Download the Testimony with the Appendix
Download the oral Testimony
Good morning Chairman Wicker, Ranking Member Cantwell, and Members of the Committee. Thank you for inviting the National Transportation Safety Board (NTSB) to testify today.
Congress established the NTSB in 1967 as an independent agency within the United States Department of Transportation (DOT) with a clearly defined mission to promote a higher level of safety in the transportation system. In 1974, Congress reestablished the NTSB as a separate entity outside of the DOT, reasoning that “no federal agency can properly perform such (investigatory) functions unless it is totally separate and independent from any other . . . agency of the United States.” Because the DOT has broad operational and regulatory responsibilities that affect the safety, adequacy, and efficiency of the transportation system, and transportation accidents may suggest deficiencies in that system, the NTSB’s independence was deemed necessary for proper oversight.
The NTSB is charged by Congress with investigating every civil aviation accidents in the United States and significant accidents in other modes of transportation—highway, rail, marine, and pipeline. We determine the probable cause of the accidents we investigate, and we issue recommendations to federal, state, and local agencies, as well as other entities, aimed at improving safety, preventing future accidents and injuries, and saving lives. The NTSB is not a regulatory agency—we do not promulgate operating standards nor do we certificate organizations and individuals. The goal of our work is to foster safety improvements for the traveling public.
Our Office of Railroad, Pipeline and Hazardous Materials Investigations is responsible for investigating railroad accidents. The majority of railroad investigations involve freight train accidents, such as collisions and derailments, but the office also places special emphasis on train accidents that involve the traveling public, such as passenger train and rail transit accidents. Based on these accident investigations, the NTSB issues safety recommendations to federal and state regulatory agencies, industry and safety standards organizations, railroads, rail transit agencies, manufacturers and emergency response organizations. There are currently 25 open recommendations that we have made to Amtrak, and 89 open recommendations that we have made to the Federal Railroad Administration (FRA). 
Our nation’s system of rail transportation is generally safe. However, when an accident does occur the consequences can be devastating. When there is a fatality or an accident involving a passenger train, it is the NTSB’s role to investigate, determine probable cause, and issue safety recommendations. Recent accidents involving passenger rail remind us of the need to be vigilant in improving safety, and should compel all those who are responsible for the safety of rail transportation and of the travelling public to make improvements.
On May 15, 2019, the Board held a meeting to determine the probable cause of the December 18, 2017, derailment of Amtrak train 501 onto Interstate 5 near DuPont, Washington.3 Of the 83 people on the train, 3 passengers died, and 57 passengers and crew members were injured. In addition, eight people in highway vehicles were injured. There were multiple factors contributing to this accident and its severity, but the tragic fact is that it, and the deaths and injuries that resulted, were preventable. Several of the factors relate to safety issues that we have identified and made recommendations to address in previous investigations. This testimony will discuss those issues and the need to address them in order to prevent the continued recurrence of such accidents.
Positive Train Control
Positive Train Control (PTC) is an advanced train control system designed to prevent train-to-train collisions, overspeed derailments, incursions into established work zones, and movement through a switch left in the wrong position. The first NTSB-investigated accident that train control technology would have prevented occurred in 1969, when 4 people died and 43 were injured in the collision of two Penn Central commuter trains in Darien, Connecticut. In the 50 years since then, we have investigated over 150 accidents that could have been prevented by PTC. These accidents have claimed almost 300 lives.
On February 4, 2019, we announced our Most Wanted List of Transportation Safety Improvements for 2019–2020, which identifies the top safety improvements that can be made across all modes to prevent accidents and injuries and save lives, based on our investigations. The implementation of PTC appeared on the first Most Wanted List in 1990, and remains on the current list due to lack of full implementation.
According to Amtrak’s First Quarter 2019 PTC Progress Report submitted to the FRA, Amtrak has made progress in implementing PTC on the tracks that it owns. Amtrak-owned locomotives are all PTC-equipped and 85 percent of the route miles on its own tracks are operational.  However, Amtrak’s progress toward PTC implementation on host railroads cannot be determined through reports provided to the FRA because the host railroads report on the entirety of their systems (all locomotives and all infrastructure), with no transparency as to whether Amtrak is PTC operational on their lines. Additionally, the NTSB remains concerned about the FRA’s granting of exemptions to PTC, including more than 1,400 miles of freight railroad-owned track on which Amtrak operates, some of which is in dark (non-signaled) territory.
In the DuPont investigation, the Central Puget Sound Regional Transit Authority (Sound Transit) had identified the need for PTC to mitigate the risk of the accident curve on the Point Defiance Bypass; and, at the time of the accident was working with Amtrak and BNSF Railway on the installation, testing and verification, and validation of the PTC system on the route. However, service was initiated even though neither PTC, nor any other risk mitigation, had been implemented. Without PTC and the lack of oversight to implement mitigations, there was an increased safety risk to the traveling public. We found that had PTC been fully installed and operational at the time of the accident, it would have intervened to stop the train prior to the curve, thus preventing the overspeed derailment.
As a result of the DuPont investigation, we have recommended that the FRA prohibit the operation of passenger trains on new, refurbished, or updated territories unless PTC is implemented. PTC must be fully implemented to ensure the safety of railroad passengers and crews.
Speed Limit Action Plans
Without PTC in place, it was critical for Sound Transit, Amtrak, and FRA to ensure that processes and procedures were in place to reduce the risk of derailment at the accident curve due to train overspeeds. The maximum authorized speed for passenger trains on the Point Defiance Bypass was 79 miles per hour (mph), but it reduced to 30 mph at the curve.
Section 11406 of the Fixing America’s Surface Transportation Act of 2015 (the FAST Act) required each railroad carrier providing intercity rail passenger transportation or commuter rail passenger transportation, in consultation with host railroad carriers, to survey their systems and identify each main track location where there is a reduction of more than 20 mph from the approach speed to a curve, bridge, or tunnel. The carriers also must develop appropriate actions to enable warning and enforcement of the maximum authorized speed for passenger trains at each of those locations. The plans must be reviewed and approved by the Secretary of Transportation, who is also provided authority to add conditions to the approval. The FAST Act did not require the FRA to continue to solicit updates from railroads beyond the initial submission deadline, nor did FRA pursue additional submissions for new or updated routes from railroads that owned or operated service on such routes even though the FRA has authority to do so. Because the upgrade had not yet occurred at the time of the enactment of the FAST Act, the accident curve was not addressed in any speed limit action plans. Additionally, FRA did not require railroads in the planning or construction phases of projects to evaluate the potential risk to future operational territories, and Sound Transit did not apply risk mitigation strategies as outlined by the FAST Act on the accident curve.
For its part, Amtrak had planned to update its Speed Limit Reduction Action Plan through a General Order implementing a “crew focus zone” at the accident curve. Crew focus zones are locations where the operating crews are required to communicate warnings of upcoming speed restrictions. This was not planned to be completed until January 2018, several weeks after revenue service on the subdivision had begun. We recommended that Amtrak update its safety review process to ensure all operating documents are up to date and accurate before initiating new or revised revenue operations.
Although FRA participated in the Point Defiance Bypass project through federal grant funding administration and safety oversight, FRA officials located in both headquarters and in the field failed to recognize that additional hazard mitigations strategies were not implemented by Sound Transit or Amtrak at the accident location. While the FAST Act did not require it, the FRA should have ensured that speed limit action plans include new or updated routes owned or operated by railroads. As a result of this investigation, we have recommended that FRA require intercity and passenger railroads to periodically review and update their speed limit action plans to reflect any operational or territorial operating changes requiring additional safety mitigations and to continually monitor the effectiveness of their speed limit action plan mitigations. We also recommended that the agency require railroads to apply their existing speed limit action plan criteria for overspeed risk mitigation to all current and future projects in the planning, design, and construction phases, including projects where operations are provided under contract.
Safety Culture and Management
Our investigation of the DuPont accident, as well as of the February 4, 2018, collision of Amtrak train 91 and a CSX train in Cayce, South Carolina, highlighted that there is inconsistency in the approach to managing safety on the territories in which Amtrak operates. Amtrak operates on track that it owns, as well as track that it does not own—referred to as a host railroad. Amtrak maintains host railroad agreements to access the infrastructure necessary to provide nationwide passenger rail service. On July 10 and 11, 2018, we held an investigative hearing regarding the DuPont and Cayce accidents to explore issues on managing safety on passenger railroads.
In the Cayce accident, the Amtrak train unexpectedly entered a siding and collided with a stationary CSX freight train. Two of the Amtrak crewmembers—the engineer and the conductor—were killed, and 91 others transported to medical facilities. At the time of the accident, a signal suspension was in place through the area, due to signal work being done by CSX, including upgrades to prepare for implementation of PTC. Trains were being directed through the area by a CSX dispatcher, who would issue warrants, or permissions, to use the main line.  The crew of the CSX train had completed work in the area, moved the train to the siding, and released their authority to use the main line back to the dispatcher. However, the switch on the main line was left open to the siding and locked. As we saw in DuPont and other accidents, this accident also demonstrates Amtrak’s incapability to control or influence the management of safety on the host railroad. When operating over the territory of a host railroad Amtrak is subjected to the risk mitigation strategies implemented by that host. Although there is a host railroad agreement in place between Amtrak and the host railroad, this agreement does not establish the parameters for safe operations and a consistent level of risk mitigation from host railroad to host railroad.
Amtrak relies on host railroads to meet the minimum federal safety standards to ensure safe operations of Amtrak trains. However, on its own territory, Amtrak aims to meet and exceed these standards. Our investigation of the DuPont derailment determined that, to improve safety for the public, Amtrak needs to implement a safety management system (SMS) program on all of its operations, whether internal or on a host railroad. We have recommended that Amtrak work collaboratively with all host railroads and states that own infrastructure over which Amtrak operates to develop and implement a comprehensive SMS program.
The NTSB has long recommended the implementation of SMS across all modes of transportation. For example, SMS is becoming a standard of practice among Part 121 commercial aviation operators. There are four components to SMS per Federal Aviation Administration Order:
a safety policy that sets out what the organization is trying to achieve; outlines the requirements, methods, and processes the organization will use to achieve the desired safety outcomes; establishes senior leadership’s commitment to incorporate and continually improve safety in all aspects of the business; and reflects management’s commitment to implementing processes and procedures for establishing and meeting safety objectives and promoting a safety culture.
a safety risk management process that identifies all hazards, analyzes the risk, assesses the risk, controls the risk, and then continually evaluates whether those risk management strategies are working.
a safety assurance process that evaluates the continued effectiveness of, and compliance with, requirements and implemented risk control strategies and supports the identification of new hazards.
a safety promotion program which includes training, communication, and other actions to create a positive safety culture within all levels of the workforce.
Had Amtrak developed and implemented a comprehensive SMS, the DuPont accident, and others, would likely never have occurred.
This accident is not the first time we have raised the importance of Amtrak implementing SMS. In 2016, an Amtrak train traveling near Chester, Pennsylvania, struck a backhoe with a worker inside, killing the operator and a track supervisor and injuring 39 others. We found that Amtrak allowing a passenger train to travel at maximum authorized speed on unprotected track where workers were present, the absence of worker protection devices, the failure of the foreman to conduct a job briefing at the start of the shift, all coupled with the numerous inconsistent views of safety and safety management throughout Amtrak, led to the accident. We also found that Amtrak did not have an effective program to ensure that its employees, especially those in safety-sensitive positions, were drug-free while performing their public transportation duties. We continue to investigate other accidents where unsafe practices have killed railway workers In our report, we recommended that Amtrak develop a comprehensive SMS that vitalizes safety goals and programs with executive management accountability; incorporates risk management controls for all operations affecting employees, contractors, and the traveling public; improves continually through safety data monitoring and feedback; and is promoted at all levels of the company.
The Rail Safety Improvement Act of 2008 required the Secretary of Transportation to promulgate a regulation that requires each Class I railroad and railroad carriers that provide intercity rail passenger or commuter rail passenger transportation to develop and implement a railroad safety risk reduction program that systematically evaluates railroad safety risks on its system and manages those risks in order to reduce the numbers and rates of railroad accidents, incidents, injuries, and fatalities. On August 12, 2016, the FRA published a final rule to implement the 2008 mandate, known as the System Safety Program, with an initial effective date of October 11, 2016.  However, the enactment of the final rule has been continually delayed, and on June 12, 2019, the FRA issued a notice of proposed rulemaking seeking to further delay for an undetermined time period the final rule for a seventh time.
As part of our investigation into the collision near Chester, Pennsylvania, we found that by delaying progressive system safety regulation, the FRA had failed to maximize safety for the passenger rail industry and the traveling public and recommended that the FRA enact the System Safety Program without further delay. We also recommended that Amtrak and the labor unions work collaboratively to develop and implement a comprehensive SMS program that complied with the pending System Safety Program regulation.
We also reiterated our recommendation to FRA to enact the 2016 final rule without delay in the DuPont accident report. Despite evidence further demonstrating the need for the timely enactment of the System Safety Program regulation, the FRA continues to delay the requirement for commuter and intercity passenger railroads to improve the safety of their operations. It has been 11 years since Congress mandated implementation of a final rule. The rule itself provides another year for railroads to submit their plans for review and approval to the FRA and another three years for them to implement it, which means a full 15 years will have gone by before the mandate is even implemented, and that is assuming there is not another delay as the FRA has proposed. The absence of a sense of urgency by the FRA to implement this safety recommendation and the willingness to continue to jeopardize the safety of train crews and their passengers is unacceptable. The railroads should not wait one more day on the FRA to implement a final rule, and each railroad should take swift action to ensure system safety.
The failure of Sound Transit to provide an effective mitigation for the hazardous curve on the Point Defiance Bypass without PTC in place allowed the engineer of Amtrak 501 to enter the curve at too high of a speed due to his inadequate training on the territory and inadequate training on the newer equipment.
Our investigation found that the engineer only had rudimentary knowledge and experience with both the accident locomotive and the physical characteristics of the territory. The Amtrak qualification program for the Point Defiance Bypass did not effectively train and test qualifying crewmembers on the physical characteristics of a new territory, and Amtrak did not provide sufficient training on all characteristics of the Charger locomotive, the type of lead locomotive involved in the accident. The engineer had qualified on the route two days before the accident, and the accident trip was his first time operating on the territory in revenue service and without supervision. He was accompanied in the operating compartment by a qualifying conductor who was making his first trip over that territory. The engineer’s qualification training included a number of observation rides, then making two northbound and one southbound trips while operating the train under supervision. Some of these trips were made on the Charger locomotive.
As a result of our investigation, we made recommendations to Amtrak to improve training for crewmembers to ensure proficiency on the physical characteristics of a territory and operating characteristics of locomotives, including through the use of simulators. Simulators are very useful in addressing in a controlled environment operating behaviors that are either too dangerous to undertake using actual equipment or that must be evaluated more precisely than is possible through observation alone. However, to be most effective, this type of training must closely reproduce the conditions and operating tasks of the equipment being represented.
We also recommended that Amtrak conduct training that specifies and reinforces how each crewmember, including those who have not received their certifications or qualifications, may be used as a resource to assist in establishing and maintaining safe train operations.
Passenger Rail Car Crashworthiness
The rail cars involved in the DuPont accident have a unique design, different from conventional United States passenger equipment. The Talgo Series VI trainsets were manufactured by Talgo for Amtrak and the Washington State Department of Transportation between 1996 and 1998, and the accident trainset was built in 1998. On May 12, 1999, the FRA published a final rule strengthening passenger equipment safety standards. The Talgo Series VI trainsets did not meet the requirements of the new rule, so Amtrak petitioned the FRA to grandfather or permit the use of the Talgo Series IV trainsets on three corridors, including the Pacific Northwest corridor between Eugene, Oregon, and Blane, Washington, via Portland and Seattle (Puget Sound route). In 2009, the FRA ultimately authorized the use of the Talgo Series VI on the route. However, the FRA did express concern about the performance of the trainsets in higher energy events, particularly collisions at greater than 25 mph. Additionally, although risk analyses conducted by Amtrak at the request of the FRA showed that PTC would have reduced the risk of fatality by 47 percent and injury by 30 percent, the FRA did not require implementation of PTC on the route, even the FRA had the authority to attach special conditions to the approval of the petition.
On September 6, 2017, Amtrak submitted a petition to the FRA requesting permission to operate the Talgo Series VI trainsets on Sound Transit's Lakewood Subdivision near Tacoma, Washington. On December 14, 2017, just four days before the accident, FRA determined that granting Amtrak’s request was “in the public interest and consistent with railroad safety” with no risk assessment of the new route or review of the risk of operations between the original route and the new route.
As the result of our investigation, we found that the Talgo Series VI did not provide adequate occupant protection, resulting in complex uncontrolled movements and secondary collisions with the surrounding environment which led to damage so severe to the railcar body structure, that it caused passenger ejections. The failure of the railcars directly resulted in three fatalities and two partially ejected passengers. We recommended that WSDOT discontinue the use of the Talgo Series VI trainsets as soon as possible and replace them with passenger railroad equipment that meets all current safety requirements. We also found that allowing the grandfathering provision to remain in FRA regulations is an unnecessary risk that is not in the public interest nor consistent with railroad safety, and recommended its removal.
Audio and Image Recorders
In the DuPont accident, the locomotive was equipped with an inward-facing image recorder that provided investigators with both a visual and audio recording of the crewmember activities during the accident trip. Amtrak installed these devices even though they are not required by the FRA. This accident demonstrated the value of image and audio data for investigations and development of safety recommendations.
Dozens of previous railroad accident investigations would have benefitted from this technology. These types of recorders are also critical to improving operational safety and management oversight. When investigating the September 12, 2008, accident in Chatsworth, California, we were unable to determine the actions of the Metrolink engineer leading up to the collision and after discovering some illicit activities by the engineer during previous trips. The railroad had no way of monitoring the engineer’s activities to ensure appropriate behaviors. This accident, in which 25 people were killed and 102 people were injured, underscored the importance of understanding the activities of crewmembers in the time leading up to the accident. As a result of that investigation, we recommended that the FRA require the installation, in all controlling locomotive cabs and cab car operating compartments, of crash- and fire-protected inward- and outward-facing audio and image recorders.16 The FAST Act required the Secretary of Transportation to require each railroad carrier that provides regularly scheduled intercity rail passenger or commuter rail passenger transportation to the public to install inward- and outwardfacing image recording devices in all controlling locomotive cabs and cab car operating compartments in such passenger trains.
We continue to believe that inward- and outward-facing audio and image recorders improve the quality of accident investigations and provide the opportunity for proactive steps by railroad management and the FRA to improve operational safety. Nonetheless, after six reiterations of the NTSB’s recommendations, the FRA has not taken positive action regarding inward-facing devices nor developed inward-facing recorder regulations as required by the FAST Act. Therefore, as a result of the DuPont investigation, we have recommended that the Secretary of Transportation require the FRA issue regulations for inward-facing recorder regulations that include audio recordings as recommended by NTSB, not just image recordings as required in the FAST Act.
Over the last 52 years, our investigations have found that railroad safety is a shared responsibility among operators, government oversight agencies, and local communities.
Railroads remain one of the safest means of transportation. However, the consequences are tragic when there is a lack of PTC, lack of SMS, or insufficient training. Our 2019 – 2020 Most Wanted List of Transportation Safety Improvements includes additional safety issues related to rail that, if addressed, would make a significant impact. To that end, the NTSB urges FRA, Amtrak, and other operators to expeditiously implement all NTSB safety recommendations.
We recognize the progress that has been made; yet, there will always be room for improvement. The NTSB stands ready to work with the Committee to continue improving the safety of our nation’s rail network.
Thank you again for the opportunity to testify today. I am happy to answer your questions.
Independent Safety Board Act of 1974 § 302, Pub. L. 93-633, 88 Stat. 2166–2173 (1975).
A list of all open and closed unacceptable recommendations to Amtrak and the FRA is contained in the appendix.
A list of all open recommendations to Amtrak is contained in the appendix.
Signal suspension means train control signals located alongside the track have been taken out of service, oftentimes for maintenance or system upgrades. When these signals are taken out of service, train movements are controlled by means such as absolute blocks or by track warrants.
49 CFR Part 270
49 CFR Part 238
FRA Docket ID: FRA-1999-6404