[Federal Register: September 22, 2010 (Volume 75, Number 183)]
[Rules and Regulations]
[Page 57660-57664]
[DOCID:fr22se10-4]

-----------------------------------------------------------------------

DEPARTMENT OF TRANSPORTATION

Federal Aviation Administration

14 CFR Part 39

[Docket No. FAA-2009-0811; Directorate Identifier 2008-NE-41-AD;
Amendment 39-16429; AD 2010-19-01]
RIN 2120-AA64

Airworthiness Directives; Rolls-Royce Corporation (RRC) AE 3007A
Series Turbofan Engines

AGENCY: Federal Aviation Administration (FAA), DOT.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: The FAA is superseding an existing airworthiness directive
(AD) for RRC AE 3007A series turbofan engines. That AD currently
requires performing an eddy current inspection (ECI) or surface wave
ultrasonic test (SWUT) inspection on each affected high-pressure
turbine (HPT) wheel. This AD requires removing or performing initial
and repetitive ECIs or SWUT inspections on HPT stage 2 wheels for
cracks. This AD also reduces the approved life limits of certain HPT
stage 2 wheels. This AD results from reports of cracked HPT stage 2
wheels. We are issuing this AD to prevent uncontained failure of the
HPT stage 2 wheel and damage to the airplane.

DATES: This AD becomes effective October 27, 2010. The Director of the
Federal Register approved the incorporation by reference of certain

publications listed in the regulations as of October 27, 2010.

ADDRESSES: You can get the service information identified in this AD
from Rolls-Royce Corporation, P.O. Box 420, Speed Code U15,
Indianapolis, IN 46206-0420, e-mail: indy.pubs.services@rolls-
royce.com.
    The Docket Operations office is located at Docket Management
Facility, U.S. Department of Transportation, 1200 New Jersey Avenue,
SE., West Building Ground Floor, Room W12-140, Washington, DC 20590-
0001.

FOR FURTHER INFORMATION CONTACT: Kyri Zaroyiannis, Aerospace Engineer,
Chicago Aircraft Certification Office, Small Airplane Directorate, FAA,
2300 E. Devon Ave., Des Plaines, IL 60018; e-mail:
<EMAIL_ADDRESS>telephone<PHONE_NUMBER>; fax<PHONE_NUMBER>.

SUPPLEMENTARY INFORMATION: The FAA proposed to amend 14 CFR part 39 by
superseding AD 2009-08-51, Amendment 39-15905 (74 FR 22091, May 12,
2009), with a proposed AD. The proposed AD applies to RRC AE 3007A
series turbofan engines. We published the proposed AD in the Federal
Register on February 18, 2010 (75 FR 7209). That action proposed to
require:
     Removing from service, any engine with certain part number
(P/N) HPT stage 2 wheels that have a cycles-since-new (CSN) specified
in Table 1 of this AD, by the compliance time specified in Table 1 of
this AD; or
     Performing an ECI or SWUT inspection on certain P/N HPT
stage 2 wheels that have a CSN specified in Table 1 of this AD by the
compliance time specified in Table 1 of this AD; and
     Performing repetitive ECI or SWUT inspections of the HPT
stage 2 wheels within 3,000 cycles-since-last inspection.

Examining the AD Docket

    You may examine the AD docket on the Internet at http://
www.regulations.gov; or in person at the Docket Operations office
between 9 a.m. and 5 p.m., Monday through Friday, except Federal
holidays. The AD docket contains this AD, the regulatory evaluation,
any comments received, and other information. The street address for
the Docket Operations office (telephone<PHONE_NUMBER>) is provided in
the ADDRESSES section. Comments will be available in the AD docket
shortly after receipt.

Comments

    We provided the public the opportunity to participate in the
development of this AD. We have considered the comments received.

Request To Clarify Repetitive Inspection Paragraph

    One commenter asks us to clarify paragraph (i) of the proposed AD,
which states ``Thereafter, within 3,000 cycles since last inspection,
remove the engine from service * * *'' The commenter asks if the last
inspection means those inspections performed to comply with ADs 2008-
19-51, 2008-26-06 and 2009-08-51. The commenter feels paragraph (i) of
the proposed AD is not clear.
    We agree. We changed paragraph (i) of this AD to ``Thereafter,
within 3,000 cycles-since-last inspection performed as a result of this
AD or its predecessor ADs (Emergency ADs 2008-19-51, AD 2008-26-06, and
2009-08-51), remove the engine from service * * *

Request To Credit for Work Done to Previous Revisions of the Service
Bulletins

    Four commenters ask us to allow credit for initial and repetitive
inspections performed using previous versions of RRC Alert Service
Bulletin (ASB) AE 3007A-A-72-367, Revision 2, dated June 22, 2009,
Service Bulletin (SB) AE 3007A-72-176, Revision 5, dated September 2,
2008; SB AE 3007A-72-215, Revision 2, dated September 28, 2009; SB AE
3007A-72-368, Revision 3, dated May 24, 2010; and SB AE 3007A-72-369,
Revision 2, dated November 5, 2009.
    We agree. We added paragraph (g)(6) to allow credit for initial and
repetitive inspections performed using earlier versions of RRC ASB AE
3007A-A-72-367, Revision 2, dated June 22, 2009; SB AE 3007A-72-368,
Revision 3, dated May 24, 2010; and SB AE 3007A-72-369, Revision 2,
dated November 5, 2009. We also changed paragraph (l) of this AD to
state ``For wheels, P/N 23069438 * * * RRC SB AE 3007A-72-176, Revision
5, dated September 2, 2008, or earlier version; or SB AE 3007A-72-215,
Revision 2, dated September 28, 2009, or earlier version, remove the
wheel before exceeding the new, reduced ECLL of 10,000 CSN.''

Conclusion

    We have carefully reviewed the available data, including the
comments received, and determined that air safety and the public
interest require adopting the AD with the changes described previously.
We have determined that these changes will neither increase the
economic burden on any operator nor increase the scope of the AD.

Costs of Compliance

    We estimate that this AD will affect 1402 engines installed on
airplanes of U.S. registry. We also estimate that it will take about 2
work-hours per engine to perform both the ECI and SWUT. The average
labor rate is $85 per work-hour. No parts are required for the
inspection. We estimate the prorated life lost per stage 2 wheel is
about $13,177. Based on these figures, we estimate the total cost of
the AD to U.S. operators to be $18,712,494. This estimate is exclusive
of any warranty coverage.

Authority for This Rulemaking

    Title 49 of the United States Code specifies the FAA's authority to
issue rules on aviation safety. Subtitle I, Section 106, describes the
authority of the FAA Administrator. Subtitle VII, Aviation Programs,
describes in more detail the scope of the Agency's authority.
    We are issuing this rulemaking under the authority described in
Subtitle VII, Part A, Subpart III, Section 44701, ``General
requirements.'' Under that section, Congress charges the FAA with
promoting safe flight of civil aircraft in air commerce by prescribing
regulations for practices, methods, and procedures the Administrator
finds necessary for safety in air commerce. This regulation is within
the scope of that authority because it addresses an unsafe condition
that is likely to exist or develop on products identified in this
rulemaking action.

Regulatory Findings

    We have determined that this AD will not have federalism
implications under Executive Order 13132. This AD will not have a
substantial direct effect on the States, on the relationship between
the national government and the States, or on the distribution of power
and responsibilities among the various levels of government.
    For the reasons discussed above, I certify that this AD:
    (1) Is not a ``significant regulatory action'' under Executive
Order 12866;
    (2) Is not a ``significant rule'' under DOT Regulatory Policies and
Procedures (44 FR 11034, February 26, 1979); and
    (3) Will not have a significant economic impact, positive or
negative, on a substantial number of small entities under the criteria
of the Regulatory Flexibility Act.
    We prepared a summary of the costs to comply with this AD and
placed it in the AD Docket. You may get a copy of this summary at the
address listed under ADDRESSES.

List of Subjects in 14 CFR Part 39

    Air transportation, Aircraft, Aviation safety, Incorporation by
reference, Safety.

Adoption of the Amendment

0
Accordingly, under the authority delegated to me by the Administrator,
the Federal Aviation Administration amends 14 CFR part 39 as follows:

PART 39--AIRWORTHINESS DIRECTIVES

0
1. The authority citation for part 39 continues to read as follows:

    Authority:  49 U.S.C. 106(g), 40113, 44701.

Sec.  39.13  [Amended]

0
2. The FAA amends Sec.  39.13 by removing Amendment 39-15905 (74 FR
22091, May 12, 2009), and by adding a new airworthiness directive,
Amendment 39-16429, to read as follows:

2010-19-01 Rolls-Royce Corporation (Formerly Allison Engine
Company): Amendment 39-16429. Docket No. FAA-2009-0811; Directorate
Identifier 2008-NE-41-AD.

Effective Date

    (a) This airworthiness directive (AD) becomes effective October
27, 2010.

Affected ADs

    (b) This AD supersedes AD 2009-08-51, Amendment 39-15905.

Applicability

    (c) This AD applies to Rolls-Royce Corporation (RRC) AE 3007A
series turbofan engines with high-pressure turbine (HPT) stage 2
wheels, part numbers (P/Ns) 23069438, 23069592, 23074462, 23074644,
23075345, or 23084520 installed. These engines are installed on, but
not limited to, Empresa Brasileira de Aeronautica S. A. (EMBRAER)
EMB-135 and EMB-145 airplanes.

Unsafe Condition

    (d) This AD results from reports of cracked HPT stage 2 wheels.
We are issuing this AD to prevent uncontained failure of the HPT
stage 2 wheel and damage to the airplane.

Compliance

    (e) You are responsible for having the actions required by this
AD performed within the compliance times specified unless the
actions have already been done.

HPT Stage 2 Wheels Exempted From the Inspection Requirements of This AD

    (f) The following engines are exempt from the inspection
requirements of this AD:
    (1) All engines with an HPT stage 2 wheel, P/N 23084520.
    (2) All engines with an HPT stage 2 wheel, P/N 23075345, that
has a serial number (S/N) specified in Table 1 of this AD, and
    (3) All engines with an HPT stage 2 wheel, P/N 23074462, that
has a S/N specified in Table 2 of this AD.

Table 1--HPT Stage 2 Wheel, P/N 23075345 by S/N Excluded From Inspection
                 Requirements (g) Through (i) of This AD
------------------------------------------------------------------------

------------------------------------------------------------------------
MM507646                 MM508211                 MM508319
MM508144                 MM508221                 MM508320
MM508153                 MM508241                 MM508322
MM508176                 MM508248                 MM508337
MM508186                 MM508251                 MM508338
MM508188                 MM508264                 MM508382
MM508205                 MM508305                 MM508387
MM508208                 MM508311                 ......................
------------------------------------------------------------------------

Table 2--HPT Stage 2 Wheel, P/N 23074462 by S/N Excluded From Inspection
                 Requirements (g) Through (i) of This AD
------------------------------------------------------------------------

------------------------------------------------------------------------
MM504890                 MM505025                 MM505054
MM504963                 MM505034                 MM505055
MM504990                 MM505041                 MM505056
MM504995                 MM505045                 MM505061
MM505007                 MM505046                 All `MM' prefix S/Ns
                                                   higher than MM505061
MM505017                 MM505048                 All S/Ns with `MW'
                                                   prefix
------------------------------------------------------------------------

Initial Eddy Current Inspection (ECI) or Surface Wave Ultrasonic
Testing (SWUT) Inspection

    (g) For engines with an HPT stage 2 wheel, P/Ns 23069438,
23069592, 23074462, 23074644, or 23075345, remove the engine from
service or perform an initial inspection of the wheel by the cycle
limit specified in Table 3 of this AD. Use one of the following
methods for the inspection:
    (1) For HPT stage 2 wheels that have S/Ns listed in Table 4 of
this AD, use paragraphs 2.A. through 2.C.(4) of RRC Alert Service
Bulletin (ASB) AE 3007A-A-72-367, Revision 2 dated June 22, 2009, to
inspect the wheel.
    (2) For HPT stage 2 wheels that have S/Ns not listed in Table 4
of this AD, use paragraphs 2.A. through 2.C.(4) of RRC ASB AE 3007A-
A-72-367, Revision 2, dated June 22, 2009, or use paragraphs 2.A.
through 2.N. of RRC Service Bulletin (SB) AE 3007A-72-368, Revision
3, dated May 24, 2010; or use 2.A. through 2.V.(4) of RRC SB AE
3007A-72-369, Revision 2, dated November 5, 2009, to perform the
inspections.

 Table 3--Compliance Times for Engine Removal or ECI or SWUT Inspection
              of the HPT Stage 2 Wheels by Cycles-Since-New
                                  [CSN]
------------------------------------------------------------------------
                                          Remove engine from service or
    For HPT stage 2 wheels with the          inspect wheel within the
 following CSN on the effective date of    following cycles-in-service
                this AD:                  (CIS) after the effective date
                                                   of this AD:
------------------------------------------------------------------------
(3) 17,500 or more CSN.................  Remove engine from service or
                                          inspect before next flight.
(4) 10,000 to 17,499 CSN...............  15 CIS.
(5) 9,999 or fewer CSN.................  Before accumulating 10,015 CSN.
------------------------------------------------------------------------

Credit for Previous Inspections

    (6) Inspections performed before the effective date of this AD
using earlier versions of RRC ASB AE 3007A-A-72-367 or RRC SB AE
3007A-72-368 or RRC SB AE 3007A-72-369 comply with the requirements
of paragraphs (g)(1) and (g)(2) of this AD.

 Table 4--S/Ns of HPT Stage 2 Wheels to be Inspected by SB AE 3007A-72-
                                   367
                            [ECI Method Only]
------------------------------------------------------------------------

------------------------------------------------------------------------
              HPT stage 2 wheels requiring ECI method only
------------------------------------------------------------------------
MM119400                             MM183796
MM119480                             MM183808
MM119508                             MM183831
MM155847                             MM228730
MM155907                             MM228951
MM155908                             MM503748
MM183236                             MM504004
MM183362                             MM57188
MM183754                             MM57440
MM183762                             MM57480
------------------------------------------------------------------------

Installation Prohibition

    (h) After the effective date of this AD, don't return to
service, any HPT stage 2 wheel that was installed in any RRC AE
3007A series engine that has been removed as a result of the
inspection requirements of this AD, unless the HPT stage 2 wheel was
inspected as specified in RRC ASB AE 3007A-A-72-367, Revision 2,
dated June 22, 2009; or RRC

SB AE 3007A-72-368, Revision 3, dated May 24, 2010; or RRC SB AE
3007A-72-369, Revision 2, dated November 5, 2009.

Repetitive Inspection

    (i) Thereafter, within 3,000 cycles-since-last inspection
performed as a result of this AD or its predecessor ADs (Emergency
ADs 2008-19-51, AD 2008-26-06, and 2009-08-51), remove the engine
from service until an ECI or SWUT inspection is performed on the HPT
stage 2 wheel. Use paragraphs 2.A. through 2.C.(4) of RRC ASB AE
3007A-A-72-367, Revision 2, dated June 22, 2009, or use paragraphs
2.A. through 2.N. of RRC SB AE 3007A-72-368, Revision 3, dated May
24, 2010; or use 2.A. through 2.V.(4) of RRC SB AE 3007A-72-369,
Revision 2, dated November 5, 2009, to inspect the wheel.

New, Reduced Engine Cycle Life Limit and Removal From Service

    (j) For HPT stage 2 wheels, P/N 23084520, do the following:
    (1) For wheels that have 22,985 CSN or more on the effective
date of this AD, remove the wheel from service within 15 CIS after
the effective date of this AD.
    (2) Thereafter, remove HPT stage 2 wheels, P/N 23084520, before
exceeding the new, reduced engine cycle life limit (ECLL) of 23,000
CSN.
    (k) For HPT stage 2 wheels, P/N 23075345 and 23074644, do the
following:
    (1) For wheels that have 19,985 CSN or more on the effective
date of this AD, remove the wheel from service within 15 CIS after
the effective date of this AD unless paragraph (k)(3) of this AD
applies.
    (2) Thereafter, remove HPT stage 2 wheels, P/N 23075345 and
23074644, before exceeding the new, reduced ECLL of 20,000 CSN.
    (3) For HPT stage 2 wheels, P/N 23075345, that have a S/N listed
in Table 5 of this AD and that have 22,985 CSN or more on the
effective date of this AD, remove the wheel from service within 15
CIS after the effective date of this AD.
    (4) Thereafter, for HPT stage 2 wheels, P/N 23075345, that have
a S/N listed in Table 5 of this AD, remove the wheel from service
before exceeding the new, reduced ECLL of 23,000 CSN.

 Table 5--S/Ns of HPT Stage 2 Wheel, P/N 23075345, Eligible To Remain in
                        Service Until 23,000 CSN
------------------------------------------------------------------------

------------------------------------------------------------------------
MM507646           MM508205           MM508251          MM508322
MM508144           MM508208           MM508264          MM508337
MM508153           MM508211           MM508305          MM508338
MM508176           MM508221           MM508311          MM508382
MM508186           MM508241           MM508319          MM508387
MM508188           MM508248           MM508320          ................
------------------------------------------------------------------------

     (l) For wheels, P/N 23069438, in engines that have not complied
with RRC SB AE 3007A-72-176, Revision 5, dated September 2, 2008, or
earlier version; or SB AE 3007A-72-215, Revision 2, dated September
28, 2009, or earlier version, remove the wheel before exceeding the
new, reduced ECLL of 10,000 CSN.
    (m) For wheels, P/N 23069438, in engines that have complied with
RRC SB AE 3007A-72-176, Revision 5, dated September 2, 2008, or
earlier version; or SB AE 3007A-72-215, Revision 2, dated September
28, 2009, or earlier version; do the following:
    (1) For wheels that have 19,985 CSN or more on the effective
date of this AD, remove the wheel from service within 15 CIS after
the effective date of this AD.
    (2) Thereafter, remove the wheel from service before exceeding
the new, reduced ECLL of 20,000 CSN.

Alternative Methods of Compliance

    (n) The Manager, Chicago Aircraft Certification Office, has the
authority to approve alternative methods of compliance for this AD
if requested using the procedures found in 14 CFR 39.19.

Special Flight Permits

    (o) Under 14 CFR 39.23, we are limiting the special flight
permits for this AD by restricting the flight to essential flight
crew only.

Related Information

    (p) Contact Kyri Zaroyiannis, Aerospace Engineer, Chicago
Aircraft Certification Office, Small Airplane Directorate, FAA, 2300
E. Devon Ave., Des Plaines, IL 60018; e-mail:
<EMAIL_ADDRESS>telephone<PHONE_NUMBER>; fax (847) 294-
7834, for more information about this AD.

Material Incorporated by Reference

    (q) You must use the service information specified in Table 6 of
this AD to perform the inspections required by this AD. The Director
of the Federal Register approved the incorporation by reference of
the documents listed in Table 6 of this AD in accordance with 5
U.S.C. 552(a) and 1 CFR part 51. You can get a copy from Rolls-Royce
Corporation, P.O. Box 420, Indianapolis, IN 46206; telephone (317)
230-3774; fax<PHONE_NUMBER>; e-mail: indy.pubs.services@rolls-
royce.com. You may review copies at the FAA, New England Region, 12
New England Executive Park, Burlington, MA; or at the National
Archives and Records Administration (NARA). For information on the
availability of this material at NARA, call<PHONE_NUMBER>, or go to:
http://www.archives.gov/federal-register/cfr/ibr-locations.html.

                                       Table 6--Incorporation by Reference
----------------------------------------------------------------------------------------------------------------
    Rolls-Royce Corporation Service
            Information No.                       Page             Revision                  Date
----------------------------------------------------------------------------------------------------------------
Alert Service Bulletin AE 3007A-A-72-   ALL.....................          2  June 22, 2009.
 367, Total Pages: 8.
Service Bulletin AE 3007A-72-368,       ALL.....................          3  May 24, 2010.
 Total Pages: 23.
Service Bulletin AE 3007A-72-369,       ALL.....................          2  November 5, 2009.
 Total Pages: 22.
----------------------------------------------------------------------------------------------------------------

    (Only the transmittal letter for Alert Service Bulletin (ASB) AE
3007A-A-72-367, Revision 2, dated June 22, 2009, identifies this
service bulletin as an ASB; no other page of this document contains
this information.)

    Issued in Burlington, Massachusetts, on September 1, 2010.
Robert G. Mann,
Acting Manager, Engine and Propeller Directorate, Aircraft
Certification Service.
[FR Doc. 2010-22370 Filed 9-21-10; 8:45 am]
BILLING CODE 4910-13-P


(b) To provide clearance for passing over retarders, locomotives
utilized in hump yard or switching service at hump yard locations may
have pilot, snowplow, or end plate maximum height of 9 inches.
    (1) Each locomotive equipped with a pilot, snowplow, or end plate
with clearance above 6 inches shall be prominently stenciled at each
end of the locomotive with the words ``9-inch Maximum End Plate Height,
Yard or Trail Service Only.''
    (2) When operated in switching service in a leading position,
locomotives with a pilot, snowplow, or end plate clearance above 6
inches shall be limited to 10 miles per hour over grade crossings.
    (3) Train crews shall be notified in writing of the restrictions on
the locomotive, by label or stencil in the cab, or by written operating
instruction given to the crew and maintained in the cab of the
locomotive.
    (4) Pilot, snowplow, or end plate clearance above 6 inches shall be
noted in the remarks section of Form FRA 6180-49a.
    (5) Locomotives with a pilot, snowplow, or end plate clearance
above 6 inches shall not be placed in the lead position when being
moved under section Sec.  229.9.
    17. Section 229.125 is amended by revising paragraphs (a) and
(d)(2) and (3) to read as follows:

Sec.  229.125  Headlights and auxiliary lights.

    (a) Each lead locomotive used in road service shall illuminate its
headlight while the locomotive is in use. When illuminated, the
headlight shall produce a peak intensity of at least 200,000 candela
and produce at least 3,000 candela at an angle of 7.5 degrees and at
least 400 candela at an angle of 20 degrees from the centerline of the
locomotive when the light is aimed parallel to the tracks. If a
locomotive or locomotive consist in road service is regularly required
to run backward for any portion of its trip other than to pick up a
detached portion of its train or to make terminal movements, it shall
also have on its rear a headlight that meets the intensity requirements
above. Each headlight shall be aimed to illuminate a person at least
800 feet ahead and in front of the headlight. For purposes of this
section, a headlight shall be comprised of either one or two lamps.
    (1) If a locomotive is equipped with a single-lamp headlight, the
single lamp shall produce a peak intensity of at least 200,000 candela
and shall produce at least 3,000 candela at an angle of 7.5 degrees and
at least 400 candela at an angle of 20 degrees from the centerline of
the locomotive when the light is aimed parallel to the tracks. The
following operative lamps meet the standard set forth in this
paragraph: a single incandescent PAR-56, 200-watt, 30-volt lamp; a
single halogen PAR-56, 200-watt, 30-volt lamp; a single halogen PAR-56,
350-watt, 75-volt lamp, or a single lamp meeting the intensity
requirements given above.
    (2) If a locomotive is equipped with a dual-lamp headlight, a peak
intensity of at least 200,000 candela and at least 3,000 candela at an
angle of 7.5 degrees and at least 400 candela at an angle of 20 degrees
from the centerline of the locomotive when the light is aimed parallel
to the tracks shall be produced by the headlight based either on a
single lamp capable of individually producing the required peak
intensity or on the candela produced by the headlight with both lamps
illuminated. If both lamps are needed to produce the required peak
intensity, then both lamps in the headlight shall be operational. The
following operative lamps meet the standard set forth in this paragraph
(a)(2): A single incandescent PAR-56, 200-watt, 30-volt lamp; a single
halogen PAR-56, 200-watt, 30-volt lamp; a single halogen PAR-56, 350-
watt, 75-volt lamp; two incandescent PAR-56, 350-watt, 75-volt lamps;
or lamp(s) meeting the intensity requirements given above.
    (i) A locomotive equipped with the two incandescent PAR-56, 350-
watt, 75 volt lamps which has an en route failure of one lamp in the
headlight fixture, may continue in service as a lead locomotive until
its next daily inspection required by Sec.  229.21 only if:
    (A) Auxiliary lights burn steadily;
    (B) Auxiliary lights are aimed horizontally parallel to the
longitudinal centerline of the locomotive or aimed to cross no less
than 400 feet in front of the locomotive.
    (C) Second headlight lamp and both auxiliary lights continue to
operate.
    (ii) [Reserved].
* * * * *
    (d) * * *
    (2) Each auxiliary light shall produce a peak intensity of at least
200,000 candela or shall produce at least 3,000 candela at an angle of
7.5 degrees and at least 400 candela at an angle of 20 degrees from the
centerline of the locomotive when the light is aimed parallel to the
tracks. Any of the following operative lamps meet the standard set
forth in this paragraph: an incandescent PAR-56, 200-watt, 30-volt
lamp; a halogen PAR-56, 200-watt, 30-volt lamp; a halogen PAR-56, 350-
watt, 75-volt lamp; an incandescent PAR-56, 350-watt, 75-volt lamp; or
a single lamp having equivalent intensities at the specified angles.
    (3) The auxiliary lights shall be aimed horizontally within 15
degrees of the

longitudinal centerline of the locomotive.
* * * * *

0
18. Section 229.133 is amended by revising paragraphs (b)(1) and (2)
and (c)(1) and (2) to read as follows:

Sec.  229.133  Interim locomotive conspicuity measures--auxiliary
external lights.

* * * * *
    (b) * * *
    (1) Strobe lights. (i) Strobe lights shall consist of two white
stroboscopic lights, each with ``effective intensity,'' as defined by
the Illuminating Engineering Society's Guide for Calculating the
Effective Intensity of Flashing Signal Lights (November 1964), of at
least 500 candela.
    (ii) The flash rate of strobe lights shall be at least 40 flashes
per minute and at most 180 flashes per minute.
    (iii) Strobe lights shall be placed at the front of the locomotive,
at least 48 inches apart, and at least 36 inches above the top of the
rail.
    (2) Oscillating light. (i) An oscillating light shall consist of:
    (A) One steadily burning white light producing at least 200,000
candela in a moving beam that depicts a circle or a horizontal figure
``8'' to the front, about the longitudinal centerline of the
locomotive; or
    (B) Two or more white lights producing at least 200,000 candela
each, at one location on the front of the locomotive, that flash
alternately with beams within five degrees horizontally to either side
of the longitudinal centerline of the locomotive.
    (ii) An oscillating light may incorporate a device that
automatically extinguishes the white light if display of a light of
another color is required to protect the safety of railroad operations.
* * * * *
    (c)(1) Any lead locomotive equipped with oscillating lights as
described in paragraph (b)(2) of this section that were ordered for
installation on that locomotive prior to January 1, 1996, is considered
in compliance with Sec.  229.125(d)(1) through (3).
    (2) Any lead locomotive equipped with strobe lights as described in
paragraph (b)(1) and operated at speeds no greater than 40 miles per
hour, is considered in compliance with Sec.  229.125(d)(1) through (3)
until the locomotive is retired or rebuilt, whichever comes first.
* * * * *

0
19. Section 229.140 is added to read as follows:

Sec.  229.140  Alerters.

    (a) Except for locomotives covered by part 238 of this chapter,
each of the following locomotives shall be equipped with a functioning
alerter as described in paragraphs (b) through (d) of this section:
    (1) A locomotive that is placed in service for the first time on or
after June 10, 2013, when used as a controlling locomotive and operated
at speeds in excess of 25 mph.
    (2) All controlling locomotives operated at speeds in excess of 25
mph on or after January 1, 2017.
    (b) The alerter on locomotives subject to paragraph (a) of this
section shall be equipped with a manual reset and the alerter warning
timing cycle shall automatically reset as the result of any of the
following operations, and at least three of the following automatic
resets shall be functional at any given time:
    (1) Movement of the throttle handle;
    (2) Movement of the dynamic brake control handle;
    (3) Movement of the operator's horn activation handle;
    (4) Movement of the operator's bell activation switch;
    (5) Movement of the automatic brake valve handle; or
    (6) Bailing the independent brake by depressing the independent
brake valve handle.
    (c) All alerters shall provide an audio alarm upon expiration of
the timing cycle interval. An alerter on a locomotive that is placed in
service for the first time on or after June 10, 2013, shall display a
visual indication to the operator at least five seconds prior to an
audio alarm. The visual indication on an alerter so equipped shall be
visible to the operator from their normal position in the cab.
    (d) Alerter warning timing cycle interval shall be within 10
seconds of the calculated setting utilizing the formula (timing cycle
specified in seconds = 2400 / track speed specified in miles per hour).
    (e) Any locomotive that is equipped with an alerter shall have the
alerter functioning and operating as intended when the locomotive is
used as a controlling locomotive.
    (f) A controlling locomotive equipped with an alerter shall be
tested prior to departure from each initial terminal, or prior to being
coupled as the lead locomotive in a locomotive consist by allowing the
warning timing cycle to expire that results in an application of the
locomotive brakes at a penalty rate.
0
20. Part 229 is amended by adding subpart E to read as follows:
Subpart E--Locomotive Electronics
Sec.
229.301 Purpose and scope.
229.303 Applicability.
229.305 Definitions.
229.307 Safety analysis.
229.309 Safety-critical changes and failures.
229.311 Review of SAs.
229.313 Product testing results and records.
229.315 Operations and maintenance manual.
229.317 Training and qualification program.
229.319 Operating Personnel Training.

Subpart E--Locomotive Electronics

Sec.  229.301  Purpose and scope.

    (a) The purpose of this subpart is to promote the safe design,
operation, and maintenance of safety-critical, as defined in Sec.
229.305, electronic locomotive control systems, subsystems, and
components.
    (b) Locomotive control systems or their functions that comingle
with safety critical processor based signal and train control systems
are regulated under part 236 subparts H and I of this chapter.

Sec.  229.303  Applicability.

    (a) The requirements of this subpart apply to all safety-critical
electronic locomotive control systems, subsystems, and components
(i.e., ``products'' as defined in Sec.  229.305), except for the
following:
    (1) Products that are in service prior to June 8, 2012.
    (2) Products that are under development as of October 9, 2012, and
are placed in service prior to October 9, 2017.
    (3) Products that comingle locomotive control systems with safety
critical processor based signal and train control systems;
    (4) Products that are used during on-track testing within a test
facility; and
    (5) Products that are used during on-track testing outside a test
facility, if approved by FRA. To obtain FRA approval of on-track
testing outside of a test facility, a railroad shall submit a request
to FRA that provides:
    (i) Adequate information regarding the function and history of the
product that it intends to use;
    (ii) The proposed tests;
    (iii) The date, time and location of the tests; and
    (iv) The potential safety consequences that will result from
operating the product for purposes of testing.
    (b) Railroads and vendors shall identify all products that are
under development to FRA by October 9, 2012.
    (c) The exceptions provided in paragraph (a) of this section do not
apply to products or product changes that result in degradation of
safety, or a material increase in safety-critical functionality.

Sec.  229.305  Definitions.

    As used in this subpart--
    Cohesion is a measure of how strongly-related or focused the
responsibilities of a system, subsystem, or component are.
    Comingle refers to the act of creating systems, subsystems, or
components where the systems, subsystems, or components are tightly
coupled and with low cohesion.
    Component means an electronic element, device, or appliance
(including hardware or software) that is part of a system or subsystem.
    Configuration management control plan means a plan designed to
ensure that the proper and intended product configuration, including
the electronic hardware components and software version, is documented
and maintained through the life-cycle of the products in use.
    Executive software means software common to all installations of a
given electronic product. It generally is used to schedule the
execution of the site-specific application programs, run timers, read
inputs, drive outputs, perform self-diagnostics, access and check
memory, and monitor the execution of the application software to detect
unsolicited changes in outputs.
    Initialization refers to the startup process when it is determined
that a product has all required data input and the product is prepared
to function as intended.
    Loosely coupled means an attribute of systems, referring to an
approach to designing interfaces across systems, subsystems, or
components to reduce the interdependencies between them--in particular,
reducing the risk that changes within one system, subsystem, or
component will create unanticipated changes within other system,
subsystem, or component.
    Materials handling refers to explicit instructions for handling
safety-critical components established to comply with procedures
specified by the railroad.
    New or next-generation locomotive control system means a locomotive
control system using technologies or combinations of technologies that
are not in use in revenue service, products that are under development
as of October 9, 2012, are placed into service prior to October 9,
2015, or products without established histories of safe practice.
    Product means any safety critical electronic locomotive control
system, subsystem, or component, not including safety critical
processor based signal and train control systems, whose functions are
directly related to safe movement and stopping of the train as well as
the associated man-machine interfaces irrespective of the location of
the control system, subsystem, or component.
    Revision control means a chain of custody regimen designed to
positively identify safety-critical components and spare equipment
availability, including repair/replacement tracking.
    Safety Analysis refers to a formal set of documentation which
describes in detail all of the safety aspects of the product, including
but not limited to procedures for its development, installation,
implementation, operation, maintenance, repair, inspection, testing,
and modification, as well as analyses supporting its safety claims.
    Safety-critical, as applied to a function, a system, or any portion
thereof, means the correct performance of which is essential to safety
of personnel or equipment, or both; or the incorrect performance of
which could cause a hazardous condition, or allow a hazardous condition
which was intended to be prevented by the function or system to exist.
    Subsystem means a defined portion of a system.
    System refers to any electronic locomotive control system and
includes all subsystems and components thereof, as the context
requires.
    Test facility means a track that is not part of the general
railroad system of transportation and is being used exclusively for the
purpose of testing equipment and has all of its public grade crossings
protected.
    Tightly Coupled means an attribute of systems, referring to an
approach to designing interfaces across systems, subsystems, or
components to maximize the interdependencies between them. In
particular, increasing the risk that changes within one system,
subsystem, or component will create unanticipated changes within other
system, subsystem, or component.

Sec.  229.307  Safety analysis.

    (a) A railroad shall develop a Safety Analysis (SA) for each
product subject to this subpart prior to the initial use of such
product on their railroad.
    (b) The SA shall:
    (1) establish and document the minimum requirements that will
govern the development and implementation of all products subject to
this subpart, and be based on good engineering practice and should be
consistent with the guidance contained in Appendix F of this part in
order to establish that a product's safety-critical functions will
operate with a high degree of confidence in a fail-safe manner;
    (2) Include procedures for immediate repair of safety-critical
functions; and
    (3) Be made available to FRA upon request.
    (c) Each railroad shall comply with the SA requirements and
procedures related to the development, implementation, and repair of a
product subject to this subpart.

Sec.  229.309  Safety-critical changes and failures.

    (a) Whenever a planned safety-critical design change is made to a
product that is in use by a railroad and subject to this subpart, the
railroad shall:
    (1) Notify FRA's Associate Administrator for Safety of the design
changes made by the product supplier;
    (2) Ensure that the SA is updated as required;
    (3) Conduct all safety-critical changes in a manner that allows the
change to be audited;
    (4) Specify all contractual arrangements with suppliers and private
equipment owners for notification of any and all electronic safety-
critical changes as well as safety-critical failures in the suppliers
and private equipment owners' system, subsystem, or components, and the
reasons for that change or failure from the suppliers or equipment
owners, whether or not the railroad has experienced a failure of that
safety critical system, sub-system, or component;
    (5) Specify the railroad's procedures for action upon receipt of
notification of a safety-critical change or failure of an electronic
system, sub-system, or component, and until the upgrade or revision has
been installed; and
    (6) Identify all configuration/revision control measures designed
to ensure that safety-functional requirements and safety-critical
hazard mitigation processes are not compromised as a result of any such
change, and that any such change can be audited.
    (b) Product suppliers and private equipment owners shall report any
safety-critical changes and previously unidentified hazards to each
railroad using the product or equipment.
    (c) Private equipment owners shall establish configuration/revision
control measures for control of safety-critical changes and
identification of previously unidentified hazards.

Sec.  229.311  Review of SAs.

    (a) Prior to the initial planned use of a product subject to this
subpart, a railroad shall inform the Associate Administrator for
Safety/Chief Safety Officer, FRA, 1200 New Jersey Avenue SE., Mail Stop
25, Washington, DC 20590 of the intent to place this product

in service. The notification shall provide a description of the
product, and identify the location where the complete SA documentation
described in Sec.  229.307, the testing records contained in Sec.
229.313, and the training and qualification program described in Sec.
229.319 is maintained.
    (b) FRA may review or audit the SA within 60 days of receipt of the
notification or anytime after the product is placed in use. If FRA has
not notified the railroad of its intent to review or audit the SA
within the 60-day period, the railroad may assume that FRA does not
intend to review or audit, and place the product in use. FRA reserves
the right, however, to conduct a review or audit at a later date.
    (c) A railroad shall maintain and make available to FRA upon
request all railroad or vendor documentation used to demonstrate that
the product meets the safety requirements of the SA for the life-cycle
of the product.
    (d) After a product is placed in service, the railroad shall
maintain a database of all safety-relevant hazards encountered with the
product. The database shall include all hazards identified in the SA
and those that had not been previously identified in the SA. If the
frequency of the safety-relevant hazards exceeds the threshold set
forth in the SA, then the railroad shall:
    (1) Report the inconsistency by mail, facsimile, email, or hand
delivery to the Director, Office of Safety Assurance and Compliance,
FRA, 1200 New Jersey Ave. SE., Mail Stop 25, Washington, DC 20590,
within 15 days of discovery;
    (2) Take immediate countermeasures to reduce the frequency of the
safety-relevant hazard(s) below the threshold set forth in the SA; and
    (3) Provide a final report to FRA's Director, Office of Safety
Assurance and Compliance, on the results of the analysis and
countermeasures taken to reduce the frequency of the safety-relevant
hazard(s) below the calculated probability of failure threshold set
forth in the SA when the problem is resolved. For hazards not
identified in the SA the threshold shall be exceeded at one occurrence.

Sec.  229.313  Product testing results and records.

    (a) Results of product testing conducted by a railroad as required
by this subpart shall be recorded on preprinted forms provided by the
railroad, or stored electronically. Electronic recordkeeping or
automated tracking systems, subject to the provisions contained in
paragraph (e) of this section, may be utilized to store and maintain
any testing or training record required by this subpart. Results of
product testing conducted by a vendor or private equipment owner in
support of a SA shall be provided to the railroad as part of the SA.
    (b) The testing records shall contain all of the following:
    (1) The name of the railroad;
    (2) The location and date that the test was conducted;
    (3) The equipment tested;
    (4) The results of tests;
    (5) The repairs or replacement of equipment;
    (6) Any preventative adjustments made; and
    (7) The condition in which the equipment is left.
    (c) Each record shall be:
    (1) Signed by the employee conducting the test, or electronically
coded, or identified by the automated test equipment number;
    (2) Filed in the office of a supervisory official having
jurisdiction, unless otherwise noted; and
    (3) Available for inspection and copying by FRA.
    (d) The results of the testing conducted in accordance with this
subpart shall be retained as follows:
    (1) The results of tests that pertain to installation or
modification of a product shall be retained for the life-cycle of the
product tested and may be kept in any office designated by the
railroad;
    (2) The results of periodic tests required for the maintenance or
repair of the product tested shall be retained until the next record is
filed and in no case less than one year; and
    (3) The results of all other tests and training shall be retained
until the next record is filed and in no case less than one year.
    (e) Electronic or automated tracking systems used to meet the
requirements contained in paragraph (a) of this section shall be
capable of being reviewed and monitored by FRA at any time to ensure
the integrity of the system. FRA's Associate Administrator for Safety
may prohibit or revoke a railroad's authority to utilize an electronic
or automated tracking system in lieu of preprinted forms if FRA finds
that the electronic or automated tracking system is not properly
secured, is inaccessible to FRA, or railroad employees requiring access
to discharge their assigned duties, or fails to adequately track and
monitor the equipment. The Associate Administrator for Safety will
provide the affected railroad with a written statement of the basis for
the decision prohibiting or revoking the railroad from utilizing an
electronic or automated tracking system.

Sec.  229.315  Operations and maintenance manual.

    (a) The railroad shall maintain all documents pertaining to the
installation, maintenance, repair, modification, inspection, and
testing of a product subject to this part in one Operations and
Maintenance Manual (OMM).
    (1) The OMM shall be legible and shall be readily available to
persons who conduct the installation, maintenance, repair,
modification, inspection, and testing, and for inspection by FRA.
    (2) At a minimum, the OMM shall contain all product vendor
operation and maintenance guidance.
    (b) The OMM shall contain the plans and detailed information
necessary for the proper maintenance, repair, inspection, and testing
of products subject to this subpart. The plans shall identify all
software versions, revisions, and revision dates.
    (c) Hardware, software, and firmware revisions shall be documented
in the OMM according to the railroad's configuration management control
plan.
    (d) Safety-critical components, including spare products, shall be
positively identified, handled, replaced, and repaired in accordance
with the procedures specified in the railroad's configuration
management control plan.
    (e) A railroad shall determine that the requirements of this
section have been met prior to placing a product subject to this
subpart in use on their property.

Sec.  229.317  Training and qualification program.

    (a) A railroad shall establish and implement training and
qualification program for products subject to this subpart prior to the
product being placed in use. These programs shall meet the requirements
set forth in this section and in Sec.  229.319.
    (b) The program shall provide training for the individuals
identified in this paragraph to ensure that they possess the necessary
knowledge and skills to effectively complete their duties related to
the product. These include:
    (1) Individuals whose duties include installing, maintaining,
repairing, modifying, inspecting, and testing safety-critical elements
of the product;
    (2) Individuals who operate trains or serve as a train or engine
crew member subject to instruction and testing under part 217 of this
chapter;
    (3) Roadway and maintenance-of-way workers whose duties require
them to know and understand how the product affects their safety and
how to avoid interfering with its proper functioning; and

    (4) Direct supervisors of the individuals identified in paragraphs
(b)(1) through (3) of this section.
    (c) When developing the training and qualification program required
in this section, a railroad shall conduct a formal task analysis. The
task analysis shall:
    (1) Identify the specific goals of the program for each target
population (craft, experience level, scope of work, etc.), task(s), and
desired success rate;
    (2) Identify the installation, maintenance, repair, modification,
inspection, testing, and operating tasks that will be performed on the
railroad's products, including but not limited to the development of
failure scenarios and the actions expected under such scenarios;
    (3) Develop written procedures for the performance of the tasks
identified; and
    (4) Identify any additional knowledge, skills, and abilities above
those required for basic job performance necessary to perform each
task.
    (d) Based on the task analysis, a railroad shall develop a training
curriculum that includes formally structured training designed to
impart the knowledge, skills, and abilities identified as necessary to
perform each task.
    (e) All individuals identified in paragraph (b) of this section
shall successfully complete a training curriculum and pass an
examination that covers the product and appropriate rules and tasks for
which they are responsible (however, such persons may perform such
tasks under the direct onsite supervision of a qualified person prior
to completing such training and passing the examination).
    (f) A railroad shall conduct periodic refresher training at
intervals to be formally specified in the program, except with respect
to basic skills for which proficiency is known to remain high as a
result of frequent repetition of the task.
    (g) A railroad shall conduct regular and periodic evaluations of
the effectiveness of the training program, verifying the adequacy of
the training material and its validity with respect to the railroad's
products and operations.
    (h) A railroad shall maintain records that designate individuals
who are qualified under this section until new designations are
recorded or for at least one year after such persons leave applicable
service. These records shall be maintained in a designated location and
be available for inspection and replication by FRA.

Sec.  229.319  Operating Personnel Training.

    (a) The training required under Sec.  229.317 for any locomotive
engineer or other person who participates in the operation of a train
using an onboard electronic locomotive control system shall address all
of the following elements and shall be specified in the training
program.
    (1) Familiarization with the electronic control system equipment
onboard the locomotive and the functioning of that equipment as part of
the system and in relation to other onboard systems under that person's
control;
    (2) Any actions required of the operating personnel to enable or
enter data into the system and the role of that function in the safe
operation of the train;
    (3) Sequencing of interventions by the system, including
notification, enforcement, penalty initiation and post penalty
application procedures as applicable;
    (4) Railroad operating rules applicable to control systems,
including provisions for movement and protection of any unequipped
trains, or trains with failed or cut-out controls;
    (5) Means to detect deviations from proper functioning of onboard
electronic control system equipment and instructions explaining the
proper response to be taken regarding control of the train and
notification of designated railroad personnel; and
    (6) Information needed to prevent unintentional interference with
the proper functioning of onboard electronic control equipment.
    (b) The training required under this subpart for a locomotive
engineer and conductor, together with required records, shall be
integrated into the program of training required by parts 240 and 242
of this chapter.

0
21. Appendix B is amended by:
0
a. Adding an entry under subpart A for 229.15;
0
b. Revising the entries under subpart B for 229.23 and 229.25 and under
subpart C for 229.105;
0
c. Adding an entry under subpart C for 229.114;
0
d. Adding in the entry under subpart C for 229.119 entries for
paragraphs (g), (h), and (i);
0
e. Adding an entry under subpart C for 229.140;
0
f. Moving the entry for 229.141 into numerical order under subpart C;
and
0
g. Adding an entry for subpart E.
    The additions and revisions read as follows:

Appendix B to Part 229--Schedule of Civil Penalties \(1)\

------------------------------------------------------------------------
                                                               Willful
                 Section                      Violation       violation
------------------------------------------------------------------------
                           Subpart A--General

                              * * * * * * *
229.15 Remote control locomotives.......              2,500        5,000

                              * * * * * * *
                     Subpart B--Inspection and tests

                              * * * * * * *
229.23 Periodic inspection General:
    (a)(1) Inspection overdue...........              2,500        5,000
    (a)(2) Inspection performed                       2,500        5,000
     improperly or at a location where
     the underneath portion cannot be
     safely inspected...................
    (b)(1) Inspection overdue...........              2,500        5,000
    (b)(2) Inspection overdue...........              2,500        5,000
    (c) Inspection overdue..............              2,500        5,000
    (e):
        (1) Form missing................              1,000        2,000
        (2) Form not properly displayed.              1,000        2,000
        (3) Form improperly executed....              1,000        2,000
    (f) Replace Form FRA F 6180.49A by    .................  ...........
     April 2 or July 3..................
    (g) Secondary record of the                       1,000        2,000
     information reported Form FRA F
     6180.49A...........................

                              * * * * * * *
229.25 Tests: every periodic inspection:
    (a) through (d)(4) and (e) and (f)                2,500        5,000
     Tests..............................
    (d)(5) Ineffective maintenance......              8,000       16,000

                              * * * * * * *
229.105 Steam generator number..........              1,000        1,500

                              * * * * * * *
229.114 Steam generator inspections and               2,500        5,000
 tests..................................

                              * * * * * * *
229.119 Cabs, floors, and passageways:

                              * * * * * * *
    (g) Failure to equip................              2,500        5,000
    (h) Failure to maintain.............              2,500        5,000
    (i) Failure to equip................              2,500        5,000

                              * * * * * * *
229.140 Alerters........................              2,500        5,000

                              * * * * * * *
                    Subpart E--Locomotive Electronics
229.307 Safety analysis:
    (a) Failure to establish and                      5,000       10,000
     maintain a safety analysis.........
    (b) Failure to provide safety                     2,500        5,000
     analysis upon request..............
    (c) Failure to comply with safety          5,000-10,000       15,000
     analysis...........................
229.309 Safety-critical changes and
 failure:
    (a)(1) Failure to notify FRA........              1,000        2,000
    (a)(2) Failure to update safety                   3,500        7,000
     analysis...........................
    (a)(4) Failure to notify                         10,000       15,000
     manufacturer.......................
    (b) Failure to notify railroad......             10,000       15,000
    (c) Failure to establish and                      3,500        7,000
     maintain program...................
229.311 Review of SAs:
    (a) Failure to notify FRA...........              1,000        2,000
    (b) Failure to report...............              1,000        2,000
    (c) Failure to correct safety              5,000-10,000       15,000
     hazards............................
    (d) Failure to final report.........              1,000        2,000
229.313 Product testing results and
 records:
    (a) Failure to maintain records and               5,000       10,000
     database...........................
    (b) Incomplete testing records......              3,500        7,000
    (c) Improper signature..............              3,500        7,000
229.315 Operations and maintenance
 manual:
    (a) Failure to implement and                      5,000       10,000
     maintain manual....................
    (c) Failure to document revisions...              5,000       10,000
    (d) Failure to follow plan..........       5,000-10,000       15,000
229.317 Training and qualification
 program:
    (a) Failure to establish and                      5,000       10,000
     implement program..................
    (b) Failure to conduct training.....              2,500        5,000
    (g) Failure to evaluate program.....              2,500        5,000
    (h) Failure to maintain records.....              1,500        3,000
229.319 Operating personnel training....              2,500        5,000
------------------------------------------------------------------------
\1\ A penalty may be assessed against an individual only for a willful
  violation. Generally, when two or more violations of these regulations
  are discovered with respect to a single locomotive that is used by a
  railroad, the appropriate penalties set forth above are aggregated up
  to a maximum of $16,000 per day. However, a failure to perform, with
  respect to a particular locomotive, any of the inspections and tests
  required under subpart B of this part will be treated as a violation
  separate and distinct from, and in addition to, any substantive
  violative conditions found on that locomotive. Moreover, the
  Administrator reserves the right to assess a penalty of up to $100,000
  for any violation where circumstances warrant. See 49 CFR part 209,
  appendix A.
Failure to observe any condition for movement set forth in Sec.   229.9
  will deprive the railroad of the benefit of the movement-for-repair
  provision and make the railroad and any responsible individuals liable
  for penalty under the particular regulatory section(s) concerning the
  substantive defect(s) present on the locomotive at the time of
  movement. Failure to comply with Sec.   229.19 will result in the
  lapse of any affected waiver.

0
22. Part 229 is amended by adding Appendix F to read as follows:

Appendix F to Part 229--Recommended Practices for Design and Safety
Analysis

    The purpose of this appendix is to provide recommended criteria
for design and safety analysis that will maximize the safety of
electronic locomotive control systems and mitigate potential
negative safety effects. It seeks to promote full disclosure of
potential safety risks to facilitate minimizing or eliminating
elements of risk where practicable. It discuses critical elements of
good engineering practice that the designer should consider when
developing safety critical electronic locomotive control systems

to accomplish this objective. The criteria and processes specified
this appendix is intended to minimize the probability of failure to
an acceptable level within the limitations of the available
engineering science, cost, and other constraints. Railroads
procuring safety critical electronic locomotive controls are
encouraged to ensure that their vendor addresses each of the
elements of this appendix in the design of the product being
procured. FRA uses the criteria and processes set forth in this
appendix (or other technically equivalent criteria and processes
that may be recommended by industry) when evaluating analyses,
assumptions, and conclusions provided in the SA documents.

Definitions

    In addition to the definitions contained in Sec.  229.305, the
following definitions are applicable to this Appendix:
    Hazard means an existing or potential condition that can result
in an accident.
    High degree of confidence, as applied to the highest level of
aggregation, means there exists credible safety analysis supporting
the conclusion that the risks associated with the product have been
adequately mitigated.
    Human factors refers to a body of knowledge about human
limitations, human abilities, and other human characteristics, such
as behavior and motivation, that shall be considered in product
design.
    Human-machine interface (HMI) means the interrelated set of
controls and displays that allows humans to interact with the
machine.
    Risk means the expected probability of occurrence for an
individual accident event (probability) multiplied by the severity
of the expected consequences associated with the accident
(severity).
    Risk assessment means the process of determining, either
quantitatively or qualitatively, the measure of risk associated with
use of the product under all intended operating conditions.
    System Safety Precedence means the order of precedence in which
methods used to eliminate or control identified hazards within a
system are implemented.
    Validation means the process of determining whether a product's
design requirements fulfill its intended design objectives during
its development and life-cycle. The goal of the validation process
is to determine ``whether the correct product was built.''
    Verification means the process of determining whether the
results of a given phase of the development cycle fulfill the
validated requirements established at the start of that phase. The
goal of the verification process is to determine ``whether the
product was built correctly.''

Safety Assessments--Recommended Contents

    The safety-critical assessment of each product should include
all of its interconnected subsystems and components and, where
applicable, the interaction between such subsystems. FRA recommends
that such assessments contain the following:
    (a) A complete description of the product, including a list of
all product components and their physical relationship in the
subsystem or system;
    (b) A description of the railroad operation or categories of
operations on which the product is designed to be used;
    (c) An operational concepts document, including a complete
description of the product functionality and information flows; as
well as identifying which functions are intended to enhance or
preserve safety and the manner in which the product architecture
implements these functions;
    (d) A safety requirements document, including a list with
complete descriptions of all functions, which the product performs
to enhance or preserve safety, and that describes the manner in
which product architecture satisfies safety requirements;
    (e) A hazard log consisting of a comprehensive description of
all safety relevant hazards addressed during the life cycle of the
product, including maximum threshold limits for each hazard (for
unidentified hazards, the threshold shall be exceeded at one
occurrence);
    (f) A risk assessment and analysis.
    (1) The risk metric for the proposed product should describe
with a high degree of confidence the accumulated risk of a
locomotive control system that operates over the intended product
life. Each risk metric for the proposed product should be expressed
with an upper bound, as estimated with a sensitivity analysis, and
the risk value selected is demonstrated to have a high degree of
confidence.
    (2) Each risk calculation should consider the totality of the
locomotive control system and its method of operation. The failure
modes of each subsystem or component, or both, should be determined
for the integrated hardware/software (where applicable) as a
function of the Mean Time to Hazardous Events (MTTHE), failure
restoration rates, and the integrated hardware/software coverage of
all processor based subsystems or components, or both. Train
operating and movement rules, along with components that are layered
in order to enhance safety-critical behavior, should also be
considered.
    (3) An MTTHE value should be calculated for each subsystem or
component, or both, indicating the safety-critical behavior of the
integrated hardware/software subsystem or component, or both. The
human factor impact should be included in the assessment, whenever
applicable, to provide an integrated MTTHE value. The MTTHE
calculation should consider the rates of failures caused by
permanent, transient, and intermittent faults accounting for the
fault coverage of the integrated hardware/software subsystem or
component, phased-interval maintenance, and restoration of the
detected failures.
    (4) The analysis should clearly document:
    (i) Any assumptions regarding the reliability or availability of
mechanical, electric, or electronic components. Such assumptions
include MTTF projections, as well as Mean Time To Repair (MTTR)
projections, unless the risk assessment specifically explains why
these assumptions are not relevant. The analysis should document
these assumptions in such a form as to permit later comparisons with
in-service experience (e.g., a spreadsheet). The analysis should
also document any assumptions regarding human performance. The
documentation should be in a form that facilitates later comparisons
with in-service experience.
    (ii) Any assumptions regarding software defects. These
assumptions should be in a form which permits the railroad to
project the likelihood of detecting an in-service software defect
and later comparisons with in-service experience.
    (iii) All of the identified safety-critical fault paths leading
to a mishap as predicted by the SA. The documentation should be in a
form that facilitates later comparisons with in-service faults.
    (4) MTTHE compliance verification and validation should be based
on the assessment of the design for verification and validation
process, historical performance data, analytical methods and
experimental safety critical performance testing performed on the
subsystem or component. The compliance process shall be demonstrated
to be compliant and consistent with the MTTHE metric and
demonstrated to have a high degree of confidence.
    (5) The safety-critical behavior of all non-processor based
components, which are part of a processor-based system or subsystem,
should be quantified with an MTTHE metric. The MTTHE assessment
methodology should consider failures caused by permanent, transient,
and intermittent faults, phase interval maintenance and restoration
of failures and the effect of fault coverage of each non-processor-
based subsystem or component. The MTTHE compliance verification and
validation should be based on the assessment of the design for
verification and validation process, historical performance data,
analytical methods and experimental safety critical performance
testing performed on the subsystem or component. The non-processor
based quantification compliance should also be demonstrated to have
a high degree of confidence.
    (g) A hazard mitigation analysis, including a complete and
comprehensive description of all hazards to be addressed in the
system design and development, mitigation techniques used, and
system safety precedence followed;
    (h) A complete description of the safety assessment and
verification and validation processes applied to the product and the
results of these processes;
    (i) A complete description of the safety assurance concepts used
in the product design, including an explanation of the design
principles and assumptions; the designer should address each of the
following safety considerations when designing and demonstrating the
safety of products covered by this part. In the event that any of
these principles are not followed, the analysis should describe both
the reason(s) for departure and the alternative(s) utilized to
mitigate or eliminate the hazards associated with the design
principle not followed.
    (1) Normal operation. The system (including all hardware and
software) should demonstrate safe operation with no hardware
failures under normal anticipated operating conditions with proper
inputs and within the

expected range of environmental conditions. All safety-critical
functions should be performed properly under these normal
conditions. Absence of specific operator actions or procedures will
not prevent the system from operating safely. Hazards categorized as
unacceptable should be eliminated by design. Best effort should also
be made by the designer to eliminate hazards that are undesirable.
Those undesirable hazards that cannot be eliminated must be
mitigated to an acceptable level.
    (2) Systematic failure. It should be shown how the product is
designed to mitigate or eliminate unsafe systematic failures--those
conditions which can be attributed to human error that could occur
at various stages throughout product development. This includes
unsafe errors in the software due to human error in the software
specification, design or coding phase, or both; human errors that
could impact hardware design; unsafe conditions that could occur
because of an improperly designed human-machine interface;
installation and maintenance errors; and errors associated with
making modifications.
    (3) Random failure. The product should be shown to operate
safely under conditions of random hardware failure. This includes
single as well as multiple hardware failures, particularly in
instances where one or more failures could occur, remain undetected
(latent) and react in combination with a subsequent failure at a
later time to cause an unsafe operating situation. In instances
involving a latent failure, a subsequent failure is similar to there
being a single failure. In the event of a transient failure, and if
so designed, the system should restart itself if it is safe to do
so. Frequency of attempted restarts should be considered in the
hazard analysis. There should be no single point failures in the
product that can result in hazards categorized as unacceptable or
undesirable. Occurrence of credible single point failures that can
result in hazards shall be detected and the product shall be
detected and the product should achieve a known state that
eliminates the possibility of false activation of any physical
appliance. If one non-self-revealing failure combined with a second
failure can cause a hazard that is categorized as unacceptable or
undesirable, then the second failure should be detected and the
product must achieve a known safe state that eliminates the
possibility of false activation.
    (4) Common Mode failure. Another concern of multiple failures
involves common mode failure in which two or more subsystems or
components intended to compensate one another to perform the same
function all fail by the same mode and result in unsafe conditions.
This is of particular concern in instances in which two or more
elements (hardware or software, or both) are used in combination to
ensure safety. If a common mode failure exists, then any analysis
cannot rely on the assumption that failures are independent.
Examples include: the use of redundancy in which two or more
elements perform a given function in parallel and when one (hardware
or software) element checks/monitors another element (of hardware or
software) to help ensure its safe operation. Common mode failure
relates to independence, which shall be ensured in these instances.
When dealing with the effects of hardware failure, the designer
should address the effects of the failure not only on other
hardware, but also on the execution of the software, since hardware
failures can greatly affect how the software operates.
    (5) External influences. The product should operate safely when
subjected to different external influences, including:
    (i) Electrical influences such as power supply anomalies/
transients, abnormal/improper input conditions (e.g., outside of
normal range inputs relative to amplitude and frequency, unusual
combinations of inputs) including those related to a human operator,
and others such as electromagnetic interference or electrostatic
discharges, or both;
    (ii) Mechanical influences such as vibration and shock; and
climatic conditions such as temperature and humidity.
    (6) Modifications. Safety must be ensured following
modifications to the hardware or software, or both. All or some of
the concerns previously identified may be applicable depending upon
the nature and extent of the modifications.
    (7) Software. Software faults should not cause hazards
categorized as unacceptable or undesirable.
    (8) Closed Loop Principle. The product design should require
positive action to be taken in a prescribed manner to either begin
product operation or continue product operation.
    (j) A human factors analysis, including a complete description
of all human-machine interfaces, a complete description of all
functions performed by humans in connection with the product to
enhance or preserve safety, and an analysis of the physical
ergonomics of the product on the operators and the safe operation of
the system;
    (k) A complete description of the specific training of railroad
and contractor employees and supervisors necessary to ensure the
safe and proper installation, implementation, operation,
maintenance, repair, inspection, testing, and modification of the
product;
    (l) A complete description of the specific procedures and test
equipment necessary to ensure the safe and proper installation,
implementation, operation, maintenance, repair, inspection, test,
and modification of the product. These procedures, including
calibration requirements, should be consistent with or explain
deviations from the equipment manufacturer's recommendations;
    (m) A complete description of the necessary security measures
for the product over its life-cycle;
    (n) A complete description of each warning to be placed in the
Operations and Maintenance Manual and of all warning labels required
to be placed on equipment as necessary to ensure safety;
    (o) A complete description of all initial implementation testing
procedures necessary to establish that safety-functional
requirements are met and safety-critical hazards are appropriately
mitigated;
    (p) A complete description of all post-implementation testing
(validation) and monitoring procedures, including the intervals
necessary to establish that safety-functional requirements, safety-
critical hazard mitigation processes, and safety-critical tolerances
are not compromised over time, through use, or after maintenance
(repair, replacement, adjustment) is performed; and
    (q) A complete description of each record necessary to ensure
the safety of the system that is associated with periodic
maintenance, inspections, tests, repairs, replacements, adjustments,
and the system's resulting conditions, including records of
component failures resulting in safety relevant hazards;
    (r) A complete description of any safety-critical assumptions
regarding availability of the product, and a complete description of
all backup methods of operation; and
    (s) The configuration/revision control measures designed to
ensure that safety-functional requirements and safety-critical
hazard mitigation processes are not compromised as a result of any
change. Changes classified as maintenance require validation.

Guidance Regarding the Application of Human Factors in the Design of
Products

    The product design should sufficiently incorporate human factors
engineering that is appropriate to the complexity of the product;
the gender, educational, mental, and physical capabilities of the
intended operators and maintainers; the degree of required human
interaction with the component; and the environment in which the
product will be used. HMI design criteria minimize negative safety
effects by causing designers to consider human factors in the
development of HMIs. As used in this discussion, ``designer'' means
anyone who specifies requirements for--or designs a system or
subsystem, or both, for--a product subject to this part, and
``operator'' means any human who is intended to receive information
from, provide information to, or perform repairs or maintenance on a
safety critical locomotive control product subject to this part.
    I. FRA recommends that system designers should:
    (a) Design systems that anticipate possible user errors and
include capabilities to catch errors before they propagate through
the system;
    (b) Conduct cognitive task analyses prior to designing the
system to better understand the information processing requirements
of operators when making critical decisions;
    (c) Present information that accurately represents or predicts
system states; and
    (d) Ensure that electronics equipment radio frequency emissions
are compliant with appropriate Federal Communications Commission
(FCC) regulations. The FCC rules and regulations are codified in
Title 47 of the Code of Federal Regulations (CFR). The following
documentation is applicable to obtaining FCC Equipment
Authorization:
    (1) OET Bulletin Number 61 (October, 1992 Supersedes May, 1987
issue) FCC Equipment Authorization Program for Radio Frequency
Devices. This document provides an overview of the equipment
authorization

program to control radio interference from radio transmitters and
certain other electronic products and how to obtain an equipment
authorization.
    (2) OET Bulletin 63: (October 1993) Understanding The FCC Part
15 Regulations for Low Power, Non-Licensed Transmitters. This
document provides a basic understanding of the FCC regulations for
low power, unlicensed transmitters, and includes answers to some
commonly-asked questions. This edition of the bulletin does not
contain information concerning personal communication services (PCS)
transmitters operating under Part 15, Subpart D of the rules.
    (3) Title 47 Code of Federal Regulations Parts 0 to 19. The FCC
rules and regulations governing PCS transmitters may be found in 47
CFR, Parts 0 to 19.
    (4) OET Bulletin 62 (December 1993) Understanding The FCC
Regulations for Computers and other Digital Devices. This document
has been prepared to provide a basic understanding of the FCC
regulations for digital (computing) devices, and includes answers to
some commonly-asked questions.
    II. Human factors issues designers should consider with regard
to the general functioning of a system include:
    (a) Reduced situational awareness and over-reliance. HMI design
shall give an operator active functions to perform, feedback on the
results of the operator's actions, and information on the automatic
functions of the system as well as its performance. The operator
shall be ``in-the loop.'' Designers should consider at minimum the
following methods of maintaining an active role for human operators:
    (1) The system should require an operator to initiate action to
operate the train and require an operator to remain ``in-the-loop''
for at least 30 minutes at a time;
    (2) The system should provide timely feedback to an operator
regarding the system's automated actions, the reasons for such
actions, and the effects of the operator's manual actions on the
system;
    (3) The system should warn operators in advance when they
require an operator to take action;
    (4) HMI design should equalize an operator's workload; and
    (5) HMI design should not distract from the operator's safety
related duties.
    (b) Expectation of predictability and consistency in product
behavior and communications. HMI design should accommodate an
operator's expectation of logical and consistent relationships
between actions and results. Similar objects should behave
consistently when an operator performs the same action upon them.
End users have a limited memory and ability to process information.
Therefore, HMI design should also minimize an operator's information
processing load.
    (1) To minimize information processing load, the designer
should:
    (i) Present integrated information that directly supports the
variety and types of decisions that an operator makes;
    (ii) Provide information in a format or representation that
minimizes the time required to understand and act; and
    (iii) Conduct utility tests of decision aids to establish clear
benefits such as processing time saved or improved quality of
decisions.
    (2) To minimize short-term memory load, the designer should
integrate data or information from multiple sources into a single
format or representation (``chunking'') and design so that three or
fewer ``chunks'' of information need to be remembered at any one
time. To minimize long-term memory load, the designer should design
to support recognition memory, design memory aids to minimize the
amount of information that should be recalled from unaided memory
when making critical decisions, and promote active processing of the
information.
    (3) When creating displays and controls, the designer shall
consider user ergonomics and should:
    (i) Locate displays as close as possible to the controls that
affect them;
    (ii) Locate displays and controls based on an operator's
position;
    (iii) Arrange controls to minimize the need for the operator to
change position;
    (iv) Arrange controls according to their expected order of use;
    (v) Group similar controls together;
    (vi) Design for high stimulus-response compatibility (geometric
and conceptual);
    (vii) Design safety-critical controls to require more than one
positive action to activate (e.g., auto stick shift requires two
movements to go into reverse);
    (viii) Design controls to allow easy recovery from error; and
    (ix) Design display and controls to reflect specific gender and
physical limitations of the intended operators.
    (4) Detailed locomotive ergonomics human machine interface
guidance may be found in ``Human Factors Guidelines for Locomotive
Cabs'' (FRA/ORD-98/03 or DOT-VNTSC-FRA-98-8).
    (5) The designer should also address information management. To
that end, HMI design should:
    (i) Display information in a manner which emphasizes its
relative importance;
    (ii) Comply with the ANSI/HFS 100-2007, or more recent standard;
    (iii) Utilize a display luminance that has a difference of at
least 35cd/m2 between the foreground and background (the displays
should be capable of a minimum contrast 3:1 with 7:1 preferred, and
controls should be provided to adjust the brightness level and
contrast level);
    (iv) Display only the information necessary to the user;
    (v) Where text is needed, use short, simple sentences or phrases
with wording that an operator will understand and appropriate to the
educational and cognitive capabilities of the intended operator;
    (vi) Use complete words where possible; where abbreviations are
necessary, choose a commonly accepted abbreviation or consistent
method and select commonly used terms and words that the operator
will understand;
    (vii) Adopt a consistent format for all display screens by
placing each design element in a consistent and specified location;
    (viii) Display critical information in the center of the
operator's field of view by placing items that need to be found
quickly in the upper left hand corner and items which are not time-
critical in the lower right hand corner of the field of view;
    (ix) Group items that belong together;
    (x) Design all visual displays to meet human performance
criteria under monochrome conditions and add color only if it will
help the user in performing a task, and use color coding as a
redundant coding technique;
    (xi) Limit the number of colors over a group of displays to no
more than seven;
    (xii) Design warnings to match the level of risk or danger with
the alerting nature of the signal; and
    (xiii) With respect to information entry, avoid full QWERTY
keyboards for data entry.
    (6) With respect to problem management, the HMI designer should
ensure that the HMI design:
    (i) enhances an operator's situation awareness;
    (ii) supports response selection and scheduling; and
    (iii) supports contingency planning.
    (7) Designers should comply with FCC requirements for Maximum
Permissible Exposure limits for field strength and power density for
the transmitters operating at frequencies of 300 kHz to 100 GHz and
specific absorption rate (SAR) limits for devices operating within
close proximity to the body. The Commission's requirements are
detailed in Parts 1 and 2 of the FCC's Rules and Regulations (47 CFR
1.1307(b), 1.1310, 2.1091, 2.1093). The FCC has a number of
bulletins and supplements that offer guidelines and suggestions for
evaluating compliance. These documents are not intended to establish
mandatory procedures; other methods and procedures may be acceptable
if based on sound engineering practice.
    (i) OET Bulletin No. 65 (Edition 97-01, August 1997),
``Evaluating Compliance With FCC Guidelines For Human Exposure To
Radio frequency Electromagnetic Fields'';
    (ii) OET Bulletin No 65 Supplement A, (Edition 97-01, August
1997), OET Bulletin No 65 Supplement B (Edition 97-01, August 1997);
and
    (iii) OET Bulletin No 65 Supplement C (Edition 01-01, June
2001). This bulletin provides assistance in determining whether
proposed or existing transmitting facilities, operations, or devices
comply with limits for human exposure to radio frequency RF fields
adopted by the FCC.

Guidance for Verification and Validation of Products

    The goal of this assessment is to provide an evaluation of the
product manufacturer's utilization of safety design practices during
the product's development and testing phases, as required by the
applicable railroad's requirements, the requirements of this part,
and any other previously agreed-upon controlling documents or
standards. The standards employed for verification or validation, or
both, of products shall be sufficient to support achievement of the
applicable requirements of this part.
    (a) The latest version of the following standards have been
recognized by FRA as

providing appropriate risk analysis processes for incorporation into
verification and validation standards.
    (1) U.S. Department of Defense Military Standard (MIL-STD) 882C,
``System Safety Program Requirements'' (January 19, 1993);
    (2) The most recent CENLE/IEC Standards as follows:
    (i) EN50126:/IEC 62278, Railway Applications: Communications,
Signaling, and Processing Systems Specification and Demonstration of
Reliability, Availability, Maintainability and Safety (RAMS);
    (ii) EN50128/IEC 62279, Railway Applications: Communications,
Signaling, and Processing Systems Software for Railway Control and
Protection Systems;
    (iii) EN50129, Railway Applications: Communications, Signaling,
and Processing Systems-Safety Related Electronic Systems for
Signaling; and
    (iv) EN50155, Railway Applications: Electronic Equipment Used in
Rolling Stock.
    (3) ATCS Specification 140, Recommended Practices for Safety and
Systems Assurance.
    (4) ATCS Specification 130, Software Quality Assurance.
    (5) Safety of High Speed Ground Transportation Systems.
Analytical Methodology for Safety Validation of Computer Controlled
Subsystems. Volume II: Development of a Safety Validation
Methodology. Final Report September 1995. Author: Jonathan F.
Luedeke, Battelle. DOT/FRA/ORD-95/10.2.
    (6) IEC 61508 (International Electro-technical Commission),
Functional Safety of Electrical/Electronic/Programmable/Electronic
Safety (E/E/P/ES) Related Systems, Parts 1-7 as follows:
    (i) IEC 61508-1 (1998-12) Part 1: General requirements and IEC
61508-1 Corr. (1999-05) Corrigendum 1-Part 1: General Requirements;
    (ii) IEC 61508-2 (2000-05) Part 2: Requirements for electrical/
electronic/programmable electronic safety-related systems;
    (iii) IEC 61508-3 (1998-12) Part 3: Software requirements and
IEC 61508-3 Corr.1(1999-04) Corrigendum 1-Part3: Software
requirements;
    (iv) IEC 61508-4 (1998-12) Part 4: Definitions and abbreviations
and IEC 61508-4 Corr.1(1999-04) Corrigendum 1-Part 4: Definitions
and abbreviations;
    (v) IEC 61508-5 (1998-12) Part 5: Examples of methods for the
determination of safety integrity levels and IEC 61508-5 Corr.1
(1999-04) Corrigendum 1 Part 5: Examples of methods for
determination of safety integrity levels;
    (vi) 1IEC 61508-6 (2000-04) Part 6: Guidelines on the
applications of IEC 61508-2 and -3; and,
    (vii) IEC 61508-7 (2000-03) Part 7: Overview of techniques and
measures.
    (7) ANSI/GEIA-STD-0010: Standard Best Practices for System
Safety Program Development and Execution
    (b) When using unpublished standards, including proprietary
standards, the standards should be available for inspection and
replication by the railroad and FRA and should be available for
public examination.
    (c) Third party assessments. The railroad, the supplier, or FRA
may conclude it is necessary for a third party assessment of the
system. A third party assessor should be ``independent''. An
``independent third party'' means a technically competent entity
responsible to and compensated by the railroad (or an association on
behalf of one or more railroads) that is independent of the supplier
of the product. An entity that is owned or controlled by the
supplier, that is under common ownership or control with the
supplier, or that is otherwise involved in the development of the
product would not be considered ``independent''.
    (1) The reviewer should not engage in design efforts, in order
to preserve the reviewer's independence and maintain the supplier's
proprietary right to the product. The supplier should provide the
reviewer access to any, and all, documentation that the reviewer
requests and attendance at any design review or walk through that
the reviewer determines as necessary to complete and accomplish the
third party assessment. Representatives from FRA or the railroad
might accompany the reviewer.
    (2) Third party reviews can occur at a preliminary level, a
functional level, or implementation level. At the preliminary level,
the reviewer should evaluate with respect to safety and comment on
the adequacy of the processes, which the supplier applies to the
design, and development of the product. At a minimum, the reviewer
should compare the supplier processes with industry best practices
to determine if the vendor methodology is acceptable and employ any
other such tests or comparisons if they have been agreed to
previously with the railroad or FRA. Based on these analyses, the
reviewer shall identify and document any significant safety
vulnerabilities that are not adequately mitigated by the supplier's
(or user's) processes. At the functional level, the reviewer
evaluates the adequacy, and comprehensiveness, of the safety
analysis, and any other documents pertinent to the product being
assessed for completeness, correctness, and compliance with
applicable standards. This includes, but is not limited to the
Preliminary Hazard Analysis (PHA), the Hazard Log (HL), all Fault
Tree Analyses (FTA), all Failure Mode and Effects Criticality
Analysis (FMECA), and other hazard analyses. At the implementation
level, the reviewer randomly selects various safety-critical
software modules for audit to verify whether the system process and
design requirements were followed. The number of modules audited
shall be determined as a representative number sufficient to provide
confidence that all un-audited modules were developed in similar
manner as the audited module. During this phase the reviewer would
also evaluate and comment on the adequacy of the plan for
installation and test of the product for revenue service.
    (d) Reviewer Report. Upon completion of an assessment, the
reviewer prepares a final report of the assessment. The report
should contain the following information:
    (1) The reviewer's evaluation of the adequacy of the risk
analysis, including the supplier's MTTHE and risk estimates for the
product, and the supplier's confidence interval in these estimates;
    (2) Product vulnerabilities which the reviewer felt were not
adequately mitigated, including the method by which the railroad
would assure product safety in the event of a hardware or software
failure (i.e., how does the railroad or vendor assure that all
potentially hazardous failure modes are identified?) and the method
by which the railroad or vendor addresses comprehensiveness of the
product design for the requirements of the operations it will govern
(i.e., how does the railroad and/or vendor assure that all
potentially hazardous operating circumstances are identified? Who
records any deficiencies identified in the design process? Who
tracks the correction of these deficiencies and confirms that they
are corrected?);
    (3) A clear statement of position for all parties involved for
each product vulnerability cited by the reviewer;
    (4) Identification of any documentation or information sought by
the reviewer that was denied, incomplete, or inadequate;
    (5) A listing of each design procedure or process which was not
properly followed;
    (6) Identification of the software verification and validation
procedures for the product's safety-critical applications, and the
reviewer's evaluation of the adequacy of these procedures;
    (7) Methods employed by the product manufacturer to develop
safety-critical software, such as use of structured language, code
checks, modularity, or other similar generally acceptable
techniques; and
    (8) Methods by which the supplier or railroad addresses
comprehensiveness of the product design which considers the safety
elements.

PART 238 [AMENDED]

0
23. The authority citation for part 238 continues to read as follows:

    Authority:  49 U.S.C. 20103, 20107, 20133, 20141, 20302-20303,
20306, 20701-20702, 21301-21302, 21304; 28 U.S.C. 2461, note; and 49
CFR 1.49.

0
24. Section 238.105 is amended by revising paragraph (d)(1) to read as
follows:

Sec.  238.105  Train electronic hardware and software safety.

* * * * *
    (d) * * *
    (1) Hardware and software that controls or monitors a train's
primary braking system shall either:
    (i) Fail safely by initiating a full service or emergency brake
application in the event of a hardware or software failure that could
impair the ability of the engineer to apply or release the brakes; or
    (ii) Provide the engineer access to direct manual control of the
primary braking system (service or emergency braking).
* * * * *

0
25. Section 238.309 is amended by revising paragraphs (b), (c), and (e)
to read as follows:

Sec.  238.309  Periodic brake equipment maintenance.

* * * * *
    (b) DMU and MU locomotives. The brake equipment and brake cylinders
of each DMU or MU locomotive shall be cleaned, repaired, and tested,
and the filtering devices or dirt collectors located in the main
reservoir supply line to the air brake system cleaned, repaired, or
replaced at intervals in accordance with the following schedule:
    (1) Every 736 days if the DMU or MU locomotive is part of a fleet
that is not 100 percent equipped with air dryers;
    (2) Every 1,104 days if the DMU or MU locomotive is part of a fleet
that is 100 percent equipped with air dryers and is equipped with PS-
68, 26-C, 26-L, PS-90, CS-1, RT-2, RT-5A, GRB-1, CS-2, or 26-R brake
systems. (This listing of brake system types is intended to subsume all
brake systems using 26 type, ABD, or ABDW control valves and PS68, PS-
90, 26B-1, 26C, 26CE, 26-B1, 30CDW, or 30ECDW engineer's brake
valves.);
    (3) Every 1,840 days if the DMU or MU locomotive is part of a fleet
that is 100 percent equipped with air dryers and is equipped with KB-
HL1, KB-HS1, or KBCT1; and,
    (4) Every 736 days for all other DMU or MU locomotives.
    (c) Conventional locomotives. The brake equipment of each
conventional locomotive shall be cleaned, repaired, and tested in
accordance with the schedule provided in Sec.  229.29 of this chapter.
* * * * *
    (e) Cab cars. The brake equipment of each cab car shall be cleaned,
repaired, and tested at intervals in accordance with the following
schedule:
    (1) Every 1,840 days for locomotives equipped with CCB-1, CCB-2,
CCB-26, EPIC 1 (formerly EPIC 3102), EPIC 3102D2, EPIC 2, KB-HS1, or
Fastbrake brake systems.
    (2) Every 1,476 days for that portion of the cab car brake system
using brake valves that are identical to the passenger coach 26-C brake
system;
    (3) Every 1,104 days for that portion of the cab car brake system
using brake valves that are identical to the locomotive 26-L brake
system; and
    (4) Every 736 days for all other types of cab car brake valves.
* * * * *

    Issued in Washington, DC, on March 28, 2012.
Joseph C. Szabo,
Administrator.
[FR Doc. 2012-7995 Filed 4-6-12; 8:45 am]
BILLING CODE 4910-06-P