http://ntsb.gov/Publictn/2010/RAR1002.htm
CONCLUSIONS
1. The following were neither causal nor contributory to the accident: weather, training and qualifications of the train operators, fatigue, use of alcohol or illegal drugs by the train operators, track structure and rail integrity, and condition and performance of train mechanical equipment.
2. The operator's decision to operate train 214 (the struck train) in manual mode during the evening rush hour period was in violation of Metro rules, but track circuit B2-304 was failing to detect trains, regardless of whether they were operating in manual or automatic mode.
3. Because train 214, which was being operated in manual mode, was traveling at a much slower speed than the authorized speed commands it was receiving, train 214 stopped completely within the faulty B2-304 track circuit when its detection was lost and it received a 0 mph speed command.
4. Because of the design of the Washington Metropolitan Area Transit Authority (WMATA) operations control center information management system and the high number of track circuit failure alarms routinely generated by that system, operations control center controllers could not have been expected to be aware of the impending collision or to warn either train operator.
5. Considering the challenges of the recovery operations, the emergency response was well coordinated and effectively managed.
6. The Metrorail automatic train control system stopped detecting the presence of train 214 (the struck train) in track circuit B2-304, which caused train 214 to stop and also allowed speed commands to be transmitted to train 112 (the striking train) until the collision.
7. Even though the operator of train 112 activated emergency braking before the collision, there was not enough time, once train 214 came into full view, to stop the train and avoid a collision.
8. On the day of the accident, parasitic oscillation in the track circuit modules for track circuit B2-304 was creating a spurious signal that mimicked a valid track circuit signal, thus causing the track circuit to fail to detect the presence of train 214.
9. Spurious signals had been causing the track circuit modules for track circuit B2-304 to erroneously indicate that the track circuit was vacant from the time the track circuit transmitter power was increased after the impedance bond was replaced on June 17, 2009, until the accident 5 days later.
10. Train operators did not report problems with track circuit B2-304 before the accident because reductions in speed commands to maintain train separation, or even momentary losses of all speed commands, were common during train operations.
11. The track circuit modules did not function safely as part of a fail-safe train control system because GRS/Alstom did not provide a maintenance plan that would detect anomalies in the track circuit signal, such as parasitic oscillation, over the modules' service life and prevent these anomalies from being interpreted as valid track circuit signals.
12. Some of the General Railway Signal Company (GRS) track circuit modules in use on the WMATA Metrorail system continue to exhibit parasitic oscillation, and the presence of this oscillation presents an unacceptable risk to Metrorail users.
13. As shown by the fact that (1) the GRS modules in the accident track circuit B2-304 consistently exhibited parasitic oscillation in on-scene and laboratory testing regardless of the type of impedance bond or simulated load used, (2) numerous other Metrorail track circuits that used all GRS components were found to have parasitic oscillation similar to the oscillation found at Fort Totten, and (3) numerous other track circuits with components made by different manufacturers showed no evidence of such oscillation, this accident did not result from WMATA's use of Union Switch & Signal impedance bonds with GRS track circuit modules.
14. The change in transmitter power level necessitated by the installation of a Union Switch & Signal impedance bond in track circuit B2-304 was within the design parameters of the equipment and would not have resulted in a failure of train detection in the absence of parasitic oscillation within the GRS track circuit modules.
15. WMATA failed to institutionalize and employ systemwide the enhanced track circuit verification test developed following the 2005 Rosslyn near-collisions, and this test procedure, had it been formally implemented, would have been sufficient to identify track circuits that could fail in the manner of those at Rosslyn and Fort Totten.
16. If proper shunt placements had been used, as required by WMATA's procedures, to verify track circuit B2-304 either immediately after the new impedance bond was installed on June 17, 2009, or when the track circuit was tested the following day, the work crews would have been able to determine that the track circuit was failing to detect trains, and actions could have been taken to resolve the problem and prevent the accident.
17. A technician following the manufacturer-provided GRS track circuit module maintenance procedures would not have detected the spurious signals that caused track circuit B2-304 to fail in an unsafe manner.
18. WMATA Metrorail automatic train control test procedure T163, developed since this accident, will permit technicians to detect the presence of parasitic oscillation like that found in the failed track circuit modules at Fort Totten; however, unless these procedures are carried out on a periodic basis, an unsafe condition may persist for some time before being discovered and corrected.
19. A comprehensive safety analysis of an automatic train control system must consider all foreseeable system failures that may result in a loss of train separation, including failures in train detection caused by track circuit failures.
20. WMATA did not effectively distribute technical bulletins and safety information to its automatic train control technicians nor did it ensure that the information was received, understood, and properly acted upon by those technicians.
21. WMATA failed to recognize that the near-collisions at Rosslyn in 2005 represented an unacceptable hazard that had not been considered in the fail-safe design of the automatic train control system, and WMATA failed to communicate that hazard to the affected divisions in the organization for resolution.
22. The Metrorail maintenance communication line system-a system that was in disrepair and was apparently no longer needed by WMATA-could allow unanticipated signal paths that could degrade the integrity, and thus the safety, of the Metrorail automatic train control system.
23. As revealed by postaccident testing, the cables serving the impedance bonds for track circuit B2-304 did not meet proposed WMATA Metrorail standards for insulation resistance, and although this did not cause or contribute to the accident, such deficiencies, if undetected and uncorrected, could undermine the safety of the Metrorail train control system.
24. The structure of the Federal Transit Administration's oversight process leads to inconsistent practices, inadequate standards, and marginal effectiveness with respect to the state safety oversight of rail transit systems in the United States.
25. The results of this investigation, as well as the Federal Transit Administration's audit of the Tri-State Oversight Committee and WMATA, determined that the Tri-State Oversight Committee has been ineffective in providing proper safety oversight of and lacks the necessary authority to properly oversee the WMATA Metrorail system.
26. The results of this investigation and the findings and recommendations contained in the Federal Transit Administration's March 4, 2010, Final Audit Report of its 2009 safety audit of the Tri-State Oversight Committee and WMATA, if implemented, will enhance WMATA Metrorail passenger and employee safety.
27. The low priority that WMATA Metrorail managers placed on addressing malfunctions in the train control system before the accident likely influenced the inadequate response to such malfunctions by automatic train control technicians, operations control center controllers, and train operators.
28. The steps that WMATA has taken since the Fort Totten accident, such as improving and increasing the use of the loss-of-shunt software tool for identifying track circuit malfunctions, will contribute to improving the safety of the system.
29. The safety of transit rail operations would be improved by periodic transit agency review of recorded operational data and non-punitive safety reports, which have been demonstrated to be effective tools for identifying safety problems in other modes of transportation.
30. Based on the results of this investigation and the Federal Transit Administration's recent safety audit, WMATA was not adequately assessing the severity of hazardous risk associated with identified anomalies in its automatic train control system.
31. The WMATA Board of Directors did not exercise oversight responsibility for the system safety of the WMATA system.
32. Before the accident, the WMATA Board of Directors did not seek adequate information about, nor did it demonstrate adequate oversight to address, the number of open corrective action plans from previous Tri-State Oversight Committee and Federal Transit Administration safety audits of WMATA.
33. Before the accident, the position of chief safety officer lacked the necessary resources and authority within the organizational structure of WMATA to adequately identify and address system safety issues, ensure the distribution of safety-critical information throughout the organization, or manage the system safety program plan as required by 49 Code of Federal Regulations Part 659.
34. Shortcomings in WMATA's internal communications, in its recognition of hazards, its assessment of risk from those hazards, and its implementation of corrective actions are all evidence of an ineffective safety culture within the organization.
35. Previous attempts at non-regulatory oversight failed to compel WMATA to maintain the organizational structure necessary to ensure effective identification and communication of safety-critical information throughout its Metrorail operations.
36. The FTA's lack of toxicological specimen authority prevents transit agencies from collecting pertinent information for determining the circumstances of transit accidents.
37. The structural design of the 1000-series railcars offers little occupant protection against a catastrophic loss of occupant survival space in a collision, and the continued use of these cars in revenue service constitutes an unacceptable risk to WMATA Metrorail users.
38. WMATA's practice of bellying the 1000-series cars does not provide appreciable crashworthiness benefits and is not an acceptable substitute for removing the cars from service.
39. The lack of onboard event recording capability on the striking train prevented a definitive determination of train performance, the status of the onboard systems, and the operator's actions before the collision.
40. Because WMATA does not have a program to monitor the performance of onboard event recorders or to ensure that they are functioning properly, these devices cannot be relied upon by WMATA to provide data that can be used for accident investigations or for equipment or operations monitoring and maintenance.
