Section 299.439(c) requires that trainsets be equipped with an event recorder that includes a certified crashworthy event recorder memory module. Section 299.449(a)(1) requires the railroad to install an image recording system in its trainsets used in revenue service. As required by § 299.449(a)(4), data from these image recording systems must be recorded on a certified crashworthy memory module or an alternative, remote storage system that provides at least equivalent data protections and is approved by FRA under § 299.15. This appendix prescribes the requirements for certifying an event recorder memory module (ERMM) or a trainset-mounted audio and/or image recording device memory module as crashworthy. For purposes of this appendix, a trainset-mounted audio or image recording system memory module is also considered an ERMM. This appendix includes the performance criteria and test sequence for establishing the crashworthiness of the ERMM as well as the marking of the event recorder containing the crashworthy ERMM.

(a) Each manufacturer that represents its ERMM as crashworthy shall, by marking it as specified in section B of this appendix, certify that the ERMM meets the performance criteria contained in this appendix and that test verification data are available to the railroad or to FRA upon request.

(b) The test verification data shall contain, at a minimum, all pertinent original data logs and documentation that the test sample preparation, test set up, test measuring devices and test procedures were performed by designated, qualified individuals using recognized and acceptable practices. Test verification data shall be retained by the manufacturer or its successor as long as the specific model of ERMM remains in service on any trainset.

(c) A crashworthy ERMM shall be marked by its manufacturer as specified in section B of this appendix.

(a) The outer surface of the event recorder containing a certified crashworthy ERMM shall be colored international orange. In addition, the outer surface shall be inscribed, on the surface allowing the most visible area, in black letters on an international orange background, using the largest type size that can be accommodated, with the words “CERTIFIED DOT CRASHWORTHY”, followed by the ERMM model number (or other such designation), and the name of the manufacturer of the event recorder. This information may be displayed as follows:

(b) Retro-reflective material shall be applied to the edges of each visible external surface of an event recorder containing a certified crashworthy ERMM.

An ERMM is crashworthy if it has been successfully tested for survival under conditions of fire, impact shock, static crush, fluid immersion, and hydro-static pressure contained in one of the two tables shown in this section of appendix B. (See Tables 1 and 2.) Each ERMM must meet the individual performance criteria in the sequence established in section D of this appendix. A performance criterion is deemed to be met if, after undergoing a test established in this appendix B for that criterion, the ERMM has preserved all of the data stored in it. The data set stored in the ERMM to be tested shall include all the recording elements required by § 299.439(c). The following tables describe alternative performance criteria that may be used when testing an ERMM's crashworthiness. A manufacturer may utilize either table during its testing but may not combine the criteria contained in the two tables.

In order to reasonably duplicate the conditions an event recorder may encounter, the ERMM shall meet the various performance criteria, described in section C of this appendix, in a set sequence. (See Figure 1). If all tests are done in the set sequence (single branch testing), the same ERMM must be utilized throughout. If a manufacturer opts for split branch testing, each branch of the test must be conducted using an ERMM of the same design type as used for the other branch. Both alternatives are deemed equivalent, and the choice of single branch testing or split branch testing may be determined by the party representing that the ERMM meets the standard.

If a new model ERMM represents an evolution or upgrade from an older model ERMM that was previously tested and certified as meeting the performance criteria contained in section C of this appendix, the new model ERMM need only be tested for compliance with those performance criteria contained in section C of this appendix that are potentially affected by the upgrade or modification. FRA will consider a performance criterion not to be potentially affected if a preliminary engineering analysis or other pertinent data establishes that the modification or upgrade will not change the performance of the older model ERMM against the performance criterion in question. The manufacturer shall retain and make available to FRA upon request any analysis or data relied upon to satisfy the requirements of this paragraph to sustain an exception from testing.