and training, both of whom had also

recently arrived on the accident scene. The general superintendent for car maintenance stated that he examined the rails closely and carefully and that he saw no evidence of skid marks.

The general superintendent for rail transportation stated that he and the other Metrorail officials examined the circuit breaker panel in the operating compartment and found that all the breakers that would normally be sealed—including the automatic train protection (ATP) cutout switch, which, if activated, would have removed ATP speed protection—remained sealed. He stated that the “mushroom” button, which activates full emergency braking, was in the depressed position. The general superintendent for car maintenance stated that, because he saw no evidence of skid marks on the track or on the train wheels, he believed that the musroom button had been depressed by the force of impact or by flying debris and not by the train operator. This was also the opinion of the director of engineering and operations support, who examined the accident train later.

Injuries

The operator of train T-111 was fatally injured. The train's two passengers were not injured. The gap train operator was in the terminal block house at the end of the passenger platform when the accident occurred; he was not involved in the accident.

Train Damage

Car 3252, the lead car of train T-111, sustained the most extensive damage. The shell of the car became partially disengaged from the frame and came to rest partially on top of the lead car of the gap train. (See figure 5.) The fiberglass end cowl of the car was pushed inside the carboxy, and the end underframe assembly moved rearward $^{10}$ as a unit, collapsing several of the transverse beams aft of the unit, buckling the floor, and upsetting passenger seats. The

〔图〕First partial view of gap train1,134First full view of gap trainN664A15-08A15-38Gap trainTrain T-1 1Track 2Track 136 mph

Figure 4 - Accident site (not to scale). Speeds shown are calculated average speeds of train T-111 between the points indicated.

9

〔图〕插图

Figure 5 – Final position of accident trains. Gap train (left) has telescopes 21 feet into the shell of train T-111

10

〔图〕插图

Figure 6 – Head end of train T-111

operator's compartment was completely crushed. (See figure 6.)

Car 3191, the lead car of the gap train, sustained a uniform crush of approximately 10 inches across the front of the car at frame level (figure 7) and telescoped approximately 21 feet into the lead car of train T-111. The fiberglass cowl sustained cracking and other damage but remained relatively intact and attached to the shell of the body. The operator's compartment and interior of the car received relatively minor damage.

The remaining cars of train T-111 and the gap train received only minor damage. Total estimated damages were between $2.1 and $2.6 million.$^{11}$

Personnel Information

Train Operator -- The operator of train T-111 was 48 years old. He was hired by WMATA on November 11, 1975, as a bus operator and was promoted to train operator on October 29, 1995, qualifying for that position through formal and on-the-job training. He worked for the first time as a train operator on November 1, 1995, on the Green Line. He had operated trains over the Red Line for all or part of approximately 30 duty days prior to the accident. WMATA provided the Safety Board with two “follow-up” evaluation reports, dated November 6, 1995, and November 21, 1995, made on the operator of train T-111 by the Office of Quality Assurance and Training. The reports included evaluations of the operator in terms of appearance, work equipment, ATO operation,

11

〔图〕插图

Figure 7 -- Head end (struck end) of gap train

door operation, communication, and general train operation. Both reports indicated that the train operator satisfactorily performed all required functions.

After being off duty on Sunday, December 31, and Monday, January 1, the train operator reported for work on the evening shift on Tuesday, January 2. He worked evening shifts (from about 3:15 p.m. until about 12:15 a.m.) on Tuesday, Wednesday, Thursday, and Friday. His wife stated that he normally slept between 1:00 a.m. and 9 a.m. each day. The day before the accident, the operator reported for duty at 3:24 p.m. at Brentwood Yard. He made two trips on the Red Line between the Wheaton and Shady Grove passenger stations during his tour of duty. He went off duty at Brentwood Yard at 12:15 a.m. on January 6.

The train operator's wife stated that on January 6 her husband slept from about 1:30

a.m. until about 9:00 a.m. She stated that he took a nap between about 11:00 a.m. and 1:45 p.m. and left for work at about 2:30 p.m. Metrorail records indicated that he reported for duty at Brentwood Yard at 4:02 p.m. for the run (job assignment) designated by Metrorail as No. 505. When he reported for work, he had been off duty for 15 hours 47 minutes and had slept for about 10 hours 15 minutes in the preceding 24 hours.

Shortly after going on duty on January 6, the train operator deadheaded to the Wheaton, Maryland, passenger station and operated trains T-108 and T-110, making one round trip between the Wheaton and Shady Grove stations in each train. The train operator's next train was T-111, with which he departed the Wheaton station toward Shady Grove at 9:37 p.m.

OCC Radio Controller -- The radio controller was 55 years old. He joined WMATA on June

12

24, 1967, as a bus operator and became a train operator in 1981. In 1984, he became utility supervisor at Shady Grove. In 1986, he entered the utility program for the OCC and in 1989 was promoted to OCC supervisor (referred to in this report as “controller”). He had worked the 10:00 p.m. to 6:00 a.m. shift “3 or 4 years,” and had worked for the previous 6 months with the individual who worked as the button controller on the night of the accident.

OCC Button Controller -- The button controller was 48 years old. He had spent his career working with WMATA and its predecessors, beginning on September 26, 1969, as a bus operator, later becoming a street supervisor for the bus company. In 1975, he entered training as an OCC controller. He stated that he was one of the first six controllers assigned to the newly opened OCC in 1976. In 1978, he became an assistant OCC superintendent. He stated that in 1984 or 1985, he wrote the procedures, duties, and responsibilities for every position within the OCC. He moved back into an OCC controller position in 1985 and worked in that capacity until assuming the position of assistant field superintendent in 1990. He returned to the OCC as a controller in July 1995. He stated that, although controllers could be assigned to either the button or radio consoles, he usually worked the button controller assignment because he felt more comfortable with it since he had only recently returned to the OCC after a 5-year absence.

Train Information

Both train T-111 and the gap train consisted of railcars manufactured by the Italian firm of Breda Costruzioni Ferroviarie, S.p.A., and were among the 466 Breda cars owned by WMATA and operated on the Metrorail system. (WMATA also owns and operates approximately 300 cars manufactured by Rohr.) Each car was 75 feet long and 10 feet wide and weighed approximately 37 tons. The cars could seat 68 passengers each, with standing room for an additional 119, for a total passenger capacity of 187.

Like all cars on the Metrorail system, each car was propelled by four traction motors receiving power from an electrified “third rail.” According to published technical specifications, the cars were capable of a top speed of 75 mph with acceleration rates ranging from 0.75 mph per second (mph/sec) to 3 mph/sec. Service brake deceleration rates ranged from 3 mph/sec to 0.75 mph/sec. The cars were equipped with emergency brakes capable of effecting a maximum deceleration rate of 3.2 mph/sec under normal conditions.

All Metrorail carbodies are constructed primarily of aluminum extrusions that serve both as structural components and as exterior skin for the roof, side walls, and rear-end cowl. The front-end cowl is molded fiberglass. (See figure 8A.) The main underframe consists of transverse aluminum beams attached to the lower side wall extrusions (also aluminum), which run the full length of the car and serve as side sills. The underframe (figure 8B) does not have a center sill that runs the entire length of the car, but does have intercostals (short longitudinal members) between some transverse beams. The end underframe assembly (figure 8C) is fabricated of low-alloy, high-tensile steel and consists of a bolster, draft sill, and angular sill end fitted with a conventional anticlimber. These components are welded together to form a single unit. The end underframe assembly bolster is attached to the side sills by mechanical fasteners referred to as huck bolts.$^{12}$ The draft sill of the end underframe assembly is attached to the side sills by four aluminum transverse members (two on each side of the draft sill), which are attached by bolts to the draft sill and welded to the side sill. The end sills of the end underframe assembly are bolted to the ends of the side sills, as shown in figure 8D.

Train T-111 -- Train T-111 consisted of two “married” pairs $^{13}$ of Breda cars: 3252 and 3253,

13

〔图〕DunieauLinerASupportsHorizontaRear EndExtrusionCollisionPostsFront EndCarCollision Posts016ASidewallsCorner PosVerticaEx

Figure 8 – (A) Typical WMATA Metrorail carboxy structure; (B) Underframe of Breda Metrorail car; (C) End underframe assembly; (D) Attachment of side sill to end sill of underframe

14

placed in revenue service on December 10, 1987; and 3192 and 3193, placed in revenue service on October 10, 1986. According to Metrorail records, a daily safety test was performed on train T-111 on the day of the accident, and no exceptions were noted.

The train operator who operated the same consist as train T-111 before it was turned over to the accident operator stated that he first took possession of the train at 4:53 p.m. at Brentwood Yard. He operated from Brentwood Yard to Wheaton on the Red Line, then used the same consist for two round trips between Wheaton and Shady Grove. He stated that he did not experience any problems with the consist. He operated in mode 1 at all times during these two round trips and did not report overrunning any stations.

Gap Train - The gap train consisted of three married pairs of Breda cars: 3164 and 3165, placed in revenue service on June 13, 1986; 3120 and 3121, placed in revenue service on October 5, 1985; and 3190 and 3191, placed in revenue service on October 3, 1986.

Site Description

The Shady Grove passenger station is a terminus and a final passenger station on the Red Line. The passenger station is located adjacent to a Metrorail yard and a railcar service inspection shop that performs running maintenance on cars operating on the Red Line.

The collision occurred on ballasted track 470 feet north of the north end of the Shady Grove passenger station platform. The track in the accident area consists of two main tracks, designated as track No. 1 (inbound, or toward Washington, D.C.) and track No. 2 (outbound, or away from Washington, D.C.), with a third rail for each track. The tracks are constructed of 115-pound continuous welded rail and are situated in generally a north-south direction. The track approaching the station is tangent (straight) with a 0.35 percent descending grade. The track remains tangent until just north of the station where it curves to the left, then immediately and equally to the right at the south end of the first interlocking.

The passenger platform is 600 feet long. Interlockings are located on either side of the station. The south interlocking on No. 2 track is 428 feet long and is, at its closest point, 52 feet from the south end of the station platform. The A15-08 signal protects northbound movements. The interlocking north of the station is 223 feet long and is, at its closest point, 213 feet from the north end of the station platform. Signal A15-38 protects northbound movements through the interlocking.

Operations Information

The WMATA Metrorail system began serving the Washington, D.C., metropolitan area in 1976. The system consists of about 89 miles of track and 74 passenger stations, about one-half of which are above ground. The system comprises five separate, intersecting “lines,” designated Red, Blue, Green, Yellow, and Orange, that connect the Maryland and Virginia suburbs with the District of Columbia. (See figure 9.)

The Red Line operates between the Wheaton passenger station in Wheaton, Maryland, and the Shady Grove passenger station near Gaithersburg, Maryland, by way of downtown Washington, D.C. The 30.38-mile Red Line serves a total of 25 stations (including Wheaton and Shady Grove) in Maryland and the District of Columbia. About one-half of the Red Line stations are above ground. Under normal conditions, a train requires about 58 minutes to completely traverse the Red Line and service all 25 stations. The distance between the Rockville and Shady Grove passenger stations is 2.68 miles.

Operations Control Center (OCC) -- The Metrorail OCC, located in the Jackson Graham Building at 600 Fifth Street, N.W., Washington, D.C., serves as the control center for the Metrorail system. The OCC is responsible for providing positive control over all station activities, train movements, and subsystems (power, automatic train control, automatic fare collection, and communications) necessary for the efficient movement of passengers. The OCC controls all revenue activities, including radio

15

〔图〕LocationMARYLANDof AccidentShady GroveWheatonRockvilleTwinbrookWhite FlintGrosvenorGreen LineWMATA HQand OCCBrentwoodCra

Figure 9 – Schematic representation of the Washington, D.C., Metrorail system with selected locations identified

16

communications, interlocking operations, gap train usage, coordination of troubleshooting activities, train and service recovery, and any other functions affecting passenger movement on trains. The OCC monitors activities in passenger stations through communication with station personnel. The OCC also manages all emergency situations in accordance with the established rules and procedures, contacting fire, police, and medical services as required.$^{14}$ On the night of the accident, the OCC was also responsible for preparing for and reacting to the winter storm that was moving into the area. This included providing for overnight storage of trains in tunnels or other protected locations.

OCC Staffing -- On the day of the accident, the OCC evening shift started at 10:00 p.m. Staffing included the OCC superintendent assisted by a utility assistant superintendent (who also served as controller on the Green Line); button and radio supervisors (controllers) for the Red Line; button and radio controllers for the Blue/Orange Lines; and a controller for the Yellow Line.

Signal and Train Control Information

Train operations on the Red Line segment between the Grosvenor and Shady Grove stations are governed by a traffic control system that controls train movements in both directions on two main tracks. The system employs General Railway Signal (GRS) type AW light signals, located at interlockings only, and GRS Model 55E electric switch machines. Train speeds are controlled by audio frequency (AF) track circuits. Interlockings are operated remotely from a control panel in Washington, D.C.

Each Metrorail mainline route is divided into blocks from the terminal station at one end to the terminal station at the other end. Each block is checked for train occupancy by means of AF track circuits. Tuned impedance devices known as WEE-Z bonds provide block separation. These WEE-Z bonds inject into the track coded AF signals that detect the presence

of a train in the block and automatically transmit limiting and regulated speeds to passing trains. There is generally one track circuit per block, with WEE-Z bonds located at each end of each track circuit.

Automatic Train Control

The WMATA Metrorail system operates under an ATC system that was designed to allow for fully automated train operations requiring very little direct involvement by train operators. The degree of automation is partially determined through the use of the following three operating modes:$^{15}$

Mode 1 (automatic): Normal train functions, including acceleration, speed, and braking, are controlled by the ATC system, with the operator responsible for monitoring console indicators and track conditions.

Mode 2 (manual with speed protection): Train acceleration and braking are manually controlled by the train operator, with overspeed protection provided by the ATP subsystem. (In this report, all references to manual train operation refer to mode 2.)

Mode 3 (manual with automatic train protection cutout): All train operations are controlled by the operator, with no overspeed protection. This operating mode is only used when malfunctioning equipment makes mode 1 or 2 operation impossible.

The ATC system consists of three subsystems:$^{16}$

Automatic Train Protection: The ATP subsystem was designed to enforce safe operation of the system. It imposes speed limits to maintain train separation and allow for safe stopping distances

17

between trains, ensures safe door operations, and provides control of interlockings. The first speed readout on the train operator's console indicates the ATP (or "limiting," or "design") speed. The system was designed never to allow trains to exceed the ATP speed in normal operation.

Automatic Train Supervision (ATS): The ATS subsystem was designed to monitor system status and provide the appropriate controls to maintain efficient train operation and scheduling. It is through the ATS subsystem that the OCC controller is able to set or change performance levels for trains across the Metrorail system.

Automatic Train Operation (ATO): The ATO subsystem performs basic train operating functions, including starting trains and accelerating to running speed, maintaining en route speed, and controlling train stopping and positioning at passenger stations. Although the ATO subsystem was designed to allow totally automatic traffic regulation by automatically selecting performance levels, automatically adjusting dwell times at stations, and providing fully automatic door operation,$^{17}$ at the time of the accident, that function was not enabled on the Metorrail system. (In this report, to avoid confusion, ATC is used to refer to all elements of the Metorrail automated train control system, including its ATO aspects.)

Train-Wayside Communication (TWC) -- The TWC system provides 2-way communication between the train and the wayside at station platforms. TWC signals are received on board the train from the rails by ATP receiver coils mounted on the cab end of each car ahead of the first axle. TWC signals are transmitted to the

rails from the train by a 3- by 4-foot transmit loop mounted beneath the front of the train's lead car. Communication between the train and the wayside begins as a train approaches a station and continues until the train leaves the station platform.

The TWC system makes automatic station stopping possible through use of an “outer marker” (in the form of tuned coils located between the rails) that signals to a train that it is approaching a station. Except in locations where the distance between stations will not allow it, the outer marker is 2,700 feet from the station platform center line. Other markers are located 1,200 feet, 484 feet, and 160 feet from the platform center line. After the train passes the outer marker, ATC equipment gradually lowers the speed of a train, bringing it ultimately to zero at a predetermined target stopping point.

Once the train is properly positioned along the station platform, carborne equipment transmits train-berthed and station check signals to the TWC devices. Reception of these signals causes the WEE-Z bond located at the leaving end of the station platform to stop transmitting speed commands to the train. Once the speed commands are removed, ensuring that the train will not start up, the WEE-Z bonds at either end of the station block transmit the “doors open” command. If the train is not acceptably aligned with the station platform, it receives the open door transmission from only one of these two bonds, and the doors will not open. At the end of a predetermined time, the doors open command transmission is stopped, and speed command transmissions are resumed. When the carborne equipment reports that the doors are closed and that the train is ready to depart, the WEE-Z bonds transmit to the train the ATS speed limit and acceleration rate that will be in effect as the train proceeds to the next station.

Performance Levels -- At the time of the accident, the ATC system used a range of performance levels to define top speeds and acceleration rates of Metrorail trains operating over various route segments.$^{18}$ These

18

performance levels were established by Metrorail controllers and could be altered as necessary. Safety Board tests confirmed that, on the segment of the rail system where the accident occurred, performance levels could only be transmitted to trains while the trains were standing in or passing through passenger stations. At the time of the accident, the performance levels (PLs) available for assignment to trains leaving the Rockville station on track 2 toward the Shady Grove station reflected the following speeds and acceleration rates:

PL 1: 79 mph (ATP speed of 75 prevails) with normal acceleration.

PL 2: 64 mph with normal acceleration.

PL 3: 59 mph with normal acceleration.

PL 4: 49 mph with normal acceleration.

PL 5-8: Top speeds equal to those of PLs 1-4 but with one-half the normal rate of acceleration.

The second of the three speed readouts (the middle readout) on the train operator's console indicates the ATS speed ("regulated speed") as established by the performance level in effect at the time.

According to syslog data, train T-111 entered the Rockville station operating under the performance level 8 that had been assigned at the Twinbrook station. At that time, a performance level 3 (maximum speed of 59 mph with full acceleration) was in effect at the Rockville station, and according to the syslog, the train was sent that performance level as it progressed into and partially through the station. When the train overran the station platform, the train operator, as directed by the OCC controller, “dropped” the “left and right [circuit] breakers,” which kept the doors on the first car

closed while he opened doors on the remainder of the train using switches in the control cab.

The syslog showed that after train T-111 finished servicing the Rockville station and reestablished communication with wayside communications devices, it was (because of the overrun) not positioned to receive transmission of the performance level that was in effect and therefore defaulted to performance level 1. This set the train's ATS speed for the next route segment (Rockville to Shady Grove) to 75 mph, the maximum allowed by the ATP subsystem for that route segment.

Railcar Braking System

Metrorail cars are equipped with both electric (dynamic $^{19}$) and friction brakes. Both brake systems incorporate an automatic “slip/slide” wheel protection system that is designed to prevent wheel slips when the train accelerates, or wheel slides when the train slows or stops. The car braking system is part of the overall ATC system. If a train operating in manual mode should exceed the ATP speed in a particular block without the operator taking action within 2 seconds to slow the train, the ATC system activates the train braking system automatically. The ATC system also activates automatic train braking by using the ATP subsystem and TWC devices to transmit to trains reduced speed commands at certain points—such as curves and station approaches—along a route. The on-board braking computers react to these lowered speed commands by reducing propulsion or by applying train brakes as necessary.

Braking may be applied at any one of five standard levels or one emergency level (full braking). The five standard braking levels are

19

designed to achieve the following deceleration rates:

B1: 0.75 mph/sec ± 0.1 mph/sec

B2: 1.65 mph/sec ± 0.1 mph/sec

B3: 2.00 mph/sec ± 0.1 mph/sec.

B4: 2.20 mph/sec ± 0.1 mph/sec

B5: 3.00 mph/sec ± 0.2 mph/sec.

Emerg.: 3.20 mph/sec ± 0.2 mph/sec

Braking characteristics also include a “speed taper” that occurs between 50 and 75 mph. The specification requires that at 75 mph train speed, the braking system achieve 75 percent of the B2, B3, B4, or B5 commanded rate. At 50 mph, the specifications require the braking system to achieve 100 percent of the commanded rate.

In a typical braking scenario, dynamic braking is applied first. When the train's speed drops to the point that dynamic braking is no longer effective, the friction brakes take over and dynamic braking is terminated. The friction brakes on each truck are controlled independently of those on the other trucks. The specifications require that the friction brakes be fail-safe in design, construction, and operation. According to the specifications, no failure or series of related failures of the brake equipment should cause the resultant brake force applied to be less than 75 percent of the braking force commanded by full service (B4) braking. If a brake failure is detected, the system is designed to prevent the release of the brakes or the application of power after the next stop. There is no mechanism that allows the ATC system to verify that the train is achieving the desired braking rate.

According to a February 14, 1996, WMATA memorandum, (appendix D) the Metrorail ATC block design was based on the availability of at least 75 percent of full service (B4) braking, which is equivalent to a deceleration rate of 1.65 mph/sec. Although a margin of safety was built into the design, the memorandum states: “If the effective brake rate of the train falls below this level [1.65 mph/sec], then other measures must be taken to assure safe operation.”

The automatic slip/slide system is an integral part of the train's braking system. The technical specifications state that the slip/slide system should be able to detect all wheel slips or slides, whether random or synchronous. If the available adhesion will not support the tractive effort during acceleration or the braking effort during deceleration, the slip/slide system should adjust (alternately increase and decrease) propulsion or brake application to eliminate the slip or slide.

Brake control and wheel slip/slide protection for the Breda 2000- and 3000-series cars is provided by an H-1 electronic unit designed for WMATA by Westinghouse Air Brake Company (WABCO). The H-1 unit consists of a chassis, power supplies, a motherboard, two input/output (I/O) boards, and two central processing unit (CPU) boards. The CPU boards are based on Intel's 8080A microprocessor running at 2 MHz with 16K of EPROM $^{20}$ space.

The H-1 unit contains a power knockout feature that inhibits the propulsion system tractive effort if a wheel slip is detected from either the front or rear truck during acceleration, and it eliminates dynamic braking when a wheel slide is detected during deceleration. The slip/slide system also relies on valves that can be used to reduce brake cylinder pressure at each truck if so required by the slip/slide system.

The slip/slide system is designed to operate under all braking commands except an emergency brake application initiated by the operator's mushroom button. The system is expected to prevent flat spots and other damage to the wheel treads under all adhesion conditions at all speeds in propulsion, and at all speeds above 5 mph in braking, provided that the coefficient of sliding friction exceeds 3 percent.

20

According to WMATA specifications for the slip/slide system:

The efficiency of the wheel slip-slide system shall be at least 80% during braking at all speeds above 5 mph and shall exceed 60% at speeds below 5 mph, for all levels of available adhesion above 5% (equivalent to an acceleration rate of approximately 1.1 mphps). Efficiency is defined as the average car deceleration or acceleration rate (mphps) expressed as a percentage of the maximum rate which the available adhesion is capable of supporting.

Car acceptance test documents provided by WMATA confirm that Metrorail cars of the type involved in the accident met the slip/slide braking efficiency specification at the time they were added to the Metrorail fleet. In other words, in conditions providing at least 5 percent available adhesion, the slip/slide braking system was able to achieve a minimum brake rate of 0.88 mph/sec (80 percent of 1.1 mph/sec). Safety Board engineers calculated the deceleration rate of the accident train to be between approximately 1.055 and 1.136 mph/sec.

Wheel Flats and Tests of the Slip/Slide System

Wheel flats $^{21}$ are a common occurrence among railcars, and Metrorail cars are no exception. (See table 1 for a weekly summary report of wheel flats occurring between October 1995 and January 1996.) Metrorail records indicated, however, that an unusually high number of wheel flats began to be reported on November 11, 1995, and that this exceptionally

high rate of reports continued through November 14, 1995.

According to a November 14, 1995, briefing paper prepared by the WMATA Quality Assurance Branch, the number of wheel flats occurring between November 11 and November 14, 1995, exceeded the total number of flats for the entire month of November 1994. The briefing paper stated that the branch's car maintenance department was collecting and preparing to examine samples of track residue taken from areas where wheel flat occurrences had been especially high. It stated that Quality Assurance Branch employees had also made observations on board trains on November 14 but had found no reason for the increase in flats. The paper highlighted the question of whether operating trains in automatic mode rather than manual would result in fewer flats and recommended that the Vehicle Engineering Branch of the Office of Engineering and Operations Support evaluate the braking characteristics of each fleet (series of cars) to determine whether stopping profiles were different in automatic and manual modes. The paper concluded by highlighting other variables for review, including rail alloys in use in high-incidence areas, wheels from a different manufacturer that had been introduced into the system during the previous 6 months, and possible track contamination due to gearbox oil leaks.

On November 15, 1995, the Metrorail Vehicle Engineering Branch prepared a memorandum, subject “Rail Car Wheel Flats,” for the director of engineering and operations support. That memorandum stated that the Vehicle Engineering Branch had conducted an investigation into the large number of wheel flats that had recently been experienced and had concluded that, since “the cars were being operated in manual at the time,” the flats were operator-induced. The memorandum recommended that, in light of these findings, manual operations during winter season storms be curtailed on the Metrorail system and ATC operations be made standard. The memorandum suggested that such a change could be implemented on selected areas of the Metrorail

21

Table 1 – Wheel flat summary

system initially, then expanded if it helped eliminate or substantially reduce wheel flats.

The director of engineering and operations support stated that he received this memorandum and considered its recommendation. He stated that, because he thought more testing was needed before a firm conclusion could be drawn regarding a cause of the increase in wheel flats, he did not forward the recommendation to WMATA's top management. He stated that he was not aware until some weeks later that the use of mode 2 (manual) as a standard operating mode, had, in fact, been curtailed across the Metrorail system effective November 17.

A total of 77 flat wheel incidents, 47 percent of the total for the full month of November, occurred between November 11 and November 14, 1995. These 77 events represent 61 percent of the flat wheel incidents occurring between November 1 and November 17 (the date of the

change to all-automatic operation). (See figure 10.)

According to climatological data provided by the National Weather Service, 2.47 inches of precipitation fell at Washington National Airport from November 11 through 14, 1995, with ice pellets reported on November 11. The precipitation recorded during this 4-day period was more than half (52 percent) of the total November precipitation of 4.77 inches.

On November 17, 1995, WMATA engineers began developing test equipment and methods to be used in a series of tests of the slip/slide wheel protection system. The purpose of these tests was to identify the cause of the high incidence of wheel flats occurring between November 11 and November 14. The Safety Board asked for and received a chronology of that testing, summarized as follows:

22

〔图〕插图

Figure 10 – Flat wheel incidents occurring in 1995 and resulting in multiple wheel flats. Source: Metrorail maintenance and reliability system (MARS) significant incident report provided at Safety Board request.

On November 15, 1995, a WMATA meeting was held to discuss the large number of wheel flats the system had recently experienced. Plans were developed for both static and dynamic tests to evaluate railcar braking response with respect to wheel protection. On December 4, 1995, a 3000-series car was dynamically tested for wheel protection. One station stopping test with the train operating under ATC resulted in a long stop, but no wheel flats.

On December 6, 1995, a 4000-series car was dynamically tested. One ATC station stopping test caused a long stop, but no wheel flats. On December 12, 1995, WMATA officials met with representatives from WABCO to discuss the need to improve the operation of the slip/slide equipment to reduce the number of wheel flats. WABCO was informed of the long station stop that occurred during testing on December 4. On December 20, 1995, WMATA received from LTK Engineering Services previously requested slip/slide qualification test charts for 2000-series cars. But according to WABCO, WMATA directed WABCO only to improve the slip/slide equipment in order to reduce the number of wheel flats being experienced. On December 21, 1995, WABCO responded with three options for

upgrading the slip/slide control system on the 2000- and 3000-series cars.

These options were being evaluated when the accident occurred on January 6, 1996. On January 9, 1996, WMATA reviewed the test data to determine if there was any correlation between the test results and the accident scenario. It was determined that the deceleration rates exhibited by the trains experiencing ATC station overruns during the WMATA tests were comparable to the deceleration rate of the accident train. The WMATA deputy general manager for operations called WABCO for assistance. On January 15, 1996, WABCO personnel arrived for brake testing and improvement.

WMATA tests conducted on January 16 and 17, 1996, showed that the effective braking deceleration rates achieved by the 3000-series cars during slip/slide operation was lower than the braking rate used to design the ATC block signaling system. Specifically, Metrorail found that the brake rates achieved during the tests averaged 1.24 mph/sec in simulated wet rail conditions, while the ATC block design was based on minimum deceleration rates ranging from 1.65 to 2.2 mph/sec.

23

On January 22, WABCO delivered braking software (EPROM) upgrade kits for Breda 2000- and 3000-series cars. WABCO informed WMATA that the upgraded software would not satisfy the performance requirements as defined in the WMATA specification 2Z0065, dated June 15, 1979. The upgraded software was designed to improve stopping distances under low-adhesion conditions. An emergency engineering modification instruction, signed by the WMATA deputy general manager for operations, was issued on January 25, 1996, and the braking modifications were completed over the next 2 days.

Meteorological Information

Weather sensors monitored by Surface Systems, Inc. (SSI), were located at Shady Grove. According to SSI data, at approximately 10:14 p.m., no precipitation was recorded. At 10:15 p.m., all four sensors indicated precipitation. The last reading from the sensors before the accident was about 10:33 p.m. At that time, sensor number two at the Shady Grove Metrorail service and inspection shop indicated that precipitation was falling; air temperature was 27 °F, surface temperature was 26 °F, and winds were calm.

Medical and Pathological Information

Rescue workers found the operator in a semi-sitting position in the center aisle next to the control cab, with his body perpendicular to the longitudinal axis of the train. Death was attributed to multiple fractures of the skull and crushing chest injuries.

The train operator had a history of chronic pancreatitis and had been diagnosed as a controlled, non-insulin-dependent diabetic. He also complained of chronic back pain. According to the train operator's medical records, he had used Tylenol 3 (acetaminophen with codeine) periodically over a period of at least 18 months prior to the accident for the treatment of his back pain. WMATA medical records for the train operator disclosed that he had been told on May 5, 1994, to take Tylenol 3 only after work as needed for back pain. During this time, he was not working as a train operator

but as a Metrorail station manager. On December 29, 1994, the train operator reported to the WMATA medical office that he had been off Tylenol 3 for 6 months but that he had begun taking the medication again because of the recurrence of back pain. A WMATA physician told the train operator to minimize his intake of Tylenol 3 while working. According to the medical records, the train operator was told that he should “(try to do without it) – if he was to take Tylenol 3, take 1/3 of this tab along with 2 Advil on a full stomach.”

Before the train operator entered the train operator training program, he was, on July 24, 1995, given a medical examination by the WMATA medical office. A drug test that was administered in conjunction with this examination was negative for drugs, including morphine. The examining physician noted the train operator's prior ailments and the drugs that had been prescribed for their control; however, no mention was made in the medical records of the operator's prior use of Tylenol 3 or Advil.

A small bag containing some of the operator's personal belongings was found at the scene of the accident. According to police reports, a prescription bottle in the bag contained three Tylenol 500 mg tablets, two Tylenol 3 tablets, four Advil caplets, two Pancrease capsules, and one medication that was not identified beyond the manufacturer's name (Mylan).

The Maryland State medical examiner's office reported the results of laboratory testing of blood and urine specimens from the deceased train operator. The medical examiner's test results for blood were negative for alcohol, phenylpropanolamine and codeine. The results were positive for acetaminophen, morphine (a metabolite of codeine), chlorpheniramine, dextromethorphan, and pseudoephedrine. Carbon monoxide was normal. The medical examiner's test results for urine were positive for acetaminophen, codeine, morphine, chlorpheniramine, dextromethorphan, pseudoephedrine, and phenylpropanolamine. Tests for other drugs were negative.

24

Portions of the train operator's specimens were sent by the Safety Board to the Center for Human Toxicology (CHT) in Salt Lake City, Utah, for additional analysis. The CHT test results for blood and urine were positive for codeine and morphine, and negative for diazapam (valium).

Acetaminophen and codeine are found in Tylenol 3. Morphine is a metabolite of codeine, and the four remaining substances are found combined in several over-the-counter multiple-symptom cold medications. Ingested medications were found to be at therapeutic dosage levels, and the morphine was at a metabolized level.

Postaccident alcohol and drug tests were administered within 12 hours of the accident to the Red Line radio controller and the Shady Grove terminal supervisor who were on duty at the time of the accident. Analysis of all specimens from both individuals was negative for alcohol or other drugs.

Wreckage

The impact sustained by the lead car (3252) of Train T-111 sheared the huck bolt fasteners attaching the bolster to the side sills, broke the welds attaching the transverse members of the draft sill to the side sill, and sheared off the ends of the side sill. The ends of the side sills remained attached to the front end sill. The side sills, once free of the end underframe assembly, moved outward and allowed the end underframe assembly to move rearward as a unit relative to the body shell. The lead car of the gap train telescopesed approximately 21 feet into car 3252.

On the lead car (3191) of the gap train, several of the huck bolts attaching the end underframe bolster to the side sills sheared, and the welds attaching the transverse members of draft sill to the side sill failed catastrophically. The ends of the side sills at the attachment to the end sill cracked but did not fail as they did on car 3252.

Emergency Response

At the time of the accident, the gap train operator and the Shady Grove terminal

supervisor were inside the terminal block house at the end of the station platform. The gap train operator stated in Safety Board interviews that he heard the noise of the collision and immediately ran outside to the rear of train T-111. He stated that he radioed the yard tower to try to get third-rail power down. He said he entered the rear of train T-111 and found two male passengers who told him they were not injured. He said he then continued forward as far as the lead car, which he could not enter because of the damage the car had sustained in the collision. According to audio tapes of Shady Grove yard tower radio communications, the gap train operator contacted the yard tower at approximately 10:47 to report the presence of uninjured passengers and to request that the tower bring third-rail power down. The tower told the gap train operator that power was coming down but that he should leave the passengers on board the train until medical assistance arrived.

The assistant superintendent of rail operations at Shady Grove, who was on duty at the Shady Grove yard at the time of the accident, said that within a few minutes of the collision he went to the gap train searching for the gap train operator, whom he believed to have been on the gap train when the collision occurred. When he could not find the gap train operator, he entered the rear of train T-111. He encountered the two passengers and, determining that they were not injured, he asked them to remain on the train while he went forward to search for the T-111 train operator.

The two passengers were a 28-year-old male physician from Miami, Florida, and a 37-year-old male with no fixed address. The physician passenger stated that he was seated in the forward area of the last car of the train, with his back toward the direction of travel, and that the other passenger was in a seat behind him (the first seat in the car, facing away from the front of the train). When the collision occurred, the physician passenger was standing facing the rear of the train, with the intention of getting off at the Shady Grove station. He stated that the impact threw him backward (in the direction of travel) approximately 10 feet into the front

25

bulkhead of the car. He stated that he did not recall any train braking or any station announcement as the train approached the Shady Grove station.

The physician passenger's recollection of events immediately after the accident was different from that of the Metrorail personnel who were the first on the scene. The passenger stated that about 5 seconds after the impact, the lights in the train went out. He said that some time after the lights went out, several people rushed by, but they did not attempt to enter the car to see if any passengers were aboard. He said that, after waiting for 15 to 30 minutes,$^{22}$ during which time no one made contact with them, he became concerned and attracted a passerby's attention by pounding on the car windows.

A review of audio tapes of Red Line OCC console radio transmissions indicated that the Red Line controller was informed that there were passengers on train T-111 at approximately 10:50 p.m. A computer printout from the Montgomery County (Maryland) Department of Fire and Rescue Emergency Communications Center indicated that they were made aware of the two passengers aboard train T-111 at 10:57 p.m.

The OCC reported the accident to the Montgomery County Emergency Communication Center (911) about 10:43 p.m. The caller identified the location of the accident by the street address for the Shady Grove station. The caller did not provide the emergency service dispatcher with the status of third-rail power or specify the best access points to the accident site. Using a Metrorail emergency response reference book, the emergency dispatcher identified the chain marker $^{23}$ for the Shady Grove station and

entered that number into the computer-aided emergency dispatch system. According to the incident commander, this caused some firefighters to respond to the Shady Grove station rather than to the accident site some 500 feet beyond the station. Once at the scene, the initial engine officer advised the dispatcher of the correct location.

Section 5.1A.25 of the Metrorail Safety Rules and Procedures Handbook (MSRPH) states, in part:

When it is necessary to notify the fire department(s), the following information shall be provided:

a. Identification of caller...;

d. Specific location of the problem and the best access points;

e. Third-rail Status.

According to a Montgomery County Emergency Communications Center computer printout, units were dispatched and were en route to the accident scene at 10:45 p.m., arriving at the scene by 10:47 p.m. The first emergency responders to reach the scene entered WMATA property through the security gate located directly west of the interlocking closest to the north end of the Shady Grove station. Of the units initially responding, only one was equipped with a warning strobe and alarm device (WSAD) that could be used to determine the status of third-rail power. Personnel placed this WSAD (pronounced WAH-SOD) on the section of third rail that supplies power to track 2 north of the interlocking; Metrorail personnel provided a warning light

26

〔图〕插图

Figure 11 -- Looking north toward the interlocking just north of the Shady Grove passenger station. Arrows at center indicate portions of third rail that remained energized for approximately 40 minutes after the accident. Arrow at left indicates property security gate through which rescue workers entered the track bed.

device, which they placed on the southwest kicker rail $^{24}$ in the interlocking.

According to interviews with firefighters, rescue operations were curtailed when it was found that a portion of the third rail in the accident area remained energized. (See figure 11.) Since this section of rail lay in an area where it could pose a potential hazard to firefighters, the officer in charge of rescue operations ordered all rescue workers out of the track bed except those working inside the train. The officer stated that at that time he was aware that two passengers were aboard train T-111. After determining that they were not injured, he purposely delayed their egress until the third rail could be confirmed to be deenergized. He added

that he did not know if there were any other passengers aboard the train when rescue efforts were curtailed, since firefighters at that time had not completed their search of the lead car of train T-111.

A review of the syslog for the night of the accident confirmed that a section of the third rail that supplied power to track 1 remained energized until 11:23 p.m., some 43 minutes after the accident. This section included both the section of third rail on the western side of the interlocking directly in front of the gate through which firefighters were staging their rescue operations and the southwest kicker rail in the interlocking itself. This section of rail is controlled by the mainline breakers located in breaker cubicles designated 63 and 33. The syslog indicated that an OCC controller attempted to shut down this section of rail from the Red Line command console shortly after the

27

accident, but he was unable to trip breaker 33. After attempting unsuccessfully to trip the breaker from the command console at 10:41, 10:42, and 11:22 p.m., the OCC controller requested that Shady Grove station personnel manually operate one of the emergency trip switches (ETSs, also known as blue light boxes, or BLBs) at the station platform. Metrorail personnel complied, and about 11:23, power was removed from the remaining energized third-rail sections in the accident area. Prior to this time, neither the firefighters nor Metrorail personnel had attempted to activate any of the ETS boxes located at or near the scene. (See figure 12.)

Section 5.2.1 of the Metrorail MSRPH states:

Third-rail power can be removed for the following reasons:

--Local police or fire department on the right-of-way;

--Derailment or collision.

Section 5.2.6 of the Metrorail MSRPH states:

Any employee discovering a condition requiring emergency removal of third rail power shall proceed to the nearest emergency trip station and operate in accordance with the procedures posted on the door.

The assistant general superintendent for rail transportation told Safety Board investigators that, since the circuit breaker at location 33 was successfully tripped from the ETS box at the station platform, the inability of the OCC controller to trip the breaker on the night of the accident was likely due to a transient fault in the command link between the OCC and the circuit breaker rather than to a malfunction in the breaker itself. The assistant general superintendent also initially reported to the Safety Board that breaker 33 was replaced after the accident as part of a planned upgrade of circuit breakers along the Metrorail system. Subsequent Safety Board investigation

determined that there was no general upgrade of circuit breakers in the accident area, but that routine maintenance work may have resulted in the swapping of circuit breakers among various breaker locations. Because WMATA does not associate circuit breaker serial numbers with specific cubicle locations, WMATA engineers could not identify and Safety Board investigators could not test the circuit breaker that was in place as breaker 33 on the night of the accident.

WMATA engineers told Safety Board investigators that there had been other instances in which third-rail circuit breakers had intermittently failed to respond to remote trip commands. Often, these failures could not be duplicated by maintenance technicians, and the cause of the failures was never identified. WMATA officials and engineers stated that after the accident they experienced no further problems remotely tripping the breaker at location 33.

A review of Red Line console radio and telephone communications audio tapes revealed that the OCC controller placed a call to Metorrail maintenance to report the problem with the circuit breaker at 10:46 p.m. At 10:49 p.m., an OCC controller made an announcement over the Red Line console radio that all outbound Red Line trains would be turned back at the Twinbrook station. At 10:55 p.m., it was reported to the OCC over the Red Line radio that firefighters had arrived on the scene. Shortly following this communication, trains T-113 and T-101 were given permission by the OCC to proceed to Shady Grove from Twinbrook. At 11:04 p.m., the Red Line console operator was contacted by Metorrail personnel on the scene regarding the status of third-rail power. The Red Line controller told those personnel that he could only confirm that power was down on track 2 and that he did not know the status either of track 1 or the interlocking.

At 11:08 p.m. the OCC was informed over the Red Line radio that fire rescue workers needed power shut off to the interlocking. The Red Line controller replied that he could not bring down power to that rail because he had

28

![Staal CornpoaileYAID BREAKER OPEFLALINE BEAER CPERACN00+06RaillRaiFanoeoA15-34,64]BnaskA15-02.62eAeA4D-A254QA TRACK 220AOY-3ROEBTXONA263TRACK 1rsmA25TA255h-1-[A15-81,61][A15-33.35,63]into yand)rpLegendtrtagh whichETS Boxesfrofigtiarn stagedGate-WU[] Control BreakeCircuit BreakerNorthCircuit connection□Controlled by Redline command consoleControlled by Yard ToweTrack 2Track 1Gate used bySecurity fencerescue personnel\n](5/c30bHCsB7t5ziiaOum9G8B/pdf_78ab0cf185284213efdf3845e35acd1e_1bcddf0dee59a16276b662fab32a768c7490560193474857/tmp_zip_img/24d736a8-f2e3-4e83-871b-5bc88b48eecf.png)

Figure 12 – Schematic representations (not to scale) of Metrorail third rail power control in the accident area. Arrows in the lower illustration indicate third rail sections that remained energized for 43 minutes after the accident.

29

trains inbound into the Shady Grove station. At 11:09 p.m., Metrorail personnel at the accident scene again informed the OCC over the Red Line console radio that the interlocking was still energized. The OCC controller told personnel at the scene that power to that section of track could not be taken down from the Red Line console. At 11:23 p.m., after trains T-101 and T-113 had been allowed to enter and leave the Shady Grove station, the OCC used the Red Line console radio to ask that personnel at Shady Grove station activate one of the ETS boxes, which they did. At 11:24 p.m., it was confirmed over the Red Line console radio that the gaps had been hotsticked $^{25}$ and that power was down.

The Red Line controller who had tried unsuccessfully to deenergize the third rail in the accident area stated in a June 5, 1996, memorandum to the Safety Board that when it was found that one of the breakers would not trip, Metrorail managers decided to leave power up on track 1 in order to accommodate train service. The assistant general superintendent for rail transportation stated that it was WMATA policy not to strand trains between stations because of the risk that passengers might try to exit these stopped trains.

The arrival and departure times of trains that arrived at Shady Grove after the accident and times these trains arrived and departed stations prior to Shady Grove are shown in table 2.

Communications Between OCC and Rescue Personnel -- Several of the firefighters who responded to the accident stated that they received contradictory information from Metrorail personnel at the scene when they asked if the third rail had been deenergized. According to recordings of tower communications, Metrorail personnel at the scene contacted the yard tower on several occasions to request that power at the accident scene be brought down. Some of these calls took place prior to the OCC's being contacted by

Metrorail personnel at the scene regarding third-rail power. After yard third-rail power had been brought down, the tower operator replied to requests from the scene by informing callers that yard power was down but that the OCC controlled power in the area of the accident. On at least one occasion he warned the caller that rescuers should hotstick the gaps before proceeding with any work. There was no evidence that a direct communication link was ever established between firefighters on the scene and OCC personnel.

Section 5 of the Montgomery County Fire and Rescue Commission's Metrorail standard operating procedures is applicable to Metrorail accidents where there is no smoke or fire. Part 5.I.d of this section states, in part:

1. I.d -- If a truck or rescue company is first on scene, the unit officer should establish communications with Operations Control Center (OCC). When reaching the kiosk or BLB, contact OCC (dial “1970” at Kiosk, or “0” at a BLB)....

1. I.q -- First Due Duty Officer: Establish the primary command post at the Kiosk or other location with access to Metro phones and assume responsibilities as the Incident Commander.

Training -- An official of Montgomery County Fire and Rescue said that joint exercises with WMATA on the revenue portion of the Metrorail system are conducted between 1 a.m. and 3 a.m. and are periodically staged near interlockings. It was this officer's observation that the absence of revenue train traffic during this time period creates an unrealistic training environment for OCC controllers. A WMATA official stated that Metrorail yards are also made available for training purposes during other hours, including during the day.

Third-rail Schematic Availability -- No third-rail schematics, such as those that are sometimes found in Metrorail tunnels, were posted in the area where the accident occurred. Firefighters

30

Table 2 – Postaccident train movements in accident area

suggested that third-rail schematics posted on ETS boxes would have aided them in third-rail deenergization because they would have known how the various rail sections within the interlocking were controlled.

Warning Strobe and Alarm Devices -- For the purpose of rescue operations in Metrorail accidents, certain Montgomery County Fire and Rescue stations are equipped with WSADs, which give both audible and visual warnings if power is present or restored to the section of third rail to which a WSAD is attached. According to the standard operating procedures of the Montgomery County Fire and Rescue Commission, two WSADs, one for each side of the accident location, should be delivered to the site of a Metrorail accident. An official from Montgomery Fire and Rescue said that, because of cost, only certain station houses were equipped with WSADs at the time of the accident, and the stations that were so equipped had only one. The initial responders to the accident reached the scene with only one WSAD. Another WSAD arrived after some delay, and a third one followed still later after it was requested by firefighters at the scene.

Accident Site Configuration/Control of Third-rail Power -- Neither the third rail in the area where the accident occurred nor the third-rail sections rescuers might have crossed in order to reach the trains could be controlled by the control tower in the yard. The area in which the third rail could be controlled by the yard is shown in figure 12 to the left (north) of the south end of the second interlocking north of the passenger station. The third rail to the right of this point could be deenergized only by the OCC, by the

ETS boxes located in the field, or by a short in the third rail.

Tests and Research

On Friday, March 8, 1996, from 1:00 a.m. until 5:00 a.m., the Safety Board conducted sight distance and stopping tests at the accident site. At the time of the tests, snow was falling, winds were from the northwest at 17 mph; relative humidity was 88 percent; and barometric pressure was 29.80 inches. The test trains were of the same type and length as the accident trains.

Sight Distance Tests -- For the sight distance tests, a test gap train was placed at the approximate point of impact. A test T-111 train was then operated toward the Shady Grove passenger station on track 2 in a northward direction, and its operator was instructed to stop as soon as the first car of the test gap train came into sight. The test results indicated that the marker lights of the gap train first came into view at 1,134 feet and were fully visible at 664 feet. (See figure 13.)

Signal System and Speed Command Tests -- Safety Board investigators tested the Metrorail signal system and determined that, during the test period, it functioned as designed. Safety Board investigators conducted tests to determine whether the speed commands transmitted to trains under different scenarios matched the signal design and to determine whether the accident speed scenario could be duplicated. The tests were performed on February 21, 1996, between Twinbrook and Shady Grove stations.

31

〔图〕插图 A-Northbound approach to Shady Grove Passenger Station

〔图〕插图 B – View from train properly positioned at the station platform. The train visible past the end of the station house is standing at the approximate location of the accident gap train.

〔图〕插图 C – View as train approaches interlocking north of Shady Grove station.

Figure 13

32

The first test simulated the accident sequence. As the test train left the first block after the Rockville station (outbound, toward Shady Grove), and the ATP speed increased to its normal 75 mph, the ATS speed also became 75. The test scenario thus duplicated the experience of train T-111 on the night of the accident

The second test was conducted to determine what speed command would have been received if train T-111 had made a proper stop at the Rockville station and had not overrun the station platform. Under this scenario, the test train was limited to a top speed of 59 mph between the Rockville and Shady Grove stations.

Additional tests were conducted to determine the effect that various signal aspects and interlocking switch positions would have had on the speed commands received by train T-111. (See appendix E for a detailed description of all speed command tests and test results.)

Brake Equipment Tests -- After the accident, WMATA mechanical personnel tested the brake equipment from the cars of train T-111. The normal periodic inspection service brake test procedure was performed on the friction brake equipment of cars 3192 and 3193. The tests indicated that all pressure readings were within tolerance except the emergency rate, which was high on all trucks. WMATA technicians also removed some brake components from cars 3252 and 3253 and tested them at WMATA's Brentwood facility. All the components operated properly except for an N7D valve (No. 038405) located on the rear truck of car 3253, which had an internal air leak.

Train Stopping Distance Tests -- On March 7, 8, and 14, 1996, Safety Board investigators conducted stopping distance tests on the Metrorail Red Line using a 4-car train identical to accident train T-111 (cars 3040 and 3041 and cars 3084 and 3085). The cars were equipped with instrumentation that monitored and recorded, on chart recorders, brake command level, deceleration, brake cylinder pressure, and speed as functions of time. Four 55-gallon drums containing a solution of water, windshield washer fluid, and detergent were

placed in the first and third cars of the test train. A valve system was installed that allowed investigators to spray this solution on the rails ahead of the train wheels to simulate the effect of rain or snow. The objective of the tests was to observe train braking performance under low-adhesion track conditions similar to those experienced on the night of the accident. (See appendix F for results of all stopping distance tests.)

The March 7, 1996, tests were performed on track located between chain markers 739+00 and 783+00,$^{26}$ which corresponds to a segment of track between the Twinbrook and Rockville passenger stations. The train was operated in manual mode for all tests, and the solution was sprayed on the rails. Tests were conducted at 30, 60, and 75 mph and at brake levels B2 through B5 for each speed. One northbound run and one southbound run were made at each speed and brake level. Investigators obtained from printouts the speed of the train at the point where braking was initiated as well as the time required to come to a complete stop. They used this information to calculate the average deceleration rate at each brake level. Because the portion of the Red Line where the tests were performed is on a grade, the northbound and southbound values were averaged to obtain an approximation of the deceleration at a particular brake command on level track. (See table 3.)

Investigators conducted another series of tests on March 8, 1996, between the Twinbrook and Shady Grove passenger stations. The track circuit was $shunted^{27}$ at the location of the gap train. The train was operated in both manual and automatic modes. The liquid solution was sprayed on the rails for four of the six tests to induce low-adhesion conditions. Station stops were made at Rockville and at Shady Grove, and

33

the stopping behavior of the train was observed. The position of the train when it came to rest at each station was recorded, and the stopping distances were calculated and recorded.

Investigators performed the final series of 11 tests on March 14, 1996, between the Rockville and Shady Grove passenger stations. Again, the solution was used to create low-adhesion conditions, and the track circuit was shunted at the location of the gap train. Tests were conducted in automatic and manual modes. In all but one of the tests, the train was assigned a performance level 1. In each case, the train began braking at a code change point ($CCP)^{28}$ located at chain marker 918+08. The distance from the CCP to the 4-car station stop position on the Shady Grove platform is 2,822 feet, and the distance from the CCP to the point of impact is 3,422 feet. The stopping distance of the train was measured for each run. Four of the tests were performed using the postaccident-modified H-1 software.

For tests conducted at speeds above 60 mph, average deceleration rates ranged from a low of 1.11 mph/sec to a high of 1.50 mph/sec. The average stopping distances for the tests performed at 75 mph ranged from 3,353 feet to 4,588 feet. During one test similar to the accident scenario, the test train was operated at 72 mph in automatic mode. The train began braking at its normal location 2,822 feet from the four-car stopping position at the station platform. The test train overran the station and came to rest 955 feet past the four-car station stop marker and 335 feet past the point at which train T-111 struck the gap train.

Gap Train Light Bulb Tests -- The gap train operator stated in Safety Board interviews that the red marker lights of the gap train were illuminated while the train stood awaiting possible assignment. WMATA provided the eight bulbs from the front (struck end) of the lead car (No. 3191) of the gap train, and the Safety Board's Materials Laboratory Division

Table 3 – Average deceleration rates under low-adhesion conditions

examined them. The bulbs from the car were as follows:

Two 5-inch-diameter red marker lights.

Two 6.5-inch-diameter headlights.

Two rectangular running lights.

Two rectangular marker lights.

The rectangular marker lights and running lights were identical, except that the marker lights had red lens covers, while the running lights had clear lens covers. The filament in the operator-side marker light bulb showed evidence of hot stretching, which is consistent with a hot filament that has been subjected to high impact forces. The sides of the aluminum shell on the passenger-side marker light had been deformed onto the glass of the light bulb. The filament in that bulb showed evidence of hot stretching. The filament from the running bulb on the operator side was not visibly damaged or deformed. The glass of the passenger-side running light bulb was loose, and two filament pieces had broken free. No

34

evidence of hot stretching or other types of deformation was noted in the filament pieces or in the remainder of the filament still attached to the posts.

The 5-inch-diameter red marker lights were sealed-beam lights similar to headlights. The filament from the operator side was intact; a major portion of the filament from the passenger side had broken away. Both filaments showed evidence of hot stretching. Neither of the headlight filaments showed any evidence of damage or deformation.

Train T-111 Inspection Test for Wheel Flats --WMATA's mechanical department inspected all wheels on cars 3252, 3253, 3193 and 3192 and reported that it found no evidence of flats on any of the wheels. Metrorail technicians listened to the cars as they were moved from the accident site to the shop and reported that they heard no sound of flats during the move.

Other Information

Oversight of MetrorailError! Bookmark not defined. - The Washington Metropolitan Area Transit Authority was established in 1967 as an instrumentality of the States of Maryland and Virginia and the District of Columbia to plan, finance, construct, and operate a comprehensive mass transit system for the Washington metropolitan area. The authority is governed by a board of directors that comprises two members from each of the three jurisdictions. The chairperson of the board is chosen by and from the board membership. The board of directors does not play a direct role in day-to-day operations of the Metrorail or Metrobus systems, although it may promulgate regulations for the safety of the public and WMATA employees.

WMATA is a member of the American Public Transit Association (APTA) and receives periodic APTA safety audits. These audits, which are provided as a service to APTA members, cover all elements of the safety program. The most recent APTA audit of WMATA was conducted between December 2-15, 1993, with a follow-up audit in June 1995. In its audit summary report, APTA stated that

“most of the essential elements of the WMATA System Safety Program Plan were effectively implemented.” The next APTA audit of WMATA is scheduled for December 1996.

The Safety Board's interest in the oversight of rail rapid transit safety dates back more than 20 years, beginning with a Safety Board special study (NTSB-RSS-71-1) that explored the role of the Urban Mass Transportation Administration (UMTA), now the Federal Transit Administration (FTA), in developing safe transit systems.$^{29}$ Primarily in response to safety recommendations resulting from Safety Board investigations of a number of rapid rail accidents during the 1970s and 1980s and the Safety Board's 1991 safety study addressing oversight of rail rapid transit safety, Congress on December 18, 1991, enacted into law the Intermodal Surface Transportation Efficiency Act of 1991 (P.L. 102-240), which added Section 289 to the Federal Transit Act. This section directed the FTA to require those States in which a rail fixed-guideway system (such as WMATA Metrorail) operates that is not regulated by the Federal Railroad Administration (FRA) to designate a State oversight agency to be responsible for overseeing the safety of the guideway system.

On December 27, 1995, the FTA published its final rule, "Rail Fixed Guideway Systems; States Safety Oversight," in the Federal Register (Vol. 60, No. 248), which became effective as 49 Code of Federal Regulations Part 659 on January 26, 1996. The Safety Board is following up with the 10 States and the District of Columbia that have rail rapid transit systems to determine what efforts are underway to address the FTA regulatory action.$^{30}$

35

In addition to the information required from the States of Virginia, Maryland, and the District of Columbia, WMATA officials told Safety Board investigators that it is responding to the FTA final rule by proposing the establishment of a new safety oversight entity, to be known as the Tristate Oversight Committee (TOC), that will prepare and monitor adherence to a new system safety program plan. The TOC will also have authority to conduct safety audits, investigate Metrorail accidents, and require that WMATA minimize, control, correct, or eliminate hazardous conditions. The proposed TOC will comprise six members, two each from the Virginia Department of Rail and Public Transportation, the Maryland Department of Transportation, and the District of Columbia Department of Public Works, Office of Mass Transit. WMATA officials told Safety Board investigators that they expect a memorandum of understanding reflecting these proposals to be signed by the three jurisdictions before the end of 1996.

Management and Organizational Factors -- Several WMATA officials, including the general manager of WMATA at the time of the accident, provided information about the organizational structure, decisionmaking, and flow of important information within the organization. The now former general manager stated that when he arrived at WMATA, he divided responsibilities between the deputy general manager for operations and himself, retaining the financial and political domains and delegating to the deputy authority for operations and the supporting departments and offices.

The two managers restructured their respective departments within several months of the general manager's arrival at WMATA. According to the general manager, the deputy configured his part of WMATA to operate like a construction company, with a military-like hierarchy, rather than as a high-technology transportation system. The former general manager said that persons hired by the deputy formed a strong inner circle of management under the deputy, who organized his staff for central control.

Several WMATA employees commented during the Safety Board investigation about the lack of communication of important information within WMATA. According to these individuals, information did not flow upward to the general manager or laterally between departments unless the deputy personally authorized it or provided it himself. They suggested that the only way information could be obtained was by asking the deputy or members of his inner circle, and only then if the “right questions” were asked. As one example of information isolation, neither the general manger, nor the director of the Office of Safety and Risk Management, nor an instructor responsible for operator training was aware, before the fact, of the policy change regarding full-time automatic train operation.

The general superintendent for rail transportation, who reported directly to the deputy general manager for operations, did not distinguish between the management method used by the deputy general manager for operations in making the decision to require exclusive automatic train operation policy and those management methods used routinely. The general superintendent stated that the deputy held regular staff meetings, at which everyone attending had an opportunity to speak. Management policy was then decided, and the managers were to do their jobs by carrying out the decisions. Once the decisions were made, only the deputy or executive-level officials could consider alternative actions. One mid-level manager stated that the deputy would often seek information directly from lower-level employees without going through the supervisory chain of command.

Manual Versus Automatic Operation on the Metrorail System - The Metrorail system, before November 1995, had rules and policies in effect that mandated manual operation of trains under certain conditions. Rule 3.21 of the MSRPH (as superseded by Special Order 94-02 issued on May 20, 1994) stated:

Mode 2 Level 1 [manual with speed protection] shall not be used on mainline unless

36

specifically authorized by the Operations Control Center, or as specified in the current General Orders.

Rule 3.85 stated:

During inclement weather or when visibility is limited, Class I vehicles shall be operated in Mode 2 level 1 in compliance with Special Order 94-02/Operating Rule 3.21 and shall enter stations at a speed no greater than 25 mph.

WMATA also established formal guidelines and requirements for regularly scheduled manual operation. A July 11, 1988, memorandum from the general superintendent for rail transportation to all train operators and OCC personnel stated that a program would be implemented that established once-per-week periods of mandatory manual operation “in order to allow Train Operators to familiarize themselves with manual train operation.”

Beginning in 1991, the policy of scheduled once-per-week manual operation was supplemented by a policy requiring all trains entering the mainline to operate in manual mode for the first trip in the morning. A Metrorail official stated that this policy was initiated because the first trip each day is made after several hours of inactivity on the system. During this time, rails may have collected moisture or residue, Metrorail workers may have left tools or equipment on or near the tracks, or other unexpected or potentially hazardous conditions may have developed. By operating manually during the first trip of the day, the operator was in a better position to respond to any such condition.

The Metrorail system also had allowed train operators to operate in manual mode during periods of inclement weather. The general superintendent for rail transportation stated in Safety Board interviews that, historically during inclement weather, OCC controllers instructed operators to change to manual mode, above ground, and that to the best of his knowledge,

this had been Metrorail policy since the opening of the system.

On November 17, 1995, the OCC superintendent, acting in accordance with what he said was guidance he had received from the general superintendent for rail transportation, issued a notice to all OCC personnel that included the following guidance for operations during adverse weather:

At no time will trains be permitted to operate in a manual mode (Mode 2, Level 1), except in an emergency situation.

The general superintendent for rail transportation stated that while he remembered discussing this new policy with the OCC superintendent, he did not remember directing that the OCC superintendent put the policy in writing. The general superintendent said that “it would be a natural assumption on his part after receiving verbal instructions to put it in writing so there would be no mistake.” He stated that he was not sure whether it was before or after the accident that he saw the written notice for the first time.

Safety Board investigators asked the general superintendent for rail transportation whether, before the issuance of this notice, any tests had been done to indicate what the performance of either the vehicles or the train operators might be in inclement weather if operators were not permitted to operate in manual mode. He stated:

There were a couple of situations where we did it on a limited basis during inclement weather; where we would have the rest of the system in manual, and then try a section to see what happened, see if we still had overruns or whatever. But it was a limited, undocumented type of thing.

On November 20, 1995, the general superintendent for rail transportation issued a memorandum (appendix G) that restated the existing rule to train operators, operations supervisors, and OCC supervisors, as follows:

37

Effective immediately, by order of this memorandum, all Train Operators must obtain authorization from the Operations Control Center to change from Mode 1 to Mode 2 operation. The only exception is when adjusting the train within the platform limits, in compliance with Special Order #94-02 (Rules 3.21 and 3.31). [Emphasis in the original.]

This memorandum also canceled the requirements for manual operation one day each week and for the first trip each day, thereby ending regularly scheduled manual operation on the Metrorrail system. The general superintendent for rail transportation stated: “ATO is the safest operating mode we have. All the fail-safe systems are activated when you are operating ATO.”

On January 4, 1996, the OCC superintendent issued a memorandum to all OCC personnel stating that, effective January 5, 1996, the normal performance levels would be used at all times systemwide, except that in the event of a station overrun in adverse weather, a performance level of 8 would be entered for the station where the overrun occurred.

Error! Bookmark not defined.Maximum Authorized Speed (MAS) -- Rule 3.82 of the MSRPH states: “Employees shall not operate rail vehicles at speeds higher than the maximum authorized speed.”

On August 14, 1986, as a result of a WMATA investigation of a February 1986 incident involving the run-through of a red signal at the Shady Grove passenger station, WMATA's then-general superintendent for rail transportation issued a memorandum, subject "Adherence to Regulated Speed," to all rail operating personnel. That memorandum stated:

We are currently operating trains at a reduced level of speed not to exceed 59 mph. This speed limit is enforced by the use of performance levels which are set from OCC.

...Train Operators shall immediately inform OCC when their Regulated Speed exceeds 59 mph. OCC shall in turn reset the performance level in the affected area to insure that the Maximum Authorized Speed (MAS) of 59 mph is maintained throughout the system.

In interviews with Safety Board investigators, the individual responsible for training Metrorail train operators stated that the training program emphasized the 59 mph systemwide speed restriction. She further said that she had personally, in both formal and on-the-job training, made clear to the accident train operator that at no time were trains to exceed 59 mph. When asked what she thought the accident operator should have done when he received an ATS speed readout above 59 mph, she said: “He should have stopped the train and hit the ATO stop and contacted Central [OCC] and let them know that the speed was over 59 mph.” When asked what action she thought the OCC controller should have taken when informed that train T-111 was showing an ATS of 75 mph, she said, “I think they should have said, ‘Go manual.’”

In a Safety Board interview, the general superintendent for rail transportation was asked, “What is the maximum authorized speed on the Red Line?” He answered by stating: “Supervisors are...not allowed to authorize anything higher than 59 mph. I would have to say 59 mph.” He was asked, “Was the maximum authorized speed 59 mph on the Red Line on the night of the accident?” He answered, “Yes.”

In a subsequent Safety Board interview, he stated:

The maximum authorized speed that could be given by Central [OCC] would be 59 mph...but the...[speed] in that area [the Red Line between Rockville and Shady Grove] by the computer was 75 mph. So, in that sense, 75 mph under ATO operation was the top speed.

38

He said that, while OCC controllers were prohibited from authorizing train operators to exceed 59 mph, “if a train under ATP and within the right set of circumstances as determined by the computerized system did exceed it, it was safe to do so.”

A restriction board located within the OCC was used to provide information on an ongoing basis to all OCC employees. The first entry on this board, on the day of the accident and, according to testimony, for several years preceding the accident, was as follows: “59 mph systemwide speed.” (See figure 14.)

In Safety Board interviews, both Red Line OCC controllers on duty at the time of the accident stated their view that the November 17, 1995, notice from the OCC superintendent that trains would not be permitted to operate in manual mode except in an emergency effectively removed any absolute speed restriction that may have been in place on the Metrorail system. The button controller stated:

Since the [November 17, 1995] memo came out, everybody just says, ‘Well, [the 59 mph speed restriction] doesn’t mean a hill of beans anymore because of the 75/75. We could use 75/75 for trains to pick up schedule, with the assistant superintendent’s permission.

The radio controller stated:

[The 59-mph maximum authorized speed] was never rescinded, but it says [in the November 17, 1995, memorandum] that no one gives the mode 2 operation. Now, in a way of speaking, that could rescind that order.... Many times when trains overrun stations, you get 75/75, and I want to put them in mode 2 operation, but [we're told] 'no mode 2 operation on the main line,' which tells me...it's OK to do 75/75.

The Red Line radio controller was asked whether a train operator was required to stop the

train if the ATS speed exceeded 59 mph. He answered, “No—only if he thinks it is an unsafe condition. If not, he calls central control and lets us know.”

The controller stated that the memorandum not permitting manual operation meant that a train operator reporting an ATS speed in excess of 59 mph would be told to remain in automatic mode:

My option at that point [when the T-111 train operator reported speeds of 75/75] was not to stop the train...I had...asked questions before, if a train was running 75 mph, should we stop it and go mode 2? I was told, `Negative, mode 1 operation; let the train do what it's supposed to do.'

Safety Board investigators asked the OCC superintendent, who was in charge of the OCC on the evening of the accident, whether, at the time of the accident, the maximum authorized speed on the Metrorail system was 59 mph. He stated:

Yes, with the exception that, if the train had that problem like it did, if [it overran a station platform] or something like that, we knew it would receive max speed... whatever the maximum track speed is. If it was 65-75, you would receive that.

The OCC superintendent also said:

I understand prior to this [accident] we have had trains that received the 75/75/75.... I had been informed that I could not, and I did not, stop the trains.... I asked the question specifically, 'If I have a train running 75 mph, do we stop it, proceed manually, or do we allow it to continue at that rate of speed?' And the answer was, 'Continue.' And on a daily basis at West Falls Church, we had trains to receive that speed.

39

〔图〕RESTRICTION"59P Systen SpCDYARDSpErD At K99 aND D995HPHAcRoss Pocket Switches BO8CpD07Cn02mTo Cno2sm sh B04 8CAR Stop

Figure 14 – Restriction board in Operations Control Center displaying 59 mph system speed

40

He went on to say:

In retrospect... I would say that the train should have been stopped.... However, at the time of the incident... I had 100 percent confidence in the system.... I have wanted to believe and have 100 percent faith in our operating system.

The general superintendent for rail transportation stated that, based on the way the system was designed to work and the information available at the time, the OCC radio controller acted properly by directing the accident train operator to continue in automatic mode even though the operator reported a regulated speed of 75 mph. He added:

Now, in hindsight, he should [have] immediately stopped the train because of the weather and...[should have told ] the operator to cut down to a lower speed—I think even less than 59, based on hindsight. But, at the time, the system was operating within safety parameters, as it was set up.

In a Safety Board interview, the WMATA deputy general manager for operations stated:

Our normal maximum speed...is 59 mph. We have imposed that for years to save energy and to save the wear and tear on equipment. So, how the heck...[could] the train operator and Central Control think it's normal to run 75 in good weather or bad weather? That's a bad decision.”

He further stated:

When a train is running at 75, even in dry weather, it indicates there is a problem. So you must bring that train speed back down to the maximum speed allowed, which is 59, or find out what the problem is with the train.

Station/Platform Overruns on the Metrorail System

-- The Metrorail assistant general manager for rail service, in an April 16, 1996, memorandum to the Safety Board, stated that Metrorail trains experience approximately 400 to 450 station overruns each year while making 20-25,000 station stops each day. She stated that WMATA considers a station overrun to be unsafe only when the train exceeds safe braking distances and violates the ATP block design, meaning that it enters a track circuit that could be occupied or enters an interlocking governed by a red signal. She further stated that in the history of Metrorail revenue operation and prior to the accident, there had been no known instance of a train violating the block design while operating under ATC.

The assistant general manager for rail service also told Safety Board investigators that, prior to the accident, station overruns were considered by Metrorail management to be an issue of passenger inconvenience rather than an issue of safety. The OCC superintendent stated that, while a station overrun could be both an inconvenience and a safety issue, “more recently, most of them are inconveniences and not safety issues.”

Controllers on duty at the time of the Shady Grove collision said that they heard train operators report at least “four or five” station overruns during the 30 minutes preceding the accident. The graph at figure 15 plots the number of passenger station platform overruns (by at least one set of doors) reported month-by-month on the Metrorail system for the years 1992 through 1995.

Of the 63 station overruns reported in November 1995, 14 occurred between November 1 and November 17, at which time the notice was issued instructing OCC controllers that they were no longer to give train operators permission to change to manual operation in inclement weather. Between November 18 and November 30, an additional 49 overruns were reported. Safety Board investigators examined local (Washington National Airport) climatological data from the National Weather Service for November 1995.

〔图〕插图

Figure 15 – Station/platform overruns (by at least one set of doors) on the Metrorail system 1992 through 1995

42

That data revealed that the metropolitan area received a total of 3.40 inches of precipitation between November 1 and November 17, and 1.37 inches from November 18 through November 30.

While no electronic means was available to determine whether overruns occurred while trains were operating in automatic or manual mode, operators sometimes reported this information. According to these reports, in November and December 1994, 60 overruns occurred in automatic mode, with the remaining 11 either in manual mode or unreported. Of 399 overruns that occurred during 1995, 340 were while operators were in automatic; the balance were either in manual or unreported. A Metrorail official stated that, because trains were generally operated (until November 1995) in manual mode only for the first trip in the morning and for a portion of 1 day each week, "it would be expected that overruns in ATO would greatly exceed those in manual operation based on the relative hours that operators spent in each mode."

Interviews with other Metrorail officials, train operators, and OCC personnel indicated that in cases of a platform overrun by one car length or less, controllers would normally direct the train operator to deenergize the circuit breakers controlling the doors on the first car and to service the station from the remaining cars.

Training of OCC Controllers -- Safety Board investigators asked OCC controllers and the assistant general superintendent for rail transportation to describe the nature and frequency of any recurrent training given to OCC controllers covering operating rules and procedures, physical characteristics of the Metrorail system, and emergency preparedness and emergency response procedures. They stated that WMATA did not provide formal recurrent training to OCC controllers. They noted that controllers were required to pass an annual rules test but that WMATA offered no formal training or other preparation for taking the test. They said controllers failing the test the first time could retake it a maximum of two

additional times. Controllers failing to pass the test after three tries would be reassigned, but Metrorail officials could cite no instance in which this had ever happened.

Metrorail officials reported to Safety Board investigators that WMATA had no program to ensure that controllers remained qualified on the physical characteristics of the route segments for which they had responsibility. The button controller on duty at the Red Line OCC console at the time of the accident stated that he had not ridden over the Red Line in “more than 10 years.” The radio controller stated that he rode the Red Line regularly, on his own time, in order to stay current on the physical characteristics of the Metrorail system.

Gap Train Placement -- According to the yard log, the gap train was brought from the Shady Grove yard to the passenger station platform at about 7:00 a.m. on January 6. The OCC then gave the gap train operator permission to move the train back north of the A15-36 signal on track No. 2 so that it would be ready for immediate use. There was no evidence that the gap train was moved from the time of its placement to the time of the accident. In Safety Board interviews, the Metrorail assistant superintendent of rail operations at Shady Grove was asked about the placement of the gap train on the same track as incoming trains. He stated:

To my knowledge, there is no written document, but there were verbal instructions given. And this was about a year ago.... [T]hey're instructed to keep the gap train on track 1; they're instructed to keep track 2 clear and let the trains from revenue come in on track 2 and be dispatched from track 2. If track 2 is occupied, they're instructed to take the trains in on track 1.

The terminal supervisor on duty at the Shady Grove station at the time of the accident stated that it was typical for the gap train to be stored on track 2, north of the A-15-36 signal. The terminal supervisor stated she had no direct knowledge of the assistant superintendent's

43

instruction regarding the gap train's location. She stated: "A couple of other supervisors mentioned it in passing, but they also put the train on track 2, so I really didn't think...[it] was any pressing issue."

The Red Line radio controller, who could see the gap train location on his OCC visual display, said that the gap train was left on track 2 “most of the time.” The Red Line button controller stated that the gap train at Shady Grove was placed on track two “every morning,” so that trains could be brought out of the yard down track 1 toward downtown. He said:

I know the rule, being an ex- assistant superintendent, that...as soon as your line goes up, the gap [train] is supposed to be moved from that track over to the other track so that in case there is a run through or overrun, you don't have...[a] situation like this incident....

Metrorail Operating Rules -- Metrorail operations are governed by the MSRPH and by change orders, special orders, and memoranda.

The MSRPH, the most recent edition of which was effective June 1994 and was signed by the WMATA general manager, could be changed by the following methods:

Reprinting: Incorporates all changes and constitutes a total reissue of the manual (normally done every 2 years).

Change Orders: Permanent revisions made by printing only those pages that are changed or substituting them for the outdated ones (normally done every 6 months).

Special Orders: Temporary changes made by issuing a single revision on the basis of expedited need and included in the next change order or reprint (normally done as needed.) All employees or contractors to whom the rules or procedures apply could suggest changes by submitting them in writing to the Rail Transportation Analysis and

Support Section, which would review each suggestion to determine its urgency. Those suggestions requiring immediate attention would be revised and issued as special orders under the signature of the general superintendent for rail transportation. If the revision has safety implications, concurrence of the Office of Safety would be required.

The Safety Rules and Procedures Standing Committee could make its recommendations for changes, corrections, additions, deletions or other improvements to the general superintendent for rail transportation, who would review all recommendations and include those approved in the next regularly scheduled update of the manual.$^{31}$

The Safety Board reviewed the process by which the policy of manual operation in inclement weather was changed in November 1995. Investigators determined that the WMATA Office of Safety and Risk Management had no role in the policy change. The various departments reporting to the deputy general manager for operations indicated during Safety Board interviews that no formal meetings were held to discuss the change in the operating policy regarding automatic operation during inclement weather. The WMATA Rail Transportation Analysis and Support Section, according to statements made in Safety Board interviews, did not review the decision to evaluate its appropriateness or urgency, nor did the Safety Rules and Procedures Standing Committee participate in the decision.

The Safety Board reviewed Metrorail procedures for providing train operators and OCC controllers with safety information or written notification of changes to operating rules, practices, or procedures. Investigators determined that this information was usually disseminated through several means, including posting notices on bulletin boards at reporting locations and terminals throughout the Metrorail

44

system and placing copies in operators' "traps" (mailboxes). Testimony indicated that sometimes train operators or other operating personnel were asked to sign for documents, but no procedure was in place requiring train operators to initial or sign a form to signify that they had read and understood memoranda or notices establishing permanent or temporary changes to operating practices or procedures. Similarly, no procedure was in place for terminal supervisors, OCC supervisors and controllers, or other operating personnel to sign for memoranda or notices meant for them.

Event Recorders -- WMATA Metrorail cars are not equipped with event monitors/recorders. The Safety Board, as a result of its 1982 investigation of the only previous Metrorail fatal accident (see "Previous Metrorail Fatal Accident" below"), made the following safety recommendation to WMATA:

R-82-74

Maintain the carborne monitors on existing Metrorail cars and require their installation on cars presently on order. Acquire the necessary equipment to read the monitor tapes.

WMATA responded in a December 15, 1982, letter that it had found that the existing carborne monitors were unreliable and that it was working to develop a substitute recording device. In a series of letters to the Safety Board between 1984 and 1987, WMATA stated that it had investigated state-of-the art monitoring technology and, in 1987, planned to recommend to the WMATA board of directors that it approve proceeding with the design/demonstration phase of the carborne monitor program.

In an April 22, 1991, letter, WMATA told the Safety Board that it had successfully completed the prototype carborne monitor development project in September 1989. The letter stated that the WMATA board of directors operations committee had determined that the procurement and installation of such equipment on the existing rail car fleet could only be done in a cost-effective manner at the time of a major

rehabilitation, but that the procurement of new railcars so equipped could be accomplished economically. Based on WMATA assurance that, with the development of a reliable carborne monitor, a requirement for such a device would be included in the next vehicle procurement specification, the Safety Board classified Safety Recommendation R-82-74 “Closed--Acceptable Action” on June 10, 1991.

WMATA took delivery of the first of its 4000-series (Breda) cars on December 23, 1991. These cars were contracted for in April 1989 and were not equipped with event recorders/carborne monitoring devices. WMATA engineers told Safety Board investigators that the 4000-series cars were designed and built with wiring to transmit to a central location on the car information about vital railcar functions and that the cars can be retrofitted with carborne monitoring devices once the devices become available.

WMATA is currently rehabilitating its 1000-series (Rohr) railcars, which are the oldest cars in the Metrorail fleet. WMATA engineers told Safety Board investigators that 266 of the 298 1000-series cars have been overhauled and that, while the rehabilitation program includes preparing the cars for the future installation of a carborne monitoring system, no such devices have been installed on any of the rehabilitated cars.

On September 9, 1996, WMATA distributed and solicited industry comment on a draft specification for a new 5000 series of railcars that includes a proposed carborne vehicle monitoring system. The proposed monitoring system will be capable of continuously monitoring and recording the performance of all vital railcar systems. It will record wayside- or operator-initiated commands received by the train control system and the response to those commands in terms of train control signals. The monitoring system will record up to 38 operating parameters, including limiting, regulated, and actual speeds and train operating modes. WMATA officials anticipate that the specification will become final before the end of 1996. No date is set for the procurement of the

45

new 5000-series cars, but WMATA officials told Safety Board investigators that they anticipate that when the cars are placed in revenue service they will be equipped with state-of-the art carborne monitoring systems.

Postaccident Policy/Rule Changes -- WMATA implemented the following policy or rule changes after the January 6 accident:

Gap Train Placement -- On February 14, 1996, the general superintendent for rail transportation issued a memorandum, subject “Terminal Operations—Gap Train Placement,” stating that gap trains at terminal stations should be placed to provide the safest possible operation of the terminal. The memorandum specified that gap trains be stored on the track opposite the one normally used for trains arriving from the mainline and as deep as possible in the tail track.

Maximum Speed in Increment Weather -- On February 2, 1996, WMATA issued Special Order 96-02 reiterating operating rule 3.1, as follows:

Passenger safety is the responsibility of every WMATA employee; however, Train Operators have the ultimate and final responsibility for the safety of the passengers on their particular trains. If any Train Operator is instructed by any person, regardless of rank, title, or position, to take any action which would adversely affect the safety of passengers, the operator shall stop the train, notify OCC or the Yardmaster, and shall not continue until satisfied that it is safe to do so.

The special order also listed the following procedures applicable during inclement weather:

● Train Operators must verify reception of a regulated speed less than or equal to 49 mph at each platform.

● At no time during inclement weather shall the regulated speed exceed 49 mph. If TWC communication is not

present and a train door is opened, such as for a Brentwood platform stop or a station overrun, the regulated speed will be reset to the limiting speed. If the regulated speed exceeds 49 mph, the Train Operator must immediately notify OCC and shall be governed by their instructions.

● If unable to immediately contact OCC, the Train Operator shall immediately stop the train and continue attempting to contact OCC.

● OCC shall instruct Train Operators of trains that have received a regulated speed that exceeds 49 mph to stop the train and to proceed in Mode 2, Level 1 operation to the next station.

OCC Controller Training -- WMATA officials told Safety Board investigators that they commenced a new training course for OCC controllers after the accident. They stated that this Supervisor Technical Refresher Training Course is a 15-day course with class size limited to two controllers at a time. The course covers the following subject areas:

● WMATA operating rules

● Safety rules

● Troubleshooting and troubleshooting handbook

● Car familiarization, seatwells, door cut-out, brake cut-out, circuit breakers

● Standard operating practices

● Simulator training

● Automatic train control

● Emergency brake applications

● Recovery procedures

● Troubleshooting console

● Circuit breakers

● Permissive block/absolute block

● Train operator procedures

● ATC car-borne subsystems

● ATC wayside systems

● Yard operations and configuration

● Decisionmaking

● Overview of Metrorail lines

46

WMATA officials said they plan to hold annual 3-day refresher classes for controllers beginning in 1997. These classes will cover rules, standard operating procedures, and safety. According to documents provided by WMATA to the Safety Board, 18 OCC controllers had successfully completed this training program by September 30, 1996.

Previous Metrorail Fatal Accident – The only previous fatal accident in the history of the Metrorail system occurred on January 13, 1982.$^{32}$ In that accident, a Blue Line train being operated in manual mode at the Smithsonian interlocking was unintentionally routed into a crossover track and through a switch that was not aligned for a crossover move. As a supervisor at the opposite end of the train attempted to pull the train back through the crossover, the rear car (which had been the lead car in the initial crossover move) derailed. Not realizing that there had been a derailment, the supervisor continued to attempt to pull the train through the crossover, at which time the derailed car stuck a reinforced concrete barrier wall separating the two main tracks in the subway tube. The concrete wall penetrated the passenger compartment, killing three passengers and injuring 25 others. As a result of its investigation of this accident, the Safety Board made 37 safety recommendations to WMATA. Of those safety recommendations, 33 were eventually classified “Closed--Acceptable Action” or “Closed--Acceptable Alternate Action,” and 4 were classified “Closed--Unacceptable Action.” (See appendix H.)

The following were among the safety recommendations the Safety Board made to WMATA as a result of the 1982 accident:

R-82-15

Upgrade the training given to rail transportation supervisors and assign them the necessary authority to effectively super-

vise train operators and correctly deal with the full range of operational situations. (Class I, Urgent Action)

WMATA responded in a December 15, 1982, letter that it had provided refresher training to all supervisors, had hired a superintendent of rail transportation training, and had contracted for a system analysis to identify potential training deficiencies, after which it expected to modify its training program. In a follow-up letter of December 14, 1983, WMATA stated that a totally revised training, retraining, and certification program for operators, transportation supervisors, station attendants, station supervisors, and OCC personnel would be phased in and would be completely in place during the first 6 months of 1984. That letter also stated that in October 1983, OCC personnel had been tested to determine proficiency in operating rules and standard operating procedures and that those who were found to be less than proficient were retrained and retested.

In an October 18, 1984, letter in response to this recommendation, WMATA stated that the training program for transportation supervisors had been upgraded in several areas, including an annual examination on the handbook of operating rules and standard operating procedures. In a March 18, 1985, letter, WMATA noted that all supervisors would attend an intensive refresher course to commence in April 1985, after which they would undergo a practical requalification examination. In its last letter in response to this recommendation, dated October 24, 1985, WMATA stated that it had completed its annual refresher training and requalification program for all transportation supervisors and that supervisors would be recertified every 18 months. The letter went on to say that WMATA had awarded a contract to a company that would assist the rail training branch in upgrading the training of several groups, including train operators, transportation supervisors, and OCC supervisors.

47

Based on the WMATA response, the Safety Board classified Safety Recommendation R-82-15 “Closed—Acceptable Action” on October 10, 1984.

R-82-17

Amend [WMATA] standard operating procedures to require the Operations Control Center to (1) require that, whenever a train emergency which requires evacuation is known to exist at a location between stations, all third-rail power circuits between the emergency location and the stations on each side of that location be deenergized as soon as all other trains have cleared the area, and (2) to direct the nearest qualified rail employee to begin the timely evacuation of passengers from the train. (Class I, Urgent Action)

WMATA responded by letter on December 15, 1982, stating that procedures were established to remove third-rail power from an affected area before passengers were permitted on the track bed. In a follow-up letter of December 14, 1983, WMATA acknowledged

that power removal procedures were deficient at the time of the 1982 accident because “non-standardized circuit breakers were installed in parts of the system.” The letter stated that WMATA had changed its procedures to provide positive assurance that the breakers were commanded open. The Safety Board, on February 19, 1985, classified Safety Recommendation R-82-17 “Closed--Acceptable Action.”

R-82-63

Eliminate the practice of issuing verbal instructions to the Metrorail Operations Control Center personnel which modify or amend operating rules and standard operating procedures. (Class I, Urgent Action)

In a December 15, 1982, letter, WMATA responded that it had discontinued the use of oral instructions and had instructed OCC personnel that “the book of rules govern until changed by written revision or amended by special order.” Based on this response, the Safety Board, on July 8, 1983, classified Safety Recommendation R-82-63 “Closed--Acceptable Action.”

ANALYSIS

General

The accident train operator was well rested when he reported for duty. Although he had been on duty for about 6 1/2 hours at the time of the accident, he was completing the first half of only his third round-trip of his duty day. The two OCC Red Line controllers were working their regularly scheduled shift and had been on duty for less than 45 minutes when the accident occurred. The Safety Board therefore concludes that fatigue was not a factor in this accident.

Safety Board investigators tested the Metrorail signal system, the track wayside communications devices, and the electronic command systems related to automatic train control and determined that these systems worked as designed during the accident sequence. The Safety Board therefore concludes that track and signal operations were not causal or contributing factors in this accident.

The Accident

The accident sequence began when train T-111, operating in automatic mode, overran the Rockville passenger station by one car and the OCC controller instructed the train operator to service the station from the second, third, and fourth cars. Under the design of the ATC system, opening the doors caused the train to lose, temporarily, the performance level—and thus the speed limitation—that was assigned to it. Under normal circumstances, the ATC system would have reestablished the train's performance level, with a top speed of 59 mph, once the doors were closed and train was ready to depart. But because the first car of train T-111 was outside the station limits, the train did not receive the signal (performance level 3) for the reduced speed (59 mph), and the system defaulted to 75 mph (performance level 1), the highest speed available for the next route segment.

The train operator recognized that the 75 mph speed was too high, and he called the OCC almost immediately to report it. The OCC controller also recognized that the 75 mph speed was problematic. At that point, both the train operator and the OCC controller had time to take action to stop the train, change to manual mode, and defuse a hazardous situation. But neither the train operator nor the OCC controller was aware that, under the conditions of high train speed and low rail adhesion that existed at the time, the braking system of train T-111 was incapable of stopping the train within the distance available. Thus, neither of them recognized the full extent of the hazard, and largely as a result of the inflexibility of WMATA's management policies and practices, neither the train operator nor the OCC controller was willing to take independent action absent clear evidence of immediate danger. The train was thus allowed to continue to operate in automatic mode at above-normal speed on known slippery rails toward a location where a significant station overrun could result in a collision with another train.

After the accident, emergency responders arrived at the accident site quickly, but they failed to establish a direct communications link with the Metrorail OCC. The result was a series of misunderstandings that impeded rescue efforts. Rescue efforts were also hampered by the failure of the OCC, immediately upon being notified of the accident, to turn off third-rail power in the accident area. Had the accident happened at a time when more passengers were aboard the train, these failures could have seriously affected survivability.

In its investigation of this accident the Safety Board identified the following safety issues:

· Adequacy and appropriateness of WMATA methods of management, decisionmaking, and communication;

49

· Safety implications of the decision to eliminate manual train operation on the Metrorail system;

· Effectiveness of using performance levels to control train speed;

· Compatibility between railcar braking performance and design of the Metrorail ATC system; and

· Adequacy of WMATA and Montgomery County emergency response procedures.

Although Safety Board investigators identified WMATA management, decisionmaking, and communication as a separate safety issue, the management style and processes employed by those at the top levels of the WMATA management were reflected in several of the other safety issues and in a number of the corollary issues examined as part of this investigation. Those corollary issues include performance of OCC controllers and the train operator during the accident sequence, placement of gap trains at Metrorail terminals, adherence to Metrorail rule-change procedures, establishment of maximum authorized speeds on the Metrorail system, and reliance on oral instructions. Those issues are discussed in detail in this analysis, as are the issues of the absence of event recorders on Metrorail cars, the crashworthiness of Metrorail cars, the inadequacy of OCC controller training, and station/platform overruns on the Metrorail system.

Elimination of Routine Manual Train Operation

Prior to November 17, 1995, and apparently for most of the 20-year history of the Metrorail system, OCC controllers routinely gave permission for train operators to change to manual operation during periods of inclement weather. This issue was important enough to be addressed by rule 3.85 in the MSRPH, which stated that revenue trains were to be operated in manual mode during periods of inclement weather or reduced visibility and as authorized by the OCC.

The November 17, 1995, notice instructing OCC controllers not to permit train operators to change to manual mode ended this 20-year policy. This notice, in combination with the November 20, 1995, memorandum annulling first-trip and once-weekly manual operation, completely eliminated routine mainline manual train operation on the Metrorail system.

This policy change was prompted by the high number of wheel flats Metrorail trains experienced between November 11 and 14, 1995. Some evidence suggested that most of these wheel flats occurred when trains were being operated in manual mode, but the exact cause was unknown. On November 17, 1995, WMATA engineers began planning tests to determine the cause of the flats. Rather than waiting for the results of those tests, however, WMATA top management decided to deal with the problem by curtailing manual train operation across the entire Metrorail system. Even though Metrorail officials stated that prior to this policy change they had conducted some “limited” and “undocumented” testing of all-ATC operation in inclement weather and had experienced no problems, no tests were done specifically to determine how the system and the operators might react if manual operation were eliminated across the system. The Safety Board concludes that the WMATA decision to completely and suddenly replace its policy of intermittent routine manual train operation with an essentially untested policy of full-time automatic train operation was a hasty decision based on insufficient information.

Evidence also suggests that no one monitored the effect of the new policy after it was implemented. One possible effect was an increase in station overruns. According to reports prepared at the request of Safety Board investigators, the Metrorail system, which had recorded 14 overruns during the 17 days immediately prior to the notice, experienced 9 station platform overruns on the first day after the notice. In all, the system experienced more than three times as many station overruns during the last 14 days of November 1995 (after the policy change) as during the first 16 days. The upward trend continued in December, when the

50

system recorded 85 overruns. Factors other than the policy change could have influenced these overrun occurrences, but the sheer numbers of events and their significant increase over the same months in the previous 3 years clearly should have invited further investigation. There is no evidence, however, that Metrorail officials noted these increases or considered their implications.

Certainly, Metrorail officials would have been expected to take particular note of wheel flat occurrences after the November 17 policy change, since reducing wheel flats was the reason for the change. Apparently, this was not done. According to a flat wheel summary supplied by Metrorail, not only did the number of wheel flats show no significant decrease after November 17, the numbers actually increased. During the 6 weeks prior to the policy change, 82 wheel flats were reported; during the 6 weeks after the change, 92 were reported. While it is true that the number of wheel flat incidents (as opposed to the total numbers of wheel flats) decreased in December, the month after the policy change, the number decreased only in relation to the exceptionally high number of incidents in November. There were actually more wheel flat incidents in December (50) than in any other month of 1995 except February (51) and November (164). The Safety Board acknowledges that a combination of factors may have contributed to these numbers, but the numbers alone should have prompted Metrorail officials to analyze the data to determine whether eliminating manual operation was having the desired effect. It is clear from the available evidence that they made no such analysis.

Two outcomes of eliminating manual train operation were obvious and should have been considered by WMATA management. The reason WMATA initially scheduled one-day-per-week manual operation was “to allow train operators to familiarize themselves with manual train operation.” This was a worthwhile objective, since, even in an environment of “normal” automatic train operation, equipment malfunctions, track maintenance, or other conditions occasionally create the need for

manual operation. But the elimination of scheduled manual operation left train operators with no opportunity to develop or maintain proficiency in operating trains manually in revenue service. The Safety Board is concerned that, without regular practice in manual train operation, train operators will not be able to develop and maintain self-confidence and attain the level of proficiency needed to ensure safe operations under non-ATC conditions. The Safety Board concludes that WMATA, before making the decision to eliminate manual train operation on the Metrorail system, failed to consider the continuing need for train operators to maintain proficiency in manual train operation. The Safety Board believes WMATA should implement procedures that will provide a means for train operators to develop and maintain this proficiency.

The Metrorail policy of operating in manual mode during the first trip each day was also based on practical considerations. Officials believed that train operators making the first trip of the day in manual mode would be better able to respond to unexpected or potentially hazardous conditions that might have developed overnight. This appears to have been a sensible policy, yet it too fell victim to the decision by WMATA management to curtail manual operation systemwide.

In Safety Board interviews, WMATA officials stated that automatic train operation is “the safest operating mode we have.” This view appears to have been widespread among Metrorail top and middle management, and it could be one reason why apparently no one in the management chain seriously questioned—much less objected to—the decision to curtail manual operation across the system. Such was the confidence in the automated system that controllers were directed to defer to the ATC system even when it displayed anomalies such as allowing trains to exceed programmed speeds. Even under those circumstances, human controllers and train operators were told to stand aside and allow the ATC system to “do what it is supposed to do.” Thus, human operators and controllers, who should at the very minimum

51

have been a backup to the automatic system, were essentially removed from the process.

The Safety Board is fully aware of statistics indicating that some 80 percent of all transportation accidents are attributable to human error. The Safety Board itself has been at the forefront of efforts to promote the use of automated systems in all transportation modes—such as positive train separation systems in the railroad industry—that will reduce absolute reliance on operating personnel to ensure safe operations. The Safety Board further acknowledges evidence that, since the opening of the Metrorail system, most accidents and incidents have been caused by human operators rather than by the automated operating system. Nevertheless, the Safety Board believes that total faith in technology, no matter how advanced and sophisticated that technology may be, is inappropriate and that technology should instead be approached with a high degree of informed caution.

WMATA top management did not display that caution; instead it encouraged among Metrorail employees a degree of confidence in the ATC system that was wholly unjustified given the system's built-in limitations (discussed elsewhere in this analysis). Had those officials had less faith in the reliability and inherent safety of the automatic train control system, they may have considered their options more carefully before mandating automatic train operation in all weather conditions. Having done so, they may have become aware of the limitations of the system and may have put procedures in place to accommodate them. In effect, WMATA officials took such steps after the accident when they issued Special Order 96-2 requiring that, in inclement weather, performance levels limiting train speeds to a maximum of 49 mph be entered and confirmed for all Metrorail route segments. If this special order had been issued before the accident and if it had been understood and followed, this accident may not have occurred. The Safety Board concludes that WMATA management failed to fully understand the design features and limitations of the ATC system, which led to unjustified management confidence that the

system could ensure safe train operation under all operating conditions.

Use of Performance Levels to Control Train Speed

Under the November 1995 guidance, degraded braking efficiency in bad weather was to be accommodated solely by lowering performance levels, which would reduce train speeds and shorten braking distances. But the use of performance levels to offset the effects of inclement weather is far from foolproof. The accident train operator overran the Twinbrook station by all four cars, even though he entered the station operating under a performance level 3, picked up at the White Flint station, that had limited his top speed between White Flint and Twinbrook to 44 mph. At Twinbrook, he picked up the most restrictive level of 8, yet he still overran the Rockville station platform by one car.

More significantly, Safety Board tests confirmed that when a train loses the assigned performance level, it can default to the highest—not to the safest—performance level. While a train is servicing a station, it temporarily loses the performance level assigned to it. Once the doors are closed and the train is ready to depart, the performance level is reassigned—but only if the train is within the platform limits. If the train has overrun the station and the lead car is outside the station track circuit, the train will default to the highest performance level, with its top speed limited only by the maximum ATP speed for the next route segment. Even though WMATA officials were aware of this default feature of the ATC system, they nonetheless relied on performance levels to control train speed, and they did not establish a policy for dealing with trains that experienced a default to the highest available speed. By following established policy and directing the operator of train T-111 to service the Rockville station with one car off the platform, the OCC radio controller inadvertently set in motion the series of events leading up to the accident.

52

Maximum Authorized Speed

The MSRPH states that train operators will not operate rail vehicles at a speed higher than the maximum authorized speed. An August 14, 1986, memorandum, subject "Adherence to Regulated Speed," made reference to 59 mph as the maximum authorized speed and directed train operators to notify the OCC should their regulated (ATS) speed ever exceed 59 mph. While this document was the only one that Safety Board investigators were able to identify that specifically referred to 59 mph as the maximum authorized speed, many at Metrorail regarded 59 mph as the maximum allowable speed across the Metrorail system. On probably no other question during this accident investigation, however, did WMATA officials and employees evidence more confusion and provide more contradictory testimony.

The deputy general manager for operations stated his belief that the 59 mph restriction was still in force at the time of the accident and that the OCC controller should have taken immediate action to stop the accident train when the operator reported receiving an ATS speed of 75 mph. He said, “When a train is running at 75, even in dry weather, it indicates there is a problem. So you must bring that train speed back down to the maximum speed allowed, which is 59, or find out what the problem is with the train.”

But Metrorail officials produced no evidence of any documentation or formal instructions that would have told OCC controllers that the general prohibition against manual train operation should be waived if a train received an ATS speed of 75 mph. In fact, the general, though unwritten, guidance was just the opposite, that trains should not be stopped just because they received a regulated speed in excess of 59 mph in automatic mode.

Testimony indicated that, to the extent that 59 mph was considered a maximum speed at all, it was not thought to be a safety issue. The deputy general manager for operations, who said that the controller should have had the train operator stop his train on the night of the accident, stated that the 59 mph speed was

imposed to “save the wear and tear on the equipment.” In other words, it was not intended as a safety measure, which may explain why exceeding 59 mph was not considered an emergency. As shown by the accident, however, maximum design speed could, under adverse weather conditions, quickly become a safety issue in light of the braking rate requirements (discussed below) built into the ATC block design.

The Safety Board concludes that WMATA management, prior to the accident, did not have a well-thought-out, firmly established maximum authorized speed policy that was understood and followed by all operating department employees. Furthermore, WMATA management failed to revisit the issue of maximum authorized speed in the context of its decision to curtail manual train operation on the Metrorail system, which created confusion among those employees, including OCC controllers and train operators, who have primary responsibility for ensuring system safety.

The Safety Board notes that after the accident WMATA issued Special Order 96-2, which specifies a maximum authorized speed of 49 mph during inclement weather. The special order also explicitly spells out the actions that should be taken by both train operators and OCC personnel if a train receives an ATS speed in excess of 49 mph. The Safety Board believes that a similarly explicit special order or other appropriate document should be published regarding the maximum authorized speed that applies in good weather. The Safety Board believes that maximum authorized speeds should be developed and published for each Metrorail route segment and that these published speeds should take into account the physical layout, length, and other significant features of each segment.

Railcar Braking Performance and Design of the ATC System

Postaccident testing revealed no defect or failure in train T-111's braking system or its slip/slide wheel protection feature. Safety Board stopping distance tests conducted with a train

53

that was identical to train T-111 and that was known to have no mechanical defects confirmed that the accident train demonstrated the braking performance that would have been expected given the capability of the equipment, the speed of the train, and the low-adhesion condition of the rails. In most of the Safety Board tests, the test train could not be decelerated from 75 mph to a stop within the 2,822 feet that was available for train T-111 to have made a proper stop at the Shady Grove station platform. Three of the tests resulted in stopping distances that were longer than the 3,422 feet between the brake initiation marker and the location of the gap train, and in one test at 72 mph in automatic mode, the test train did not come to a stop until it had traveled 335 feet past the point of impact.

According to WMATA documents, the design specifications for the H-1 slip/slide control unit called for a minimum braking efficiency of 80 percent of the braking rate that available track adhesion would support at all adhesion levels above 5 percent. For Metrorail cars, the available deceleration rate at 5 percent adhesion is 1.1 mph/sec. To meet the specifications, then, the slip/slide control unit must be capable of achieving a minimum deceleration rate of 0.88 mph/sec (80 percent of 1.1 mph/sec) at 5 percent adhesion.

WMATA acceptance test documents confirmed that the slip/slide system in the series 2000 and 3000 cars met the specified 0.88 mph/sec deceleration rate; however, this rate is incompatible with the design assumptions of the Metrorail ATC system. According to documentation provided by WMATA, the Metrorail block design is safe, that is, the design allows sufficient distance for a train to stop without colliding with another train or some other obstacle, so long as the effective brake rate of the train is equal to or greater than 75 percent of the B2 full service brake rate of 2.2 mph/sec. Because the H-1 slip/slide control units cannot always achieve this minimum deceleration rate (1.65 mph/sec at 75 mph), they cannot be expected always to guarantee safe stops. In Safety Board tests conducted during simulated low-adhesion conditions, the test train did not achieve average deceleration rates as

high as 1.65 mph/sec at any test speed above 60 mph. The Safety Board therefore concludes that, under extreme low-adhesion conditions, the deceleration rates provided by the WABCO H-1 slip/slide control unit on Metrorail 3000-series cars and specified in WMATA specifications result in stopping distances that are longer than can be safely accommodated by the ATC block design.

This accident occurred at a terminal station, but a similar accident could occur anywhere on the Metrorail system where conditions make a train deceleration rate of at least 1.65 mph/sec unachievable. If a train, because of an equipment malfunction or other reasons, were to come to a stop on the mainline, the ATC system would give any train following behind appropriate speed commands (including zero speed commands) to allow the train to stop in time avoid a collision. But, as shown by this accident, on outdoor track under extreme weather conditions, the distance required to stop the following train may be significantly longer than the available track. During rush hour, with crowded trains, scores of people could be killed or seriously injured.

WMATA officials told Safety Board investigators that they became aware of the incompatibility between the ATC block design and train braking capability only after the accident when they compared the braking profile of the accident train with the profiles generated during their own slip/slide system tests conducted in November and December 1995. But from the beginning of Metrorail operations, the documented specifications for the slip/slide system called for and allowed a minimum braking capability that was clearly “outside the envelope” of the safety requirements of the ATC block design.

This incompatibility between the braking requirements of the ATC block design on the one hand and the braking capability of certain Metrorail cars in low-adhesion conditions on the other likely existed for most, if not all, of the 20-year history of the Metrorail system. But the problem was masked by WMATA's policy of

54

operating trains manually in inclement weather, a policy that made stopping accuracy a function of the judgment and experience of the train operator rather than a function of the block design. When WMATA severely restricted manual train operation in November 1995, the incompatibility between train stopping capability and ATC block design became a serious safety issue. Unfortunately, a fatal accident occurred before the problem was brought to light and procedures were developed to address it. The Safety Board believes that WMATA should analyze the braking performance of all railcar series in the Metrorail fleet and take the measures necessary to ensure compatibility between that braking performance and the ATC block design.

The ATP subsystem is a vital subsystem of fail-safe design. A train will not operate at a speed greater than the ATP speed. As noted above, however, in adverse weather, ATP speeds can result in train stopping distances that exceed the safety margin built into the ATC block design. WMATA management recognized that some speed adjustments may be necessary during periods of inclement weather, even when operating in automatic mode, and they relied upon the automatic train supervision subsystem to provide those speed reductions. Thus, a non-vital and non-fail-safe subsystem was called upon to provide a safety-critical function. Had it been fail-safe in design, the ATS subsystem would have defaulted to the safest state when train T-111 failed to receive an ATS speed transmission before leaving the Rockville station, and the accident probably would not have occurred.

The Safety Board therefore concludes that WMATA at the time of the accident was using the non-safety-critical ATS subsystem to perform safety-critical functions. The Safety Board is concerned that although WMATA depends heavily on the ATS subsystem to provide safe operation of trains, that system does not comply with basic fail-safe design requirements because when a failure occurs, the system does not always revert to its safest state. The Safety Board believes that WMATA should discontinue the use of the non-vital and non-fail-

safe ATS subsystem to perform safety-critical functions, and make it impossible for trains to default to the current “design” or “limiting” speeds under any circumstances. This may require converting the existing ATS system into a vital system or rewiring ATP circuits to reflect maximum authorized speeds rather than design speeds. If such engineering changes are not technically or economically feasible, then well-documented procedures should be developed that would prevent a repeat of the events that occurred on the night of the accident.

Adherence to Operating Rule-Change Procedures

The November 1995 change in the longstanding operating policy of allowing train operators to switch from automatic to manual mode during inclement weather represented a change to rule 3.85 of the MSRPH:

During inclement weather or when visibility is limited, Class I vehicles shall be operated in Mode 2 level 1 in compliance with Special Order 94-02/Operating Rule 3.21 and shall enter stations at a speed no greater than 25 mph.

The MSRPH outlines three methods that can be used to change an existing rule. The Safety Board reviewed these procedures and believes that they incorporate effective checks and balances to ensure that the MSRPH is properly maintained and updated. As revealed during this investigation, however, WMATA did not follow the rule-change procedures established by the MSRPH when it used a “notice to OCC controllers” to change rule 3.85. To have been in compliance with the MSRPH, this notice should have been issued as a special order or other document appropriate to effect a change in operating rules. The rule change had obvious safety implications, since it put a burden on the ATC system that it had not been designed to assume. Consequently, the WMATA Office of Safety should have been consulted before the change was made, but it was not. The Safety Board concludes that the November 17, 1995, notice instructing OCC controllers that they

55

were not to permit train operators to change from automatic to manual mode constituted a change to MSRPH rule 3.85 and that in issuing the notice, WMATA management failed to comply with its own established formal procedures for making changes to operating rules.

Because existing rule-change procedures were circumvented, the normal checks and balances that should have been in place were absent. Thus, the policy change did not receive the scrutiny from various operational perspectives that may have helped ensure that the decision was well thought out and that all its ramifications were considered. Had all relevant Metrorail operating elements been brought into the decisionmaking and rule-change process, the potential problems with relying on the non-vital ATS subsystem to provide speed control and to ensure safety could have been raised and addressed. The Safety Board believes that WMATA should establish management controls to ensure that changes to Metrorail operating policy are properly evaluated before adoption and that any such changes that may constitute a change in operating rules are made in compliance with formal rule-change procedures and are fully coordinated with all appropriate WMATA branches and divisions.

Gap Train Placement

WMATA management recognized that positioning a gap train on the same track as incoming trains presented an unnecessary risk and had given “verbal” instructions that gap trains were to be placed on the track opposite that of arriving trains. As shown by the January 6 collision, which would not have occurred if the gap train had been located on the adjacent track, these oral instructions were totally inadequate. To the extent that the instructions were known at all to those who were to be governed by them, they were frequently violated. WMATA management apparently failed not only to properly promulgate the policy, but to enforce it. The terminal supervisor on duty the night of the accident stated that other supervisors had mentioned the policy, but that those same supervisors regularly violated it.

That the gap train at Shady Grove was often left on track 2 was widely known; for example, both Red Line controllers on duty at the time of the accident were aware of it, and at least one of them knew from previous experience that the train was not supposed to be there. He did not, however, make any effort to have the train moved. This illustrates the apparent indifference with which WMATA management and employees regarded the policy of gap train placement.

Only after the accident, on February 14, 1996, did WMATA management formalize its gap train placement policy systemwide by ordering, in writing, that gap trains be stored on the track opposite the one normally used for trains arriving from the mainline and that they be positioned as deep as possible in the tail track. The Safety Board concludes that if WMATA management had initially issued written, rather than oral, instructions regarding the safe placement of gap trains and had ensured that this policy was known and followed, the gap train at Shady Grove would probably not have been located where it was on the night of the accident, and the collision would not have occurred.

The Safety Board believes that, because of its safety-critical nature, the February 14, 1996, policy should be formalized and promulgated as an operating rule. Such a rule, if enforced, will directly enhance Metrorail safety by reducing the risk of a collision of the kind experienced in this accident. The Safety Board believes that WMATA should take the measures necessary to inform employees of the new rule and to enforce adherence to it.

Metrorail Reliance on Oral Instructions

As a result of its investigation of a January 1982 Metrorail fatal accident, the Safety Board issued Safety Recommendation R-82-63, which asked that WMATA cease using oral instructions to OCC controllers that modified or amended operating rules and standard operating procedures. WMATA responded that it had told OCC personnel that they would not be given oral instructions that modified operating rules or

56

standard operating procedures but would instead be governed by the book of rules until the rules were changed by a written revision of the rule book or by special order. On the basis of this response, the Safety Board classified this recommendation “Closed--Acceptable Action.”

Evidence gathered from this accident investigation indicates that the procedures spelled out in WMATA's response to Safety Recommendation R-82-63 are no longer being followed. As noted above, WMATA management in November 1995 changed the rule regarding manual train operation in inclement weather with a notice to OCC personnel. This notice did not meet the definition either of a written revision of the rule book or a special order. Furthermore, as is clear from this accident, Metrorail is still relying on oral instructions, if not within the OCC, then certainly among other Metrorail employees and supervisors.

For example, the instructions regarding placement of the gap train at the Shady Grove yard were oral instructions. Because they were not written down and properly disseminated, these instructions did not reach everyone who had responsibility for carrying them out; to the extent that they did reach employees, they were not given a great deal of weight. Even the important November 17, 1995, notice prohibiting routine manual train operation began as an oral instruction from the general superintendent for rail transportation, who stated that he did not recall asking the OCC supervisor to put the new guidance in writing. Metrorail management apparently considered oral instructions to be perfectly adequate, even when those instructions involved a policy change that actually constituted a change to an operating rule.

The Safety Board concludes that WMATA management relies too heavily on oral instructions to convey operations and safety information to its managers, supervisors, and employees. The Safety Board believes that WMATA should develop clear guidelines and formats for the written dissemination of information and should completely eliminate the

practice of conveying important information orally.

An over-reliance on oral instructions was not the only deficiency the Safety Board noted in Metrorail procedures for disseminating information. WMATA managers told Safety Board investigators that Metrorail had no formal procedures to ensure that train operators, terminal supervisors, OCC supervisors and controllers, or other operating personnel actually received memoranda or notices meant for them. The Safety Board is concerned that the Metrorail practice of posting memoranda or notices on bulletin boards or placing them in mailboxes gives no assurance that employees will actually receive the information, and it leaves no documentary record that employees have read and understood important safety-related guidance.

By requiring employees to sign for safety-sensitive written bulletins, special orders, memoranda, or notices, WMATA could be assured that employees have received those documents. The Safety Board therefore believes that WMATA should develop and implement procedures to ensure that Metrorail operations personnel receive all bulletins, special orders, memoranda, or notices related to their responsibilities. These procedures should include a mechanism by which these personnel must sign or initial a document to signify that they have received, read, and understood any guidance intended for them.

WMATA Management, Decisionmaking, and Communication

As noted above, this investigation determined that when WMATA top management made the decision to require exclusive automatic train operation, it overlooked or failed to consider all the ramifications of the decision. It was further determined that while the OCC responded effectively to train scheduling problems and otherwise followed basic system operating instructions, OCC personnel relied heavily on system automation to ensure safe train operation. The investigation also determined

57

that important information was often not communicated effectively between and among operating departments and employees and that several key operating rules were not enforced or even understood by management or operating personnel. Thus, the Safety Board concludes that WMATA management and its board of directors, at the time of this accident, was not providing adequate direction to ensure safety on the Metrorail system.

The investigation revealed that many, if not most, important Metrorail policies and operating procedures were derived from rigid, top-down, highly centralized management processes. Apparently, many important decisions emanated from the deputy general manager for operations and were dutifully, and generally without question, carried out by senior and middle-level managers. This was apparently the case with the decision to require exclusive automatic train operation. Metrorail engineering personnel had access to information regarding the incompatibility between the ATC block design and the stopping profile of trains in inclement weather, but this information was not sought out or considered during the decisionmaking process. In fact, before the accident, the decision to require exclusive automatic train operation was known only to senior management and OCC personnel. That decision, with its defects, thus went into effect without the knowledge of train operators or key individuals in the safety, training, or engineering departments who could have pointed out its shortcomings. The inflexibility of this highly centralized structure also explains the adherence of OCC controllers to the exclusive automatic train operation decision after train overruns began occurring on the night of the accident.

The Safety Board found WMATA management policies and methods to be inconsistent with the needs of a technically complex automated rail system. Systematic analyses of organizational processes reveal that managers operating highly automated systems must successfully contend with unique demands presented by the automation itself. One fundamental requirement for managing automated systems is to contend effectively with

“tight coupling” between different operating elements in the system.$^{33}$ That is, in organizations operating highly technical automated systems, decisions that affect one activity in the organization will probably affect other activities and will sometimes produce unanticipated hazards.

High-technology organizations must also be capable of both centralized and decentralized control. $^{34}$ Operating activities need to be controlled within “tightly prescribed steps and invariant sequences,” thereby ensuring that actions suitable in one circumstance or departmental area do not conflict with other activities in the system. At the same time, operating personnel occasionally have to be able to take “independent and sometimes...creative actions” in order to prevent the development of unsafe conditions.$^{35}$ Finally, high-technology organizations must have safeguards to prevent unsafe conditions that may result when the automation compensates temporarily for deficient operation and then fails to protect the system when unforeseen factors combine and breach the system’s safeguards. This condition poses the greatest threat to the safety of a complex system and must be addressed in well-conceived system planning.$^{36}$

Given the extent to which WMATA executive management was found to depart from these essential organizational characteristics, it is not surprising that flawed decisions, inadequate or ambiguous train control procedures, and poorly understood or unenforced rules had proliferated. The Safety Board believes that effective management of a high-technology system such as Metrorail requires skilled and informed decisionmaking,

58

unambiguous operating procedures that can be expected realistically to safeguard the system from all hazardous contingencies, and timely, open access to information for all operating personnel. WMATA executive management apparently did not comprehend that these organizational processes are essential for managing the technology of the system, and they therefore failed to provide adequate policies and procedures to ensure safe train operation.

OCC Controller Training

The Safety Board determined that WMATA did not have a recurrent formal training program for OCC controllers. While controllers were required to pass an annual rules test, they were not provided with any review or other preparation for taking the test. Additionally, WMATA had no program to ensure that controllers remained familiar with the physical characteristics of the route segments over which they had responsibility. The Safety Board is concerned that without recurrent training on operating rules, safety instructions, policies, and diagnostic procedures, physical characteristics of the Metrorail system, and emergency notification procedures, OCC controllers are not properly prepared to carry out their safety-critical function. The Safety Board concludes that, as demonstrated by this accident, the training given to OCC controllers by WMATA before the accident was inadequate to prepare them to safely manage and control the highly automated Metrorail system. The Safety Board notes that after this accident, WMATA established a training program for OCC controllers. The Safety Board believes that this training effort should form the basis for a comprehensive, recurrent training and qualification program for OCC controllers that includes, at a minimum, instruction and testing on WMATA rules, policies, and procedures; emergency preparedness and notification; Metrorail signal and control systems; and the physical characteristics of the Metrorail system. This program should be formalized as a permanent element of OCC operations and should be monitored and updated on an ongoing

basis to ensure that it continues to meet the requirements of the evolving Metrorail system.

Performance of Controllers and Train Operator

The OCC Environment -- Two highly experienced controllers were assigned to the Red Line at the time of the accident, and their activities were directly supervised by the OCC superintendent. The controllers and the OCC superintendent were familiar with train operations in inclement weather. There was no evidence of poor communication among the controllers and the OCC superintendent, and the controllers had been working together for several months and were familiar with each other's work patterns.

The Safety Board considered the possible effects on OCC performance of the increased workload demands and the distractions caused by the developing snow storm. The OCC was responsible for obtaining shelter for overnight storage for trains in addition to providing rail system operating control. At the same time, train operators were reporting overruns, and the controllers were adjusting performance levels at various locations. Nonetheless, the nature and pace of recorded communications indicate that neither the controllers nor the OCC superintendent were unduly distracted by the increased workload, nor did they seem to be preoccupied with any single ongoing problem between the time they began their shift and the time the accident occurred.

The Safety Board is concerned that OCC personnel did not see the accident developing as soon as train T-111 was directed to service the Rockville station. The Red Line radio controller knew that when trains overrun station platforms and then service those stations, they often lose the correct performance level and default to the highest available speed as they leave the overrun station. Yet, transcriptions from OCC overhead microphones indicate that even when the controllers were made aware that train T-111 had received an ATS speed of 75 mph, they had no conversations between themselves or with

59

their superiors to the effect that allowing the train to continue operating in automatic mode could have serious consequences. This lack of expressed concern is particularly troublesome in that the following information was known or knowable to the Red Line controllers and the OCC superintendent:

· Train T-111, as well as other trains, had overrun stations even while operating under reduced performance levels, indicating that the stopping capabilities of the trains were unpredictable;

· A severe snow storm was moving into the area, and track conditions were worsening rapidly;

● Train T-111 was reporting a speed that was significantly higher than normal and higher than the speed the train was traveling before it overran the previous two passenger stations; and

· The track on which train T-111 was operating into the Shady Grove station was occupied by another train approximately 1 1/2 train lengths past the station.

According to testimony by controllers and the OCC supervisor, WMATA management had made it clear that a train's receipt of an ATS speed of 75 did not, in and of itself, qualify as an emergency. As noted above, however, this emergency was not created by the excess speed but by a confluence of circumstances, of which excessive speed was only one, albeit an important one. Had OCC personnel been trained to anticipate all reasonable contingencies and authorized to actively control Metrorail operations rather than simply to respond to events and follow instructions, they would have recognized immediately that train T-111 was facing a hazardous situation that demanded prompt action. They may not then have relied on general operating policies, or even on their supervisors, to tell them what to do, but instead may have taken the decisive action necessary to break a link in the chain of events that led to the

accident. The most obvious action would have been to stop the train. If the OCC had instructed the operator of train T-111 to bring his train to a stop and change to manual operation as soon as the operator reported regulated and limiting speeds of 75 mph, the accident may not have occurred.

Testimony indicated that Red Line controllers had, in the half hour preceding the accident, asked for and been denied permission to permit train operators to change to manual mode. These requests came after trains had reported overrunning stations because of slippery rails. But the controllers did not make this request specifically with respect to train T-111, even though that train presented them with a safety hazard that was far more serious and more immediate than any they had faced since their shift began. The controllers apparently were not able to diagnose the problem as one that required more than adherence to standard operating procedures. Perhaps more disturbingly, evidence suggests that if they had, in fact, diagnosed the full extent of the problem, they would have been prevented from taking the proper action because no authorized procedures had been developed, and the rigid management controls within the OCC and WMATA required certain decisions to be approved by executive management. The Safety Board therefore concludes that OCC controllers, and, to a degree, their immediate supervisors, had responsibility for day-to-day train operations, but they lacked the authority and the systematic procedures necessary to effectively carry out that responsibility.

In the view of the Safety Board, such conditions are not consistent with the requirements of an effective central control operation. These requirements include the ability to diagnose conditions and anticipate contingencies that present operating hazards and the authority of controllers to take remedial actions according to established procedures. The Safety Board concludes that the deficient performance of the OCC on the night of the accident resulted from top-level WMATA management policies and decisions in that Metrorail management did not create an

60

environment in which OCC controllers were encouraged to use their own experience, knowledge, and judgment to make decisions involving the safety of Metrorail operations. The Safety Board believes that WMATA should develop and implement procedures for OCC controllers that provide for active monitoring of both the automated control system and of revenue train operation, that permit standardized interventions at the onset of recognition of potential automated system failures as well as direct hazards to individual trains, and that include unambiguous, clear guidelines for recognizing emergency operating situations requiring the stopping of trains.

Train Operator's Actions During the Accident Sequence — Under rule 3.1 of the MSRPH, the train operator clearly had the authority, if not the obligation, to stop his train if he perceived the train and its passengers to be in danger, regardless of the instructions from the OCC. It is not at all clear, however, that the operator fully recognized the extent of the hazard. He had been a train operator for only a little more than 2 months and, because of speed restrictions normally in place throughout the system, he probably had never before operated a train at a speed greater than about 60 mph. He almost certainly had never operated a train in weather conditions such as those experienced on the night of the accident, and he thus would have been unaware of the braking capabilities of his train under those conditions.

In accordance with his training, the train operator immediately reported his abnormally high ATS speed readout, and the controller did not suggest to the train operator that his situation was in any way perilous, instructing him instead to remain in automatic mode. This may have given the train operator a false sense of security and led him to believe that no action on his part was required. The train operator had no way of knowing that OCC controllers were operating under strict orders not to authorize a change to manual mode, because the November 17 notice conveying these orders went only to OCC personnel, not to train operators. The November 20 memorandum addressing automatic versus manual operation did go to

train operators, but that memorandum merely restated the existing operating rule, which was that no train operator could change to manual mode without OCC permission. The November 20 memorandum was blatantly misleading because it implied that no alteration had been made in the policy regarding changing from automatic to manual mode when, in fact, because of the November 17 notice, requests for such a change would almost always (except for undefined “emergency situations”) be denied.

Had the train operator wanted simply to slow his train without changing into manual mode, he would not have been able to do so; his only two options to reduce his speed were to initiate an ATO stop or an emergency stop—either of which would have been in direct violation of OCC instructions. Again, because of his limited experience as a train operator, he may have been reluctant to violate OCC instructions, even if he did have some uncertainty about the safety of his train.

The Safety Board examined the question of whether the train operator at any point used the mushroom button to attempt an emergency stop. Although the button was found in the depressed position, it could have been pushed down as a result of the collision. No wheel flats were found on the train, and no significant marks were present on the rails or on the wheels that would have provided conclusive evidence that the train had slid along the rails with the wheels locked. This would seem to indicate either that that mushroom button was not depressed by the operator before impact, or that it was depressed too late to have had any effect.

Track conditions on the night of the accident, however, were unusual. The rails were cold and possibly ice-covered; the deceleration rate exhibited by the accident train indicated that available rail adhesion was extremely low. Even if the train operator had used the bathroom button at some point before passing through the Shady Grove station, the amount of friction between the cold wheels and the cold and icy rails may have been insufficient either to slow the train appreciably or to generate the heat necessary to produce skid marks. The Safety

61

Board therefore concludes that the evidence is insufficient to indicate whether the train operator activated the emergency stop button before impact, but if he did activate emergency braking, he did so too late to avoid the collision. The Safety Board further concludes that the accident train operator acted in accordance with his limited experience when he followed OCC instructions and did not undertake unilateral and exceptional action to stop his train.

Train Operator's Use of Prescription Medications – A prescription vial containing Tylenol 3 was found among the train operator's belongings. Postaccident toxicological tests of the operator revealed the presence of codeine (and its metabolite), an analgesic and ingredient in Tylenol 3, in sufficient quantity to indicate a therapeutic use of the medication. The tests also detected four ingredients commonly found combined in over-the-counter cold medications.

Because the train operator's actions from the time he overran the Twinbrook station until the time of the accident were timely and appropriate and did not indicate any sign of impairment, the Safety Board concludes that he probably did not suffer any of the possible side effects associated with the use of Tylenol 3. He apparently had used the medication for several months and had knowledge of how it affected his performance. Nonetheless, the Physicians' Desk Reference$^{37}$ advises that patients using the medication be given the warning that "codeine may impair the mental and/or physical abilities required for the performance of potentially hazardous tasks such as driving a car or operating machinery."

The Safety Board cautions against persons in safety-critical jobs taking a medication with codeine and is concerned that the WMATA medical office permitted the train operator to use Tylenol 3 while on duty, albeit in substantially reduced dosages. The Safety Board believes that when transportation employees take such medications, even in moderate

dosages to control discomfort, they should not be permitted to perform safety-critical tasks unless there is clear evidence that the medication will not adversely affect their performance. The train operator's medical records contained no documentation of this precaution, nor did they contain a warning of possible side effects or possible interactions with other medications.

The medical office advice to the train operator to use Tylenol 3 cautiously at the time he was working as a station manager suggests that WMATA appreciates the potential hazards associated with use by employees of this commonly prescribed pain medication, which contains codeine, while they are at work. However, the fact that there was no evidence that the medical office followed up on its advice after the train operator transferred to rail service suggests that more needs to be done. In fact, this investigation revealed that WMATA did not have an education program for employees in safety-critical positions that dealt with the use and effects of medications. The Safety Board believes that WMATA should establish and administer a comprehensive educational program to alert employees to the potential adverse effects on performance that may arise from the use of prescribed and over-the-counter medications. The program should stress the importance of seeking informed medical approval for use of all medications and remedies and should document the responses to medications of employees who work in safety-critical positions.

As a result of its investigation of a 1991 National Railroad Passenger Corporation (Amtrak) derailment in Palatka, Florida,$^{38}$ the Safety Board made the following safety recommendation to Amtrak:

R-93-17

Develop and implement an educational program for employees that describes and

62

illustrates potential consequences of medication use to enable employees to make an informed decision about the relationship between their use of prescribed and over-the-counter medications and their fitness for duty.

In a March 16, 1995, letter, Amtrak stated that it had completed and deployed, as part of its annual rules training program for locomotive engineers, a discussion on the use of prescription and over-the-counter medications. Amtrak also stated that it had developed an information guide (appendix I) that was distributed to all locomotive engineers and that formed the basis for a group discussion. Based on this response, the Safety Board classified Safety Recommendation R-93-17 "Closed--Acceptable Alternate Action" on May 25, 1995. The information developed by Amtrak in response to this recommendation may be useful to guide WMATA's development of printed materials in support of its education program.

Event Recorders

No highly automated rapid transit system in the United States equips its trains with devices that monitor and record all vital train systems and system events; this despite the fact that the data provided by such devices could help those agencies enhance the efficiency and cost-effectiveness of their operations by providing engineering, signal, maintenance, operations, and training departments with vital information about the way their systems and their operators are performing. Such data can also be invaluable in the event of an accident. Because train T-111 was not equipped with an event monitor/recorder, Safety Board investigators had to gather, interpret, and interpolate information from a number of sources before they could reconstruct the accident sequence and evaluate the electronic, mechanical, and human performance factors that led to the collision. Although the lack of an event recorder did not affect the outcome of this investigation, the Safety Board believes that the absence of event monitors/recorders on rapid transit trains

represents a potentially serious obstacle to investigators attempting to determine the cause of accidents on rail systems responsible for moving millions of passengers daily.

The Safety Board acknowledges WMATA's efforts to foster development of advanced-technology carborne monitors and to facilitate their eventual installation on Metrorail cars. The Safety Board is concerned, however, that this process has been underway for 14 years and that Metrorail trains still are not equipped with carborne recorders/monitors that capture even a minimal amount of information. Had Metrorail cars been so equipped, WMATA management may have been able to precisely pinpoint the cause of the increase in wheel flats that led to the November 1995 policy change, and perhaps that change would not have been made. In view of this, the Safety Board believes that WMATA should finalize the specifications for a new advanced-technology carborne monitoring system and, once that is complete, retrofit existing Metrorail cars with the monitors/recorders during rehabilitation and require that all new Metrorail cars be equipped with the devices.

The Safety Board further believes that the Federal Transit Administration, with the assistance of APTA, should develop guidelines for monitoring/recording devices that capture critical performance and event data for rapid rail transit cars and urge transit agencies to install these devices on new and rehabilitated cars.

Emergency Response

Three Metrorail employees who were on duty at the Shady Grove passenger station at the time of the collision were the first to reach the accident scene; two of them arrived within 1 to 2 minutes of the collision. Volunteer and full-time firefighters of the Montgomery County Department of Fire and Rescue Services were notified by WMATA of the accident approximately 4 minutes after the collision and were on the scene within 9 minutes of the accident.

The statement by the physician passenger that no one made any attempt to communicate

63

with him or his fellow passenger immediately after the accident conflicts with the statements of two of the Metrorail employees who were the first to arrive on the scene. If the statements of the two Metrorail employees are accurate, then the physician and his fellow passenger had two conversations with Metrorail personnel before the physician passenger became concerned and attempted to attract the attention of rescue personnel by pounding on the train window. The testimony of the gap train operator was corroborated by the yard tower radio tapes, which confirm that within 9 minutes of the collision he had become aware of the presence of the two uninjured passengers. The inability of the physician passenger to remember his conversations with Metrorail personnel can possibly be explained by the fact that those conversations took place within minutes of the passenger's having experienced a traumatic event that included his being thrown into the bulkhead.

Passenger evacuation and firefighters' efforts to search the lead car of train T-111 for passengers were delayed because the third rail was not deenergized immediately after the accident. The fact that a portion of the energized third rail lay in the interlocking posed special problems for firefighters because they had no schematic diagrams of the third-rail circuit. Sections of third rail that lie within interlockings have gaps that make it difficult to determine visually how the sections of third rail are interconnected. In this case, firefighters had difficulty judging how many WSADs were needed and how they should be placed. The Safety Board concludes that third-rail schematics would have aided firefighters in the placement of their WSADs and would have helped ensure safe movement of rescue personnel throughout the accident area. The Safety Board therefore believes that WMATA should develop a mechanism to provide emergency rescue personnel responding to an accident anywhere on the Metrorail system with easily accessible information about third-rail circuitry. Such a mechanism could include or consist of posting schematics or third-rail circuit

diagrams on all blue light boxes and fences adjacent to interlockings.

When Montgomery County rescue personnel arrived on the scene, they were equipped with only one WSAD. Although two more WSADs arrived sometime later, because this accident occurred near an interlocking, a minimum of four WSADs would have been required, one on each independently controlled section of third rail, to ensure that rescue personnel would have been warned of third-rail reenergization in the accident area. The Safety Board therefore concludes that the number of WSADs that was delivered to the accident site was insufficient to fully protect emergency rescue personnel working in the vicinity of the interlocking. Because of the large number of interlockings throughout the Metrorail system, the Safety Board believes that all emergency response stations with primary responsibility for responding to Metrorail accidents should be equipped with an adequate number of WSADs or similar devices to monitor third-rail power in an accident location that encompasses one or more interlockings. The Safety Board believes that WMATA should work with these agencies to procure an adequate number of these protective devices and ensure that they are properly distributed among emergency rescue stations that may be called upon to respond to a Metrorail accident.

Firefighters and their commanders at the scene did not attempt to establish a direct communications link with the OCC to determine the status of the third rail, even though their own standard operating procedure states that this is to be done. Instead, firefighters communicated with Metrorrail personnel at the scene, who relayed these communications to the yard tower or to the OCC by radio. This created confusion; for example, Metrorrail personnel at the scene called the tower on several occasions and asked that the third rail in the accident area be deenergized. They were apparently not aware that third-rail power in the area where the accident occurred is controlled by the OCC and not by the yard tower.

64

The Safety Board concludes that the failure of the rescue commander at the accident scene to immediately establish a direct command link with the OCC caused miscommunications and delays in deenergizing the third rail that unnecessarily put firefighters at risk. The Safety Board believes that WMATA and the emergency rescue services of all the jurisdictions served by Metrorail should undertake more frequent joint command and control exercises with the explicit goal of ensuring that a proper command and communication structure is established quickly between the OCC and responsible rescue commanders. The Safety Board further believes that the Montgomery County Fire and Rescue Commission should review its standard operating procedures and revise the procedures or the training program as necessary to address the failure of rescue commanders on the scene of this accident to establish an immediate and direct communications link with the Metrorail OCC.

Immediately after the accident, the OCC Red Line button controller attempted repeatedly to deenergize that section of third rail in the accident area that could be controlled remotely from the OCC. These attempts failed when circuit breaker 33 did not respond to trip commands from the Red Line command console. Safety Board investigators were unable to test the nonresponsive breaker because WMATA officials provided incorrect information about its postaccident disposition. Although WMATA personnel have reported no problems remotely tripping the circuit breaker that since the accident has been designated breaker 33, they have been unable to determine why the circuit breaker at that location on the night of the accident could not be tripped from the Red Line console. This was not a unique incident; WMATA engineers told Safety Board investigators that various circuit breakers have failed to respond to remote trip commands before and that the source of the problem has never been identified. Because this could have a direct bearing on passenger safety, the Safety Board believes that WMATA should frequently test all Metrorail third-rail circuit breakers and

that such tests should include the capability of OCC personnel to trip the circuit breakers remotely. The source of any failures should be identified and corrected.

As soon as it became obvious that the circuit breaker could not be tripped from the OCC, an OCC controller or other OCC official could have directed Metrorail or rescue personnel at the accident scene to bring down third-rail power locally by using a nearby emergency trip switch. Instead, WMATA management decided to leave this section of third rail energized in order to accommodate trains en route into the Shady Grove station. Safety Recommendation R-82-17, made by the Safety Board to WMATA after a fatal Metrorail accident in 1982, asked WMATA to amend its OCC operating procedures to “require that, whenever a train emergency which requires evacuation is known to exist at a location between stations, all third-rail power circuits between the emergency location and the stations on each side of that location be deenergized as soon as all other trains have cleared the area.” Based on WMATA’s response that procedures were established to remove third-rail power from an affected area before passengers were permitted on the track bed, this recommendation was classified “Closed--Acceptable Action.” It appears that the procedures established by WMATA in response to this safety recommendation were either inadequate or were simply not followed after this accident.

A WMATA official defended the decision to leave the third rail energized by saying that it was WMATA policy not to strand trains between stations. However, when the accident occurred, there were no trains receiving power from this section of third rail, and the next train into Shady Grove, train T-112, did not leave the Rockville station until 10:45:35, which was some 7 minutes after the accident occurred, 5 minutes after the OCC was notified of the accident, and 2 minutes after the OCC controller had tried unsuccessfully to trip the circuit breakers. The appropriate response by OCC personnel would have been to hold train T-112 at Rockville until the full extent of the accident could be known. Even after the OCC became

65

aware that passengers, an injured train operator, and firefighters were at the accident scene, the OCC controller permitted two more trains to proceed into the Shady Grove station.

The decision to leave the third rail energized delayed passenger egress from the train and the search of the lead car of train T-111. The Safety Board therefore concludes that WMATA acted improperly when it did not halt train traffic into Shady Grove and turn off third-rail power in the accident area immediately after the OCC was notified of the collision. The Safety Board believes that WMATA should amend its standard operating procedures to require that OCC personnel divert all train traffic from an accident location as soon as possible after the accident and deenergize the third-rail circuits in the area of the emergency, including those on adjacent tracks, as soon as trains have left the vicinity.

Crashworthiness of Metrorail Cars

Even though both train T-111 and the gap train consisted of Breda 3000-series railcars, car 3252, the lead car of train T-111, sustained damage that was vastly disproportionate to that sustained by the lead car of the gap train.

When car 3252 struck the gap train, the attachments and fasteners securing its end underframe assembly to the side sills failed, and the side sills moved outward. On car 3191 (the lead car of the gap train), the end underframe assembly remained attached (at least partially) to the side sills, which allowed the structure of car 3191 to transmit inertial forces to the end underframe of car 3252 that were greater than it received. As a result, the body and some detached sections of the underframe of car 3252 continued forward after the initial impact. This forward motion, combined with the outward movement of the side sills, allowed the body shell of car 3252 to telescope outside the body of car 3191. As the collision progressed, the end underframe of 3252 began to act as a steel bumper for car 3191, buckling the floor of car 3252 and causing the remaining components of the car's underframe to fail. By the time car 3252 came to rest, it had telescopesed

approximately 21 feet over the body of 3191, and its occupant volume had been severely compromised.

The compromised passenger space in car 3252 is a serious safety concern. This accident occurred on a weekend evening when the accident train was carrying only two passengers in the rear of the train, but it could have happened during a weekday rush hour to a train carrying hundreds of commuters. Many of those passengers who would have been occupying the front portion of the first car would probably have received fatal injuries, and scores more throughout the train could have been injured seriously. The Safety Board concludes that the design of Metrorail cars may make them susceptible to telescoping in collisions that involve a failure of the attachments securing the end underframe to the side sills.

The Safety Board believes that WMATA should undertake, with the assistance of qualified engineering support, a comprehensive evaluation of the design and design specifications of all series of Metrorail cars with respect to resisting carbody telescoping and providing better passenger protection, and that it should make the necessary modifications, such as incorporating underframe bracing or similar features, to improve the crashworthiness of cars in the current and/or future Metrorail fleet.

Station/Platform Overruns on the

Metrorail System

The highly computerized Metrorail ATC system is designed to bring trains to a stop at the appropriate station marker. Nonetheless, Metrorail experiences an average of 400 to 450 station or platform overruns each year. The Safety Board is concerned that this large number of station overruns indicates the presence of an uncorrected deficiency in that part of the Metrorail ATC system that is designed to detect a train's location in relation to a station platform. Metrorail officials have stated that they consider overruns of the type normally experienced on the Metrorail system to be a service issue (an inconvenience to passengers) rather than a safety issue. This could explain

66

Metrorail management's failure to conduct a detailed analysis of the overruns so that the underlying deficiency or deficiencies can be corrected. As shown by this accident, however, under certain circumstances a platform overrun of only one car can have serious safety implications. The Safety Board concludes that because WMATA management has not viewed station overruns as a potential

safety issue, it has not taken the adequate steps to identify and eliminate the cause of the 400 to 450 station or platform overruns experienced on the Metrorail system each year. The Safety Board believes that WMATA should conduct a detailed investigation and analysis to determine the cause of the overruns and should take the measures necessary to improve station stopping accuracy.

CONCLUSIONS

1. Neither fatigue nor track and signal operations were causal or contributing factors in this accident.

1. The Washington Metropolitan Area Transit Authority (WMATA) decision to completely and suddenly replace its policy of intermittent routine manual train operation with an essentially untested policy of full-time automatic train operation was a hasty decision based on insufficient information.

1. WMATA, before making the decision to eliminate manual train operation on the Metrorail system, failed to consider the continuing need for train operators to maintain proficiency in manual train operation.

1. Metrorail management failed to fully understand the design features and limitations of the automatic train control system, which led to unjustified management confidence that the system could ensure safe train operation under all operating conditions.

1. WMATA management, prior to the accident, did not have a well-thought-out, firmly established maximum authorized speed policy that was understood and followed by all operating department employees.

1. Under extreme low-adhesion conditions, the deceleration rates provided by the Westinghouse Air Brake Company H-1 slip/slide control unit on Metrorail 3000-series cars and specified in WMATA specifications result in stopping distances that are longer than can be safely accommodated by the automatic train control block design.

1. WMATA at the time of the accident was using the non-safety-critical automatic train supervision subsystem to perform safety-critical functions.

1. The November 17, 1995, notice instructing Operations Control Center controllers that they were not to permit train operators to change from automatic to manual mode constituted a change to Metrorail Safety Rules and Procedures Handbook rule 3.85, and in issuing the notice, WMATA management failed to comply with its own established formal procedures for making changes to operating rules.

1. If WMATA management had initially issued written, rather than oral, instructions regarding the safe placement of gap trains and had ensured that this policy was known and followed, the gap train at Shady Grove would probably not have been located where it was on the night of the accident, and the collision would not have occurred.

1. WMATA management relies too heavily on oral instructions to convey operations and safety information to its managers, supervisors, and employees.

1. WMATA management and its board of directors, at the time of this accident, was not providing adequate direction to ensure safety on the Metrorail system.

1. As demonstrated by this accident, the training given to Operations Control Center controllers by WMATA prior to the accident was inadequate to prepare them to safely manage and control the highly automated Metrorail system.

1. Operations Control Center controllers, and, to a degree, their immediate supervisors, had responsibility for day-to-day train operations, but they lacked the authority and the systematic procedures necessary to effectively carry out that responsibility.

1. The deficient performance of the Operations Control Center on the night of the accident resulted from top-level WMATA management policies and decisions in that Metrorail management did not create an

68

environment in which controllers were encouraged to use their own experience, knowledge, and judgment to make decisions involving the safety of Metrorail operations.

1. The evidence is insufficient to indicate whether the train operator activated the emergency stop button before impact, but if he did activate emergency braking, he did so too late to avoid the collision.

1. The accident train operator acted in accordance with his limited experience when he followed Operations Control Center instructions and did not undertake unilateral and exceptional action to stop his train.

1. The train operator probably did not suffer any of the possible side effects associated with the use of Tylenol 3.

1. Third-rail schematics would have aided firefighters in the placement of their warning strobe and alarm devices and would have helped ensure safe movement of rescue personnel throughout the accident area.

1. The number of warning strobe and alarm devices that was delivered to the accident

site was insufficient to fully protect emergency rescue personnel working in the vicinity of the interlocking.

1. The failure of the rescue commander at the accident scene to immediately establish a direct command link with the Operations Control Center caused miscommunications and delays in deenergizing the third rail that unnecessarily put firefighters at risk.

1. WMATA acted improperly when it did not halt train traffic into Shady Grove and turn off third-rail power in the accident area immediately after the Operations Control Center was notified of the collision.

1. The design of Metrorail cars may make them susceptible to telescoping in collisions that involve a failure of the attachments securing the end underframe to the side sills.

1. Because WMATA management has not viewed station overruns as a potential safety issue, it has not taken the adequate steps to identify and eliminate the cause of the 400 to 450 station or platform overruns experienced each year on the Metrorail system.

PROBABLE CAUSE

The Safety Board determines that the probable cause of this accident was the failure of Washington Metropolitan Area Transit Authority management and board of directors (1) to fully understand and address the design features and incompatibilities of the automatic train control system before establishing automatic train operation as the standard operating mode at all times and in all weather conditions, (2) to permit operating department employees, particularly Operations

Control Center controllers and supervisors, to use their own experience, knowledge, and judgment to make decisions involving the safety of Metrorail operations, and (3) to effectively promulgate and enforce a prohibition against placing standby trains at terminal stations on the same track as incoming trains. Contributing to the severity of the injuries to the train operator was the鿕proportionate amount of crush sustained by the lead cars of the colliding trains.

RECOMMENDATIONS

As a result of its investigation of this accident, the National Transportation Safety Board makes the following recommendations:

To the Washington Metropolitan Area

Transit Authority:

Analyze the braking performance under low-adhesion conditions of all railcar series in the Metrorail fleet. Take the measures necessary to ensure compatibility between the cars' braking performance and the automatic train control system block design. (R-96-26)

Discontinue the use of the non-vital and non-fail-safe automatic train supervision (ATS) subsystem to perform safety-critical functions, and make it impossible for trains to default to a higher speed when a lower speed is required to ensure safe operation. (R-96-27)

Establish management controls to ensure that changes to Metrorail operating policy are properly evaluated before adoption and that any such changes that may constitute a change in operating rules are (1) made in compliance with formal rule-change procedures, and (2) fully coordinated with all appropriate Washington Metropolitan Area Transit Authority technical and administrative branches and divisions. (R-96-28)

Establish, document, and enforce a maximum authorized speed for every route segment on the Metrorail system. Ensure that these speeds are made known to all Metrorail personnel who hold safety-sensitive positions. (R-96-29)

Develop a formal operating rule that governs the placement of standby gap trains at Metrorail terminals or other locations. This rule should clearly state

that gap trains will not be stored on the inbound track. (R-96-30)

Develop and implement a formal, comprehensive, recurrent training and qualification program for Operations Control Center controllers that includes, at a minimum, decisionmaking, instruction and testing on Washington Metropolitan Area Transit Authority rules, policies, operational procedures, emergency procedures, emergency preparedness and notification (including the minimum information to be provided to emergency dispatchers); Metrorail signal and control systems; and the physical characteristics of the Metrorail system, to include requirements that controllers be qualified on the physical characteristics of the route segments for which they are responsible. (R-96-31)

Develop and implement procedures for Operations Control Center controllers that (1) provide for active monitoring of both the automated control system and revenue train operation, (2) permit standardized interventions at the onset of recognition of potential automated system failures as well as direct hazards to individual trains, and (3) include unambiguous, clear guidelines for recognizing emergency operating situations requiring the stopping of trains. (R-96-32)

Discontinue the practice of using oral instructions to convey standard operating procedures or to notify Metrorail personnel of new or revised rules, policies, or operating practices. (R-96-33)

Develop and implement procedures to ensure that Metrorail operations personnel receive all bulletins, special orders, memoranda, or notices related to their responsibilities. These procedures

71

should include a mechanism by which these personnel must sign or initial a document to signify that they have received, read, and understood any guidance intended for them. (R-96-34)

Implement policies and procedures that provide a means for train operators to develop and maintain proficiency in manual train operation. (R-96-35)

Conduct a detailed investigation and analysis to determine the cause of the approximately 400 station or platform overruns experienced across the Metrorail system each year, and take the measures necessary to improve train stopping accuracy and to eliminate station overruns. (R-96-36)

Undertake, with the assistance of qualified engineering support, a comprehensive evaluation of the design and design specifications of all series of Metrorail cars with respect to resisting carboxy telescoping and providing better passenger protection, and make the necessary modifications, such as incorporating underframe bracing or similar features, to improve the crash-worthiness of cars in the current and/or future Metrorail fleet. (R-96-37)

Establish and administer a comprehensive educational program to alert employees to the potential adverse effects on performance that may arise from the use of prescribed and over-the-counter medications. (R-96-38)

Finalize the specifications for a new advanced-technology carborne monitoring system and, once that is complete, retrofit existing Metrorail cars with the monitors/recorders during rehabilitation and require that all new Metrorail cars be equipped with the devices. (R-96-39)

Coordinate with emergency service providers in all jurisdictions served by the Metrorail system to determine what information should be provided during an initial emergency notification, and amend the Metrorail Safety Rules and

Procedures Handbook or standard operating procedures as needed to reflect these requirements. (R-96-40)

Amend Washington Metropolitan Area Transit Authority standard operating procedures to require that in Metrorail emergencies in which rescue workers must be summoned to the scene or in which the possibility of passenger evacuation exists, all train traffic be diverted from that location as soon as possible and all third-rail circuits in the emergency area, including those on adjacent tracks, be deenergized as soon as trains have left the vicinity. (R-96-41)

Develop a mechanism to provide emergency rescue personnel responding to an accident anywhere on the Metrorail system with easily accessible information about third-rail circuitry. Such a mechanism could include or consist of posting schematics or third-rail circuit diagrams on all blue light boxes and fences adjacent to interlockings. (R-96-42)

Implement a program of regularly scheduled operational testing of systems used to remotely trip third-rail circuit breakers from Operations Control Center command consoles. (R-96-43)

Increase the frequency of command and control exercises conducted jointly between the Washington Metropolitan Area Transit Authority and the emergency rescue services of all jurisdictions served by the Motorrail system. (R-96-44)

Coordinate with and assist fire and rescue service providers of all jurisdictions served by the Metrorail system in the procurement and distribution of sufficient quantities of warning strobe and alarm devices (WSADs) or similar protective devices to ensure that all rescue stations that may respond to a Metrorail accident are equipped to monitor the status of third-rail power in an accident area that

72

includes one or more interlockings. (R-96-45)

To the Federal Transit Administration:

Develop, with the assistance of the American Public Transit Association, guidelines for monitoring/recording devices that capture critical performance and event data for rapid rail transit cars and urge transit agencies to install these devices on new and rehabilitated cars. (R-96-46)

To the American Public Transit Association:

Cooperate with the Federal Transit Administration in developing guidelines for monitoring/recording devices that capture critical performance and event data for rapid rail transit cars and urge transit agencies to install these devices on new and rehabilitated cars. (R-96-47)

To the Montgomery County Fire and Rescue Commission:

Review your Metrorail Standard Operating Procedures regarding the requirement that the on-scene rescue commander immediately take charge of the accident scene and establish a direct communications link with the Metrorail Operations Control Center. Ensure that all rescue personnel and supervisors are knowledgeable about the procedure and are trained to carry it out. (R-96-48)

To all jurisdictions providing primary or secondary response to Metrorail accidents or incidents:

Review the circumstances of this accident, with particular attention to deficiencies in emergency response procedures. Review and amend, as necessary, your risk assessment procedures and emergency response plans and procedures for responding to Metrorail accidents or incidents. (R-96-49)

BY THE NATIONAL TRANSPORTATION SAFETY BOARD

JAMES E. HALLChairman

ROBERT T. FRANCIS II Vice Chairman

JOHN A. HAMMERSCHMIDT Member

JOHN J. GOGLIA Member

GEORGE W. BLACK, JR. Member

October 29, 1996

73

APPENDIX A

Investigation

The National Transportation Safety Board learned of this accident on January 6, 1996. Investigation by telephone began immediately. The winter storm delayed the dispatch of an on-scene investigator from the Safety Board's Washington, D.C., headquarters until January 11, 1996. Additional investigators were dispatched later to participate in the on-scene investigation. Investigators began taking testimony on January 16, 1996.

This report is based on the factual information developed as a result of the investigation and on Safety Board analysis. The Safety Board has considered all facts in the investigative record relative to its statutory responsibility to determine probable cause of the accident and to make recommendations.

The following parties participated in this investigation: Washington Area Metropolitan Transit Authority, Westinghouse Air Brake Company, and the Rockville (Maryland) Volunteer Fire Department.

The Safety Board did not conduct a public hearing during this investigation.

75

APPENDIX B

November 17, 1995, WMATA Notice to all OCC Personnel

NOTICE

ALL OCC PERSONNEL

· PERFORMANCE LEVEL 4 is to be implemented system wide during the following times:

SATURDAY & SUNDAY - 0700 hours to 0900 hours

MONDAY -0400 hours to 0600 hours

. ADVERSE/INLEMENT WEATHER CONDITIONS

Implement PERFORMANCE LEVEL 4 SYSTEM WIDE at the first sign of rain, sleet or snow.

AT NO TIME WILL TRAINS BE PERMITTED TO OPERATE IN A MANUAL MODE (MODE II, LEVEL I), except in an emergency situation.

The requirement for trains to be operated MODE 2, LEVEL 1 for the first trip is RESCINDED until further notice.

$$ 1.44 $$

Superintendent - OCCS

November 17, 1995

APPENDIX C--WMATA Speed Calculation Chart--Train T-111

〔图〕插图 79

APPENDIX D

February 14, 1996, Memorandum, Subject: ATC Block Design

〔图〕Mmetro\n

Washington Metropolitan Area Transit Authority

MEMORANDUM

February 14, 1996

sOBJECT: ATC Block Design

FROM: SYM-M Lukes

TO: SARM - K. Lyons

In response to your telephone call, I have attached copies of the Sections 3.2.3, Transit Vehicle Characteristics and 3.3.3, ATC Block Design" of Contract Specifications 1Z7013, ATC for the middle E route. Generally, these specifications provide the requirements for a contractor to perform a block design. The Technical Appendices contain acceleration and clearance information. They do not provide any information on braking; all the information relative to braking is in section 3.2.3.

The safe braking distance calculations are based on 75 % of Full Service Braking (64), which is 2.2 mphps below 50 mph and tapered from 2.2 to 1.65 mphps between 50 mph and 75 mph. This approximates a 25°A safety margin. In addition, a failure mode is inserted into the calculations such that a train will accelerate at full power above its previous authorized speed for a portion of the Reaction Distance. All reaction times for the equipment, which are provided by rail car engineers, are considered to be ‘worst case.’ After the Braking Distance is calculated, 30 feet is added for coupler overhang and jerk rate while stopping (flare-out).

The block design is safe as long as the effective brake rate of a train is equal to or greater than 75% of Full Service Brake rate. If the effective brake rate of the train falls below this level, then other measures must be taken to assure safe operation.

81

APPENDIX E

Signal System and Speed Command Tests

Safety Board investigators tested the Metrorail signal system and determined that, during the test period, it functioned as designed. Safety Board investigators conducted tests to determine if the speed commands transmitted to trains under different scenarios matched the signal design and to determine if the accident speed scenario could be duplicated. The tests were performed on February 21, 1996, between Twinbrook and Shady Grove stations. (See table on next page for the speed commands received under each scenario.)

Scenario No. 1 -- Scenario No. 1 simulated the accident sequence. The purpose was to determine what ATP and ATS speeds would be transmitted to the train as it approached the Shady Grove passenger station with another train occupying the YL2-4 track circuit (where the gap train stood on the night of the accident) and signal A15-38 displaying a lunar aspect. A performance level of 8 (ATS speed 49 mph) was set at the Twinbrook station. A performance level of 3 (ATS speed 59 mph) was set at Rockville station. At Rockville, the test train was allowed to overrun the station platform by one car length. The right and left door circuit breakers were de-energized to prevent the doors from opening on the lead car. The door circuit breakers were then restored to their normal positions.

When the circuit breakers were re-energized, the test train ATS speed changed from PL-3 speed (59 mph) to the ATP speed (75 mph) because the lead car, which carried the TWC receiver, was past the passenger station track circuit boundary. As the test train left the first block after the Rockville station (outbound, toward Shady Grove), and the ATP speed increased to its normal 75 mph, the ATS speed also became 75. The test scenario thus duplicated the experience of train T-111 on the night of the accident.

Scenario No. 2 -- The second scenario was conducted to determine what speed command would have been received if train No. T-111 had made a proper stop at the Rockville station and had not overrun the station platform. Under this scenario, train T-111 would have been limited to a top speed of 59 mph between the Rockville and Shady Grove stations.

Scenario No. 3 -- Scenario No. 3 was similar to scenario No. 1, except that signal A15-38 was changed to display a stop signal. After allowing the train to overrun the Rockville station platform by one car, the test train operator keyed out and then keyed back in to simulate the actions of the accident train operator. This action was found to cancel the performance level 3 that had been entered for the Rockville station. Because of the stop signal, the ATP and ATS speed commands would have been reduced to 40 mph approximately 3,700 ft. from the station platform, decreasing to 0 mph (a stop) just before the A15-08 signal, located approximately 1,000 ft. from the station platform.

82 Appendix E

Scenario No. 4 -- Scenario No. 4 was similar to scenario No. 2, except that signal A15-38 was changed to display a stop signal. By making a proper stop, the test train retained the performance level 3 assigned to it at the Rockville station and was limited to a top speed of 59 mph. The stop signal caused the same reduced speed profile as in scenario 3.

Scenario No. 5 -- The last scenario was conducted to determine what speed command train T-111 would have been received between the Rockville and Shady Grove stations if it had made a proper station stop and if signal A15-38 had displayed a lunar aspect with a train occupying the YL2-4 track circuit, but with the south interlocking switch on track 2 lined for a crossover move to track 1. This test determined that the "reverse" switch position allowed slightly higher speeds approaching the Shady Grove station than scenario 2. An additional test determined that these were the same speed commands that would have been received if the switch were in the normal (straight through) position with no gap train occupying the block.

Appendix E 83

ATP and ATS speed reception tests

$^{1}$ Average actual speed for the block calculated based on the time entered and left each block and the known length of the block.

$^{2}$Disregard this speed because of the short block length.

APPENDIX F -- Brake Test Details

• Invalid Test

86

Appendix F

Results of train stopping distance tests conducted March 8, 1996

*Performance level

Results of train stopping distance tests conducted March 14, 1996

$^{1}\text{Performance level}$

$^{2}$Code change point (point at which a new speed command is transmitted to the train).

*Tests conducted with the new H-1 software EPROM

**Unrecorded

87

APPENDIX G

November 20, 1995, Memorandum, Subject: Manual Train Operation

〔图〕M...etro\n

Washington Metropolitan Area Transit Authority

MEMONANDУЕ

SUBJECT: Manual Train Operation

DATE: November 20, 1995

FROM: RTRA - KUBrayBorton

TO: - Train Operators

• Operations Supervisors

• Central Control Supervisors

Effective immediately, by order of this memorandum, all Train Operators must obtain authorization from the Operations Control Center to change from Mode 1 to Mode 2 operation. The only exception is when adjusting the train within the platform limits, on compliance with Special Order #94-02 (Rules 3.21 and 3.31). Also, this memorandum supersedes the memorandum titled "First Trip Manual Operation, dated June 15, 1992" and the memorandum titled "Manual T's Operation, dated October 17, 1995".

Operations Supervisors shall insure that all train operators understand and comply with this directive and it shall remain in effect until further notice.

ce: . DGM/OPER - Fady P. Bassily

RAIL . Nancy Hsu

RTRA-W. Mark Miller

• Superintendents

• Assistang Superintendents

CMNT - Lamual Proctor

SMNT - Sean Burgøss

OTAN - Paul C. Gillum

• Charles Waple

• Chris Barker

OPSV - Susan Riel

89

APPENDIX H Previous Safety Recommendations Issued to WMATA As Result of 1982 Fatal Metrorail Accident

R-82-008

Class I

The NTSB recommends that the Washington Metropolitan Area Transit Authority: modify its operating rules and standard operating procedures to require the establishment of an absolute block whenever it is necessary to operate a train in other than the fully automatic mode.

Status:

Closed - Acceptable Action

3/18/85

R-82-009

Class I

The NTSB recommends that the Washington Metropolitan Area Transit Authority: include in its operating rules a requirement that whenever it is necessary to operate a train manually, the operations control center will not permit the train to proceed into the block to the next station as long as that block is occupied by another train. If there is an interlocking between the stations, require that the absolute block between the stations will apply to both main tracks unless the operations control center has an oscilloscope indication that all crossover switches are aligned for main track movement.

Status

Closed - Acceptable Action

10/18/84

R-82-010

Class I

The NTSB recommends that the Washington Metropolitan Area Transit Authority: include in its operating rules a requirement that train operators report to the operations control center whenever they are unable to operate in the fully automatic mode, and enforce the operating rules requiring authorization by the operations control center to change operating modes.

Status

Closed - Acceptable Action

12/14/83

R-82-011

Class I

The NTSB recommends that the Washington Metropolitan Area Transit Authority: include in its operating rules a requirement that before a manually operated train is permitted to enter a block containing an interlocking, the operations control center must instruct the train's operator as to the intended route for the train and receive proper acknowledgment from the operator.

Status

Closed - Acceptable Action

10/18/84

R-82-012

Class I

90

Appendix H

The NTSB recommends that the Washington Metropolitan Area Transit Authority: modify its operating rules to prohibit the reverse movement of a train within interlocking limits until it has been established that no derailment has occurred, that switches are properly aligned, and that there are no conflicting train movements.

Status Closed - Acceptable Action 12/15/82

R-82-013 Class I

The NTSB recommends that the Washington Metropolitan Area Transit Authority: improve the maintenance and redundancy of the communications equipment in the operations control center and the other Washington Metropolitan Area Transit Authority command centers to provide continuous communications between all centers.

Status Closed - Acceptable Action 12/15/82

R-82-014 Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: provide radio communicating capability for the operations control center that is commensurate with peak radio traffic demands of the expanding Washington Metropolitan Area Transit Authority rail system.

Status Closed - Acceptable Action 12/15/82

R-82-015 Class I

The NTSB recommends that the Washington Metropolitan Area Transit Authority: upgrade the training given to rail transportation supervisors and assign them the necessary authority to effectively supervise train operations and correctly deal with the full range of operating situations.

Status Closed - Acceptable Action 10/24/85

R-82-016 Class I

The NTSB recommends that the Washington Metropolitan Area Transit Authority: implement a program of mandatory periodic instruction and examination on the combined book of operating rules and standard operating procedures, including emergency train evacuation procedures, for all rail supervisors and train operators.

Status Closed - Acceptable Action 10/18/84

Appendix H

91

The NTSB recommends that the Washington Metropolitan Area Transit Authority: amend its standard operating procedures to require the operations control center (1) require that, whenever a train emergency which requires evacuation is known to exist at a location between stations, all third-rail power circuits between the emergency location and the stations on each side of that location be deenergized as soon as all other trains have cleared the area, and (2) to direct the nearest qualified rail employee to begin the timely evacuation of passengers from the train.

Status Closed - Acceptable Action 10/18/84

R-82-018 Class I

The NTSB recommends that the Washington Metropolitan Area Transit Authority: implement a continuing program to educate passengers on the procedures to be followed when it is necessary to evacuate a disabled train.

Status Closed - Acceptable Action 10/24/85

R-82-055 Class I

The NTSB recommends that the Washington Metropolitan Area Transit Authority: immediately implement an in-depth continuing program for controllers and their superiors in the Metrorail operations control center which includes instruction in the rules, procedures, and fundamentals of rail transit operations; familiarization with all Metrorail operations; radio protocol; and periodic testing and certification by a professional training specialist who is knowledgeable in rail transit operations.

Status Closed - Acceptable Action 10/24/85

R-82-056 Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority (WMATA): establish a training department for Metrorail that is accountable to top WMATA management and is staffed by professional specialists in this field.

Status Closed - Acceptable Action 12/14/83

R-82-057 Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: evaluate the quality of the curriculum, instruction, training aids, and periodic certification process of the present Metrorail train operators' training course, and implement necessary improvements.

Status Closed - Acceptable Action 10/24/85

92

Appendix H

R-82-058

Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: modify the overspeed control on the Metrorail cars to enforce speed commands of the automatic train protection subsystem to and including zero miles per hour.

Status

Closed - Unacceptable Action

12/14/83

R-82-059

Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: change the identification numbers of its interlockings and interlocking signals to eliminate possible misunderstandings which could result in a train improperly passing a restricting signal.

Status

Closed - Unacceptable Action

12/15/82

R-82-060

Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: require the Metrorail operations control center personnel, rail transportation supervisors, and train operators to refer to all signals by their complete and proper designation.

Status

Closed - Acceptable Action

12/15/82

R-82-061

Class I

The NTSB recommends that the Washington Metropolitan Area Transit Authority: require that the Metrorail operations control center personnel, and transportation supervisors understand and implement provisions of standard operating procedure No. 15 for the establishment of an absolute block when there is a failure in the automatic train control system.

Status

Closed - Acceptable Action

12/15/82

R-82-062

Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: include in Metorail operating rules a definition of restricted speed. Establish and require that all employees involved in the operation of trains understand and abide by the maximum allowable speed for trains being operated through an interlocking with inoperative track circuits.

Status

Closed - Acceptable Action

12/14/83

R-82-063

Class I

Appendix H 93

The NTSB recommends that the Washington Metropolitan Area Transit Authority: eliminate the practice of issuing verbal instructions to the Metrorail operations control center personnel which modify or amend operating rules and standard operating procedures.

Status

Closed - Acceptable Action

12/15/82

R-82-064

Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: modify the

automated alert system to segregate the "serious" physical plant-related type 1 visual alarms from the less serious train-oriented type 2 alarms, and to provide an audible indication of a type 1 alarm which must be manually acknowledged.

Status

Closed - Acceptable Action

12/14/83

R-82-065

Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: require that type 1 automated alert alarms be immediately reported by the operations control center to maintenance control for corrective action.

Status

Closed - Acceptable Action

12/15/82

R-82-066

Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: require that maintenance forces inspect switch machine fusetrons while making their regular preventive maintenance inspections of the control system apparatus.

Status

Closed - Acceptable Action

10/18/84

R-82-067

Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: provide train operators with some type of self-contained radios which will function in the event that auxiliary and emergency car power sources are lost.

Status

Closed - Acceptable Action

12/14/83

R-82-068

Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: arrange for a comprehensive review of its Metrorail safety program and of its rules and procedures by a peer review board of the American Public Transit Association.

Status

Closed - Acceptable Action

12/15/82

Appendix H

94

R-82-069

Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: provide all Metrorail operations control center controllers and their supervisors with clear instructions that all automatic reclosing circuit breakers for the traction power sections in the affected area must be commanded open prior to the commencement of an evacuation of a train.

Status

Closed - Acceptable Action

12/15/82

R-82-070

Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: require the installation of an adequate number of marked emergency escape windows on all new Metrorail cars and implement a program to similarly retrofit existing cars.

Status

Closed - Acceptable Alternate Action

10/24/85

R-82-071

Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: equip each Metrorail car with an adequate number of self-contained, battery-powered emergency lights which will automatically illuminate the car interior in the event the car's auxiliary and emergency power is lost.

Status

Closed - Unacceptable Action

10/18/84

R-82-072

Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: post emergency information inside Metrorail cars at locations near the doors regarding the location and method of operation of the manual emergency door handle.

Status

Closed - Acceptable Alternate Action

10/24/85

R-82-073

Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: retrofit existing Metrorail cars with derailment detector devices which will apply the brakes in emergency when a car wheel leaves the rail. Require that all new cars be so equipped.

Status

Closed - Unacceptable Action

10/18/84

Appendix H 95

R-82-074

Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: maintain the carborne monitors on existing Metrorail cars and require their installation on cars presently on order. Acquire the necessary equipment to read the monitor tapes.

Status

Closed - Acceptable Action

4/22/91

R-82-075

Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: provide a portable radio, compatible with the Metrorail communication system, at each station kiosk for dedicated use by fire/rescue personnel.

Status

Closed - Acceptable Alternate Action

12/14/83

R-82-076

Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: expedite the completion of its underground communication system.

Status

Closed - Acceptable Action

12/14/83

R-82-077

Class II

The NTSB recommends that the Washington Metropolitan Area Transit Authority: in conjunction with the District Of Columbia fire department, expand the scope and frequency of the disaster crash simulations and include hospitals and fire/rescue units from surrounding jurisdictions.

Status

Closed - Acceptable Action

12/14/83