On Monday, June 22, 2009, about 4:58 p.m., eastern daylight time, inbound Washington Metropolitan Area Transit Authority (WMATA) Metrorail train 112 struck the rear of stopped inbound Metrorail train 214. The accident occurred on aboveground track on the Metrorail Red Line near the Fort Totten station in Washington, D.C. The lead car of train 112 struck the rear car of train 214, causing the rear car of train 214 to telescope into the lead car of train 112, resulting in a loss of occupant survival space in the lead car of about 63 feet (about 84 percent of its total length). Nine people aboard train 112, including the train operator, were killed. Emergency response agencies reported transporting 52 people to local hospitals. Damage to train equipment was estimated to be $12 million.
The National Transportation Safety Board determines that the probable cause of the June 22, 2009, collision of Washington Metropolitan Area Transit Authority (WMATA) Metrorail train 112 with the rear of standing train 214 near the Fort Totten station was (1) a failure of the track circuit modules, built by GRS/Alstom Signaling Inc., that caused the automatic train control system to lose detection of train 214 (the struck train) and thus transmit speed commands to train 112 (the striking train) up to the point of impact, and (2) WMATA's failure to ensure that the enhanced track circuit verification test (developed following the 2005 Rosslyn near-collisions) was institutionalized and used systemwide, which would have identified the faulty track circuit before the accident.
Contributing to the accident were (1) WMATA's lack of a safety culture, (2) WMATA's failure to effectively maintain and monitor the performance of its automatic train control system, (3) GRS/Alstom Signaling Inc.'s failure to provide a maintenance plan to detect spurious signals that could cause its track circuit modules to malfunction, (4) ineffective safety oversight by the WMATA Board of Directors, (5) the Tri-State Oversight Committee's ineffective oversight and lack of safety oversight authority, and (6) the Federal Transit Administration's lack of statutory authority to provide federal safety oversight.
Contributing to the severity of passenger injuries and the number of fatalities was WMATA's failure to replace or retrofit the 1000-series railcars after these cars were shown in a previous accident to exhibit poor crashworthiness.
The National Transportation Safety Board's investigation found that the Metrorail automatic train control system stopped detecting the presence of train 214 (the struck train), which caused train 214 to stop and also allowed speed commands to be transmitted to train 112 (the striking train) until the collision. This loss of detection occurred because parasitic oscillation in the General Railway Signal Company (GRS)/Alstom Signaling Inc. (Alstom) track circuit modules was creating a spurious signal that mimicked a valid track circuit signal, thus causing the track circuit to fail to detect the presence of train 214. The investigation found that the track circuit modules did not function safely as part of a fail-safe train control system because GRS/Alstom did not provide a maintenance plan that would detect anomalies in the track circuit signal, such as parasitic oscillation, over the modules' service life and prevent these anomalies from being interpreted as valid track circuit signals.
The investigation examined two near-collisions in 2005 near the Rosslyn Metrorail station that were the result of a loss of train detection. The track circuit in that case failed to detect the presence of stopped trains between the Foggy Bottom and Rosslyn stations. Tests on the circuit modules from the Rosslyn event conducted in 2009 as part of the Fort Totten investigation showed that the Rosslyn modules exhibited parasitic oscillation, and archived data showed that the Rosslyn track circuit had experienced this problem from as far back as 1988 (the earliest time from which data were available). In response to the Rosslyn event, WMATA developed, and issued technical bulletins requiring the use of an enhanced circuit verification test procedure. However, none of the WMATA technicians interviewed as part of this investigation was familiar with the enhanced procedure.
This report explains that WMATA failed to institutionalize and employ systemwide the enhanced track circuit verification test procedure that was developed following the 2005 Rosslyn near-collisions. If the enhanced circuit verification test procedure had been used after recent track circuit work near the Fort Totten accident location, work crews would have been able to determine that the track circuit was failing to detect trains, and actions could have been taken to resolve the problem and prevent the accident.
The report also discusses how shortcomings in WMATA's internal communications, its recognition of hazards, its assessment of risk from those hazards, and its implementation of corrective actions are all evidence of an ineffective safety culture within the organization. Examples described in the report include the low priority that WMATA Metrorail managers placed on addressing malfunctions in the train control system before the accident, which likely influenced the inadequate response to such malfunctions by automatic train control technicians, operations control center controllers, and train operators; and the fact that before the accident the position of chief safety officer lacked the necessary resources and authority, within the organizational structure of WMATA, to adequately identify and address system safety issues and ensure the distribution of safety-critical information throughout the organization.
The report explains the role played in the accident by inadequate or deficient oversight by the Tri-State Oversight Committee and the WMATA Board of Directors and the lack of oversight authority by the Federal Transit Administration. Specifically, the report points out that TOC was ineffective in providing proper safety oversight of WMATA and that the WMATA Board of Directors did not seek adequate information about, nor did it demonstrate adequate oversight to address, the number of open corrective action plans from previous Tri-State Oversight Committee and Federal Transit Administration safety audits of WMATA. The report also explains how the structure of the Federal Transit Administration's current oversight process leads to inconsistent practices, inadequate standards, and marginal effectiveness with respect to state safety oversight of rail transit systems.
With regard to the survivability of the accident, the investigation found that the structural design of the 1000-series railcars offers little occupant protection against a catastrophic loss of survival space in a collision and this contributed to the severity of the occupant injuries and fatalities. In 2006, the National Transportation Safety Board recommended that WMATA accelerate retirement of the 1000-series cars or retrofit them with crashworthiness collision protection comparable to the 6000-series cars. In 2007, that recommendation was classified "Closed—Unacceptable Action" based on WMATA's response that it was not feasible to retrofit the 1000-series cars and that they would remain in service until replacement with the 7000-series cars in 2014.
As a result of its investigation of this accident, the National Transportation Safety Board makes the following safety recommendations.
To the U.S. Department of Transportation:
Continue to seek the authority to provide safety oversight of rail fixed guideway transportation systems, including the ability to promulgate and enforce safety regulations and minimum requirements governing operations, track and equipment, and signal and train control systems. (R-10-3)
To the Federal Transit Administration:
Facilitate the development of non-punitive safety reporting programs at all transit agencies to collect reports from employees in all divisions within their agencies and to have their safety departments; representatives of their operations, maintenance, and engineering departments; and representatives of labor organizations regularly review these reports and share the results of those reviews across all divisions of their agencies. (R-10-4)
Seek authority similar to Federal Railroad Administration regulations (Title 49 Code of Federal Regulations 219.207) to require that transit agencies obtain toxicological specimens from covered transit employees and contractors who are fatally injured as a result of an on-duty accident. (R-10-5)
To the Tri-State Oversight Committee:
Work with the Washington Metropolitan Area Transit Authority to satisfactorily address the recommendations contained in the Federal Transit Administration's March 4, 2010, final report of its audit of the Tri-State Oversight Committee and the Washington Metropolitan Area Transit Authority. (R-10-6)
To the Board of Directors, Washington Metropolitan Area Transit Authority:
Elevate the safety oversight role of the Washington Metropolitan Area Transit Authority Board of Directors by (1) developing a policy statement to explicitly and publicly assume the responsibility for continual oversight of system safety, (2) implementing processes to exercise oversight of system safety, including appropriate proactive performance metrics, and (3) evaluating actions taken in response to National Transportation Safety Board and Federal Transit Administration recommendations, as well as the status of open corrective action plans and the results of audits conducted by the Tri-State Oversight Committee. (R-10-7)
To the Washington Metropolitan Area Transit Authority:
Because of the susceptibility to pulse-type parasitic oscillation that can cause a loss of train detection by the Generation 2 General Railway Signal Company audio frequency track circuit modules, establish a program to permanently remove from service all of these modules within the Metrorail system. (R-10-8)
Establish periodic inspection and maintenance procedures to examine all audio frequency track circuit modules within the Metrorail system to identify and remove from service any modules that exhibit pulse-type parasitic oscillation. (R-10-9)
Review the process by which Metrorail technical bulletins and other safety information are provided to employees and revise that process as necessary to ensure that (1) employees have received the information intended for them, (2) employees understand the actions to be taken in response to the information, and (3) employees take the appropriate actions. (R-10-10)
Completely remove the unnecessary Metrorail wayside maintenance communication system to eliminate its potential for interfering with the proper functioning of the train control system. (R-10-11)
Conduct a comprehensive safety analysis of the Metrorail automatic train control system to evaluate all foreseeable failures of this system that could result in a loss of train separation, and work with your train control equipment manufacturers to address in that analysis all potential failure modes that could cause a loss of train detection, including parasitic oscillation, cable faults and placement, and corrugated rail. (R-10-12)
Based on the findings of the safety analysis recommended in R-10-12 incorporate the design, operational, and maintenance controls necessary to address potential failures in the automatic train control system. (R-10-13)
Implement cable insulation resistance testing as part of Metrorail's periodic maintenance program. (R-10-14)
Work with the Tri-State Oversight Committee to satisfactorily address the recommendations contained in the Federal Transit Administration's March 4, 2010, final report of its audit of the Tri-State Oversight Committee and the Washington Metropolitan Area Transit Authority. (R-10-15)
Require that your safety department; representatives of the operations, maintenance, and engineering departments; and representatives of labor organizations regularly review recorded operational data from Metrorail train onboard recorders and the Advanced Information Management system to identify safety issues and trends and share the results across all divisions of your organization. (R-10-16)
Develop and implement a non-punitive safety reporting program to collect reports from employees in all divisions within your organization, and ensure that the safety department; representatives of the operations, maintenance, and engineering departments; and representatives of labor organizations regularly review these reports and share the results of those reviews across all divisions of your organization. (R-10-17)
Review the Hazard Identification and Resolution Matrix process in your system safety program plan to ensure that safety-critical systems such as the automatic train control system and its subsystem components are assigned appropriate levels of risk in light of the issues identified in this accident. (R-10-18)
Develop a formal process by which the general manager and managers responsible for Washington Metropolitan Area Transit Authority operations, maintenance, and engineering will periodically review, in collaboration with the chief safety officer, all safety audits and open corrective action plans, and modify policy, identify and commit resources, and initiate any other action necessary to ensure that the plans are adequately addressed and closed within the required time frame. (R-10-19)
Remove all 1000-series railcars as soon as possible and replace them with cars that have crashworthiness collision protection at least comparable to the 6000-series railcars. (R-10-20)
Ensure that the lead married-pair car set of each train is equipped with an operating onboard event recorder. (R-10-21)
Develop and implement a program to monitor the performance of onboard event recorders and ensure they are functioning properly. (R-10-22)
To Alstom Signaling Inc.:
Develop and implement periodic inspection and maintenance guidelines for use by the Washington Metropolitan Area Transit Authority and other rail transit operators and railroads equipped with General Railway Signal Company audio frequency track circuit modules and assist them in identifying and removing from service all modules that exhibit pulse-type parasitic oscillation in order to ensure the vitality and integrity of the automatic train control system. (R-10-23)
Conduct a comprehensive safety analysis of your audio frequency track circuit modules to evaluate all foreseeable failure modes that could cause a loss of train detection over the service life of the modules, including parasitic oscillation, and work with your customers to address these failure modes. (R-10-24)
To the Massachusetts Bay Transportation Authority, the Southeastern Pennsylvania Transportation Authority, the Greater Cleveland Regional Transit Authority, the Metropolitan Atlanta Regional Transportation Authority, the Los Angeles County Metropolitan Transportation Authority, and the Chicago Transit Authority:
Work with Alstom Signaling Inc. to establish periodic inspection and maintenance procedures to examine all General Railway Signal Company audio frequency track circuit modules to identify and remove from service any modules that exhibit pulse-type parasitic oscillation. (R-10-25)
As a result of this accident investigation, the National Transportation Safety Board previously issued the following safety recommendations:
To the Federal Transit Administration:
Advise all rail transit operators that have train control systems capable of monitoring train movements to determine whether their systems have adequate safety redundancy if losses in train detection occur. If a system is susceptible to single point failures, urge and verify that corrective action is taken to add redundancy by evaluating track occupancy data on a real-time basis to automatically generate alerts and speed restrictions to prevent train collisions. (R-09-7 Urgent) (Currently classified "Open—Acceptable Response.")
Advise all rail transit operators that use audio frequency track circuits in their train control systems that postaccident testing following the June 22, 2009, collision between two rail transit trains near the Fort Totten station in Washington, D.C., identified that a spurious signal generated in a track circuit module transmitter by parasitic oscillation propagated from the transmitter through a metal rack to an adjacent track circuit module receiver, and through a shared power source, thus establishing an unintended signal path. The spurious signal mimicked a valid track circuit signal, bypassed the rails, and was sensed by the module receiver so that the ability of the track circuit to detect the train was lost. (R-09-17 Urgent) (Classified "Closed—Acceptable Action.")
Advise all rail transit operators that use audio frequency track circuits in their train control systems to examine track circuits that may be susceptible to parasitic oscillation and spurious signals capable of exploiting unintended signal paths and eliminate those adverse conditions that could affect the safe performance of their train control systems. This work should be conducted in coordination with their signal and train control equipment manufacturers. (R-09-18 Urgent) (Classified "Closed—Acceptable Action.")
Advise all rail transit operators that use audio frequency track circuits in their train control systems to develop a program to periodically determine that electronic components in their train control systems are performing within design tolerances. (R-09-19) (Currently classified "Open—Acceptable Response.")
To the Federal Railroad Administration:
Advise all railroads that use audio frequency track circuits in their train control systems that postaccident testing following the June 22, 2009, collision between two rail transit trains near the Fort Totten station in Washington, D.C., identified that a spurious signal generated in a track circuit module transmitter by parasitic oscillation propagated from the transmitter through a metal rack to an adjacent track circuit module receiver, and through a shared power source, thus establishing an unintended signal path. The spurious signal mimicked a valid track circuit signal, bypassed the rails, and was sensed by the module receiver so that the ability of the track circuit to detect the train was lost. (R-09-20 Urgent) (Classified "Closed—Acceptable Action.")
Require all railroads that use audio frequency track circuits in their train control systems to examine track circuits that may be susceptible to parasitic oscillation and spurious signals capable of exploiting unintended signal paths and eliminate those adverse conditions that could affect the safe performance of their train control systems. This work should be conducted in coordination with their signal and train control equipment manufacturers. (R-09-21 Urgent) (Currently classified "Open—Acceptable Response.")
Require all railroads that use audio frequency track circuits in their train control systems to develop a program to periodically determine that electronic components in their train control systems are performing within design tolerances. (R-09-22) (Currently classified "Open—Acceptable Response.")
To Washington Metropolitan Area Transit Authority:
Take action to enhance the safety redundancy of your train control system by evaluating track occupancy data on a real-time basis in order to detect losses in track occupancy and automatically generate alerts. Alerts should prompt actions that include immediately stopping train movements or implementing appropriate speed restrictions to prevent collisions. (R-09-6 Urgent) (Currently classified "Open—Acceptable Response.")
Develop a program to periodically determine that electronic components in your train control system are performing within design tolerances. (R-09-16) (Currently classified "Open—Initial Response Received.")
To Washington Metropolitan Area Transit Authority:
Examine track circuits within your system that may be susceptible to parasitic oscillation and spurious signals capable of exploiting unintended signal paths, and eliminate those adverse conditions that could affect the safe performance of your train control system. This work should be conducted in coordination with your signal and train control equipment manufacturer(s). (R-09-15 Urgent)
Urgent Safety Recommendation R-09-15, previously classified "Open—Acceptable Response," is reclassified "Closed—Superseded" by Safety Recommendation R-10-8.
To Alstom Signaling Inc.:
Assist the Washington Metropolitan Area Transit Authority, and other rail transit operators and railroads that use your audio frequency track circuit equipment, in examining their train control systems for susceptibility to parasitic oscillations and spurious signals capable of exploiting unintended signal paths, and implementing measures to eliminate those adverse conditions that could affect the safe performance of their train control systems. (R-09-23 Urgent)
Urgent Safety Recommendation R-09-23, previously classified "Open—Acceptable Response," is reclassified "Closed—Superseded" by Safety Recommendations R-10-23 and -25.
