(a) System security. The integrity of the program and database must be protected by a security system that utilizes an employee identification number and password, or a comparable method, to establish appropriate levels of program access meeting all of the following standards:

(1) Data input is restricted to the employee or train crew or signal gang whose time is being recorded, with the following exceptions:

(i) A railroad, or a contractor or subcontractor to a railroad, may allow its recordkeeping system to pre-populate fields of the hours of service record provided that—

(A) The recordkeeping system pre-populates fields of the hours of service record with information known to the railroad, or contractor or subcontractor to the railroad, to be factually accurate for a specific employee.

(B) The recordkeeping system may also provide the ability for employees to copy data from one field of a record into another field, where applicable.

(C) Estimated, historical, or arbitrary data are not used to pre-populate any field of an hours of service record.

(D) A railroad, or a contractor or a subcontractor to a railroad, is not in violation of this paragraph if it makes a good faith judgment as to the factual accuracy of the data for a specific employee but nevertheless errs in pre-populating a data field.

(E) The employee may make any necessary changes to the data by typing into the field, without having to access another screen or obtain clearance from the railroad, or a contractor or subcontractor to a railroad.

(ii) A railroad, or a contractor or a subcontractor to a railroad, shall allow employees to complete a verbal quick tie-up, or to transmit by facsimile or other electronic means the information necessary for a quick tie-up, if—

(A) The employee is released from duty at a location at which there is no terminal available;

(B) Computer systems are unavailable as a result of technical issues; or

(C) Access to computer terminals is delayed and the employee has exceeded his or her maximum allowed time on duty.

(2) No two individuals have the same electronic identity.

(3) A record cannot be deleted or altered by any individual after the record is certified by the employee who created the record.

(4) Any amendment to a record is either—

(i) Electronically stored apart from the record that it amends, or

(ii) Electronically attached to the record as information without changing the original record.

(5) Each amendment to a record uniquely identifies the individual making the amendment.

(6) The electronic system provides for the maintenance of inspection records as originally submitted without corruption or loss of data.

(7) Supervisors and crew management officials can access, but cannot delete or alter the records of any employee after the report-for-duty time of the employee or after the record has been certified by the reporting employee.

(b) Identification of the individual entering data. The program must be capable of identifying each individual who entered data for a given record. If a given record contains data entered by more than one individual, the program must be capable of identifying each individual who entered specific information within the record.

(c) Capabilities of program logic. The program logic must have the ability to—

(1) Calculate the total time on duty for each employee, using data entered by the employee and treating each identified period as defined in § 228.5;

(2) Identify input errors through the use of program edits;

(3) Require records, including outstanding records, the completion of which was delayed, to be completed in chronological order;

(4) Require reconciliation when the known (system-generated) prior time off differs from the prior time off reported by an employee;

(5) Require explanation if the total time on duty reflected in the certified record exceeds the statutory maximum for the employee;

(6) Require the use of a quick tie-up process when the employee has exceeded or is within three minutes of his or her statutory maximum time on duty;

(7) Require that the employee's certified final release be not more than three minutes in the future, and that the employee may not certify a final release time for a current duty tour that is in the past, compared to the clock time of the computer system at the time that the record is certified, allowing for changes in time zones;

(8) Require automatic modification to prevent miscalculation of an employee's total time on duty for a duty tour that spans changes from and to daylight savings time;

(9) For train employees, require completion of a full record at the end of a duty tour when the employee initiates a tie-up with less than the statutory maximum time on duty and a quick tie-up is not mandated;

(10) For train employees, disallow use of a quick tie-up when the employee has time remaining to complete a full record, except as provided in paragraph (a)(1)(ii) of this section.

(11) Disallow any manipulation of the tie-up process that precludes compliance with any of the requirements specified by paragraphs (c)(1) through (c)(10) of this section.

(d) Search capabilities. The program must contain sufficient search criteria to allow any record to be retrieved through a search of any one or more of the following data fields, by specific date or by a date range not exceeding 30 days for the data fields specified by paragraphs (d)(1) and (d)(2) of this section, and not exceeding one day for the data fields specified by paragraphs (d)(3) through (d)(7) of this section:

(1) Employee, by name or identification number;

(2) Train or job symbol;

(3) Origin location, either yard or station;

(4) Released location, either yard or station;

(5) Operating territory (i.e., division or service unit, subdivision, or railroad-identified line segment);

(6) Certified records containing one or more instances of excess service; and

(7) Certified records containing duty tours in excess of 12 hours.

(e) The program must display individually each train or job assignment within a duty tour that is required to be reported by this part.