plan in accordance with Sec.  236.1009 and paragraph (a) of this
section, as applicable.
    (d) Subpart H. A railroad that elects to install a PTC system when
not required to do so may elect to proceed under this subpart or under
subpart H.
    (e) Upon receipt of a PTCIP, PTCDP, or PTCSP, FRA posts on its
public Web site notice of receipt and reference to the public docket in
which a copy of the filing has been placed. FRA may consider any public
comment on each document to the extent practicable within the time
allowed by law and without delaying implementation of PTC systems.

Sec.  236.1013  PTCDP content requirements and Type Approval.

    (a) For a PTC system to obtain a Type Approval from FRA, the PTCDP
shall be filed in accordance with Sec.  236.1009 and shall include:
    (1) A complete description of the PTC system, including a list of
all PTC system components and their physical relationships in the
subsystem or system;
    (2) A description of the railroad operation or categories of
operations on which the PTC system is designed to be used, including
train movement density (passenger, freight), operating speeds, track
characteristics, and railroad operating rules;
    (3) An operational concepts document, including a list with
complete descriptions of all functions which the PTC system will
perform to enhance or preserve safety;
    (4) A document describing the manner in which the PTC architecture
satisfies safety requirements;
    (5) A description of the safety assurance concepts that are to be
used for system development, including an explanation of the design
principles and assumptions;
    (6) A preliminary human factors analysis, including a complete
description of all human-machine interfaces and the impact of
interoperability requirements on the same;
    (7) An analysis of the applicability to the PTC system of the
requirements of subparts A-G of this part that may no longer apply or
are satisfied by the PTC system using an alternative method, and a
complete explanation of the manner in which those requirements are
otherwise fulfilled;
    (8) A description of the necessary security measures for the
system;
    (9) A description of target safety levels (e.g., MTTHE for major
subsystems as defined in subpart H), including requirements for system
availability and a description of all backup methods of operation and
any critical assumptions associated with the target levels;
    (10) A complete description of how the PTC system will enforce
authorities and signal indications;
    (11) A description of the deviation required under Sec.
236.1029(c), if applicable; and
    (12) A complete description of how the PTC system will appropriate
and timely enforce all integrated hazard detectors in accordance with
Sec.  236.1005(c)(3), if applicable.
    (b) If the Associate Administrator finds that the system described
in the PTCDP would satisfy the requirements for PTC systems under this
subpart and that the applicant has made a reasonable showing that a
system built to the stated requirements would achieve the level of
safety mandated for such a system under Sec.  236.1015, the Associate
Administrator may grant a numbered Type Approval for the system.
    (c) Each Type Approval shall be valid for a period of 5 years,
subject to automatic and indefinite extension provided that at least
one PTC System Certification using the subject PTC system has been
issued within that period and not revoked.
    (d) A PTCSP submitted under this subpart may reference and utilize
in accordance with this subpart any Type Approval previously issued by
the Associate Administrator to any railroad, provided that the
railroad:
    (1) Maintains a continually updated PTCPVL pursuant to Sec.
236.1023; and
    (2) Provides the applicable licensing information.
    (e) A railroad submitting a PTCDP under this subpart must show that
the supplier from which they are procuring the PTC system has
established and can maintain a quality control system for PTC system
design and manufacturing acceptable to the Associate Administrator.
    (f) The Associate Administrator may prescribe special conditions,
amendments, and restrictions to any Type Approval as necessary for
safety.

Sec.  236.1015  PTCSP content requirements and PTC System
Certification.

    (a) Before placing a PTC system required under this part in
service, the host railroad must submit to FRA a PTCSP and receive a PTC
System Certification. If the Associate Administrator finds that the
PTCSP and supporting documentation support a finding that the system
complies with this part, the Associate Administrator approves the PTCSP
and issues a PTC System Certification. Receipt of a PTC System
Certification affirms that the PTC system has been reviewed and
approved by FRA in accordance with, and meets the requirements of, this
part.
    (b) A PTCSP submitted in accordance with this subpart shall:
    (1) Include the applicable FRA approved PTCIP and, if applicable,
the PTCDP and Type Approval;
    (2)(i) Specifically and rigorously document each variance,
including the significance of each variance between the PTC system and
its applicable operating conditions as described in the applicable
PTCIP and any applicable PTCDP from that as described in the PTCSP, and
attest that are no other such variances; or
    (ii) Attest that there are no variances between the PTC system and
its applicable operating conditions as described in the applicable
PTCIP and any applicable PTCDP from that as described in the PTCSP; and
    (3) Attest that the system was otherwise built in accordance with
the applicable PTCDP and PTCSP and achieves the level of safety
represented therein.
    (c) A PTCSP shall include the same information required for a PTCDP
under Sec.  236.1013(a). If a PTCDP has been filed and approved prior
to filing of the PTCSP, PTCSP may incorporate the PTCDP by reference,
with the exception that a final human factors analysis shall be
provided. The PTCSP shall contain the following additional elements:
    (1) A hazard log consisting of a comprehensive description of all
safety-relevant hazards not previously addressed by the vendor to be
addressed during the life cycle of the PTC system, including maximum
threshold limits for each hazard (for unidentified hazards, the
threshold shall be exceeded at one occurrence);
    (2) A risk assessment of the as-built PTC system described;
    (3) A hazard mitigation analysis, including a complete and
comprehensive description of each hazard and the mitigation techniques
used;
    (4) A complete description of the safety assessment and
Verification and Validation processes applied to the PTC system, their
results, and whether these processes address the safety principles
described in Appendix C to this part directly, using other safety
criteria, or not at all;

    (5) A complete description of the railroad's training plan for
railroad and contractor employees and supervisors necessary to ensure
safe and proper installation, implementation, operation, maintenance,
repair, inspection, testing, and modification of the PTC system;
    (6) A complete description of the specific procedures and test
equipment necessary to ensure the safe and proper installation,
implementation, operation, maintenance, repair, inspection, testing,
and modification of the PTC system on the railroad and establish
safety-critical hazards are appropriately mitigated. These procedures,
including calibration requirements, shall be consistent with or explain
deviations from the equipment manufacturer's recommendations;
    (7) A complete description of any additional warning to be placed
in the Operations and Maintenance Manual in the same manner specified
in Sec.  236.919 and all warning labels to be placed on equipment as
necessary to ensure safety;
    (8) A complete description of the configuration or revision control
measures designed to ensure that the railroad or its contractor does
not adversely affect the safety-functional requirements and that
safety-critical hazard mitigation processes are not compromised as a
result of any such change;
    (9) A complete description of all initial implementation testing
procedures necessary to establish that safety-functional requirements
are met and safety-critical hazards are appropriately mitigated;
    (10) A complete description of all post-implementation testing
(validation) and monitoring procedures, including the intervals
necessary to establish that safety-functional requirements, safety-
critical hazard mitigation processes, and safety-critical tolerances
are not compromised over time, through use, or after maintenance
(adjustment, repair, or replacement) is performed;
    (11) A complete description of each record necessary to ensure the
safety of the system that is associated with periodic maintenance,
inspections, tests, adjustments, repairs, or replacements, and the
system's resulting conditions, including records of component failures
resulting in safety-relevant hazards (see Sec.  236.1033);
    (12) A safety analysis to determine whether, when the system is in
operation, any risk remains of an unintended incursion into a roadway
work zone due to human error. If the analysis reveals any such risk,
the PTCDP and PTCSP shall describe how that risk will be mitigated;
    (13) A more detailed description of any alternative arrangements as
already provided under Sec.  236.1011(a)(10);
    (14) A complete description of how the PTC system will enforce
authorities and signal indications, unless already completely provided
for in the PTCDP;
    (15) A description of how the PTCSP complies with Sec.
236.1019(e), if applicable;
    (16) A description of the deviation required under Sec.
236.1029(c), if applicable and unless already completely provided for
in the PTCDP;
    (17) A complete description of how the PTC system will appropriate
and timely enforce all integrated hazard detectors in accordance with
Sec.  236.1005;
    (18) An emergency and planned maintenance temporary rerouting plan
indicating how operations on the subject PTC system will take advantage
of the benefits provided under Sec.  236.1005(g)-(k); and
    (19) Any alternative arrangements for each rail at-grade crossing
not adhering to the table under Sec.  236.1005(a)(1)(i).
    (d) The following additional requirements apply to:
    (1) Non-vital overlay. A PTC system proposed as an overlay on the
existing method of operation and not built in accordance with the
safety assurance principles set forth in Appendix C of this part must,
to the satisfaction of the Associate Administrator, be shown to:
    (i) Reliably execute the functions set forth in Sec.  236.1005;
    (ii) Obtain at least 80 percent reduction of the risk associated
with accidents preventable by the functions set forth in Sec.
236.1005, when all effects of the change associated with the PTC system
are taken into account. The supporting risk assessment shall evaluate
all intended changes in railroad operations coincident with the
introduction of the new system; and
    (iii) Maintain a level of safety for each subsequent system
modification that is equal to or greater than the level of safety for
the previous PTC systems.
    (2) Vital overlay. A PTC system proposed on a newly constructed
track or as an overlay on the existing method of operation and is built
in accordance with the safety assurance principles set forth in
Appendix C of this part must, to the satisfaction of the Associate
Administrator, be shown to:
    (i) Reliably execute the functions set forth in Sec.  236.1005; and
    (ii) Have sufficient documentation to demonstrate that the PTC
system, as built, fulfills the safety assurance principles set forth in
Appendix C of this part. The supporting risk assessment may be
abbreviated as that term is used in subpart H of this part.
    (3) Stand-alone. A PTC system proposed on a newly constructed
track, an existing track for which no signal system exists, as a
replacement for an existing signal or train control system, or to
otherwise intend to replace or materially modify the existing method of
operation, shall:
    (i) Demonstrate to reliably execute the functions required by Sec.
236.1005; and
    (ii) Have a PTCSP establishing, with a high degree of confidence,
that the system will not introduce new hazards that have not been
mitigated. The supporting risk assessment shall evaluate all intended
changes in railroad operations in relation to the introduction of the
new system and shall examine in detail the direct and indirect effects
of all changes in the method of operations.
    (4) Mixed systems. If a PTC system combining overlay, stand-alone,
vital, or non-vital characteristics is proposed, the railroad shall
confer with the Associate Administrator regarding appropriate
structuring of the safety case and analysis.
    (e) When determining whether the PTCSP fulfills the requirements
under paragraph (d) of this section, the Associate Administrator may
consider all available evidence concerning the reliability and
availability of the proposed system and any and all safety consequences
of the proposed changes. In any case where the PTCSP lacks data
regarding safety impacts of the proposed changes, the Associate
Administrator may request the necessary data from the applicant. If the
requested data is not provided, the Associate Administrator may find
that potential hazards could or will arise.
    (f) If a PTCSP applies to a system designed to replace an existing
certified PTC system, the PTCSP will be approved provided that the
PTCSP establishes with a high degree of confidence that the new system
will provide a level of safety not less than the level of safety
provided by the system to be replaced.
    (g) When reviewing the issue of the potential data errors (for
example, errors arising from data supplied from other business systems
needed to execute the braking algorithm, survey data needed for
location determination, or mandatory directives issued through the
computer-aided dispatching system), the PTCSP must include a careful
identification of each of the risks and a discussion of each applicable
mitigation. In an appropriate case, such as a case in which the
residual risk after mitigation is substantial or the underlying method
of operation will be significantly altered, the Associate

Administrator may require submission of a quantitative risk assessment
addressing these potential errors.

Sec.  236.1017  Independent third party Verification and Validation.

    (a) The PTCSP must be supported by an independent third-party
assessment when the Associate Administrator concludes that it is
necessary based upon the same criteria set forth in Sec.  236.913 of
this chapter, with the exception that consideration of the methodology
used in the risk assessment (Sec.  236.913(g)(2)(vii)) shall apply only
to the extent that a comparative risk assessment was required. To the
extent practicable, FRA makes this determination not later than review
of the PTCIP and the accompanying PTCDP or PTCSP. If an independent
assessment is required, the assessment may apply to the entire system
or a designated portion of the system.
    (b) If a PTC system is to undergo an independent assessment in
accordance with this section, it may submit to the Associate
Administrator a written request that FRA confirm whether a particular
entity would be considered an independent third party pursuant to this
section. The request should include supporting information in
accordance with paragraph (c) of this section. FRA may request further
information to make a determination or provide its determination in
writing.
    (c) As used in this section, ``independent third party'' means a
technically competent entity responsible to and compensated by the
railroad (or an association on behalf of one or more railroads) that is
independent of the PTC system supplier and vendor. An entity that is
owned or controlled by the supplier or vendor, that is under common
ownership or control with the supplier or vendor, or that is otherwise
involved in the development of the PTC system is not considered
``independent'' within the meaning of this section.
    (d) The independent third party assessment must, at a minimum,
consist of the activities and result in the production of documentation
meeting the requirements of Appendix F to this part, unless excepted by
this part or by FRA order or waiver.
    (e) Information provided that has been certified under the auspices
of a foreign railroad regulatory entity recognized by the Associate
Administrator may, at the Associate Administrator's discretion, be
accepted as having been independently verified.

Sec.  236.1019  Main line track exceptions.

    (a) Scope and procedure. This section pertains exclusively to
exceptions from the rule that trackage over which scheduled intercity
and commuter passenger service is provided is considered main line
track requiring installation of a PTC system. One or more intercity or
commuter passenger railroads, or freight railroads conducting joint
passenger and freight operation over the same segment of track may file
a main line track exclusion addendum (``MTEA'') to its PTCIP requesting
to designate track as not main line subject to the condition that such
trackage may not be trackage otherwise required to be equipped (e.g.,
because of tonnage and PIH traffic) and to the further conditions set
forth in paragraphs (b) and (c) of this section. No track shall be
designated as yard or terminal unless it is identified in a MTEA that
is part of an FRA approved PTCIP.
    (b) Passenger terminal exception. FRA will consider an exception in
the case of trackage used exclusively as yard or terminal tracks by or
in support of regularly scheduled intercity or commuter passenger
service where the MTEA describes in detail the physical boundaries of
the trackage in question, its use and characteristics (including track
and signal charts) and all of the following apply:
    (1) The maximum authorized speed for all movements is not greater
than 20 miles per hour, and that maximum is enforced by any available
onboard PTC equipment within the confines of the yard or terminal;
    (2) Interlocking rules are in effect prohibiting reverse movements
other than on signal indications without dispatcher permission; and
    (3) No freight operations are permitted.
    (c) Limited operations exception. FRA will consider an exception in
the case of trackage used for limited operations by at least one
passenger railroad subject to at least one of the following conditions:
    (1) All trains are limited to restricted speed;
    (2) Temporal separation of passenger and other trains is maintained
as provided in paragraph (d) of this section; or
    (3) Passenger service is operated under a risk mitigation plan
submitted by all railroads involved in the joint operation and approved
by FRA. The risk mitigation plan must be supported by a risk assessment
establishing that the proposed mitigations will achieve a level of
safety not less than the level of safety that would obtain if the
operations were conducted under paragraph (c)(1) or (c)(2) of this
section.
    (d) Temporal separation. As used in this section, temporal
separation means the processes or physical arrangements, or both, in
place to assure that limited passenger and freight operations do not
operate on any segment of shared track during the same period. The use
of exclusive authorities under mandatory directives is not, by itself,
sufficient to establish that temporal separation is achieved.
Procedures to ensure temporal separation shall include verification
checks between passenger and freight and effective physical means to
positively ensure segregation of passenger and freight operations in
accordance with this paragraph.
    (e) PTCSP requirement. No PTCSP filed after the approval of a PTCIP
with an MTEA shall be approved by FRA unless it attests that no
changes, except for those included in a FRA approved RFA, have been
made to the information in the PTCIP and MTEA required by paragraph (b)
or (c) of this section.
    (f) Designation modifications. If subsequent to approval of its
PTCIP or PTCSP the railroad seeks to modify which track or tracks
should be designated as main line or not main line, it shall request
modification of its PTCIP or PTCSP, as applicable, in accordance with
Sec.  236.1021.

Sec.  236.1021  Discontinuances, material modifications, and
amendments.

    (a) No changes, as defined by this section, to a PTC system, PTCIP,
PTCDP, or PTCSP, shall be made unless:
    (1) The railroad files a request for amendment (``RFA'') to the
applicable PTCIP, PTCDP, or PTCSP with the Associate Administrator; and
    (2) The Associate Administrator approves the RFA.
    (b) After approval of a RFA in accordance with paragraph (a) of
this section, the railroad shall immediately adopt and comply with the
amendment.
    (c) In lieu of a separate filing under part 235 of this chapter, a
railroad may request approval of a discontinuance or material
modification of a signal or train control system by filing a RFA to its
PTCIP, PTCDP, or PTCSP with the Associate Administrator.
    (d) A RFA made in accordance with this section will not be approved
by FRA unless the request includes:
    (1) The information listed in Sec.  235.10 of this chapter and the
railroad provides FRA upon request any additional information necessary
to evaluate the RFA (see Sec.  235.12), including:
    (2) The proposed modifications;
    (3) The reasons for each modification;
    (4) The changes to the PTCIP, PTCDP or PTCSP, as applicable;

    (5) Each modification's effect on PTC system safety;
    (6) An approximate timetable for filing of the PTCDP, PTCSP, or
both, if the amendment pertains to a PTCIP; and
    (7) An explanation of whether each change to the PTCSP is planned
or unplanned.
    (A) Unplanned changes that affect the Type Approval's PTCDP require
submission and approval in accordance with Sec.  236.1013 of a new
PTCDP, followed by submission and approval in accordance with Sec.
236.1015 of a new PTCSP for the PTC system.
    (B) Unplanned changes that do not affect the Type Approval's PTCDP
require submission and approval of a new PTCSP.
    (C) Unplanned changes are changes affecting system safety that have
not been documented in the PTCSP. The impact of unplanned changes on
PTC system safety has not yet been determined.
    (D) Planned changes may be implemented after they have undergone
suitable regression testing to demonstrate, to the satisfaction of the
Associate Administrator, they have been correctly implemented and their
implementation does not degrade safety.
    (E) Planned changes are changes affecting system safety in the
PTCSP and have been included in all required analysis under Sec.
236.1017. The impact of these changes on the PTC system's safety has
been incorporated as an integral part of the approved PTCSP safety
analysis.
    (e) If the RFA includes a request for approval of a discontinuance
or material modification of a signal or train control system, FRA will
publish a notice in the Federal Register of the application and will
invite public comment in accordance with part 211 of this chapter.
    (f) When considering the RFA, FRA will review the issue of the
discontinuance or material modification and determine whether granting
the request is in the public interest and consistent with railroad
safety, taking into consideration all changes in the method of
operation and system functionalities, both within normal PTC system
availability and in the case of a system failed state (unavailable),
contemplated in conjunction with installation of the PTC system. The
railroad submitting the RFA must, at FRA's request, perform field
testing in accordance with Sec.  236.1035 or engage in Verification and
Validation in accordance with Sec.  236.1017.
    (g) FRA may issue at its discretion a new Type Approval number for
a PTC system modified under this section.
    (h) Changes requiring filing of an RFA. Except as provided by
paragraph (i), an RFA shall be filed to request the following:
    (1) Discontinuance of a PTC system, or other similar appliance or
device;
    (2) Decrease of the PTC system's limits;
    (3) Modification of a safety critical element of a PTC system; or
    (4) Modification of a PTC system that affects the safety critical
functionality of any other PTC system with which it interoperates.
    (i) Discontinuances not requiring the filing of an RFA. It is not
necessary to file an RFA for the following discontinuances:
    (1) Removal of a PTC system from track approved for abandonment by
formal proceeding;
    (2) Removal of PTC devices used to provide protection against
unusual contingencies such as landslide, burned bridge, high water,
high and wide load, or tunnel protection when the unusual contingency
no longer exists;
    (3) Removal of the PTC devices that are used on a movable bridge
that has been permanently closed by the formal approval of another
government agency and is mechanically secured in the closed position
for rail traffic; or
    (4) Removal of the PTC system from service for a period not to
exceed six months that is necessitated by catastrophic occurrence such
as derailment, flood, fire, or hurricane.
    (j) Changes not requiring the filing of an RFA. When the resultant
change to the PTC system will comply with an approved PTCSP of this
part, it is not necessary to file for approval to decrease the limits
of a system when it involves the:
    (1) Decrease of the limits of a PTC system when interlocked
switches, derails, or movable-point frogs are not involved;
    (2) Removal of an electric or mechanical lock from hand-operated
switch in a PTC system where train speed over switch does not exceed 20
miles per hour; or
    (3) Removal of an electric lock from hand-operated switch in a PTC
system where trains are not permitted to clear the main track at such
switch and the electric lock has not been a part of the conditional
approval of a PTCSP.
    (k) Modifications not requiring the filing of an RFA. When the
resultant arrangement will comply with an approved PTCSP of this part,
it is not necessary to file an application for approval of the
following modifications:
    (1) A modification that is required to comply with an order of the
Federal Railroad Administration or any section of part 236 of this
title;
    (2) Installation of devices used to provide protection against
unusual contingencies such as landslide, burned bridges, high water,
high and wide loads, or dragging equipment;
    (3) Elimination of existing track other than a second main track;
    (4) Extension or shortening of a passing siding;
    (5) A line relocation;
    (6) Installation of new track; or
    (7) The temporary or permanent arrangement of existing systems
necessitated by highway rail separation construction. Temporary
arrangements shall be removed within six months following completion of
construction.

Sec.  236.1023  Errors and malfunctions.

    (a) Except as provided in paragraph (g) of this section, when any
PTC system, subsystem, component, product, or process fails,
malfunctions, or otherwise experiences a defect that decreases, or
eliminates, any safety functionality, its vendor--regardless of whether
any railroad has indicated whether it experienced the same--shall
notify FRA and the affected railroads of the following:
    (1) The nature and specificity of the failure, malfunction, or
defect;
    (2) The vendor's procedures for responding to the issue until the
failure, malfunction, or defect is cured;
    (3) Any corrective action required;
    (4) The risk mitigation actions to be taken pending resolution of
the failure cause and issuance of the corrective action; and
    (5) The estimated time to correct the failure.
    (b) Any railroad implementing or operating a PTC system, subsystem,
component, product, or process that fails, malfunctions, or otherwise
experiences a defect that decreases, or eliminates, any safety or
interoperability functionality, shall:
    (1) Notify the applicable vendor and FRA of the failure,
malfunction, or defect that decreased or eliminated the safety
functionality; and
    (2) Keep the applicable vendor and FRA apprised on a continual
basis of the status of any and all subsequent failures.
    (c) Each railroad implementing a PTC system on its property shall
maintain a PTC Product Vendor List (PTCPVL) continually updated to
include all vendors of each PTC system, subsystem, component, product,
and process currently used in its PTC system. The PTCPVL shall be made
available to FRA upon request and without undue delay.
    (d) The railroad shall specify to FRA--and the applicable vendor if

appropriate--its procedures for action upon notification of a safety
critical upgrade, patch, or revision for the PTC system, subsystem,
component, product, or process, and until the revision has been
installed.
    (e) Each notification required by this section shall:
    (1) Be made within 7 days after the vendor or railroad discovers
the failure, malfunction, or defect. However, a report that is due on a
Saturday or a Sunday may be delivered on the following Monday and one
that is due on a holiday may be delivered on the next workday;
    (2) Be transmitted in a manner and form acceptable to the Associate
Administrator and by the most expeditious method available; and
    (3) Include as much available and applicable information as
possible, including:
    (i) PTC system name and model;
    (ii) Identification of the part, component, or system involved. The
identification must include the part number;
    (iii) Nature of the failure, malfunctions, or defects;
    (iv) Mitigation to ensure the safety of the crews and public; and
    (v) The estimated time to correct the failure.
    (f) Whenever any investigation of an accident or service difficulty
report shows that an article is unsafe because of a manufacturing or
design defect, the manufacturer shall, upon request of the Associate
Administrator, report to the Associate Administrator the results of its
investigation and any action taken or proposed by the manufacturer to
correct that defect.
    (g) The requirements of this section do not apply to failures,
malfunctions, or defects that:
    (1) Are caused by improper maintenance or improper usage; or
    (2) Have been previously identified to the FRA, vendor, and
applicable railroads.
    (h) Any railroad experiencing a failure of a system resulting in a
more favorable aspect than intended or another condition hazardous to
movement of a train shall comply with the reporting requirements,
including the making of a telephonic report of an accident or incident
under part 233 of this chapter. Filing of one or more reports under
part 233 of this chapter does not exempt a railroad or vendor from the
reporting requirements contained in paragraphs (a) through (e) of this
section.

Sec.  236.1027  Exclusions.

    (a) The requirements of this subpart apply to each office
automation system that performs safety-critical functions within, or
affects the safety performance of, the PTC system. For purposes of this
section, ``office automation system'' means any centralized or
distributed computer-based system that directly or indirectly controls
the active movement of trains in a rail network.
    (b) Changes or modifications to PTC systems otherwise excluded from
the requirements of this subpart by this section do not exclude those
PTC systems from the requirements of this subpart if the changes or
modifications result in a degradation of safety or a material decrease
in safety-critical functionality.
    (c) Primary train control systems cannot be integrated with
locomotive electronic systems unless the complete integrated systems:
    (1) Have been shown to be designed on fail safe principles;
    (2) Have demonstrated to operate in a fail safe mode;
    (3) Have a manual fail safe fallback and override to allow the
locomotive to be brought to a safe stop in the event of any loss of
electronic control; and
    (4) Are included in the approved and applicable PTCDP and PTCSP.
    (d) PTC systems excluded by this section from the requirements of
this subpart remain subject to subparts A through H of this part as
applicable.

Sec.  236.1029  PTC system use and en route failures.

    (a) When any safety-critical PTC system component fails to perform
its intended function, the cause must be determined and the faulty
component adjusted, repaired, or replaced without undue delay. Until
repair of such essential components are completed, a railroad shall
take appropriate action as specified in its PTCSP.
    (b) Where a PTC onboard apparatus on a lead locomotive that is
operating in or is to be operated within a PTC system fails or is
otherwise cut-out while en route (i.e., after the train has departed
it's initial terminal), the train may only continue in accordance with
the following:
    (1) The train may proceed at restricted speed, or if a block signal
system is in operation according to signal indication at medium speed,
to the next available point where communication of a report can be made
to a designated railroad officer of the host railroad;
    (2) Upon completion and communication of the report required in
paragraph (b)(1) of this section, or where immediate electronic report
of said condition is appropriately provided by the PTC system itself, a
train may continue to a point where an absolute block can be
established in advance of the train in accordance with the following:
    (i) Where no block signal system is in use, the train may proceed
at restricted speed, or
    (ii) Where a block signal system is in operation according to
signal indication, the train may proceed at a speed not to exceed
medium speed.
    (3) Upon reaching the location where an absolute block has been
established in advance of the train, as referenced in paragraph (b)(2)
of this section, the train may proceed in accordance with the
following:
    (i) Where no block signal system is in use, the train may proceed
at medium speed; however, if the involved train is a passenger train or
a train hauling any amount of PIH material, it may only proceed at a
speed not to exceed 30 miles per hour.
    (ii) Where a block signal system is in use, a passenger train may
proceed at a speed not to exceed 59 miles per hour and a freight train
may proceed at a speed not to exceed 49 miles per hour.
    (iii) Except as provided in paragraph (c), where a cab signal
system with an automatic train control system is in operation, the
train may proceed at a speed not to exceed 79 miles per hour.
    (c) In order for a PTC train that operates at a speed above 90
miles per hour to deviate from the operating limitations contained in
paragraph (b) of this section, the deviation must be described and
justified in the FRA approved PTCDP or PTCSP, or the Order of
Particular Applicability, as applicable.
    (d) Each railroad shall comply with all provisions in the
applicable PTCDP and PTCSP for each PTC system it uses and shall
operate within the scope of initial operational assumptions and
predefined changes identified.
    (e) The normal functioning of any safety-critical PTC system must
not be interfered with in testing or otherwise without first taking
measures to provide for the safe movement of trains, locomotives,
roadway workers, and on-track equipment that depend on the normal
functioning of the system.
    (f) The PTC system's onboard apparatus shall be so arranged that
each member of the crew assigned to perform duties in the locomotive
can view a PTC display and execute any functions necessary to that crew
member's duties. The locomotive engineer shall not be required to
perform functions related to the PTC system while the train is moving
that have the potential to distract the locomotive engineer from
performance of other safety-critical duties.

Sec.  236.1031  Previously approved PTC systems.

    (a) Any PTC system fully implemented and operational prior to
[insert effective date of final rule], may receive PTC System
Certification if the applicable PTC railroad, or one or more system
suppliers and one or more PTC railroads, submits a Request for
Expedited Certification (REC) letter to the Associate Administrator.
The REC letter must do one of the following:
    (1) Reference a product safety plan (PSP) recognized or approved by
FRA under subpart H of this part and include a document fulfilling the
requirements under Sec. Sec.  236.1011 and 236.1013 not already
included in the PSP;
    (2) Attest that the PTC system has been approved by FRA and in
operation for at least 5 years and has already received an assessment
of Verification and Validation from an independent third party under
part 236 or a waiver supporting such operation; or
    (3) Attest that the PTC railroad has implemented and is operating a
PTC system required by a FRA order issued prior to [insert effective
date of final rule].
    (b) If a REC letter conforms to paragraph (a)(1) of this section,
the Associate Administrator, at his or her sole discretion, may also
issue a new Type Approval for the PTC system.
    (c) In order to receive a Type Approval or PTC System Certification
under paragraph (a) or (b) of this section, the PTC system must be
shown to reliably execute the functionalities required by Sec. Sec.
236.1005 and 236.1007 and otherwise conform to this subpart.
    (d) Previous approval or recognition of a train control system,
together with an established service history, may, at the request of
the PTC railroad, and consistent with available safety data, be
credited toward satisfaction of the safety case requirements set forth
in this part for the PTCSP with respect to all functionalities and
implementations contemplated by the approval or recognition.
    (e) To the extent that the PTC system proposed for implementation
under this subpart is different in significant detail from the system
previously approved or recognized, the changes shall be fully analyzed
in the PTCDP or PTCSP as would be the case absent prior approval or
recognition.
    (f) As used in this section--
    (1) Approved refers to approval of a Product Safety Plan under
subpart H of this part.
    (2) Recognized refers to official action permitting a system to be
implemented for control of train operations under an order or waiver,
after review of safety case documentation for the implementation.
    (g) Upon receipt of a REC, FRA will consider all safety case
information to the extent feasible and appropriate, given the specific
facts before the agency. Nothing in this section limits re-use of any
applicable safety case information by a party other than the party
receiving:
    (1) A prior approval or recognition referred to in this section; or
    (2) A Type Approval or PTC System Certification under this subpart.

Sec.  236.1033  Communications and security requirements.

    (a) All wireless communications between the office, wayside, and
onboard components in a PTC system shall provide cryptographic message
integrity and authentication.
    (b) Cryptographic keys required under paragraph (a) shall:
    (1) Use an algorithm approved by the National Institute of
Standards (NIST) or a similarly recognized and FRA approved standards
body;
    (2) Be distributed using manual or automated methods, or a
combination of both; and
    (3) Be revoked:
    (i) If compromised by unauthorized disclosure of the cleartext key;
or
    (ii) When the key algorithm reaches its lifespan as defined by the
standards body responsible for approval of the algorithm.
    (c) The cleartext form of the cryptographic keys shall be protected
from unauthorized disclosure, modification, or substitution, except
during key entry when the cleartext keys and key components may be
temporarily displayed to allow visual verification. When encrypted keys
or key components are entered, the cryptographically protected
cleartext key or key components shall not be displayed.
    (d) Access to cleartext keys shall be protected by a tamper
resistant mechanism.
    (e) Each railroad electing to also provide cryptographic message
confidentiality shall:
    (1) Comply with the same requirements for message integrity and
authentication under this section; and
    (2) Only use keys meeting or exceeding the security strength
required to protect the data as defined in the railroad's PTCSP and
required under Sec.  236.1017(a)(8).
    (f) Each railroad, or its vendor, shall have a prioritized service
restoration and mitigation plan for scheduled and unscheduled
interruptions of service. This plan shall be included in the PTCDP or
PTCSP as required by Sec. Sec.  236.1013 or 236.1015, as applicable,
and made available to FRA upon request, without undue delay, for
restoration of communication services that support PTC system services.
    (g) Each railroad may elect to impose more restrictive requirements
than those in this section, consistent with interoperability
requirements specified in the PTCSP for the system.

Sec.  236.1035  Field testing requirements.

    (a) Before any field testing of an uncertified PTC system, or a
product of an uncertified PTC system, or any regression testing of a
certified PTC system is conducted on the general rail system, the
railroad requesting the testing must provide:
    (1) A complete description of the PTC system;
    (2) An operational concepts document;
    (3) A complete description of the specific test procedures,
including the measures that will be taken to protect trains and on-
track equipment;
    (4) An analysis of the applicability of the requirements of
subparts A-G of this part to the PTC system that will not apply during
testing;
    (5) The date the proposed testing shall begin;
    (6) The test locations; and
    (7) The effect on the current method of the PTC system under test
operation.
    (b) FRA may impose additional testing conditions that it believes
may be necessary for the safety of train operations.
    (c) Relief from regulations other than from subparts A-G of this
part that the railroad believes are necessary to support the field
testing, must be requested in accordance with part 211 of this title.

Sec.  236.1037  Records retention.

    (a) Each railroad with a PTC system required to be installed under
this subpart shall maintain at a designated office on the railroad:
    (1) A current copy of each FRA approved Type Approval, if any,
PTCDP, and PTCSP that it holds;
    (2) Adequate documentation to demonstrate that the PTCSP and PTCDP
meet the safety requirements of this subpart, including the risk
assessment;
    (3) An Operations and Maintenance Manual, pursuant to Sec.
236.1039; and
    (4) Training and testing records pursuant to Sec.  236.1043(b).
    (b) Results of inspections and tests specified in the PTCSP and
PTCDP must be recorded pursuant to Sec.  236.110.
    (c) Each contractor providing services relating to the testing,
maintenance, or

operation of a PTC system required to be installed under this subpart
shall maintain at a designated office training records required under
Sec.  236.1039(b).
    (d) After the PTC system is placed in service, the railroad shall
maintain a database of all safety-relevant hazards as set forth in the
PTCSP and PTCDP and those that had not been previously identified in
either document. If the frequency of the safety-relevant hazards
exceeds the threshold set forth in either of these documents, then the
railroad shall:
    (1) Report the inconsistency in writing by mail, facsimile, e-mail,
or hand delivery to the Director, Office of Safety Assurance and
Compliance, FRA, 1200 New Jersey Ave., SE., Mail Stop 25, Washington,
DC 20590, within 15 days of discovery. Documents that are hand
delivered must not be enclosed in an envelope;
    (2) Take prompt countermeasures to reduce the frequency of each
safety-relevant hazard to below the threshold set forth in the PTCSP
and PTCDP; and
    (3) Provide a final report when the inconsistency is resolved to
the FRA Director, Office of Safety Assurance and Compliance, on the
results of the analysis and countermeasures taken to reduce the
frequency of the safety-relevant hazard(s) below the threshold set
forth in the PTCSP and PTCDP.

Sec.  236.1039  Operations and Maintenance Manual.

    (a) The railroad shall catalog and maintain all documents as
specified in the PTCDP and PTCSP for the installation, maintenance,
repair, modification, inspection, and testing of the PTC system and
have them in one Operations and Maintenance Manual, readily available
to persons required to perform such tasks and for inspection by FRA and
FRA-certified State inspectors.
    (b) Plans required for proper maintenance, repair, inspection, and
testing of safety-critical PTC systems must be adequate in detail and
must be made available for inspection by FRA and FRA-certified State
inspectors where such PTC systems are deployed or maintained. They must
identify all software versions, revisions, and revision dates. Plans
must be legible and correct.
    (c) Hardware, software, and firmware revisions must be documented
in the Operations and Maintenance Manual according to the railroad's
configuration management control plan and any additional configuration/
revision control measures specified in the PTCDP and PTCSP.
    (d) Safety-critical components, including spare equipment, must be
positively identified, handled, replaced, and repaired in accordance
with the procedures specified in the PTCDP and PTCSP.
    (e) Each railroad shall designate in its Operations and Maintenance
Manual an appropriate railroad officer responsible for issues relating
to scheduled interruptions of service contemplated by Sec.  236.1029.

Sec.  236.1041  Training and qualification program, general.

    (a) Training program for PTC personnel. Employers shall establish
and implement training and qualification programs for PTC systems
subject to this subpart. These programs must meet the minimum
requirements set forth in the PTCDP and PTCSP in Sec. Sec.  236.1039
through 236.1045 as appropriate, for the following personnel:
    (1) Persons whose duties include installing, maintaining,
repairing, modifying, inspecting, and testing safety-critical elements
of the railroad's PTC systems, including central office, wayside, or
onboard subsystems;
    (2) Persons who dispatch train operations (issue or communicate any
mandatory directive that is executed or enforced, or is intended to be
executed or enforced, by a train control system subject to this
subpart);
    (3) Persons who operate trains or serve as a train or engine crew
member subject to instruction and testing under part 217 of this
chapter, on a train operating in territory where a train control system
subject to this subpart is in use;
    (4) Roadway workers whose duties require them to know and
understand how a train control system affects their safety and how to
avoid interfering with its proper functioning; and
    (5) The direct supervisors of persons listed in paragraphs (a)(1)
through (a)(4) of this section.
    (b) Competencies. The employer's program must provide training for
persons who perform the functions described in paragraph (a) of this
section to ensure that they have the necessary knowledge and skills to
effectively complete their duties related to operation and maintenance
of the PTC system.

Sec.  236.1043  Task analysis and basic requirements.

    (a) Training structure and delivery. As part of the program
required by Sec.  236.1041, the employer shall, at a minimum:
    (1) Identify the specific goals of the training program with regard
to the target population (craft, experience level, scope of work,
etc.), task(s), and desired success rate;
    (2) Based on a formal task analysis, identify the installation,
maintenance, repair, modification, inspection, testing, and operating
tasks that must be performed on a railroad's PTC systems. This includes
the development of failure scenarios and the actions expected under
such scenarios;
    (3) Develop written procedures for the performance of the tasks
identified;
    (4) Identify the additional knowledge, skills, and abilities above
those required for basic job performance necessary to perform each
task;
    (5) Develop a training and evaluation curriculum that includes
classroom, simulator, computer-based, hands-on, or other formally
structured training designed to impart the knowledge, skills, and
abilities identified as necessary to perform each task;
    (6) Prior to assignment of related tasks, require all persons
mentioned in Sec.  236.1041(a) to successfully complete a training
curriculum and pass an examination that covers the PTC system and
appropriate rules and tasks for which they are responsible (however,
such persons may perform such tasks under the direct onsite supervision
of a qualified person prior to completing such training and passing the
examination);
    (7) Require periodic refresher training and evaluation at intervals
specified in the PTCDP and PTCSP that includes classroom, simulator,
computer-based, hands-on, or other formally structured training and
testing, except with respect to basic skills for which proficiency is
known to remain high as a result of frequent repetition of the task;
and
    (8) Conduct regular and periodic evaluations of the effectiveness
of the training program specified in Sec.  236.1041(a)(1) verifying the
adequacy of the training material and its validity with respect to
current railroads PTC systems and operations.
    (b) Training records. Employers shall retain records which
designate persons who are qualified under this section until new
designations are recorded or for at least one year after such persons
leave applicable service. These records shall be kept in a designated
location and be available for inspection and replication by FRA and
FRA-certified State inspectors.

Sec.  236.1045  Training specific to office control personnel.

    (a) Any person responsible for issuing or communicating mandatory
directives in territory where PTC systems are or

will be in use must be trained in the following areas, as applicable:
    (1) Instructions concerning the interface between the computer-
aided dispatching system and the train control system, with respect to
the safe movement of trains and other on-track equipment;
    (2) Railroad operating rules applicable to the train control
system, including provision for movement and protection of roadway
workers, unequipped trains, trains with failed or cut-out train control
onboard systems, and other on-track equipment; and
    (3) Instructions concerning control of trains and other on-track
equipment in case the train control system fails, including periodic
practical exercises or simulations, and operational testing under part
217 of this chapter to ensure the continued capability of the personnel
to provide for safe operations under the alternative method of
operation.
    (b) [Reserved]

Sec.  236.1047  Training specific to locomotive engineers and other
operating personnel.

    (a) Operating personnel. Training provided under this subpart for
any locomotive engineer or other person who participates in the
operation of a train in train control territory must be defined in the
PTCDP as well as the PTCSP. The following elements must be addressed:
    (1) Familiarization with train control equipment onboard the
locomotive and the functioning of that equipment as part of the system
and in relation to other onboard systems under that person's control;
    (2) Any actions required of the onboard personnel to enable, or
enter data to, the system, such as consist data, and the role of that
function in the safe operation of the train;
    (3) Sequencing of interventions by the system, including pre-
enforcement notification, enforcement notification, penalty application
initiation and post-penalty application procedures;
    (4) Railroad operating rules and testing (part 217) applicable to
the train control system, including provisions for movement and
protection of any unequipped trains, or trains with failed or cut-out
train control onboard systems and other on-track equipment;
    (5) Means to detect deviations from proper functioning of onboard
train control equipment and instructions regarding the actions to be
taken with respect to control of the train and notification of
designated railroad personnel; and
    (6) Information needed to prevent unintentional interference with
the proper functioning of onboard train control equipment.
    (b) Locomotive engineer training. Training required under this
subpart for a locomotive engineer, together with required records, must
be integrated into the program of training required by part 240 of this
chapter.
    (c) Full automatic operation. The following special requirements
apply in the event a train control system is used to effect full
automatic operation of the train:
    (1) The PTCDP and PTCSP must identify all safety hazards to be
mitigated by the locomotive engineer.
    (2) The PTCDP and PTCSP must address and describe the training
required with provisions for the maintenance of skills proficiency. As
a minimum, the training program must:
    (i) As described in Sec.  236.1047(a)(2), develop failure scenarios
which incorporate the safety hazards identified in the PTCDP and PTCSP
including the return of train operations to a fully manual mode;
    (ii) Provide training, consistent with Sec.  236.1047(a), for safe
train operations under all failure scenarios and identified safety
hazards that affect train operations;
    (iii) Provide training, consistent with Sec.  236.1047(a), for safe
train operations under manual control; and
    (iv) Consistent with Sec.  236.1047(a), ensure maintenance of
manual train operating skills by requiring manual starting and stopping
of the train for an appropriate number of trips and by one or more of
the following methods:
    (A) Manual operation of a train for a 4-hour work period;
    (B) Simulated manual operation of a train for a minimum of 4 hours
in a Type I simulator as required; or
    (C) Other means as determined following consultation between the
railroad and designated representatives of the affected employees and
approved by FRA. The PTCDP and PTCSP must designate the appropriate
frequency when manual operation, starting, and stopping must be
conducted, and the appropriate frequency of simulated manual operation.
    (d) Conductor training. Training required under this subpart for a
conductor, together with required records, must be integrated into the
program of training required under this chapter.

Sec.  236.1049  Training specific to roadway workers.

    (a) Roadway worker training. Training required under this subpart
for a roadway worker must be integrated into the program of instruction
required under part 214, subpart C of this chapter (``Roadway Worker
Protection''), consistent with task analysis requirements of Sec.
236.1039. This training must provide instruction for roadway workers
who provide protection for themselves or roadway work groups.
    (b) Training subject areas. (1) Instruction for roadway workers
must ensure an understanding of the role of processor-based signal and
train control equipment in establishing protection for roadway workers
and their equipment.
    (2) Instruction for all roadway workers working in territories
where PTC is required under this subpart must ensure recognition of
processor-based signal and train control equipment on the wayside and
an understanding of how to avoid interference with its proper
functioning.
    (3) Instructions concerning the recognition of system failures and
the provision of alternative methods of on-track safety in case the
train control system fails, including periodic practical exercises or
simulations and operational testing under part 217 of this chapter to
ensure the continued capability of roadway workers to be free from the
danger of being struck by a moving train or other on-track equipment.
    11. Revise Appendix B to part 236 to read as follows:

Appendix B to Part 236--Risk Assessment Criteria

    The safety-critical performance of each product for which risk
assessment is required under this part must be assessed in
accordance with the following minimum criteria or other criteria if
demonstrated to the Associate Administrator for Safety to be equally
suitable:
    (a) How are risk metrics to be expressed? The risk metric for
the proposed product must describe with a high degree of confidence
the accumulated risk of a train control system that operates over
the designated life-cycle of the product. Each risk metric for the
proposed product must be expressed with an upper bound, as estimated
with a sensitivity analysis, and the risk value selected must be
demonstrated to have a high degree of confidence.
    (b) How does the risk assessment handle interaction risks for
interconnected subsystems/components? The risk assessment of each
safety-critical system (product) must account not only for the risks
associated with each subsystem or component, but also for the risks
associated with interactions (interfaces) between such subsystems.
    (c) What is the main principle in computing risk for the
previous and current conditions? The risk for the previous condition
must be computed using the same metrics as for the new system being
proposed. A full risk assessment must

consider the entire railroad environment where the product is being
applied, and show all aspects of the previous condition that are
affected by the installation of the product, considering all faults,
operating errors, exposure scenarios, and consequences that are
related as described in this part. For the full risk assessment, the
total societal cost of the potential numbers of accidents assessed
for both previous and new system conditions must be computed for
comparison. An abbreviated risk assessment must, as a minimum,
clearly compute the MTTHE for all of the hazardous events identified
for both previous and current conditions. The comparison between
MTTHE for both conditions is to determine whether the product
implementation meets the safety criteria as required by Subpart H or
Subpart I as applicable.
    (d) What major system characteristics must be included when
relevant to risk assessment? Each risk calculation must consider the
total signaling and train control system and method of operation, as
subjected to a list of hazards to be mitigated by the signaling and
train control system. The methodology requirements must include the
following major characteristics, when they are relevant to the
product being considered:
    (1) Track plan infrastructure, switches, rail crossings at grade
and highway-rail grade crossings as applicable;
    (2) Train movement density for freight, work, and passenger
trains where applicable and computed over a time span of not less
than 12 months;
    (3) Train movement operational rules, as enforced by the
dispatcher, roadway worker/Employee in Charge, and train crew
behaviors;
    (4) Wayside subsystems and components;
    (5) Onboard subsystems and components;
    (6) Consist contents such as hazardous material, oversize loads;
and
    (7) Operating speeds if the provisions of Part 236 cite
additional requirements for certain type of train control systems to
be used at such speeds for freight and passenger trains.
    (e) What other relevant parameters must be determined for the
subsystems and components? In order to derive the frequency of
hazardous events (or MTTHE) applicable for a product, subsystem or
component included in the risk assessment, the railroad may use
various techniques, such as reliability and availability
calculations for subsystems and components, Fault Tree Analysis
(FTA) of the subsystems, and results of the application of safety
design principles as noted in Appendix C. Such failure frequency is
to be derived for both fail-safe and non-fail-safe subsystems or
components. The lower bounds of the MTTF or MTBF determined from the
system sensitivity analysis, which account for all necessary and
well justified assumptions, may be used to represent the estimate of
MTTHE for the associated non-fail-safe subsystem or component in the
risk assessment.
    (f) How are processor-based subsystems/components assessed? (1)
An MTTHE value must be calculated for each processor-based subsystem
or component, or both, indicating the safety-critical behavior of
the integrated hardware/software subsystem or component, or both.
The human factor impact must be included in the assessment, whenever
applicable, to provide the integrated MTTHE value. The MTTHE
calculation must consider the rates of failures caused by permanent,
transient, and intermittent faults accounting for the fault coverage
of the integrated hardware/software subsystem or component, phased-
interval maintenance, and restoration of the detected failures.
    (2) Software fault/failure analysis must be based on the proper
assessment of the design and implementation of the application code,
its operating/executive program, and associated device drivers,
historical performance data, analytical methods and experimental
safety-critical performance testing performed on the subsystem or
component. The software assessment process must demonstrate through
repeatable predictive results that all software defects have been
identified and corrected by process with a high degree of
confidence.
    (g) How are non-processor-based subsystems/components assessed?
(1) The safety-critical behavior of all non-processor-based
components, which are part of a processor-based system or subsystem,
must be quantified with an MTTHE metric. The MTTHE assessment
methodology must consider failures caused by permanent, transient,
and intermittent faults, phase-interval maintenance and restoration
of operation after failures and the effect of fault coverage of each
non-processor-based subsystem or component.
    (2) MTTHE compliance verification and validation must be based
on the assessment of the design for adequacy by a documented
verification and validation process, historical performance data,
analytical methods and experimental safety-critical performance
testing performed on the subsystem or component. The non-processor-
based quantification compliance must be demonstrated to have a high
degree of confidence.
    (h) What assumptions must be documented for risk assessment? (1)
The railroad shall document any assumptions regarding the derivation
of risk metrics used. For example, for the full risk assessment, all
assumptions made about each value of the parameters used in the
calculation of total cost of accidents should be documented. For
abbreviated risk assessment, all assumptions made for MTTHE
derivation using existing reliability and availability data on the
current system components should be documented. The railroad shall
document these assumptions in such a form as to permit later
automated comparisons with in-service experience.
    (2) The railroad shall document any assumptions regarding human
performance. The documentation shall be in such a form as to
facilitate later comparisons with in-service experience.
    (3) The railroad shall document any assumptions regarding
software defects. These assumptions shall be in a form which permits
the railroad to project the likelihood of detecting an in-service
software defect. These assumptions shall be documented in such a
form as to permit later automated comparisons with in-service
experience.
    (4) The railroad shall document all of the identified safety-
critical fault paths to a mishap as predicted by the safety analysis
methodology. The documentation shall be in such a form as to
facilitate later comparisons with in-service faults.

    12. Revise Appendix C to read as follows:

Appendix C to Part 236--Safety Assurance Criteria and Processes

    (a) What is the purpose of this appendix? This appendix provides
safety criteria and processes that the designer must use to develop
and validate the product that meets safety requirements of this
part. FRA uses the criteria and processes set forth in this appendix
to evaluate the validity of safety targets and the results of system
safety analyses provided in the RSPP, PSP, PTCIP, PTCDP, and PTCSP
documents as appropriate. An analysis performed under this appendix
must:
    (1) Address each of the safety principles of paragraph (b) of
this appendix, or explain why they are not relevant, and
    (2) Employ a validation and verification process pursuant to
paragraph (c) of this appendix.
    (b) What safety principles must be followed during product
development? The designer shall address each of the following safety
considerations principles when designing and demonstrating the
safety of products covered by subpart H or I of this part. In the
event that any of these principles are not followed, the PSP or
PTCDP or PTCSP shall state both the reason(s) for departure and the
alternative(s) utilized to mitigate or eliminate the hazards
associated with the design principle not followed.
    (1) System safety under normal operating conditions. The system
(all its elements including hardware and software) must be designed
to assure safe operation with no hazardous events under normal
anticipated operating conditions with proper inputs and within the
expected range of environmental conditions. All safety-critical
functions must be performed properly under these normal conditions.
Absence of specific operator actions or procedures will not prevent
the system from operating safely. The designer must identify and
categorize all hazards that may lead to unsafe system operation.
Hazards categorized as unacceptable or undesirable, which is
determined by hazard analysis, must be eliminated by design. Those
undesirable hazards that cannot be eliminated should be mitigated to
the acceptable level as required by this part.
    (2) System safety under failures.
    (i) It must be shown how the product is designed to eliminate or
mitigate or eliminate unsafe systematic failures--those conditions
which can be attributed to human error that could occur at various
stages throughout product development. This includes unsafe errors
in the software due to human error in the software specification,
design or coding phases, or both; human errors that could impact
hardware design; unsafe conditions that could occur because of an
improperly designed human-machine interface; installation and
maintenance errors; and errors associated with making modifications.

    (ii) The product must be shown to operate safely under
conditions of random hardware failure. This includes single as well
as multiple hardware failures, particularly in instances where one
or more failures could occur, remain undetected (latent) and react
in combination with a subsequent failure at a later time to cause an
unsafe operating situation. In instances involving a latent failure,
a subsequent failure is similar to there being a single failure. In
the event of a transient failure, and if so designed, the system
should restart itself if it is safe to do so. Frequency of attempted
restarts must be considered in the hazard analysis required by Sec.
236.907(a)(8).
    (iii) There shall be no single point failures in the product
that can result in hazards categorized as unacceptable or
undesirable. Occurrence of credible single point failures that can
result in hazards must be detected and the product must achieve a
known safe state before falsely activating any physical appliance.
    (iv) If one non-self-revealing failure combined with a second
failure can cause a hazard that is categorized as unacceptable or
undesirable, then the second failure must be detected and the
product must achieve a known safe state before falsely activating
any physical appliance.
    (v) Another concern of multiple failures involves common mode
failures in which two or more subsystems or components intended to
compensate one another to perform the same function all fail by the
same mode and result in unsafe conditions. This is of particular
concern in instances in which two or more elements (hardware or
software, or both) are used in combination to ensure safety. If a
common mode failure exists, then any analysis performed under this
appendix cannot rely on the assumption that failures are
independent. Examples include: The use of redundancy in which two or
more elements perform a given function in parallel and when one
(hardware or software) element checks/monitors another element (of
hardware or software) to help ensure its safe operation. Common mode
failure relates to independence, which must be ensured in these
instances. When dealing with the effects of hardware failure, the
designer shall address the effects of the failure not only on other
hardware, but also on the execution of the software, since hardware
failures can greatly affect how the software operates.
    (3) Closed loop principle. System design adhering to the closed
loop principle requires that all conditions necessary for the
existence of any permissive state or action be verified to be
present before the permissive state or action can be initiated.
Likewise the requisite conditions shall be verified to be
continuously present for the permissive state or action to be
maintained. This is in contrast to allowing a permissive state or
action to be initiated or maintained in the absence of detected
failures. In addition, closed loop design requires that failure to
perform a logical operation, or absence of a logical input, output
or decision shall not cause an unsafe condition, i.e., system safety
does not depend upon the occurrence of an action or logical
decision.
    (4) Safety assurance concepts. The product design must include
one or more of the following Safety Assurance Concepts as described
in IEEE-1483 standard to ensure that failures are detected and the
product is placed in a safe state. One or more different principles
may be applied to each individual subsystem or component, depending
on the safety design objectives of that part of the product.
    (i) Design diversity and self-checking concept. This concept
requires that all critical functions be performed in diverse ways,
using diverse software operations and/or diverse hardware channels,
and that critical hardware be tested with Self-Checking routines.
Permissive outputs are allowed only if the results of the diverse
operations correspond, and the Self-Checking process reveals no
failures in either execution of software or in any monitored input
or output hardware. If the diverse operations do not agree or if the
checking reveals critical failures, safety-critical functions and
outputs must default to a known safe state.
    (ii) Checked redundancy concept. The Checked Redundancy concept
requires implementation of two or more identical, independent
hardware units, each executing identical software and performing
identical functions. A means is to be provided to periodically
compare vital parameters and results of the independent redundant
units, requiring agreement of all compared parameters to assert or
maintain a permissive output. If the units do not agree, safety-
critical functions and outputs must default to a known safe state.
    (iii) N-version programming concept. This concept requires a
processor-based product to use at least two software programs
performing identical functions and executing concurrently in a
cycle. The software programs must be written by independent teams,
using different tools. The multiple independently written software
programs comprise a redundant system, and may be executed either on
separate hardware units (which may or may not be identical) or
within one hardware unit. A means is to be provided to compare the
results and output states of the multiple redundant software
systems. If the system results do not agree, then the safety-
critical functions and outputs must default to a known safe state.
    (iv) Numerical assurance concept. This concept requires that the
state of each vital parameter of the product or system be uniquely
represented by a large encoded numerical value, such that permissive
results are calculated by pseudo-randomly combining the
representative numerical values of each of the critical constituent
parameters of a permissive decision. Vital algorithms must be
entirely represented by data structures containing numerical values
with verified characteristics, and no vital decisions are to be made
in the executing software, only by the numerical representations
themselves. In the event of critical failures, the safety-critical
functions and outputs must default to a known safe state.
    (v) Intrinsic fail-safe design concept. Intrinsically fail-safe
hardware circuits or systems are those that employ discrete
mechanical and/or electrical components. The fail-safe operation for
a product or subsystem designed using this principle concept
requires a verification that the effect of every relevant failure
mode of each component, and relevant combinations of component
failure modes, be considered, analyzed, and documented. This is
typically performed by a comprehensive failure modes and effects
analysis (FMEA) which must show no residual unmitigated failures. In
the event of critical failures, the safety-critical functions and
outputs must default to a known safe state.
    (5) Human factor engineering principle. The product design must
sufficiently incorporate human factors engineering that is
appropriate to the complexity of the product; the educational,
mental, and physical capabilities of the intended operators and
maintainers; the degree of required human interaction with the
component; and the environment in which the product will be used.
    (6) System safety under external influences. The product must be
shown to operate safely when subjected to different external
influences, including:
    (i) Electrical influences such as power supply anomalies/
transients, abnormal/improper input conditions (e.g., outside of
normal range inputs relative to amplitude and frequency, unusual
combinations of inputs) including those related to a human operator,
and others such as electromagnetic interference or electrostatic
discharges, or both;
    (ii) Mechanical influences such as vibration and shock; and
    (iii) Climatic conditions such as temperature and humidity.
    (7) System safety after modifications. Safety must be ensured
following modifications to the hardware or software, or both. All or
some of the concerns identified in this paragraph may be applicable
depending upon the nature and extent of the modifications. Such
modifications must follow all of the concept, design, implementation
and test processes and principles as documented in the PSP for the
original product. Regression testing must be comprehensive and
documented to include all scenarios which are affected by the change
made, and the operating modes of the changed product during normal
and failure state (fallback) operation.
    (c) What standards are acceptable for verification and
validation? (1) The standards employed for verification or
validation, or both, of products subject to this subpart must be
sufficient to support achievement of the applicable requirements of
subpart H and subpart I of this part.
    (2) U.S. Department of Defense Military Standard (MIL-STD) 882C,
``System Safety Program Requirements'' (January 19, 1993), is
recognized as providing appropriate risk analysis processes for
incorporation into verification and validation standards.
    (3) The following standards designed for application to
processor-based signal and train control systems are recognized as
acceptable with respect to applicable elements of safety analysis
required by subpart H and subpart I of this part. The latest
versions of the standards listed below should be used unless
otherwise provided.

    (i) IEEE standards as follows:
    (A) IEEE 1483-2000, Standard for the Verification of Vital
Functions in Processor-Based Systems Used in Rail Transit Control.
    (B) IEEE 1474.2-2003, Standard for user interface requirements
in communications based train control (CBTC) systems.
    (C) IEEE 1474.1-2004, Standard for Communications-Based Train
Control (CBTC) Performance and Functional Requirements.
    (ii) CENELEC Standards as follows:
    (A) EN50129: 2003, Railway Applications: Communications,
Signaling, and Processing Systems-Safety Related Electronic Systems
for Signaling; and
    (B) EN50155:2001/A1:2002, Railway Applications: Electronic
Equipment Used in Rolling Stock.
    (iii) ATCS Specification 200 Communications Systems
Architecture.
    (iv) ATCS Specification 250 Message Formats.
    (v) AREMA 2009 Communications and Signal Manual of Recommended
Practices, Part 16, Part 17, 21, and 23.
    (vi) Safety of High Speed Ground Transportation Systems.
Analytical Methodology for Safety Validation of Computer Controlled
Subsystems. Volume II: Development of a Safety Validation
Methodology. Final Report September 1995. Author: Jonathan F.
Luedeke, Battelle. DOT/FRA/ORD-95/10.2.
    (vii) IEC 61508 (International Electrotechnical Commission),
Functional Safety of Electrical/Electronic/Programmable/Electronic
Safety (E/E/P/ES) Related Systems, Parts 1-7 as follows:
    (A) IEC 61508-1 (1998-12) Part 1: General requirements and IEC
61508-1 Corr. (1999-05) Corrigendum 1-Part 1: General Requirements.
    (B) IEC 61508-2 (2000-05) Part 2: Requirements for electrical/
electronic/programmable electronic safety-related systems.
    (C) IEC 61508-3 (1998-12) Part 3: Software requirements and IEC
61508-3 Corr.1 (1999-04) Corrigendum 1-Part3: Software requirements.
    (D) IEC 61508-4 (1998-12) Part 4: Definitions and abbreviations
and IEC 61508-4 Corr.1 (1999-04) Corrigendum 1-Part 4: Definitions
and abbreviations.
    (E) IEC 61508-5 (1998-12) Part 5: Examples of methods for the
determination of safety integrity levels and IEC 61508-5 Corr.1
(1999-04) Corrigendum 1 Part 5: Examples of methods for
determination of safety integrity levels.
    (F) IEC 61508-6 (2000-04) Part 6: Guidelines on the applications
of IEC 61508-2 and -3.
    (G) IEC 61508-7 (2000-03) Part 7: Overview of techniques and
measures.
    (H) IEC62278: 2002, Railway Applications: Specification and
Demonstration of Reliability, Availability, Maintainability and
Safety (RAMS);
    (I) IEC62279: 2002 Railway Applications: Software for Railway
Control and Protection Systems;
    (4) Use of unpublished standards, including proprietary
standards, is authorized to the extent that such standards are shown
to achieve the requirements of this part. However, any such
standards shall be available for inspection and replication by FRA
and for public examination in any public proceeding before the FRA
to which they are relevant.

    13. A new Appendix F to part 236 is added to read as follows:

Appendix F to Part 236--Requirements of Mandatory Independent Third-
Party Assessment of PTC System Safety Verification and Validation

    (a) This appendix provides minimum requirements for mandatory
independent third-party assessment of PTC system safety verification
and validation pursuant to subpart H or I of this part. The goal of
this assessment is to provide an independent evaluation of the PTC
system manufacturer's utilization of safety design practices during
the PTC system's development and testing phases, as required by the
applicable PSP, PTCDP, and PTCSP, the applicable requirements of
subpart H or I of this part, and any other previously agreed-upon
controlling documents or standards.
    (b) The supplier may request advice and assistance of the
independent third-party reviewer concerning the actions identified
in paragraphs (c) through (g) of this appendix. However, the
reviewer should not engage in design efforts in order to preserve
the reviewer's independence and maintain the supplier's proprietary
right to the PTC system.
    (c) The supplier shall provide the reviewer access to any and
all documentation that the reviewer requests and attendance at any
design review or walkthrough that the reviewer determines as
necessary to complete and accomplish the third party assessment. The
reviewer may be accompanied by representatives of FRA as necessary,
in FRA's judgment, for FRA to monitor the assessment.
    (d) The reviewer shall evaluate with respect to safety and
comment on the adequacy of the processes which the supplier applies
to the design and development of the PTC system. At a minimum, the
reviewer shall compare the supplier processes with acceptable
methodology and employ any other such tests or comparisons if they
have been agreed to previously with FRA. Based on these analyses,
the reviewer shall identify and document any significant safety
vulnerabilities which are not adequately mitigated by the supplier's
(or user's) processes. Finally, the reviewer shall evaluate the
adequacy of the railroad's applicable PSP or PTCSP, and any other
documents pertinent to the PTC system being assessed.
    (e) The reviewer shall analyze the Preliminary Hazard Analysis
(PHA) for comprehensiveness and compliance with industry, national,
or international standards.
    (f) The reviewer shall analyze all Fault Tree Analyses (FTA),
Failure Mode and Effects Criticality Analysis (FMECA), and other
hazard analyses for completeness, correctness, and compliance with
industry, national, or international standards.
    (g) The reviewer shall randomly select various safety-critical
software modules, as well as safety-critical hardware components if
required by FRA for audit to verify whether the vendors and
industry, national, or international standards were followed. The
number of modules audited must be determined as a representative
number sufficient to provide confidence that all unaudited modules
were developed in compliance industry, national, or international
standards
    (h) The reviewer shall evaluate and comment on the plan for
installation and test procedures of the PTC system for revenue
service.
    (i) The reviewer shall prepare a final report of the assessment.
The report shall be submitted to the railroad prior to the
commencement of installation testing and contain at least the
following information:
    (1) Reviewer's evaluation of the adequacy of the PSP or PTCSP
including the supplier's MTTHE and risk estimates for the PTC
system, and the supplier's confidence interval in these estimates;
    (2) PTC system vulnerabilities, potentially hazardous failure
modes, or potentially hazardous operating circumstances which the
reviewer felt were not adequately identified, tracked or mitigated;
    (3) A clear statement of position for all parties involved for
each PTC system vulnerability cited by the reviewer;
    (4) Identification of any documentation or information sought by
the reviewer that was denied, incomplete, or inadequate;
    (5) A listing of each applicable vendor, industry, national or
international standard, process, or procedure which was not properly
followed;
    (6) Identification of the hardware and software verification and
validation procedures for the PTC system's safety-critical
applications, and the reviewer's evaluation of the adequacy of these
procedures;
    (7) Methods employed by PTC system manufacturer to develop
safety-critical software, such as use of structured language, code
checks, modularity, or other similar generally acceptable
techniques; and
    (8) If directed by FRA, methods employed by PTC system
manufacturer to develop safety-critical hardware.

Karen J. Rae,
Deputy Administrator.
[FR Doc. E9-17184 Filed 7-15-09; 4:15 pm]

BILLING CODE 4910-06-P