(a) General. The rolling stock shall be designed to meet all applicable clearance requirements of the railroad. The railroad shall make its clearance diagrams available to FRA upon request.

(b) Clearance above top of rail. No part or appliance of a trainset except the wheels, sander tips, wheel guards, and other components designed to be in the path of the wheel (i.e., above the rail and aligned inside the wheel width path) may be less than 60 mm (2.36 inches) above the top of rail.

(c) Obstacle deflector. The leading end of a trainset shall be equipped with an obstacle deflector that extends across both rails of the track. The minimum clearance above the rail of the obstacle deflector shall be 76 mm (3 inches), and the maximum clearance shall be 229 mm (9 inches).

(d) Flexible wheel guards. The lead axle of a trainset shall be equipped with flexible wheel guards mounted on the bogie below the primary suspension with a maximum clearance above the rail of 15 mm (0.59 inches).

(a) Occupied volume integrity. To demonstrate resistance to loss of occupied volume, the trainsets shall comply with both the compression load requirement in paragraph (b) of this section and the dynamic collision requirements in paragraph (c) of this section.

(b) Compression load requirement. The end compression load shall be applied to the vehicle as defined in JIS E 7105:2006(E) as amended by JIS E 7105:2011(E) (all incorporated by reference, see § 299.17), with an end load magnitude no less than 980 kN (220,300 lbf) without permanent deformation of the occupied volume.

(c) Dynamic collision scenario. In addition to the requirements of paragraph (b) of this section, occupied volume integrity shall also be demonstrated for the trainset through an evaluation of a dynamic collision scenario in which a moving trainset impacts a proxy object under the following conditions:

(1) The initially-moving trainset is made up of the equipment undergoing evaluation at its AW0 ready-to-run weight.

(2) The scenario shall be evaluated on tangent, level track.

(3) The trainset shall have an initial velocity of 32 km/h (20 mph) and shall not be braked.

(4) The proxy object shall have the following characteristics:

(i) The object shall be a solid circular cylinder that weighs 6350 kg (14,000 pounds);

(ii) The object shall have a width of 914 mm (36 inches) and a diameter of 1219 mm (48 inches);

(iii) The axis of the cylinder shall be perpendicular to the direction of trainset motion and parallel to the ground; and

(iv) The center of the object shall be located 762 mm (30 inches) above the top of the underframe.

(5) Two collision configurations shall be evaluated.

(i) The center of the object shall be located 483 mm (19 inches) from the longitudinal centerline of the trainset; and

(ii) The center of the object shall be aligned with the side of the cab car at the point of maximum width.

(6) The model used to demonstrate compliance with the dynamic collision requirements must be validated. Model validation shall be demonstrated and submitted to FRA for review and approval.

(7) As a result of the impact described in paragraphs (c)(5)(i) and (ii) of this section—

(i) One of the following two conditions must be met for the occupied volume:

(A) There shall be no more than 254 mm (10 inches) of longitudinal permanent deformation; or

(B) Global vehicle shortening shall not exceed 1 percent over any 4.6 m (15-feet) length of occupied volume.

(ii) Compliance with each of the following conditions shall also be demonstrated for the cab after the impact:

(A) Each seat provided for an employee regularly assigned to occupy the cab, and any floor-mounted seat in the cab, shall maintain a survival space where there is no intrusion for a minimum of 305 mm (12 inches) from each edge of the seat. Walls or other items originally within this defined space shall not further intrude more than 38 mm (1.5 inches) towards the seat under evaluation.

(B) There shall be a clear exit path for the occupants of the cab;

(C) The vertical height of the cab (floor to ceiling) shall not be reduced by more than 20 percent; and

(D) The operating console shall not have moved closer to the driver's seat by more than 51 mm (2 inches).

(d) Equipment override. (1) Using the dynamic collision scenarios described in paragraph (c) of this section, and with all units in the trainset positioned at their nominal running heights, the anti-climbing performance shall be evaluated for each of the following sets of initial conditions:

(2) For the initial conditions specified in paragraphs (c)(1) through (3) of this section, compliance with the following conditions shall be demonstrated after a dynamic impact:

(i) The relative difference in elevation between the underframes of the connected equipment shall not change by more than 102 mm (4 inches); and

(ii) The tread of any wheel of the trainset shall not rise above the top of rail by more than 102 mm (4 inches).

(e) Roof and side structure integrity. To demonstrate roof and side structure integrity, each passenger car shall comply with the following:

(1) Rollover strength. (i) Each passenger car shall be designed to rest on its side and be uniformly supported at the top and bottom cords of the vehicle side. The allowable stress in the structural members of the occupied volumes for this condition shall be one-half yield or one-half the critical buckling stress, whichever is less. Local yielding to the outer skin of the passenger car is allowed provided that the resulting deformations in no way intrude upon the occupied volume of the car.

(ii) Each passenger car shall also be designed to rest on its roof so that any damage in occupied areas is limited to roof extrusions. Other than roof extrusions, the allowable stress in the structural members of the occupied volumes for this condition shall be one-half yield or one-half the critical buckling stress, whichever is less. Local yielding to the outer skin, including the floor structure, of the car is allowed provided that the resulting deformations in no way intrude upon the occupied volume of the car. Deformation to the roof extrusions is allowed to the extent necessary to permit the vehicle to be supported directly on the top chords of the sides and ends.

(2) Side structure. (i) The sum of the section moduli about a longitudinal axis, taken at the weakest horizontal section between the side sill and roof, of the extrusions on each side of the car located between the inside edge of the doors shall be not less than 3.95 x 105 mm 3 (24.1 in 3).

(ii) The sum of the section moduli about a transverse axis, taken at the weakest horizontal section on each side of the car located between body corners shall be not less than 2.64 x 105 mm 3 (16.1 in 3).

(iii) The minimum section moduli or thicknesses specified in paragraph (f)(2)(i) of this section shall be adjusted in proportion to the ratio of the yield strength of the material used to a value of 172 MPa (25 ksi).

(iv) The combined thickness of the skin of the side structure extrusions shall not be less than 3 mm (0.125 inch) nominal thickness. The thicknesses shall be adjusted in proportion to the ratio of the yield strength of the material used to a value of 172 MPa (25 ksi).

(f) Bogie-to-carbody attachment. (1) The bogie-to-carbody attachment shall utilize the service-proven design as used on the N700.

(2) The bogie shall be securely attached to the carbody and designed to operate without failure under the operating conditions of the railroad, including expected mechanical shocks and vibrations.

(a) Interior fittings. Interior fittings of trainsets shall be—

(1) Securely attached and designed to operate without failure under the conditions typically found in passenger rail equipment including expected mechanical vibrations, and shock.

(2) To the extent possible, all interior fittings shall be recessed or flush mounted. Corners and/or sharp edges shall be either avoided or padded to mitigate the consequence of impact with such surfaces.

(b) Luggage stowage. (1) Luggage stowage racks shall slope downward in the outboard direction at a minimum ratio of 1:8 with respect to a horizontal plane to provide lateral restraint for stowed articles.

(2) Luggage stowage compartments shall provide longitudinal restraint for stowed articles.

(a) General. The railroad shall install glazing systems compliant with the requirements defined in this section.

(b) Trainset glazing; end-facing. (1) Each end-facing exterior window of the trainset shall comply with the requirements for large object and ballistic impact scenarios as defined in this section.

(2) Each end-facing exterior window of the trainset shall demonstrate compliance with the following requirements for the large object impact test.

(i) The glazing article shall be impacted with a cylindrical projectile that complies with the following design specifications as depicted in Figure 1 to paragraph (b)(2)(i)(D) of this section:

(A) The projectile shall be constructed of aluminum alloy such as ISO 6362-2:1990, grade 2017A, or its demonstrated equivalent;

(B) The projectile end cap shall be made of steel;

(C) The projectile assembly shall weigh 1 kilogram (kg) (−0, +0.020 kg) or 2.2 lbs (−0, +0.044 lbs) and shall have a hemispherical tip. Material may be removed from the interior of the aluminum portion to adjust the projectile mass according to the prescribed tolerance. The hemispherical tip shall have a milled surface with 1 mm (0.04 inches) grooves; and

(D) The projectile shall have an overall diameter of 94 mm (3.7 inches) with a nominal internal diameter of 70 mm (2.76 inches).

(ii) The test of the glazing article shall be deemed satisfactory if the test projectile does not penetrate the glazing article, the glazing article remains in its frame, and the witness plate is not marked by spall.

(iii) A new projectile shall be used for each test.

(iv) The glazing article to be tested shall be that which has the smallest area for each design type. For the test, the glazing article shall be fixed in a frame of the same construction as that mounted on the vehicle.

(v) A minimum of four tests shall be conducted and all must be deemed satisfactory. Two tests shall be conducted with the complete glazing article at 0 °C ± 0.5 °C (32 °F ± 0.9 °F) and two tests shall be conducted with the complete glazing article at 20 °C ± 5 °C (68 °F ± 9 °F). For the tests to be valid it shall be demonstrated that the core temperature of the complete glazing article during each test is within the required temperature range.

(vi) The test glazing article shall be mounted at the same angle relative to the projectile path as it will be to the direction of travel when mounted on the vehicle.

(vii) The projectile's impact velocity shall equal the maximum operating speed of the trainset plus 160 km/h (100 mph). The projectile velocity shall be measured within 4 m (13 feet) of the point of impact.

(viii) The point of impact shall be at the geometrical center of the glazing article.

(3) Representative samples for large object impact testing of large end-facing cab glazing articles may be used, instead of the actual design size provided that the following conditions are met:

(i) Testing of glazing articles having dimensions greater than 1,000 mm by 700 mm (39.4 by 27.6 inches), excluding framing, may be performed using a flat sample having the same composition as the glazing article for which compliance is to be demonstrated. The glazing manufacturer shall provide documentation containing its technical justification that testing a flat sample is sufficient to verify compliance of the glazing article with the requirements of this paragraph.

(ii) Flat sample testing is permitted only if no surface of the full-size glazing article contains curvature whose radius is less than 2,500 mm (98 inches); and when a complete, finished, glazing article is laid (convex side uppermost) on a flat horizontal surface, the distance, (measured perpendicularly to the flat surface) between the flat surface and the inside face of the glazing article is not greater than 200 mm (8 inches).

(4) End-facing glazing shall demonstrate sufficient resistance to spalling, as verified by the large impact projectile test under the following conditions:

(i) An annealed aluminum witness plate of maximum thickness 0.15 mm (0.006 inches) and of dimension 500 mm by 500 mm (19.7 by 19.7 inches) is placed vertically behind the sample under test, at a horizontal distance of 500 mm (19.7 inches) from the point of impact in the direction of travel of the projectile or the distance between the point of impact of the projectile and the location of the driver's eyes in the driver's normal operating position, whichever is less. The center of the witness plate is aligned with the point of impact.

(ii) Spalling performance shall be deemed satisfactory if the aluminum witness plate is not marked.

(iii) For the purposes of this part, materials used specifically to protect the cab occupants from spall (i.e., spall shields) shall not be required to meet the flammability and smoke emission performance requirements of § 299.413.

(5) Each end-facing exterior window in a cab shall, at a minimum, provide ballistic penetration resistance that meets the requirements of appendix A to part 223 of this chapter.

(c) Trainset glazing; side-facing. Except as provided in paragraph (d) of this section, each side-facing exterior window in a trainset shall comply with the requirements for Type II glazing as defined in part 223 of this chapter or other alternative standard approved by FRA.

(d) Side-facing breakable glazing. A side-facing exterior window intended to be breakable and serve as an emergency egress window may comply with an alternative standard approved for use by FRA under § 299.15.

(e) Certification of Glazing Materials. Glazing materials shall be certified in accordance with the following procedures:

(1) Each manufacturer that provides glazing materials, intended by the manufacturer for use in achieving compliance with the requirements of this subpart, shall certify that each type of glazing material being supplied for this purpose has been successfully tested in accordance with this section and that test verification data are available to the railroad or to FRA upon request.

(2) Tests performed on glazing materials for compliance with this part shall be conducted by either—

(i) An independent third party (lab, facility, underwriter); or

(ii) The glazing manufacturer, providing FRA with the opportunity to witness all tests by written notice, a minimum of 30 days prior to testing.

(3) Any glazing material certified to meet the requirements of this part shall be re-certified if any change is made to the glazing that may affect its mechanical properties or its mounting arrangement on the vehicle.

(4) All certification/re-certification documentation shall be made available to FRA upon request. The test verification data shall contain all pertinent original data logs and documentation that the selection of material samples, test set-ups, test measuring devices, and test procedures were performed by qualified individuals using recognized and acceptable practices and in accordance with this section.

(5) Glazing shall be marked in the following manner:

(i) Each end-facing exterior window in a cab shall be permanently marked, prior to installation, in such a manner that the marking is clearly visible after the material has been installed. The marking shall include:

(A) The words “FRA TYPE IHS” to indicate that the material meets the requirements specified in paragraph (b) of this section;

(B) The manufacturer of the material; and

(C) The type or brand identification of the material.

(ii) Each side-facing exterior window in a trainset shall be permanently marked, prior to installation, in such a manner that the marking is clearly visible after the material has been installed. The marking shall include:

(A) The words “FRA TYPE II” to indicate that the material meets the requirements specified in paragraph (c) of this section;

(B) The manufacturer of the material; and

(C) The type or brand identification of the material.

(f) Glazing securement. Each exterior window shall remain in place when subjected to—

(1) The forces due to air pressure differences caused when two trainsets pass at the minimum separation for two adjacent tracks, while traveling in opposite directions, each trainset traveling at the maximum approved trainset speed in accordance with § 299.609(g); and

(2) The impact forces that the exterior window is required to resist as specified in this section.

(a) General. The railroad shall demonstrate through analysis and testing the maximum safe operating speed for its trainsets that results in no thermal damage to equipment or infrastructure during normal operation of the brake system.

(b) Minimum performance requirement for brake system. Each trainset's brake system, under the worst-case adhesion conditions as defined by the railroad, shall be capable of stopping the trainset from its maximum operating speed within the signal spacing existing on the track over which the trainset is operating.

(c) Urgent brake system. A trainset shall be provided with an urgent brake application feature that produces an irretrievable stop. An urgent brake application shall be available at any time, and shall be initiated by an unintentional parting of the trainset or by the trainset crew from the conductor rooms.

(d) Application/release indication. The brake system shall be designed so that an inspector may determine whether the brake system is functioning properly without being placed in a dangerous position on, under or between the equipment. This determination may be made through automated monitoring system that utilizes sensors to verify that the brakes have been applied and released.

(e) Passenger brake alarm. (1) A means to initiate a passenger brake alarm shall be provided at two locations in each unit of a trainset. The words “Passenger Brake Alarm” shall be legibly stenciled or marked on each device or on an adjacent badge plate.

(2) All passenger brake alarms shall be installed so as to prevent accidental activation.

(3) When a passenger brake alarm is activated, it shall initiate an emergency brake application. The emergency brake application can be overridden by the driver so that the trainset can be stopped at a safe location.

(4) To retrieve the emergency brake application described in paragraph (e)(3) of this section, the driver must activate appropriate controls to issue a command for brake application as specified in the railroad's operating rules.

(f) Degraded brake system performance. The following requirements address degraded brake system performance on the railroad's high-speed trainsets—

(1) Loss of power or failure of regenerative brake shall not result in exceeding the allowable stopping distance as defined by the railroad;

(2) The available friction braking shall be adequate to stop the trainset safely under the operating conditions defined by the railroad;

(3) The operational status of the trainset brake system shall be displayed for the driver in the operating cab; and

(4) Under § 299.607(b)(5), the railroad shall demonstrate through analysis and testing the maximum speed for safely operating its trainsets using only the friction brake system with no thermal damage to equipment or infrastructure. The analysis and testing shall also determine the maximum safe operating speed for various percentages of operative friction brakes.

(g) Main reservoir system. The main reservoirs in a trainset shall be designed and tested to meet the requirements set forth in JIS B 8265:2010(E) (incorporated by reference, see § 299.17). Reservoirs shall be certified based on their size and volume requirements.

(h) Main reservoir tests. Prior to initial installation, each main reservoir shall be subjected to a pneumatic or hydrostatic pressure test based on the maximum working pressure defined in paragraph (g) of this section unless otherwise established by the railroad's mechanical officer. Records of the test date, location, and pressure shall be maintained by the railroad for the life of the equipment. Periodic inspection requirements for main reservoirs shall be defined in the railroad's inspection, testing, and maintenance program required under § 299.445.

(i) Brake gauges. All mechanical gauges and all devices providing electronic indication of air pressure that are used by the driver to aid in the control or braking of a trainset shall be located so that they can be conveniently read from the driver's normal position during operation of the trainset.

(j) Brake application/release. (1) Brake actuators shall be designed to provide brake pad clearance when the brakes are released.

(2) The minimum brake cylinder pressure shall be established to provide adequate adjustment from minimum service to emergency for proper trainset operation.

(k) Leakage. The method of inspection for main reservoir pipe and brake cylinder pipe leakage shall be prescribed in the railroad's inspection, testing, and maintenance program required by § 299.445.

(l) Slide alarm. (1) A trainset shall be equipped with an adhesion control system designed to automatically adjust the braking force on each wheel to prevent sliding during braking.

(2) A wheel slide alarm that is visual or audible, or both, shall alert the driver in the operating cab to wheel-slide conditions on any axle of the trainset.

(3) Operating restrictions for a trainset with wheel slide protection devices that are not functioning as intended shall be defined by the railroad under its requirements for movement of defective equipment required by § 299.447, and within the railroad's operating rules, as appropriate.

(m) Monitoring and diagnostic system. Each trainset shall be equipped with a monitoring and diagnostic system that is designed to assess the functionality of the brake system for the entire trainset automatically. Details of the system operation and the method of communication of brake system functionality prior to the dispatch of the trainset shall be described in detail in the railroad's Operating Rules and inspection, testing, and maintenance program required by § 299.445.

(n) Trainset securement. Each trainset shall be equipped with a means of securing the equipment, independent of the friction brake, on the grade condition defined by the railroad. The railroad's operating rules shall define procedures for trainset securement and the railroad shall demonstrate that these procedures effectively secure the equipment in accordance with § 299.607(b)(5).

(o) Rescue operation; brake system. A trainset's brake system shall be designed so as to allow a rescue vehicle or trainset to control its brakes when the trainset is disabled.

(a) Wheel climb. (1) Suspension systems shall be designed to reasonably prevent wheel climb, wheel unloading, rail rollover, rail shift, and a vehicle from overturning to ensure safe, stable performance and ride quality. These requirements shall be met—

(i) In all operating environments, and under all track conditions and loading conditions as determined by the railroad; and

(ii) At all track speeds and over all track qualities consistent with the requirements in subpart C of this part, up to the maximum trainset speed and maximum cant deficiency of the equipment in accordance with § 299.609(g).

(2) All passenger equipment shall meet the safety performance standards for suspension systems contained in § 299.609(h). In particular—

(i) Vehicle/track system qualification. All trainsets shall demonstrate safe operation during vehicle/track system qualification in accordance with § 299.609 and is subject to the requirements of § 299.315.

(ii) Revenue service operation. All passenger equipment in service is subject to the requirements of § 299.315.

(b) Lateral accelerations. The trainsets shall not operate under conditions that result in a steady-state lateral acceleration greater than 0.15g, as measured parallel to the car floor inside the passenger compartment.

(c) Journal bearing overheat sensors. Bearing overheat sensors shall be provided on all journal bearings on each trainset.

(a) General. All materials used in constructing the interior of the trainset shall meet the flammability and smoke emission characteristics and testing standards contained in appendix B to part 238 of this chapter. For purposes of this section, the interior of the trainset includes walls, floors, ceilings, seats, doors, windows, electrical conduits, air ducts, and any other internal equipment.

(b) Certification. The railroad shall require certification that a representative sample of combustible materials to be—

(1) Used in constructing a passenger car or a cab, or

(2) Introduced in a passenger car or a cab, as part of any kind of rebuild, refurbishment, or overhaul of the car or cab, has been tested by a recognized independent testing laboratory and that the results show the representative sample complies with the requirements of paragraph (a) of this section at the time it was tested.

(c) Fire safety analysis. The railroad shall ensure that fire safety considerations and features in the design of the trainsets reduce the risk of personal injury caused by fire to an acceptable level in its operating environment using a formal safety methodology. To this end, the railroad shall complete a written fire safety analysis for the passenger equipment being procured. In conducting the analysis, the railroad shall—

(1) Identify, analyze, and prioritize the fire hazards inherent in the design of the equipment.

(2) Take effective steps to design the equipment and select materials which help provide sufficient fire resistance to reasonably ensure adequate time to detect a fire and safely evacuate the passengers and crewmembers, if a fire cannot be prevented. Factors to consider include potential ignition sources; the type, quantity, and location of the materials; and availability of rapid and safe egress to the exterior of the equipment under conditions secure from fire, smoke, and other hazards.

(3) Reasonably ensure that a ventilation system in the equipment does not contribute to the lethality of a fire.

(4) Identify in writing any trainset component that is a risk of initiating fire and which requires overheat protection. An overheat detector shall be installed in any component when the analysis determines that an overheat detector is necessary.

(5) Identify in writing any unoccupied trainset compartment that contains equipment or material that poses a fire hazard, and analyze the benefit provided by including a fire or smoke detection system in each compartment so identified. A fire or smoke detector shall be installed in any unoccupied compartment when the analysis determines that such equipment is necessary to ensure sufficient time for the safe evacuation of passengers and crewmembers from the trainset. For purposes of this section, an unoccupied trainset compartment means any part of the equipment structure that is not normally occupied during operation of the trainset, including a closet, baggage compartment, food pantry, etc.

(6) Determine whether any occupied or unoccupied space requires a portable fire extinguisher and, if so, the proper type and size of the fire extinguisher for each location. As required by § 239.101 of this chapter, each passenger car is required to have a minimum of one portable fire extinguisher. If the analysis performed indicates that one or more additional portable fire extinguishers are needed, such shall be installed.

(7) Analyze the benefit provided by including a fixed, automatic fire-suppression system in any unoccupied trainset compartment that contains equipment or material that poses a fire hazard, and determine the proper type and size of the automatic fire-suppression system for each such location. A fixed, automatic fire-suppression system shall be installed in any unoccupied compartment when the analysis determines that such equipment is practical and necessary to ensure sufficient time for the safe evacuation of passengers and crewmembers from the trainset.

(8) Explain how safety issues are resolved in the design of the equipment and selection of materials to reduce the risk of each fire hazard.

(9) Describe the analysis and testing necessary to demonstrate that the fire protection approach taken in the design of the equipment and selection of materials meets the fire protection requirements of this part.

(d) Inspection, testing, and maintenance. The railroad shall develop and adopt written procedures for the inspection, testing, and maintenance of all fire safety systems and fire safety equipment on the passenger equipment it operates under § 299.445(b), and subpart G of this part. The railroad shall comply with those procedures that it designates as mandatory for the safety of the equipment and its occupants.

(a) Each powered, exterior side door in a vestibule that is partitioned from the passenger compartment of a trainset shall have a manual override device that is—

(1) Capable of releasing the door to permit it to be opened without power.

(2) Located such that—

(i) Interior access is provided adjacent to each manual door release mechanism; and,

(ii) Exterior access is provided on each side of each car.

(3) Designed and maintained so that a person may access and operate the override device readily without requiring the use of a tool or other implement.

(4) The railroad may protect a manual override device used to open a powered, exterior door with a cover or a screen.

(5) When a manual override device is activated, door panel friction, including seals and hangers, shall allow the doors to be opened or closed manually with as low a force as practicable.

(6) The emergency release mechanism shall require manual reset.

(b) Each passenger car shall have a minimum of one exterior side door per side. Each such door shall provide a minimum clear opening with dimensions of 813 mm (32 inches) horizontally by 1,850 mm (72.8 inches) vertically.

(c) Door exits shall be marked, and instructions provided for their use, as specified in § 299.423.

(d) All doors intended for access by emergency responders shall be marked, and instructions provided for their use, as specified in § 299.423.

(e) Vestibule doors and other interior doors intended for passage through a passenger car.

(1) General. Except for a door providing access to a control compartment each powered vestibule door and any other powered interior door intended for passage through a passenger car shall have a manual override device that conforms with the requirements of paragraphs (e)(2) and (3) of this section.

(2) Manual override devices. Each manual override device shall be:

(i) Capable of releasing the door to permit it to be opened without power;

(ii) Located adjacent to the door it controls; and

(iii) Designed and maintained so that a person may readily access and operate the override device from each side of the door without the use of a tool or other implement.

(3) Marking and instructions. Each manual override device and each retention mechanism shall be marked, and instructions provided for their use, as specified in § 299.423.

(f) The status of each powered, exterior side door in a passenger car shall be displayed to the driver in the operating cab. Door interlock sensors shall be provided to detect trainset motion and shall be nominally set to operate at 5 km/h.

(g) All powered exterior side passenger doors shall—

(1) Be equipped with the service-proven door safety system utilized by the N700 or an alternate door safety system designed subject to a Failure Modes, Effects, Criticality Analysis (FMECA);

(2) Be designed with an obstruction detection system capable of detecting a rigid flat bar, 6.4 mm ( 1/4 inches) wide and 76 mm (3 inches) high and a rigid rod, 9.5 mm ( 3/8 inches) in diameter;

(3) Incorporate an obstruction detection system sufficient to detect large obstructions;

(4) Be designed so that activation of a door by-pass feature does not affect the operation of the obstruction detection system on all the other doors on the trainset;

(5) Have the door control station located in a secured area that is only accessible to crewmembers or maintenance personnel;

(6) Be designed such that the door open or closed circuit is not affected by the throttle position; and

(7) Use discrete, dedicated trainlines for door-open and door-close commands, door-closed summary circuit, and no motion, if trainlined.

(h) All powered exterior side door systems in a trainset shall—

(1) Be designed with a door summary circuit. The door summary circuit shall be connected or interlocked to prohibit the trainset from developing tractive power if an exterior side door in a passenger car, other than a door under the direct physical control of a crewmember for his or her exclusive use, is not closed;

(2) Be connected to side door status indicators located on the exterior of each unit of the trainset;

(3) Be connected to a door summary status indicator that is readily viewable to the driver from his or her normal position in the operating cab;

(4) If equipped with a trainset-wide door by-pass device, be designed so that the trainset-wide door by-pass functions only when activated from the operating cab of the trainset;

(5) Be equipped with a lock (cut-out/lock-out) mechanism installed at each door panel to secure a door in the closed and locked position. When the lock mechanism is utilized to secure the door in the closed position, a door-closed indication shall be provided to the door summary circuit; and

(6) Be designed such that a crew key or other secure device be required to lock-out an exterior side door to prevent unauthorized use.

(i)(1) Visual inspections and functional tests. The inspection and functional tests required for the door safety system, including the trainset-wide door by-pass verification, shall be conducted in accordance with the railroad's trainset inspection, testing, and maintenance program in accordance with § 299.445, and operating rules under subpart E.

(2) Face-to-face relief. Crewmembers taking control of a trainset do not need to perform a visual inspection or a functional test of the door by-pass devices in cases of face-to-face relief of another trainset crew and notification by that crew as to the functioning of the door by-pass devices.

(j) The railroad shall maintain a record of each door by-pass activation and each unintended opening of a powered exterior side door, including any repair(s) made, in the defect tracking system as required by § 299.445(h).

(a) General. Emergency lighting shall be provided in each unit of a trainset. The emergency lighting system shall be designed to facilitate the ability of passengers and trainset crew members, and/or emergency responders to see and orient themselves, to identify obstacles, in order to assist them to safely move through and out of a passenger rail car.

(1) Emergency lighting shall illuminate the following areas:

(i) Passenger car aisles, passageways, and toilets;

(ii) Door emergency exit controls/manual releases;

(iii) Vestibule floor near the door emergency exits (to facilitate safe entrance/exit from the door);

(iv) Within the car diaphragm and adjacent area; and

(v) Specialty car locations such as crew offices.

(b) Minimum illumination levels. (1) A minimum, average illumination level of 10.7 lux (1 foot-candle) measured at floor level adjacent to each exterior door and each interior door providing access to an exterior door (such as a door opening into a vestibule);

(2) A minimum, average illumination level of 10.7 lux (1 foot-candle) measured 635 mm (25 inches) above floor level along the center of each aisle and passageway;

(3) A minimum illumination level of 1.1 lux (0.1 foot-candle) measured 635 mm (25 inches) above floor level at any point along the center of each aisle and passageway;

(c) Lighting activation. Each emergency lighting fixture shall activate automatically or be energized continuously whenever the car is in revenue service and normal lighting is not available.

(d) Independent power source. Emergency lighting system shall have an independent power source(s) that is located in or within one half a car length of each light fixture it powers.

(e) Functional requirements. Emergency lighting system components shall be designed to operate without failure and capable of remaining attached under the conditions typically found in passenger rail equipment including expected mechanical vibrations, and shock in accordance with § 299.405(a)(1), as well as comply with electromagnetic interference criteria in § 299.435(e).

(1) All emergency lighting system components shall be capable to operate in all railcar orientations.

(2) All emergency lighting system components shall be capable to operate when normal power is unavailable for 90 minutes without a loss of more than 40% of the minimum illumination levels specified in paragraph (b) of this section.

(f) Inspection. (1) The railroad shall inspect the emergency lighting system as required by its inspection, testing, and maintenance program in accordance with § 299.445.

(2) If batteries are used as independent power sources, they shall have automatic self-diagnostic modules designed to perform discharge tests.

(a) PA (public address) system. Each passenger car shall be equipped with a PA system that provides a means for a trainset crewmember to communicate by voice to passengers of his or her trainset in an emergency situation. The PA system shall also provide a means for a trainset crewmember to communicate by voice in an emergency situation to persons in the immediate vicinity of his or her trainset (e.g., persons on the station platform). The PA system may be part of the same system as the intercom system.

(b) Intercom system. Each passenger car shall be equipped with an intercom system that provides a means for passengers and crewmembers to communicate by voice with each other in an emergency situation. Except as further specified, at least one intercom that is accessible to passengers without using a tool or other implement shall be located in each end (half) of each car.

(c) Marking and instructions. The following requirements apply to all units of a trainset:

(1) The location of each intercom intended for passenger use shall be conspicuously marked with HPPL material in accordance with § 299.423; and

(2) Legible and understandable operating instructions shall be made of HPPL material in accordance with § 299.423 and posted at or near each such intercom.

(d) Back-up power. PA and intercom systems shall have a back-up power system capable of—

(1) Powering each system to allow intermittent emergency communication for a minimum period of 90 minutes. Intermittent communication shall be considered equivalent to continuous communication during the last 15 minutes of the 90-minute minimum period; and

(2) Operating in all equipment orientations within 90 degrees of vertical.

(e) Additional requirements. The PA and intercom systems shall be designed to operate without failure and remain attached under the conditions typically found in passenger rail equipment including expected mechanical vibrations, and shock in accordance with § 299.405(a)(1), as well as comply with electromagnetic interference criteria in § 299.435(e).

(a) Number and dimensions. Each passenger car shall have a minimum of two emergency roof access locations, each providing a minimum opening of 660 mm (26 inches) longitudinally (i.e., parallel to the longitudinal axis of the car) by 610 mm (24 inches) laterally.

(b) Means of access. Emergency roof access shall be provided by means of a conspicuously marked structural weak point in the roof for access by properly equipped emergency response personnel.

(c) Location. Emergency roof access locations shall be situated so that when a car is on its side—

(1) One emergency access location is situated as close as practicable within each half of the roof as divided top from bottom; and

(2) One emergency access location is situated as close as practicable within each half of the roof as divided left from right. (See Figure 1 to this paragraph.)

(d) Obstructions. The ceiling space below each emergency roof access location shall be free from wire, cabling, conduit, and piping. This space shall also be free of any rigid secondary structure (e.g., a diffuser or diffuser support, lighting back fixture, mounted PA equipment, or luggage rack) where practicable. It shall be permissible to cut through interior panels, liners, or other non-rigid secondary structures after making the cutout hole in the roof, provided any such additional cutting necessary to access the interior of the vehicle permits a minimum opening of the dimensions specified in paragraph (a) of this section to be maintained.

(e) Marking instructions. Each emergency roof access location shall be conspicuously marked with retroreflective material of contrasting color meeting the minimum requirements specified in § 299.423. Legible and understandable instructions shall be posted at or near each such location.

(a) General. Instructions and markings shall be provided in each unit of a trainset in accordance with the minimum requirements of this section to provide instructions for passengers and trainset crewmembers regarding emergency egress, and rescue access instructions for emergency responders.

(b) Visual identity and recognition. Emergency exit signage/marking systems shall enable passengers and trainset crewmembers to make positive identification of emergency exits.

(1) Each interior emergency exit sign and emergency exit locator sign shall be conspicuous (i.e., clearly recognizable/distinguishable) or become conspicuous to passengers and trainset crewmembers immediately and automatically upon the loss of power for normal lighting, from a minimum distance of 1.52 m (5 feet).

(2) The signs and markings shall operate independently of the car's normal and emergency lighting systems, for a minimum of 90 minutes after loss of all power for normal lighting.

(3) An emergency exit locator sign shall be located in close proximity of each emergency exit and shall work in conjunction with the emergency exit sign. The location of the sign, directional arrow(s), or wording shall guide passengers and trainset crewmembers to the emergency exit route.

(c) Rescue access signage/marking systems. (1) Rescue access signage and marking systems shall enable emergency responders to make positive identification of rescue access points.

(2) Rescue access information for emergency responders placed on the exterior of the carbody shall, at a minimum, consist of the following:

(i) Each door intended for use by emergency responders for rescue access shall be identified with emergency access signs, symbols, or other conspicuous marking consisting of retroreflective material that complies with paragraphs (d) and (e) of this section.

(ii) Rescue access door control locator signs/markings and instructions;

(A) Each door intended for use by emergency responders for rescue access shall have operating instructions for opening the door from outside the car placed on or immediately adjacent to the door on the carbody. If a power door does not function with an integral release mechanism, the instructions shall indicate the location of the exterior manual door control.

(B) Each power door intended for use by emergency responders for rescue access which has a non-integral release mechanism located away from the door, shall have a door control sign/marking placed at the location of this control that provides instructions for emergency operation, either as part of the access sign/marking or as another sign/marking.

(C) Each car equipped with manual doors shall have operating instructions for opening the door from the exterior, either as part of the access sign/marking or as another sign/marking.

(iii) Rescue access window locator signs/markings and instructions; and

(A) Each rescue access window shall be identified with a unique retroreflective and easily recognizable sign, symbol, or other conspicuous marking that complies with paragraphs (d) and (e) of this section.

(B) Signs, symbols, or marking shall be placed at the bottom of each such window, on each window, or adjacent to each window, utilizing arrows, where necessary, to clearly designate rescue assess window location. Legible and understandable window-access instructions, including any pictogram/instructions for removing the window, shall be posted at or near each rescue access window.

(iv) Roof access locator signs/markings and instructions.

(A) The location of each emergency access point provided on the roof of a passenger car shall be clearly marked with retroreflective material of contrasting color that complies with paragraphs (d) and (e) of this section.

(B) Legible and understandable instructions shall be posted at or near each such location.

(C) If emergency roof access is provided by means of a structural weak point:

(1) The retroreflective material shall clearly mark the line along which the roof skin shall be cut; and

(2) A sign plate with a retroreflective border shall also state:

CAUTION—DO NOT USE FLAME CUTTING DEVICES.

CAUTION—WARN PASSENGERS BEFORE CUTTING.

CUT ALONG DASHED LINE TO GAIN ACCESS.

ROOF CONSTRUCTION—[STATE RELEVANT DETAILS].

(d) Color contrast. Exterior signs/markings shall provide luminance contrast ratio of not less than 0.5, as measured by a color-corrected photometer.

(e) Materials—(1) Retroreflective material. Exterior emergency rescue access locator signs/markings shall be constructed of retroreflective material that conforms to the specifications for Type I material sheeting, as specified in ASTM D 4956-07 ε 1 (incorporated by reference, see § 299.17), as tested in accordance with ASTM E 810-03 (incorporated by reference, see § 299.17).

(2) HPPL materials. All HPPL materials used in finished component configurations shall comply with the minimum luminance criterion of 7.5 mcd/m 2 after 90 minutes when tested according to the provisions of ASTM E 2073-07 (incorporated by reference, see § 299.17), with the following three modifications:

(i) Activation. The HPPL material shall be activated with a fluorescent lamp of 40W or less and a color temperature of 4000-4500K that provides no more than 10.7 lux (1 fc) of illumination as measured on the material surface. The activation period shall be for no more than 60 minutes.

(ii) Luminance. The photopic luminance of all specimens of the HPPL material shall be measured with a luminance meter as defined in section 5.2 of ASTM E 2073-07, a minimum of 90 minutes after activation has ceased.

(iii) Luminance in mcd/m 2. The test report shall include a luminance measurement 90 minutes after activation has ceased.

(f) Recordkeeping. (1) The railroad shall retain a copy of the car manufacturer/supplier provided independent laboratory certified test report results showing that the illuminance or luminance measurements, as appropriate, on the active area of the signage/marking component. Such records shall be kept until all cars with those components are retired, transferred, leased, or conveyed to another railroad for use in revenue service. A copy of such records shall be transferred to the accepting railroad along with any such cars.

(2) The railroad shall retain a copy of the railroad-approved illuminance test plan(s) and test results until the next periodic test, or other test specified in accordance with the railroad's inspection, testing, and maintenance program is conducted on a representative car/area, or until all cars of that type are retired, or are transferred, leased, or conveyed to another railroad. A copy of such records shall be transferred to the accepting railroad along with such car(s).

(3) The railroad shall retain a copy of the certified independent laboratory test report results that certify that the retroreflective material complies with Type I materials per ASTM D-4956-07 ε 1 until all cars containing the retroreflective material are retired, or are transferred, leased, or conveyed to another railroad. A copy of such records shall be provided to the accepting railroad along with any car(s) that are transferred, leased, or conveyed.

(a) General. Low-location emergency exit path marking (LLEEPM) shall be provided in each unit of a trainset. The LLEEPM system shall be designed to identify the location of primary door exits and the exit path to be used to reach such doors by passengers and trainset crewmembers under conditions of darkness when normal and emergency sources of illumination are obscured by smoke or are inoperative.

(b) Visual identity and recognition. The LLEEPM system shall be conspicuous (i.e., clearly recognizable/distinguishable), or become conspicuous immediately and automatically from a low-location upon loss of power for normal lighting, and under the minimum general emergency light illumination levels as specified in § 299.423.

(c) Signage and markings. At a minimum, the LLEEPM system shall have the following three components:

(1) Primary door exit signs. (i) Each primary door exit shall be clearly marked with an exit sign;

(ii) The exit sign shall be visible from a low-location from the exit along the exit path; and

(iii) Each exit sign shall be located on or immediately adjacent to each door and placed between 152.4 and 457.2 mm (6 and 18 inches) above the floor.

(2) Primary door exit marking/delineators. (i) The location of the exit path shall be marked using electrically powered (active) marking/delineators or light fixtures, HPPL (passive) marking/delineators or a combination of these two systems.

(ii) The requirements in this section apply for both electrical and HPPL components, whether installed on the walls, floors, or seat assemblies.

(iii) Each primary door shall be marked on or around the door's operating handle.

(3) Exit path marking/delineators. (i) The marking/delineator components shall be positioned so as to identify an exit path to all primary exits that is clearly visible and easily recognizable from any seat or compartment in the trainset, when normal lighting and emergency lighting are unavailable in conditions of darkness and/or smoke.

(ii) Markings/delineators shall be located on the floor or no higher than 457.2 mm (18 inches) on the seat assembly, or walls/partitions of aisles, and/or passageways.

(iii) Changes in the direction of the exit path shall be indicated by the LLEEPM and be placed within 102 mm (4 inches) of the corner of the exit path.

(d) Material—(1) HPPL passive systems. HPPL strip marking/delineator material used for LLEEPM components shall be capable of providing a minimum luminance level of 7.5 mcd/m 2, measured 90 minutes after normal power has ceased.

(2) Electroluminescent marking/delineator strips. The luminance value of the electroluminescent (EL) marking/delineator strip shall be at least 1,000 mcd/m 2, as measured on the strip surface.

(e) Conspicuity of markings. LLEEPM signs shall comply with the text, color and respective illuminance or luminance requirements specified in § 299.423 and in this section.

(f) Emergency performance duration. The LLEEPM system shall operate independently of the car's normal and emergency lighting systems for 90 minutes after loss of all power for normal lighting.

(g) Recordkeeping. (1) The railroad shall retain a copy of the car manufacturer/supplier provided certified independent laboratory test report results showing that the illuminance or luminance measurements, as appropriate, on the active area of the signage/marking/delineator component comply with the criteria specified in § 299.423 and in this section.

(2) The railroad shall retain a copy of the railroad-approved illuminance test plan(s) and test results until the next periodic test, or other test specified in accordance with the railroad's inspection, testing, and maintenance program and ensure that tests are conducted on a representative car, or until all cars of that type are retired, transferred, leased, or conveyed to another railroad. A copy of such records shall be provided to the accepting railroads along with any car(s) that are transferred, leased, or conveyed.

(3) Illegible, broken, damaged, missing, or non-functioning components of the LLEEPM system, including the normal and emergency power systems, shall be reported and repaired in accordance with the railroad's inspection, testing, and maintenance program as specified in § 299.445.

(a) Number and location. Each unit in a trainset shall have a minimum of four emergency egress windows. At least one emergency egress window shall be located in each side of each end (half) of the car, in a staggered configuration where practicable. (See Figure 1 to this paragraph.)

(b) Ease of operability. Each emergency egress window shall be designed to permit rapid and easy removal from the inside of the car during an emergency situation using a hammer designed to break the glazing that shall be located adjacent to each emergency egress window. The railroad shall inspect for the presence of the emergency hammers each day prior to the trainset being placed into service in accordance with § 299.711(b).

(c) Dimensions. Except as provided in paragraph (f) of this section, each emergency egress window in a passenger car shall have an unobstructed opening with minimum dimensions of 660 mm (26 inches) horizontally by 610 mm (24 inches) vertically. A seatback is not an obstruction if it can be moved away from the window opening without using a tool or other implement.

(d) Marking and instructions. (1) Each emergency egress window shall be conspicuously and legibly marked with luminescent material on the inside of each car to facilitate passenger egress as specified in § 299.423.

(2) Legible and understandable operating instructions, including instructions for removing the emergency egress window shall be made of luminescent material, shall be posted at or near each such emergency egress window as specified in § 299.423.

(e) Obstructions. If emergency egress window removal may be hindered by the presence of a seatback, headrest, luggage rack, or other fixture, the instructions shall state the method for allowing rapid and easy removal of the emergency egress window, taking into account the fixture(s), and this portion of the instructions may be in written or pictorial format.

(f) Additional emergency egress windows. Any emergency egress window in addition to the minimum number required by paragraph (a) of this section that has been designated for use by the railroad need not comply with the minimum dimension requirements in paragraph (c) of this section, but must otherwise comply with all requirements in this subpart applicable to emergency egress windows.

(a) General. Each emergency egress window required by § 299.427 shall also serve as a means of rescue access.

(b) Ease of operability. Each rescue access window must be capable of being removed without unreasonable delay by an emergency responder using tools or implements that are commonly available to the responder in a passenger trainset emergency.

(c) Marking and instructions. (1) Each rescue access window shall be marked with retroreflective material on the exterior of each car as specified in § 299.423. A unique and easily recognizable symbol, sign, or other conspicuous marking shall also be used to identify each such window.

(2) Legible and understandable window-access instructions, including instructions for removing the window, shall be posted at or near each rescue access window as specified in § 299.423.

(a) Driver controls and cab layout. Driver controls and cab layout shall replicate that used in the N700, unless otherwise approved by FRA.

(b) Cab seating. Each seat provided for an employee regularly assigned to occupy a cab and any floor-mounted seat in the cab shall be securely attached in accordance with § 299.405.

(c) Cab interior surface. Sharp edges and corners shall be eliminated from the interior of the cab, and interior surfaces of the cab likely to be impacted by an employee during a collision or derailment shall be padded with shock-absorbent material.

(d) Cab securement. Trainset interior cab doors shall be equipped with the following:

(1) A secure and operable device to lock the door from the outside that does not impede egress from the cab; and

(2) A securement device on each cab door that is capable of securing the door from inside of the cab.

(e) Cab glazing serviceability. End-facing cab windows of the lead trainset cab shall be free of cracks, breaks, or other conditions that obscure the view of the right-of-way for the crew from their normal position in the cab.

(f) Floors of cabs, passageways, and compartments. Floors of cabs, passageways, and compartments shall be kept free from oil, water, waste or any obstruction that creates a slipping, tripping or fire hazard. Floors shall be properly treated to provide secure footing.

(g) Cab environmental control. Each lead cab in a trainset shall be heated and air conditioned. The HVAC system shall be inspected and maintained to ensure that it operates properly and meets the railroad's performance standard which shall be defined in the inspection, testing, and maintenance program.

(h) Trainset cab noise. Performance standards for the railroad's trainsets—

(1) The average noise levels in the trainset cab shall be less than or equal to 85 dB(A) when the trainset is operating at maximum approved trainset speed as approved under § 299.609(g). Compliance with this paragraph (h)(1) shall be demonstrated during the pre-revenue service system integration testing as required by § 299.607.

(2) The railroad shall not make any alterations during maintenance or modifications to the cab, that cause the average sound level to exceed the requirements in paragraph (h)(1) of this section.

(3) The railroad or manufacturer shall follow the test protocols set forth in appendix B to this part to determine compliance with paragraph (h)(1) of this section, and, to the extent reasonably necessary to evaluate the effect of alterations during maintenance, to determine compliance with paragraph (h)(2) of this section.

(i) Maintenance of trainset cabs. (1) If the railroad receives an excessive noise report, and if the condition giving rise to the noise is not required to be immediately corrected under this part, the railroad shall maintain a record of the report, and repair or replace the item identified as substantially contributing to the noise:

(i) On or before the next periodic inspection required by the railroad's inspection, testing, and maintenance program under subpart G; or

(ii) If the railroad determines that the repair or replacement of the item requires significant shop or material resources that are not readily available, at the time of the next major equipment repair commonly used for the particular type of maintenance needed.

(2) The railroad has an obligation to respond to an excessive noise report that a trainset-cab-occupant files. The railroad meets its obligation to respond to an excessive noise report, as set forth in paragraph (i)(1) of this section, if the railroad makes a good faith effort to identify the cause of the reported noise, and where the railroad is successful in determining the cause, if the railroad repairs or replaces the items that cause the noise.

(3)(i) The railroad shall maintain a written or electronic record of any excessive noise report, inspection, test, maintenance, replacement, or repair completed pursuant to paragraph (i) of this section, and the date on which that inspection, test, maintenance, replacement, or repair occurred. If the railroad elects to maintain an electronic record, the railroad must satisfy the conditions listed in § 299.11.

(ii) The railroad shall retain these records for a period of one year.

(iii) The railroad shall establish an internal, auditable, monitorable system that contains these records.

(j) Trainset sanitation facilities for employees. Sanitation facilities shall be provided for crewmembers either:

(1) On the trainset, that meet otherwise applicable sanitation standards, which are accessible at frequent intervals during the course of their work shift; or

(2) Ready access to railroad-provided sanitation facilities outside of the trainset.

(k) Speed indicators. (1) Each trainset controlling cab shall be equipped with a speed indicator which is—

(i) Accurate within ±2 km/h (1.24 miles per hour) for speed lower than 30 km/h (18.6 miles per hour), then increasing linearly up to ±12 km/h (7.5 miles per hour) at 500 km/h (311 miles per hour); and

(ii) Clearly readable from the driver's normal position under all light conditions.

(2) The speed indicator shall be based on a system of independent on-board speed measurement sources guaranteeing the accuracy level specified in paragraph (a)(1) of this section under all operational conditions. The system shall be automatically monitored for inconsistencies and the driver shall be automatically notified of any inconsistency potentially compromising this accuracy level.

(3) The speed indicator shall be calibrated periodically as defined in the railroad's inspection, testing, and maintenance program.

(l) Cab lights. (1) Each trainset cab shall have cab lights which will provide sufficient illumination for the control instruments, meters, and gauges to enable the driver to make accurate readings from his or her normal positions in the cab. These lights shall be located, constructed, and maintained so that light shines only on those parts requiring illumination and does not interfere with the driver's vision of the track and signals. Each trainset cab shall also have a conveniently located light that can be readily turned on and off by the driver operating the trainset and that provides sufficient illumination for them to read trainset orders and timetables.

(2) Cab passageways and compartments shall be illuminated.

(a) Headlights. Each leading end of a trainset shall be equipped with two or more headlights.

(1) Each headlight shall produce 80,000 candela.

(2) Headlights shall be arranged to illuminate signs in the right-of-way.

(3) Headlights shall be recognized 600 m (1,968 feet) ahead of the cab car by a driver in another trainset or a maintenance person standing in the right-of-way under clear weather conditions.

(b) Taillights (marking devices). (1) The trailing end of the trainset shall be equipped with two red taillights;

(2) Each taillight shall be located at least 1.2 m (3.9 feet) above rail;

(3) Each taillight shall be recognizable 200 m (656 feet) ahead of the cab car by a driver in another trainset or a maintenance person standing in the right-of-way under clear weather conditions;

(4) Taillights of the trailing end of the trainset shall be on when the trainset is in operation;

(5) Taillights shall not be on in the direction of trainset travel, except if the driver shall re-position the trainset in a station. Such re-positioning operations shall be done in accordance with the railroad's operating rules; and

(6) In an emergency situation, the headlight on the rear of the trainset may serve as the taillights in accordance with the railroad's operating rules.

(a) Overhead collector systems. (1) Pantographs shall be so arranged that they can be operated from the driver's normal position in the cab. Pantographs that automatically rise when released shall have an automatic locking device to secure them in the down position.

(2) Each overhead collector system, including the pantograph, shall be equipped with a means to electrically ground any uninsulated parts to prevent the risk of electrical shock when working on the system.

(3) Means shall be provided to permit the driver to determine that the pantograph is in its lowest position, and for securing the pantograph if necessary, without the need to mount the roof of the trainset.

(4) Each trainset equipped with a pantograph operating on an overhead collection system shall also be equipped with a means to safely lower the pantograph in the event of an emergency. If an emergency pole is used for this purpose, that part of the pole which can be safely handled shall be marked to so indicate. This pole shall be protected from moisture and damage when not in use. Means of securement and electrical isolation of a damaged pantograph, when it cannot be performed automatically, shall be addressed in the railroad's operating rules.

(b) Circuit protection. (1) Each auxiliary circuit shall be provided with a circuit breaker or equivalent current-limiting devices located as near as practicable to the point of connection to the source of power for that circuit. Such protection may be omitted from circuits controlling safety-critical devices.

(2) The 25-kV main power line shall be protected with a lightning arrestor, automatic circuit breaker, and overload relay. The lightning arrestor shall be run by the most direct path possible to ground with a connection to ground of not less than No. 6 AWG. These overload protection devices shall be housed in an enclosure designed specifically for that purpose with the arc chute vented directly to outside air.

(3) Auxiliary power supply (440 VAC), providing power distribution, shall be provided with both overload and ground fault protection.

(c) Main battery system. (1) The main batteries shall be isolated from the cab and passenger seating areas by a non-combustible barrier.

(2) If batteries have the potential to vent explosive gases, the batteries shall be adequately ventilated to prevent accumulation of explosive concentrations of these gases.

(3) Battery chargers shall be designed to protect against overcharging.

(4) Battery circuits shall include an emergency battery cut-off switch to completely disconnect the energy stored in the batteries from the load.

(d) Capacitors for high-energy storage. (1) Capacitors, if provided, shall be isolated from the cab and passenger seating areas by a non-combustible barrier.

(2) Capacitors shall be designed to protect against overcharging and overheating.

(e) Electromagnetic interference (EMI) and electromagnetic compatibility (EMC). (1) The railroad shall ensure electromagnetic compatibility of the safety-critical equipment systems with their environment. Electromagnetic compatibility can be achieved through equipment design or changes to the operating environment.

(2) The electronic equipment shall not produce electrical noise that interferes with trainline control and communications or with wayside signaling systems.

(3) To contain electromagnetic interference emissions, suppression of transients shall be at the source wherever possible.

(4) Electrical and electronic systems of equipment shall be capable of operation in the presence of external electromagnetic noise sources.

(5) All electronic equipment shall be self-protected from damage or improper operation, or both, due to high voltage transients and long-term over-voltage or under-voltage conditions. This includes protection from both power frequency and harmonic effects as well as protection from radio frequency signals into the microwave frequency range.

(f) Insulation or grounding of metal parts. All unguarded noncurrent-carrying metal parts subject to becoming charged shall be grounded or thoroughly insulated.

(g) High voltage markings: doors, cover plates, or barriers. External surfaces of all doors, cover plates, or barriers providing direct access to high voltage equipment shall be conspicuously and legibly marked “DANGER-HIGH VOLTAGE” or with the word “DANGER” and the normal voltage carried by the parts so protected. Labels shall be retro-reflective.

(h) Hand-operated switches. All hand-operated switches carrying currents with a potential of more than 150 volts that may be operated while under load shall be covered and shall be operative from the outside of the cover. Means shall be provided to show whether the switches are open or closed. Switches that should not be operated while under load shall be conspicuously and legibly marked with the words “must not be operated under load” and the voltage carried.

(i) Conductors; jumpers; cable connections. (1) Conductor sizes shall be selected on the basis of current-carrying capacity, mechanical strength, temperature, flexibility requirements, and maximum allowable voltage drop. Current-carrying capacity shall be derated for grouping and for operating temperature.

(2) Jumpers and cable connections between trainset units shall be located and guarded to provide sufficient vertical clearance. They may not hang with one end free.

(3) Cable and jumper connections between trainset units may not have any of the following conditions:

(i) Broken or badly chafed insulation;

(ii) Broken plugs, receptacles, terminals, or trainline pins; and

(iii) Broken or protruding strands of wire.

(j) Traction motors. All traction motors shall be in proper working order, or safely cut-out.

(a) Each trainset shall be equipped to monitor the performance of the following systems or components:

(1) Reception of cab and trainset control signals;

(2) Electric brake status;

(3) Friction brake status;

(4) Fire detection systems, if so equipped;

(5) Auxiliary power status;

(6) Wheelslide;

(7) On-board bearing-temperature sensors;

(8) Door open/closed status; and

(9) Bogie vibration detection.

(b) When any of the monitored parameters are out of predetermined limits, an alert shall be sent immediately to the driver. The railroad's operating rules shall control trainset movement when the monitored parameters are out of predetermined limits.

(c) The railroad shall develop appropriate operating rules to address driver and equipment performance in the event that the automatic monitoring system becomes defective.

(d) The monitoring system shall be designed with an automatic self-test feature that notifies the driver that the monitoring capability is functioning correctly and alerts the driver when a system failure occurs.

(a) Duty to equip and record. Each trainset shall be equipped with an operative event recorder that monitors and records as a minimum all safety data required by paragraph (b) of this section. The event recorder shall record the most recent 48 hours of operational data of the trainset on which it is installed.

(b) Equipment requirements. Event recorders shall monitor and record data elements or information needed to support the data elements required by paragraph (c) of this section. The data shall be recorded with at least the accuracy required of the indicators displaying any of the required data elements to the driver.

(c) Data elements. The event recorder shall be equipped with a certified crashworthy event recorder memory module that meets the requirements of appendix A to this part. The certified event recorder memory module shall be mounted for its maximum protection. The event recorder shall record, and the certified crashworthy event recorder memory module shall retain, the following data elements or information needed to support the data elements:

(1) Trainset speed;

(2) Selected direction of motion;

(3) Date and time;

(4) Distance traveled;

(5) Throttle position;

(6) Applications and operations of the trainset brake system, including urgent and emergency applications. The system shall record, or provide a means of determining, that a brake application or release resulted from manipulation of brake controls at the position normally occupied by the driver. In the case of a brake application or release that is responsive to a command originating from or executed by an on-board computer (e.g., electronic braking system controller, controlling cab electronic control system, or trainset control computer), the system shall record, or provide a means of determining, the involvement of any such computer;

(7) Applications and operations of the regenerative brake;

(8) Cab signal aspect(s);

(9) Urgent brake application(s);

(10) Passenger brake alarm request;

(11) Wheel slip/slide alarm activation (with a property-specific minimum duration);

(12) Trainset number;

(13) Trainset tractive effort (positive and negative);

(14) Trainset brake cylinder pressures;

(15) Cruise control on/off, if so equipped and used;

(16) Bogie vibration detection;

(17) Door status opened/closed; and

(18) Safety-critical trainset control data routed to the controlling driver's display with which the driver is required to comply, specifically including text messages conveying mandatory directives and maximum authorized speed. The specific information format, content, and proposed duration for retention of such data shall be specified in the PTC Safety Plan submitted for the trainset control system under subpart B, subject to FRA approval. If it can be calibrated against other data required by this part, such trainset control data may, at the election of the railroad, be retained in a separate certified crashworthy memory module.

(d) Response to defective equipment. A trainset on which the event recorder has been taken out of service may remain in-service only until the next pre-service inspection. A trainset with an inoperative event recorder is not deemed to be in improper condition, unsafe to operate, or a non-complying trainset under § 299.447.

(e) Annual tests. (1) The railroad's inspection, testing, and maintenance program under subpart G of this part shall require annual testing of the event recorder. All testing under this section shall be performed at intervals that do not exceed 368 calendar days.

(2) A microprocessor-based event recorder with a self-monitoring feature equipped to verify that all data elements required by this part are recorded, requires further maintenance and testing only if either of the following conditions exist:

(i) The self-monitoring feature displays an indication of a failure. If a failure is displayed, further maintenance and testing must be performed until a subsequent test is successful. When a successful test is accomplished, a record, in any medium, shall be made of that fact and of any maintenance work necessary to achieve the successful result. This record shall be available at the location where the trainset is maintained until a record of a subsequent successful test is filed; or

(ii) A download of the event recorder, taken within the preceding 30 days and reviewed for the previous 48 hours of trainset operation, reveals a failure to record a regularly recurring data element or reveals that any required data element is not representative of the actual operations of the trainset during this time period. If the review is not successful, further maintenance and testing shall be performed until a subsequent test is successful. When a successful test is accomplished, a record, in any medium, shall be made of that fact and of any maintenance work necessary to achieve the successful result. This record shall be kept at the location where the trainset is maintained until a record of a subsequent successful test is filed. The download shall be taken from information stored in the certified crashworthy crash hardened event recorder memory module.

(f) Preserving accident data. If any trainset equipped with an event recorder, or any other trainset mounted recording device or devices designed to record information concerning the functioning of a trainset, is involved in an accident/incident that is required to be reported to FRA under part 225 of this chapter, the railroad shall, to the extent possible, and to the extent consistent with the safety of life and property, preserve the data recorded by each such device for analysis by FRA in accordance with § 299.11. This preservation requirement permits the railroad to extract and analyze such data, provided the original downloaded data file, or an unanalyzed exact copy of it, shall be retained in secure custody and shall not be utilized for analysis or any other purpose except by direction of FRA or the National Transportation Safety Board. This preservation requirement shall expire one (1) year after the date of the accident/incident unless FRA or the Board notifies the railroad in writing that the data are desired for analysis.

(g) Relationship to other laws. Nothing in this section is intended to alter the legal authority of law enforcement officials investigating potential violation(s) of Federal or State criminal law(s), and nothing in this chapter is intended to alter in any way the priority of National Transportation Safety Board investigations under 49 U.S.C. 1131 and 1134, nor the authority of the Secretary of Transportation to investigate railroad accidents under 49 U.S.C. 5121,5122,20107,20111,20112,20505,20702,20703,and.

(h) Disabling event recorders. Any individual who willfully disables an event recorder, or who tampers with or alters the data recorded by such a device is subject to civil penalty as provided in part 218 of this chapter, and to disqualification from performing safety-sensitive functions on a railroad under subpart D of part 209 of this chapter.

(a) Purpose and scope. The requirements of this section apply to all safety-critical electronic control systems, subsystems, and components on the trainsets, except for on-board signaling and trainset control system components that must meet the software safety requirements defined in subpart B of this part.

(b) Applicability. (1) The trainsets shall utilize the service-proven safety-critical electronic control systems, subsystems, and components as used on the N700 to control and monitor safety-critical components.

(2) Any modifications to the existing service-proven safety-critical electronic control systems, subsystems, and components shall be subject to the requirements defined in paragraph (c) of this section.

(i) The railroad shall assure that the suppliers of new or modified safety-critical systems, subsystems, and components utilize an industry recognized hardware and software development process which is evaluated and certified by an independent third-party assessor authorized by the industry standard utilized.

(ii) The railroad shall require that all suppliers submit the certifications and audit results as applicable. All such certifications shall be made available to FRA upon request.

(3) Any major upgrades or introduction of new safety-critical technology shall be subject to § 299.613(d).

(c) Electronic hardware and software safety program. The railroad shall develop and maintain a written electronic hardware and software safety program to guide the design, development, testing, integration, and verification of all new or modified safety-critical trainset hardware and software.

(1) Hardware and software safety program description. The hardware and software safety program shall include a description of how the following will be implemented to ensure safety and reliability:

(i) The hardware and software design process;

(ii) The hardware and software design documentation;

(iii) The hardware and software hazard analysis;

(iv) Hardware and software safety reviews;

(v) Hardware and software hazard monitoring and tracking;

(vi) Hardware and software integration safety testing;

(vii) Demonstration of overall hardware and software system safety as part of the pre-revenue service testing of the equipment; and

(viii) Safety-critical changes and failures.

(2) Safety analysis. The hardware and software safety program shall be based on a formal safety methodology that includes a FMECA; verification and validation testing for all hardware and software components and their interfaces; and comprehensive hardware and software integration testing to ensure that the hardware and software system functions as intended.

(3) Compliance. The railroad shall comply with the elements of its hardware and software safety program that affect the safety of the passenger trainset.

(4) Safety-critical changes and failures. Whenever a planned safety-critical design change is made to the safety-critical electronic control systems, subsystems and components (the products) that are in use by the railroad and subject to this subpart, the railroad shall—

(i) Notify FRA in accordance with § 299.9 of the design changes made by the product supplier;

(ii) Ensure that the safety analysis required under paragraph (c)(2) of this section is updated as required;

(iii) Conduct all safety-critical changes in a manner that allows the change to be audited;

(iv) Document all arrangements with suppliers for notification of all electronic safety-critical changes as well as safety-critical failures in the supplier's system, subsystem, or components, and the reasons for that change or failure from the suppliers, whether or not the railroad has experienced a failure of that safety-critical system, sub-system, or component;

(v) Specify the railroad's procedures for action upon receipt of notification of a safety-critical change or failure of an electronic system, sub-system, or component, and until the upgrade or revision has been installed;

(vi) Identify all configuration/revision control measures designed to ensure that safety-functional requirements and safety-critical hazard mitigation processes are not compromised as a result of any such change, and that any such change can be audited;

(vii) Require suppliers to provide notification of all electronic safety-critical changes as well as safety-critical failures in the supplier's system, subsystem, or components;

(ix) Document all arrangements with suppliers for notification of any and all electronic safety-critical changes as well as safety-critical failures in the supplier's system, subsystem, or components.

(d) Specific requirements. Hardware and software that controls or monitors a trainset's primary braking system shall either—

(1) Fail safely by initiating an emergency or urgent brake application in the event of a hardware or software failure that could impair the ability of the driver to apply or release the brakes; or

(2) Provide the driver access to direct manual control of the primary braking system (emergency or urgent braking).

(e) Inspection, testing, and maintenance records. The inspection, testing, and maintenance conducted by the railroad in accordance with § 299.445 shall be recorded in hardcopy or stored electronically. Electronic recordkeeping or automated tracking systems, subject to the provisions contained in § 299.11, may be utilized to store and maintain any testing or training record required by this subpart. Results of product testing conducted by a vendor in support of a safety analysis shall be provided to and recorded by the railroad.

(1) The testing records shall contain all of the following:

(i) The name of the railroad;

(ii) The location and date that the test was conducted;

(iii) The equipment tested;

(iv) The results of tests;

(v) The repairs or replacement of equipment;

(vi) Any preventative adjustments made; and

(vii) The condition in which the equipment is left.

(2) Each record shall be—

(i) Signed by the employee conducting the test, or electronically coded, or identified by the automated test equipment number;

(ii) Filed in the office of a supervisory official having jurisdiction, unless otherwise noted; and

(iii) Available for inspection and copying by FRA.

(3) The results of the testing conducted in accordance with this section shall be retained as follows:

(i) The results of tests that pertain to installation or modification of a product shall be retained for the life-cycle of the product tested and may be kept in any office designated by the railroad;

(ii) The results of periodic tests required for the maintenance or repair of the product tested shall be retained until the next record is filed and in no case less than one year; and

(iii) The results of all other tests and training shall be retained until the next record is filed and in no case less than one year.

(f) Review of safety analysis. (1) Prior to the initial planned use of a new product as defined by paragraphs (b)(2) or (3) of this section, the railroad shall notify FRA in accordance with § 299.9 of the intent to place this product in service. The notification shall provide a description of the product, and identify the location where the complete safety analysis documentation and the testing are maintained.

(2) The railroad shall maintain and make available to FRA upon request all railroad or vendor documentation used to demonstrate that the product meets the safety requirements of the safety analysis for the life-cycle of the product.

(g) Hazard tracking. After a new product is placed in service in accordance with paragraphs (b)(2) or (3) of this section, the railroad shall maintain a database of all safety-relevant hazards encountered with the product. The database shall include all hazards identified in the safety analysis and those that had not been previously identified in the safety analysis. If the frequency of the safety-relevant hazards exceeds the threshold set forth in the safety analysis, then the railroad shall—

(1) Report the inconsistency to the Associate Administrator, within 15 days of discovery in accordance with § 299.9;

(2) Take immediate countermeasures to reduce the frequency of the safety-relevant hazard(s) below the threshold set forth in the safety analysis;

(3) Provide a final report to the Associate Administrator, on the results of the analysis and countermeasures taken to mitigate the hazard to meet the threshold set forth in the safety analysis when the problem is resolved. For hazards not identified in the safety analysis the threshold shall be exceeded at one occurrence; and

(4) Electronic or automated tracking systems used to meet the requirements contained in paragraph (g) of this section shall be in accordance with § 299.11.

(h) Operations and maintenance manual. The railroad shall maintain all supplier or vendor documents pertaining to the operation, installation, maintenance, repair, modification, inspection, and testing of the safety-critical electronic control systems, subsystems and components.

(i) Training and qualification program. Under § 299.13(c)(3), the railroad shall establish and implement a training and qualification program for the safety-critical electronic control systems, subsystems, and components subject to subpart G of this part prior to the safety-critical electronic control systems, subsystems, and components being placed in use.

(j) Operating personnel training. The training program required by § 299.13(c)(3) for any driver or other person who participates in the operation of a trainset using the safety-critical electronic control systems, subsystems and components shall address all the following elements:

(1) Familiarization with the electronic control system equipment on-board the trainset and the functioning of that equipment as part of the system and in relation to other on-board systems under that person's control;

(2) Any actions required of the operating personnel to enable or enter data into the system and the role of that function in the safe operation of the trainset;

(3) Sequencing of interventions by the system, including notification, enforcement, and recovery from the enforcement as applicable;

(4) Railroad operating rules applicable to control systems, including provisions for movement and protection of any unequipped passenger equipment, or passenger equipment with failed or cut-out controls;

(5) Means to detect deviations from proper functioning of on-board electronic control system equipment and instructions explaining the proper response to be taken regarding control of the trainset and notification of designated railroad personnel; and

(6) Information needed to prevent unintentional interference with the proper functioning of on-board electronic control equipment.

(a) Couplers. (1) The leading and trailing ends of each trainset shall be equipped with an automatic rescue coupler that couples on impact.

(i) Uncoupling of the rescue coupler shall be done only at a trainset maintenance facility or other location where personnel can safely get under or between units.

(ii) The leading and the trailing ends of a trainset are not required to be equipped with sill steps or end or side handholds.

(2) The leading and trailing end couplers and uncoupling devices may be stored within a removable shrouded housing.

(3) Leading and trailing automatic couplers of trainsets shall be compatible with the railroad's rescue vehicles. A coupler adaptor can be used to meet this requirement.

(4) The railroad shall develop and implement rescue procedures that assure employee safety during rescue operations and shall be contained in the railroad's operating rules.

(5) Each unit within a trainset shall be semi-permanently coupled and shall only be uncoupled at a trainset maintenance facility or other locations identified by the railroad where the protections afforded in subpart B of part 218 of this chapter can be applied.

(6) The ends of units in a trainset that are semi-permanently coupled are not required to be equipped with automatic couplers, sill steps, end handholds or side handholds.

(b) Crew access. (1) Each trainset shall provide a minimum of two (2) locations per side, where crew members can board or disembark the trainset safely from ground level.

(2) Each location used for crew access shall be equipped with retractable stairs with handrails designed for safe access to the trainset from ground level.

(a) General. (1) The railroad shall develop a written inspection program for the rolling stock, in accordance with and approved under the requirements of § 299.713. As further specified in this section, the program shall describe in detail the procedures, equipment, and other means necessary for the safe operation of the passenger equipment, including all inspections set forth in paragraph (e) of this section. This information shall include a detailed description of the methods of ensuring accurate records of required inspections.

(2) The initial inspection, testing, and maintenance program submitted under § 299.713 shall, as a minimum, address the specific safety inspections contained in paragraphs (e)(1) through (4) of this section. The railroad may submit the procedures detailing the bogie inspections or general overhaul requirements contained in paragraph (e)(3) and (4) of this section, respectively, at a later date than the initial inspection, testing, and maintenance program, but not less than 180 days prior to the scheduled date of the first bogie inspection or general overhaul.

(b) Identification of safety-critical items. In addition to safety critical items identified under § 299.711(b), on-board emergency equipment, emergency back-up systems, trainset exits and trainset safety-critical hardware and software systems in accordance with § 299.441 shall be deemed safety-critical.

(c) Compliance. The railroad shall adopt and comply with the approved inspection, testing, and maintenance program in accordance with § 299.703.

(d) General condition. The inspection, testing, and maintenance program shall ensure that all systems and components of the equipment are free of conditions that endanger the safety of the crew, passengers, or equipment. These conditions include, but are not limited to the following:

(1) A continuous accumulation of oil or grease;

(2) Improper functioning of a component;

(3) A crack, break, excessive wear, structural defect, or weakness of a component;

(4) A leak;

(5) Use of a component or system under conditions that exceed those for which the component or system is designed to operate; and

(6) Insecure attachment of a component.

(e) Specific safety inspections. The program under paragraph (a) of this section shall specify that all passenger trainsets shall receive thorough safety inspections by qualified individuals designated by the railroad at regular intervals. At a minimum, and in addition to the annual tests required for event recorder under § 299.439(e), the following shall be performed on each trainset:

(1) Pre-service inspections. (i) Each trainset in use shall be inspected at least once every two calendar days by qualified individuals at a location where there is a repair pit and access to the top of the trainset. The inspection shall verify the correct operation of on-board safety systems defined in the inspection, testing, and maintenance program. If any of the conditions defined as safety-critical in paragraph (b) of this section and § 299.711(b) are found during this inspection, the trainset shall not be put into service until that condition is rectified. The pre-service inspection shall include the following:

(A) Functional tests to determine the status of application and release of the service, emergency, and urgent air brakes using the monitoring system;

(B) Operational tests of the exterior doors; and

(C) A review of the log of on-board ATC equipment.

(ii) If the existence of any safety-critical conditions cannot be determined by use of an automated monitoring system, the railroad shall perform a visual inspection to determine if the condition exists.

(2) Regular inspections. The railroad shall perform a regular inspection on all trainsets in accordance with the test procedures and inspection criteria established in paragraph (a) of this section and at the intervals defined by paragraph (f) of this section. If any of the conditions defined as safety-critical in paragraph (b) of this section and § 299.711(b) are found during this inspection, the trainset shall not be put into service until that condition is rectified.

(3) Bogie inspections. The railroad shall perform a bogie inspection on all trainsets in accordance with the test procedures and inspection criteria established in paragraph (a) of this section and at the intervals defined by paragraph (f) of this section. If any of the conditions defined as safety-critical in paragraph (b) of this section and § 299.711(b) are found during this inspection, the trainset shall not be put into service until that condition is rectified.

(4) General overhaul. The railroad shall perform a general overhaul on all trainsets in accordance with the test procedures and inspection criteria established in paragraph (a) of this section and at the intervals defined by paragraph (f) of this section. If any of the conditions defined as safety-critical in paragraph (b) of this section and § 299.711(b) are found during this inspection, the trainset shall not be put into service until that condition is rectified.

(f) Maintenance intervals. The railroad's program established pursuant to paragraph (a) of this section shall include the railroad's scheduled maintenance intervals for all specific safety inspections in paragraph (e) of this section, as required by § 299.707.

(g) Training and qualification program. The railroad shall establish a training and qualification program as defined in § 299.13(c)(3) to qualify individuals to perform inspections, testing, and maintenance on the equipment. Only qualified individuals shall perform inspections, testing, and maintenance of the equipment.

(h) Reporting and tracking of repairs to defective trainsets. The railroad shall have in place prior to start of operations a reporting and tracking system for passenger trainsets with a defect not in conformance with this subpart. The reporting and tracking system shall record the following information:

(1) The identification number of the defective unit within a trainset, and trainset identification number;

(2) The date the defect was discovered;

(3) The nature of the defect;

(4) The determination made by a qualified individual whether the equipment is safe to run;

(5) The name of the qualified individual making such a determination;

(6) Any operating restrictions placed on the equipment; and

(7) Repairs made and the date that they were completed.

(i) Retention of records. At a minimum, the railroad shall keep the records described in paragraph (j) of each required inspection under this section in accordance with § 299.11. Each record shall be maintained for at least one year from the date of the inspection.

(j) Availability of records. The railroad shall make defect reporting and tracking records available to FRA upon request.

(k) Brake system repair points. The railroad shall designate brake system repair points in the inspection, testing, and maintenance program required by paragraph (a) of this section. No trainset shall depart a brake system repair point unless that trainset has a 100 percent operational brake system.

(a) A trainset with one or more conditions not in compliance with the list of safety critical defects identified in accordance with § 299.445(b) during a pre-service inspection required by § 299.445(e)(1) shall not be moved in revenue service and shall only be moved in accordance with paragraph (e) of this section.

(b) Except as provided in paragraph (c) of this section, and after departure in compliance with the pre-service inspection required by § 299.445(e)(1), a trainset with one or more conditions not in compliance with the list of safety critical defects identified in accordance with §§ 299.445(b) and 299.711(b) may be moved in revenue service only after the railroad has complied with all of the following:

(1) A qualified individual determines that it is safe to move the trainset, consistent with the railroad's operating rules;

(i) If appropriate, these determinations may be made based upon a description of the defective condition provided by a crewmember.

(ii) If the determinations required by this paragraph are made by an off-site qualified individual based on a description of the defective condition by on-site personnel, then a qualified individual shall perform a physical inspection of the defective equipment, at the first location possible, in accordance with the railroad's inspection, testing, and maintenance program and operating rules, to verify the description of the defect provided by the on-site personnel.

(2) The qualified individual who made the determination in paragraph (b)(1) of this section, notifies the driver in charge of movement of the trainset, in accordance with the railroad's operating rules, of the maximum authorized speed, authorized destination, and any other operational restrictions that apply to the movement of the non-compliant trainset. This notification may be achieved through the tag required by paragraph (b)(3) of this section; and

(3) A tag bearing the words “non-complying trainset” and containing the following information, are securely attached to the control stand on each control cab of the trainset:

(i) The trainset number and unit or car number;

(ii) The name of the qualified individual making the determination in paragraph (b)(1) of this section;

(iii) The location and date of the inspection that led to the discovery of the non-compliant item;

(iv) A description of each defect;

(v) Movement restrictions, if any;

(vi) The authorized destination of the trainset; and

(vii) The signature, if possible, as well as the job title and location of the person making the determinations required by this section.

(4) Automated tracking systems used to meet the tagging requirements contained in paragraph (b)(3) of this section may be reviewed and monitored by FRA at any time to ensure the integrity of the system. FRA's Associate Administrator may prohibit or revoke the railroad's ability to utilize an automated tracking system in lieu of tagging if FRA finds that the automated tracking system is not properly secure, is inaccessible to FRA or the railroad's employees, or fails to track or monitor the movement of defective equipment adequately. Such a determination will be made in writing and will state the basis for such action.

(c) A trainset that develops a non-complying condition in service may continue in revenue service, so long as the requirements of paragraph (b) of this section are otherwise fully met, until the next pre-service inspection.

(d) In the event of an in-service failure of the braking system, the trainset may proceed in accordance with the railroad's operating rules relating to the percentage of operative brakes and at a speed no greater than the maximum authorized speed as determined by § 299.409(f)(4) so long as the requirements of paragraph (b) of this section are otherwise fully met, until the next pre-service inspection.

(e) A non-complying trainset may be moved without passengers within a trainset maintenance facility, at speeds not to exceed 16 km/h (10 mph), without meeting the requirements of paragraph (a) of this section where the movement is solely for the purpose of repair. The railroad shall ensure that the movement is made safely.

(f) Nothing in this section authorizes the movement of equipment subject to a Special Notice for Repair under part 216 of this chapter unless the movement is made in accordance with the restrictions contained in the Special Notice.

(a) Duty to equip and record. (1) Each trainset used in revenue service must be equipped with an image recording system comprised of—

(i) Outward-facing image recording devices capable of recording images of the right-of-way ahead of the trainset in the direction of travel as further described in paragraph (b) of this section; and,

(ii) Inward-facing image recording devices capable of recording images of crewmember activities inside the leading trainset cab as further described in paragraph (c) of this section.

(2) The image recording system must be turned on and recording whenever a trainset is in motion, at all speeds. If operating circumstances cause the controlling cab to be other than the cab of the leading end of the trainset, the railroad must also record images of activities inside the controlling cab.

(3) The trainset image recording system shall record at a minimum the most recent 12 hours of operation of a leading trainset cab used in revenue service.

(4) Image recording device data for each leading trainset cab used in revenue service shall be recorded on a memory module meeting the requirements for a certified crashworthy event recorder memory module described in appendix A to this part or on an alternative, remote storage system that provides at least equivalent data protections and is approved by FRA under paragraph (g) of this section.

(b) Outward-facing recording device requirements for leading trainset cabs used in revenue service. The image recording system shall—

(1) Include an image recording device aimed parallel to the centerline of tangent track within the gauge on the leading end of the trainset;

(2) Be able to distinguish the signal aspects displayed by go/no-go signals;

(3) Record at a minimum frame rate of 15 frames per second (or its equivalent);

(4) Have sufficient resolution, as defined by the railroad in the railroad's inspection, testing, and maintenance program under § 299.445, to record the position of switch points in advance of the trainset at speeds of 170 km/h (106 mph) and below, and to capture images in daylight or with normal nighttime illumination from the headlight of the trainset; and

(5) Include an accurate time and date stamp on image recordings.

(c) Inward-facing image recording device requirements for leading trainset cabs used in revenue service. (1) The image recording system shall include an image recording device positioned to provide complete coverage of all areas of the leading trainset cab where a crewmember typically may be positioned, including complete coverage of the instruments and controls required to operate the trainset in normal use, and—

(i) Have sufficient resolution, as defined in the railroad's inspection, testing, and maintenance program under § 299.445, to record crewmember actions;

(ii) Record at a minimum frame rate of 5 frames per second;

(iii) Be capable of using ambient light in the cab, and when ambient light levels drop too low for normal operation, automatically switch to infrared or another operating mode that enables the recording sufficient clarity to comply with the requirements of this paragraph (c)(1); and

(iv) Include an accurate time and date stamp on image recordings.

(2) Inward-facing image recording devices shall not be installed in a location where the device can record activities within a trainset cab's sanitation compartment, as defined in § 229.5 of this chapter, and shall not be used to make recordings of any activities within a trainset cab's sanitation compartment.

(3) If a leading trainset cab used in revenue service experiences a technical failure of its inward-facing image recording system, then the system shall be removed from service and handled in accordance with paragraph (i) of this section.

(d) Image recording system protection requirements for leading trainset cabs used in revenue service. The railroad must provide convenient wired or wireless connections to allow authorized railroad personnel to download audio or image recordings from any certified crashworthy event recorder memory module in leading trainset cabs used in revenue service. The railroad also must use electronic security measure(s), and apply appropriate cybersecurity measures, to prevent unauthorized access to, and download, deletion, or alteration of, the recording system or its recordings.

(e) Inspection, testing, and maintenance for image recording systems in leading trainset cabs used in revenue service. (1) The image recording system in trainsets used in revenue service shall have self-monitoring features to assess whether the system is operating properly, including whether the system is powered on.

(2) Periodic inspection requirements for the trainset image recording system shall be defined in the railroad's inspection, testing, and maintenance program required under § 299.445. As part of the periodic inspection, the railroad shall take sample download(s) from the image recording system's crashworthy memory module to confirm proper operation of the system, and, if necessary, repair the system to full operation.

(f) Handling of recordings-(1) Chain-of-custody procedure. The railroad shall develop, adopt, maintain, and comply with a chain-of-custody procedure governing the handling and the release of the image recordings described in paragraphs (a) through (c) of this section and any audio recordings. The chain-of-custody procedure must specifically address the preservation and handling requirements for post-accident/incident recordings provided to FRA or other Federal agencies under paragraph (f)(2) of this section.

(2) Accident/incident preservation. If any trainset equipped with an image or audio recording system is involved in an accident/incident that must be reported to FRA under part 225 of this chapter, the railroad shall, to the extent possible, and to the extent consistent with the safety of life and property, preserve the data recorded by the system for analysis by FRA or other Federal agencies. The railroad must either provide the image and/or audio data in a format readable by FRA or other Federal agencies; or make available to FRA or other Federal agencies any platform, software, media device, etc., that is required to play back the image and/or audio data. This preservation requirement shall expire one year after the date of the accident unless FRA or another Federal agency notifies the railroad in writing that it must preserve the recording longer. The railroad may extract and analyze such data for the purposes described in paragraph (f)(3) of this section, only if—

(i) The original downloaded data file, or an unanalyzed exact copy of it, is retained in secure custody under the railroad's procedure adopted under paragraph (f)(1) of this section; and

(ii) It is not utilized for analysis or any other purpose, except by direction of FRA or another Federal agency.

(3) Recording uses. Subject to the conditions specified in paragraph (f)(2) of this section, the railroad may use image and audio recordings from a leading trainset cab used in revenue service subject to this section to—

(i) Investigate an accident/incident that is required to be reported to FRA under part 225 of this chapter;

(ii) Investigate a violation of a Federal railroad safety law, regulation, or order, or the railroad's operating rules and procedures;

(iii) Conduct an operational test under § 299.505;

(iv) Monitor for unauthorized occupancy of a trainset's cab or operating compartment;

(v) Investigate a violation of a criminal law;

(vi) Assist Federal agencies in the investigation of a suspected or confirmed act of terrorism; or

(vii) Perform inspection, testing, maintenance, or repair activities to ensure the proper installation and functioning of an image or audio recorder as required under paragraph (e)(2) of this section.

(g) Image recording system approval process. The railroad must submit for approval a description of the technical aspects of its trainset image recording system installed pursuant this section. The required description must be submitted via electronic mail to the following email address: [email protected].

(1) The description must specifically address the image recording system's—

(i) Minimum 12-hour continuous recording capability;

(ii) Crashworthiness; and

(iii) Post-accident accessibility of the system's recordings.

(2) The railroad must submit the written statement not less than 90 days before the installation of such image recording system.

(3) The Associate Administrator will review the railroad's description and may approve, or disapprove, the image recording system if it does not meet the requirements of this section. FRA may disapprove any recording systems that do not meet the requirements of this section.

(h) Relationship to other laws. Nothing in this section is intended to alter the legal authority of law enforcement officials investigating potential violation(s) of State criminal law(s), and nothing in this section is intended to alter in any way the priority of investigations under 49 U.S.C. 1131 and 1134, or the authority of the Secretary of Transportation to investigate railroad accidents under 49 U.S.C. 5121,5122,20107,20111,20112,20505,20702,20703,and.

(i) Removal of an image recording system or device from service and handling for repair. (1) Notwithstanding the duty established in paragraph (a) of this section to equip trainsets cabs used in revenue service with an image recording system, the railroad—

(i) May remove from service the entire image recording system or an image recording device in a leading trainset cab used in revenue service for any reason.

(ii) Must remove from service the entire image recording system or an image recording device in a leading trainset cab used in revenue service if the railroad knows the system or device is not properly recording.

(2) When a railroad removes the entire image recording system or an image recording device in a leading trainset cab used in revenue service from service, a qualified person shall record the date the system or device was removed from service in the trainset's maintenance records.

(3) A trainset on which the entire image recording system, or an image recording device in a leading trainset cab used in revenue service, has been taken out of service as provided in paragraphs (i)(1)(i) or (ii) of this section may be used as a leading trainset cab in revenue service only until the next pre-service inspection required under the railroad's inspection, testing, and maintenance program.

(4) A trainset with an image recording device that has been taken out of service on only one cab end may be used in revenue service beyond the next pre-service inspection without repair provided the other cab end is the leading end of the trainset and the image recording system is otherwise operative for that cab end.

(5) A trainset with an inoperative image recording device alone is not deemed to be in an improper condition, unsafe to operate, or non-complying under § 299.447. However, a trainset with an entire image record system taken out of service or image recording devices taken out service in both cab ends, may not be used in revenue service beyond the next pre-service inspection required under the railroad's inspection, testing, and maintenance program without repair or replacement of the non-operative system or devices.

(j) Disabling or interfering with locomotive-mounted audio and video recording equipment. Any individual who willfully disables or interferes with the intended functioning of image or audio recording system equipment mounted in a leading trainset cab used in revenue service, or who tampers with or alters the data recorded by such equipment, is subject to a civil penalty and to disqualification from performing safety-sensitive functions on a railroad as provided in parts 209 and 218 of this chapter.

(k) Employee protections. (1) If inward-facing image or in-cab audio trainset recordings are utilized to conduct operational tests and inspections under § 299.505, the railroad shall adopt and comply with a procedure in its operational tests and inspections program that ensures employees are randomly subject to such operational tests and inspections involving image or audio recordings. The procedure adopted must:

(i) Establish objective, neutral criteria to ensure every employee subject to such operational tests and inspections is selected randomly for such operational tests and inspections within a specified time frame;

(ii) Not permit subjective factors to play a role in selection, i.e., no employee may be selected based on the exercise of the railroad's discretion; and

(iii) Require that any operational test or inspection using trainset image or audio recordings be performed within 72 hours of the completion of the employee's tour of duty that is the subject of the operational test. Any operational test performed more than 72 hours after the completion of the tour of duty that is the subject of the test is a violation of this section. The 72-hour limitation does not apply to investigations of railroad accidents/incidents or to violations of Federal railroad safety laws, regulations, or orders, or any criminal laws.

(2) FRA may review the railroad's procedure implementing paragraph (k)(1) of this section, and, for cause stated, may disapprove such procedure under § 299.505(h).