14-Reference 01- A0 UTA PTCSP Version 3.0 Main Body Final.pdf

Utah Transit Authority FrontRunner Service

Enhanced Automatic Train Control

(E-ATC)

Positive Train Control Safety Plan

(PTCSP)

Per FRA Docket FRA-2010-0052

Version 3.0 December 2, 2022

MAIN BODY and APPENDICES

This document is the PTC Safety Plan (PTCSP) for the UTA FrontRunner PTC system. This Plan is submitted to the Federal Railroad Administration (FRA) for FRA approval pursuant to 49 CFR 236, Subpart I, §236.1015, as mandated by the Rail Safety Improvement Act of 2008 (RSIA 08) for PTC system certification.

Utah Transit Authority E-ATC FrontRunner PTC Safety Plan Main Body

Version 3.0 ii December, 2, 2022

Revision History

Date

Revision Description Author

1/18/16 0.1

Initial 60% draft of PTCSP main body using E-ATC template. Information yet to be provided or verified is marked with yellow highlight RSC/RMSS

2/12/16 0.2

Initial 60% draft of PTCSP main body with corrections made from internal comments. Information yet to be provided or verified is marked with yellow highlight RSC/RMSS

8/23/18 0.3

Draft with Results from UTA document review meeting and additional inputs from RMSS and others for review RSC/RMSS

6/27/19 0.4

Updates to document for the implementation of comments against Revision 0.3 and related revisions.

Highlighter used to show streamlining potential RSC/RMSS

9/27/19 0.5

Document updated per project team comments and conformance with PNWR SP standardized format. RSC/RMSS

10/4/19 0.6 Added streamlining and edits from RMSS, UTA, and RSC for review RSC/RMSS

11/26/19 0.7 Final Clean Version for Final Edits/Review

RSC/RMSS/

UTA

12/20/19 1.0 Released for UTA Review and FRA submission

RSC/RMSS/

UTA

5/27/20 2.0 Updated per FRA comments RMSS/UTA

9/18/20 2.1 Updated per FRA comments RMSS/UTA

10/9/20 2.2 Updated per FRA comments RMSS/UTA

Version 3.0 iii December, 2, 2022

12/2/2022 3.0

Revised section 6.2.3.3 to include MDER functionality.

Added new reference document for MDER Whitepaper Revised sections 6.2.4.1 and 6.2.4.2 to reflect changes to Office Blocking and TSR functions after the TDX v3 upgrades Revised Table 15-1 for updated TDX User Manual and Appendix A07 for updated Dispatch HFA RMSS/UTA

NOTE: In this document, there are references to GE Transportation Systems, GETS, or GETSGS which refer to General Electric entities. The General Electric signal systems business was sold in 2016 to Alstom Transportation, and any such references are now intended to reference Alstom Signaling Operation, LLC.

Version 3.0 iv December, 2, 2022

Table of Contents

Executive Summary of PTCSP

1 Introduction

1.1 SCOPE

1.2 UTA FRONTRUNNER SYSTEM OVERVIEW

1.3 DOCUMENT OVERVIEW

1.4 UPDATE OF THIS PTCSP

1.5 ACRONYMS AND DEFINITIONS

2 Applicable Documents

3 Confirmation of FRA Type Designation for UTA FrontRunner PTC System

[49 CFR §236.1015©(2)]

3.1 RELIABLY EXECUTE PTC SYSTEM FUNCTIONS OF 49 CFR § 236.1005

3.2 SUFFICIENT DOCUMENTATION TO FULFILL APPENDIX C SAFETY ASSURANCE

PRINCIPLES

3.3 JUSTIFICATION OF NON-VITAL CLASSIFICATION OF THE OFFICE AND COMMUNICATIONS

SEGMENT

Basic Architecture of E-ATC System

Non- Vitality of Office Segment and Communication Segment

4 Type Approval Reference [49 CFR §236.1015(b)]

4.1 TYPE APPROVAL REFERENCED AND UTILIZED IN THIS PTCSP

4.2 PTC PRODUCT VENDORS LIST (PTCPVL) [§236.1015(B)(1)]

4.3 PTC SYSTEM VENDOR QUALITY CONTROL SYSTEM [§236.1015(B)(2)]

4.4 APPLICABLE LICENSING INFORMATION [§236.1015(B)(3)]

5 PTCDP Reference and Identification of Any Variances [§236.1015(c)]

5.1 PTCDP AND TYPE APPROVAL REFERENCES [§236.1015(C)(1)]

5.2 ANY VARIANCES FROM PTCDP (TYPE APPROVED) [§236.1015(C)(2)(I)]

UTA Variance 1 – No Code Proceed Release

UTA Variance 2 – Time to Penalty

UTA Variance 3 – Expedient Release of Mandatory Directive

6 UTA FrontRunner PTC System Implementation [§236.1005(a)] [§236.1015(d)]

6.1 INFORMATION REQUIRED FOR PTCDP UNDER §236.1013(A)

Incorporate PTCDP by Reference

E-ATC System Safety Integration Descriptions

6.2 UTA APPLICATION OF E-ATC

UTA-Specific Implementation of Functions

Use of Timed Code Change Point (TCCP) Functionality

Implementation of Safety Functions

6.2.3.1 AFTAC Overlay Functionality

Version 3.0 v December, 2, 2022

6.2.3.2 Implementation of No Code Proceed Release

6.2.3.3 Highway Grade Crossing Warning System Malfunction Protection

6.2.3.4 Authorization to Enter Work Zone

UTA-Specific Implementation of E-ATC Architecture

6.2.4.1 Office Segment

6.2.4.1.1 CTC Machine

6.2.4.1.1 Office Blocking Function

6.2.4.1.2 TSR Function

6.2.4.1.3 TSR Heartbeat

6.2.4.1.4 Modification of Speed Codes

6.2.4.2 Communication Segment

6.2.4.3 Wayside Segment

6.2.4.3.1 Wayside Segment Overview

6.2.4.3.2 Automatic Operation

6.2.4.3.3 FrontRunner South

6.2.4.3.3.1 Wayside Segment Functionality

6.2.4.3.3.2 Highway Grade Crossings

6.2.4.3.3.3 Highway Grade Crossing within a Control Point

6.2.4.3.3.4 Warning System and Health Monitoring at Highway Grade Crossings

6.2.4.3.4 FrontRunner North

6.2.4.3.4.1 Wayside Segment Functionality

6.2.4.3.4.2 Highway Grade Crossings

6.2.4.3.4.3 Highway Grade Crossing within a Control Point

6.2.4.3.4.4 Warning System and Health Monitoring at Highway Grade Crossings

6.2.4.3.5 Integrated Hazard Detectors

6.2.4.3.6 Enforcement of Permanent Speed Restrictions (PSRs)

6.2.4.3.7 Enforcement of Temporary Speed Restrictions (TSRs)

6.2.4.3.8 Effects of TSR Function on Local Control Mode

6.2.4.3.9 Local Control Mode

6.2.4.4 Onboard Segment

6.2.4.4.1 Onboard Segment Overview

6.2.4.4.2 Onboard Segment Equipment

6.2.4.4.3 Code Rates and Associated Speed Commands

6.2.4.4.4 Operating Modes

6.2.4.4.5 Implementation of E-ATC Cutout

6.2.4.4.6 Onboard Segment Modifications for PTC

6.2.4.4.7 Enforcement Braking

6.2.4.4.8 In-Cab Aspect Display Unit

6.2.4.4.9 Event Recorder

UTA FrontRunner PTC System Configuration Parameters

Interoperable Architecture

Failure Modes

6.2.7.1 Office Segment or Communication Segment Failure

6.2.7.2 Wayside Segment Failure

6.2.7.3 Onboard Segment Failure

7 Final Human Factors Analysis [§236.1013(a)(5)] [§236.1015(d)]

7.1 FINAL HUMAN FACTORS ANALYSIS OF ADU

7.2 TDX CONTROLLER INTERFACE ANALYSIS FOR HUMAN FACTORS

8 Safety Assessment and Application of 49 CFR Part 236, Appendix C [§236.1015(d)(5)] [§236.1015(e)(2)(ii)] [49 CFR Part 236, Appendix C]

Version 3.0 vi December, 2, 2022

8.1 SAFETY PROGRAM SCOPE FOR E-ATC

8.2 E-ATC SYSTEM SAFETY PROCESS

8.3 HAZARD ANALYSES AND MITIGATION

8.4 SAFETY CRITICAL ITEMS LIST (SCIL) / HAZARD LOG

8.5 SAFETY ASSURANCE CONCEPTS

8.6 RISK ASSESSMENT

8.7 VERIFICATION AND VALIDATION OF E-ATC

8.8 SEGMENT SAFETY REQUIREMENTS COMPLIANCE [49 CFR PART 236 APPENDIX C] 77

9 Safety Critical Items List (SCIL) or Hazard Log [§236.1015(d)(1)]

9.1 SAFETY CRITICAL ITEMS LIST DESCRIPTION

9.2 SCIL ROLE IN THE PTC SAFETY ASSESSMENT

9.3 THE E-ATC SCIL

9.4 CONCLUSIONS DRAWN FROM SCIL ANALYSIS

9.5 MAINTENANCE OF THE SCIL

10 Safety Assurance Concepts [§236.1015(d)(2)] [Part 236 Appendix C(b)]

10.1 TYPES OF SACS

Checked Redundancy

Diversity with Self-Checking

Numerical Assurance

Intrinsic Fail-Safe Design

10.2 SAC CLASSIFICATIONS

11 Risk Assessment [§236.1015(d)(3), Part 236 Appendix B (as revised)], Part 236 Appendix C

11.1 RISK ASSESSMENT APPROACH

11.2 RISK ASSESSMENT OBJECTIVES

11.3 RISK ASSESSMENT METHODOLOGY

11.4 49 CFR 236 APPENDIX C COMPLIANCE ANALYSIS

11.5 RAILROAD TDX CTC SYSTEMS IMPACT ASSESSMENT

11.6 COMMUNICATIONS SEGMENT ASSESSMENT

11.7 RESIDUAL RISK ASSESSMENT

11.8 MTTHE CALCULATION METHOD

12 Hazard Mitigation Analysis [§236.1015(d)(4)]

12.1 SYSTEM PRELIMINARY HAZARD ANALYSIS (PHA)

12.2 SYSTEM HAZARD ANALYSIS (SHA)

12.3 OPERATING & SUPPORT HAZARD ANALYSIS (O&SHA)

12.4 SYSTEM FUNCTIONAL FAULT TREE (FFT)

12.5 SEGMENT (SUBSYSTEM) FAULT TREE ANALYSIS (FTA)

12.6 FAILURE MODES AND EFFECTS ANALYSIS (FMEA)

13 Verification and Validation Processes [§236.1015(d)(5)]

13.1 VALIDATION AND VERIFICATION OF E-ATC

13.2 PTC SYSTEM VALIDATION AND VERIFICATION PROCESSES

13.3 TESTING E-ATC

Version 3.0 vii December, 2, 2022

Stage 1 Testing – Segment Testing

Stage 2–Testing - Laboratory Integration Testing

Stage 3 - Field Testing of E-ATC

13.4 REVENUE SERVICE DEMONSTRATION

13.5 INTEROPERABILITY TESTING

14 UTA FrontRunner Training Plan [§236.1015(d)(6)] [§236.1041] [§236.1043] [§236.1045] [§236.1047(a), (b) & (d)] [§236.1049]

14.1 RAIL CONTROLLER (TDX) TRAINING

14.2 TRAIN OPERATOR TRAINING

14.3 MOW AND NETWORK (WAYSIDE) TRAINING

14.4 ROADWAY WORKER PERSONNEL TRAINING

14.5 TRAINING RECORDS

14.6 REFRESHER TRAINING

14.7 PRELIMINARY OPERATING RULES FOR PTC

Books of Rules

PTC Operating Instructions and Crew Record-Keeping

15 Procedures, Test Equipment, and Operations and Maintenance Manual [§236.1015(d)(7)] [§236.1039 (all)]

15.1 MAINTENANCE PROCEDURES AND PROCESS

UTA FrontRunner-Specific Procedures

Controlling and Tracking Documents

Controlling and Tracking Component/Product Modifications

15.2 PTC OPERATIONS AND MAINTENANCE MANUALS

16 Warnings and Warning Labels [§236.1015(d)(8)]

16.1 WARNINGS IN VENDOR MANUALS

16.2 WARNING LABELS

17 Configuration Management and Revision Control Measures, UTA FrontRunner [§236.1015(d)(9)] [§236.1023(c)(2)]

17.1 CONFIGURATION MANAGEMENT INTEGRATION WITH VENDORS

17.2 UTA FRONTRUNNER PTC SYSTEM CONFIGURATION MANAGEMENT

17.3 UTA FRONTRUNNER REVISION CONTROL MEASURES

17.4 VENDOR CONFIGURATION MANAGEMENT AND REVISION CONTROL MEASURES 116

18 Initial Implementation Testing Procedures [§236.1015(d)(10)]

18.1 UTA INFORMATIONAL FILING AND TESTING WAIVERS

18.2 PRE-CERTIFICATION FIELD DEPLOYMENT

18.3 POST-CERTIFICATION SEGMENT DEFINITION

18.4 INTEROPERABILITY TESTING

19 Post-Implementation Testing (Validation) and Monitoring Procedures [§236.1015(d)(11)]

19.1 POST IMPLEMENTATION AND MONITORING ACTIVITIES

Version 3.0 viii December, 2, 2022

20 Records [§236.1015(d)(12)] [§236.1023(b)(1)],[§236.1023(e)] [§236.1037] .. 121

20.1 RECORDS MANAGEMENT

20.2 RECORD DESCRIPTION

20.3 DATA RETENTION MANAGEMENT

Type Approval, PTCDP, and PTCSP

Supporting Safety Documentation for PTCDP/PTCSP

Operations & Maintenance Manual

Training Records

Inspection & Test Records

Safety Critical Items List (Hazard Log)

Product Vendor List

21 Safety Analysis of Work Zone Incursion Protection from Human Error [§236.1015(d)(13)]

21.1 FUNCTIONAL DESCRIPTION

21.2 IDENTIFICATION AND MITIGATION OF HUMAN ERRORS

21.3 UTA FRONTRUNNER OPERATING RULES RELATED TO E-ATC PROTECTION

AGAINST WORK ZONE INCURSION

22 Alternative Arrangements for Rail At-Grade Diamond Crossings [§236.1005(a)(1)(i)] [§236.1015(d)(14)] < Reserved>

23 Authority and Signal Enforcement Exceptions Not in PTCDP [§236.1005(e)(4)] [§236.1015(d)(15)]

24 Compliance with Stated Main Line Track Exclusion Addendum (MTEA) [§236.1015(d)(16)] [§236.1019(f)]

25 Deviation in Operational Requirements for Enroute Failures [§236.1015(d)(17)] [§236.1029(c)]

26 Enforcement of Hazard Detectors [§236.1005(a)(4)(v)] [§236.1005(c)(1)] [§236.1005(c)(2)] [§236.1015(d)(18)]

26.1 FUNCTION DESCRIPTION FOR ADDITIONAL NON-INTEGRATED HAZARD DETECTORS

ON UTA FRONTRUNNER

27 Emergency and Planned Maintenance Re-Routing Management Plan [§236.1005(g-k)] [§236.1015(d)(19)] [§236.1029] [§236.1033(f)]

28 High Speed Service Requirements [§236.1005(c)(3)] [§236.1007] [§236.1015(d)(20)]

29 Communication and Security Requirements [§236.1015(d)(20)] [§236.1033]

29.1 COMMUNICATIONS RESTORATION PLAN

29.2 WIRELESS MESSAGING SECURITY AND ENCRYPTION

29.3 COMMUNICATIONS SECURITY PROVISIONS IN E-ATC

Version 3.0 ix December, 2, 2022

Wayside to Wayside Data Exchange

Wayside to TDX Servers Communications

CTC Servers to Dispatch Workstations

30 Identification of Potential Data Errors and their Mitigation [§236.1015(h)] 138

30.1 SOURCES OF POTENTIAL DATA ERRORS

30.2 MITIGATIONS FOR POTENTIAL DATA ERROR HAZARDS

31 Third Party Assessment [§236.1017]

32 PTC Data Maintained in Locomotive Event Recorder [§236.1005(d)]

33 Errors and Malfunctions [§236.1023]

33.1 PTCPVL [§236.1023(A)]

33.2 FAILURE NOTIFICATION AND RECORDING PROCESS

33.3 RAILROAD PROCESS IN RESPONSE TO SAFETY-CRITICAL FAILURES

34 PTC System Exclusions [§236.1027]

34.1 OFFICE E-ATC ADDED FUNCTIONS

34.2 IMPLEMENTATION OF OFFICE E-ATC FUNCTIONS

34.3 SUMMARY OF E-ATC CTC AUTOMATION

35 Novel Technology Employed in Highway Crossing Protection for PTC [§234.275(c)]

36 List of Appendices

Version 3.0 x December, 2, 2022

Table of Figures

Figure 1-1 – Map of FrontRunner Service

Figure 3-1 – UTA E-ATC Architecture

Figure 6-1 – Overview of UTA FrontRunner E-ATC PTC System

Figure 6-2 - Block Diagram showing layout of ‘Code Line’ and ‘Point-to-Point’ Links ... 54

Figure 6-3 - Aspect Display Unit

Figure 12-1 – Organization of Hazard Mitigation Analysis

Figure 13-1 – UTA FrontRunner Certification and V&V Flowchart

Figure 29-1 –Basic RP2000 and RLP Interaction

Table of Tables Table 1-1 – Passenger Statistics

Table 1-2 – 49 CFR 236, Subpart I Cross-Reference from Regulation to PTCSP

Table 1-3 – Abbreviation and Acronyms

Table 1-4 – Definitions of Safety Terms

Table 6-1 – E-ATC Primary Functions

Table 6-2 - Vehicle Wheel Size Definition

Table 6-3 - Cab Signal Rates, Names, Instructions and Notes

Table 20-1 – Retained Documents

Version 3.0 1 December, 2, 2022

Executive Summary of PTCSP

This document is the Utah Transit Authority Positive Train Control Safety Plan (PTCSP) for the FrontRunner Positive Train Control system implemented on UTA FrontRunner service territory. This information is supplied under FRA docket FRA-2010-0052. This PTCSP provides the appropriate information and safety analysis to gain system certification for UTA’s implementation of the Enhanced Automatic Train Control (E-ATC) as a vital overlay PTC system as defined in 49 CFR §236.1015 (e)(2).

As the host railroad, this PTCSP is submitted in the name of UTA. The usage agreement provides Union Pacific Railroad (UPRR) and Utah Railway with rights to provide freight rail service thereon. UTA has Tenant Railroads, which operate on short sections of the FrontRunner system mainline to provide freight deliveries to their customers. UPRR services customers off of the FrontRunner Provo Salt Lake and the Salt Lake to Ogden mainline track segments.

Utah Railways also services customers off of the FrontRunner Provo to Salt Lake City and Salt Lake City to Ogden mainline track segments. UTA’s tenant railroads are not required to be PTC equipped per §236.1006(b)(5). UTA and UPRR executed a Letter of Understanding regarding implementation of Positive Train Control on or about March 9, 2010. UTA and Utah Railways executed a Letter of Understanding regarding implementation of Positive Train Control on or about August 16th, 2010.

This PTCSP describes the Safety Assurance Concepts employed and the results of all Safety Assurance activities in connection with the PTC implementation. The outcome is a PTC system that is certifiable as safe by the Federal Railroad Administration (FRA).

The underlying system is a vital cab signaling system operated through centralized supervisory control using a Centralized Traffic Control (CTC) dispatching system Track Driver eXtra (TDX).

The Alstom E-ATC System is used as the core technology and functionality for the UTA FrontRunner PTC system. The PTC system has been developed in compliance with requirements and standards defined in response to Rail Safety Improvement Act of 2008

(RSIA08) [3].

The common operating description for E-ATC is provided in the E-ATC PTCDP [11] which has received a Type Approval from the FRA. The UTA Frontrunner implementation of E- ATC is compliant with the description of the system in the PTCDP.

UTA’s passenger rail rolling stock fleet consists of passenger locomotives, cab cars and coaches, in push-pull configurations. Passenger locomotives, which are remanufactured units, are equipped with standard 480-volt head-end power (HEP), and geared for an actual operating top end of 79 mph. Each train typically consists of one locomotive, three non-controlling passenger coaches, and one cab car with operating controls to allow for push-pull operation. The locomotive in normal service leads in the northbound direction with the cab car leading in the southbound direction.

Version 3.0 2 December, 2, 2022

The on-board component of the train control system is based on the Alstom Ultra Cab II (UCII) and Alstom Micro Cabmatic IIIG ATC products, adapted as necessary for the FrontRunner rolling stock. Either the UCII or Micro Cabmatic IIIG ATC system is installed in the cab end of each locomotive and cab car in service.

Highway grade crossings are equipped with warning devices (e.g., flashing light units, gates, signs, and bells) on a site-specific basis and controlled by crossing activation devices. Where required, the highway grade crossing warning system provides highway traffic signal preemption. Highway crossings are shared with UPRR for 56 of the 61 total highway crossings on the UTA FrontRunner territory.

The E-ATC System is based on modifications to the previous Frontrunner Automatic Train Control System. The relevant information and instructions have been updated, according to the information described in the CONOPS document in the PTCDP, provided such that the E-ATC System is certifiable as a vital overlay PTC system for revenue operation.

The E-ATC System will provide protection against train-to-train collisions and switch protection throughout the FrontRunner territory. The E-ATC System will also provide enforcement of zero speed prior to reaching a Stop Signal. The E-ATC PTC system is designed to enforce all Permanent Speed Restrictions (PSRs), Temporary Speed Restrictions (TSRs), and Mandatory Directives (MDs). The use of service proven track circuits, supplemented by a vital wayside signal system and onboard vital logic, is the foundation of the E-ATC System. The Controller inputs interfacing with the vital wayside signal system will allow for TSR enforcement, including roadway worker protection and grade crossing malfunction protection.

UTA has been actively engaged within the rail industry, and with FRA, in comprehensively reading, interpreting and compiling necessary documentation required under FRA regulations toward implementation of PTC. UTA has held regular meetings with the FRA in creating a structure for the PTCSP that is similar to that used by the Class 1 Railroads in their PTCSP FRA filings.

In order to gain System Certification, 49 CFR §236.1015(e)(2)(i) requires that all PTC systems reliably prevent train-to-train collisions, overspeed derailments, incursions into work zones, and movements of a train through a misaligned switch. In addition, the regulation also requires that a vital overlay PTC system integrate all authorities and indications of a wayside or cab signal system and provide appropriate warnings and enforcements for protection of derails or switches entering the main line, highway grade crossing malfunctions, after arrival mandatory directives, moveable bridges, integrated hazard detectors, and maximum train speed in areas without broken rail protection. Vital overlay PTC systems must show that the PTC system fulfills the safety assurance principles set forth in 49 CFR §236 Appendix C.

The E-ATC wayside signal system and onboard equipment are designed and built on well-defined and proven failsafe principles. Any human error by the Controller or the

Version 3.0 3 December, 2, 2022

CTC server for moving the switch position or route in an unsafe manner is prevented by the vital wayside logic. The hardware and software are designed and installed based on the FRA guidelines per CFR 49 Part 236. Any failures within the safety critical circuits are self-detected. No single point E-ATC system failure results in unsafe train operation.

Wherever applicable, safety assurance concepts according to IEEE 1483-2000 [2] are used in all aspects of the hardware and software design.

A Risk Assessment [A1] was performed, providing an aggregate assessment of the residual risk of the E-ATC system and demonstrating that the system has met the applicable requirements of 49 CFR §236 Subpart I. As the E-ATC system is a vital overlay system, compliance with Part 236, Appendix C is demonstrated within the Risk Assessment.

This PTCSP and the results of system testing show that the E-ATC system implemented by UTA meets the requirements of 49 CFR Part 236.1005. UTA’s testing program of E- ATC and deployment and operation of the system in Revenue Service Demonstration (RSD) phase provide evidence that the E-ATC system has been designed consistently with §236.1005 and does reliably execute the functions described therein.

Version 3.0 4 December, 2, 2022

1 Introduction

This PTC Safety Plan (PTCSP) is submitted by Utah Transit Authority pursuant to 49 CFR 236, Subpart I, §236.1015 to meet the PTCSP requirements specified in Subpart I of 49 CFR, Part 236 [6]. The UTA FrontRunner system is classified according to FRA definitions as a “Vital Overlay” PTC system, employing fail-safe design to achieve the FRA-required level of safety.

UTA understands that UTA PTC system certification using the E-ATC architecture is dependent on fulfilling all FRA requirements found in 49 CFR 236.1015. The accompanying safety analysis in this PTCSP provides the quantitative and qualitative analysis required to show that the UTA PTC system, evaluated as a whole, can receive System Certification as a vital overlay PTC.

1.1 Scope

This PTCSP provides the analysis necessary to show that the PTC system, as a whole, is a vital overlay system. The scope of the safety assessment concentrates on the installed elements of PTC and their interfaces to existing railroad systems and operations.

The elements that make up the proposed PTC system consist of four segments:

1. Office Segment - Non-vital (justification provided in Section 3.3 herein)

2. Communications Segment – Non-Vital (justification provided in Section 3.3 herein)

3. Onboard Segment – Vital

4. Wayside Segment – Vital

E-ATC is a wayside-centric, vital overlay system that operates through wayside speed code transmissions to the vehicle, and the assimilation and processing of data by the Onboard Segment. The vital Onboard Segment continuously accepts, validates, and processes operating data obtained from onboard peripheral devices and from the Wayside (Signaling) Segment through traditional track codes impressed on the rails. The data elements are validated and combined in such a way as to eliminate single points of failure at a system level and reduce the overall probability of unsafe failure to an acceptable level. This wayside-centric approach minimizes the effect of communications data errors, data conflicts, data latency and malicious datacom actions, facilitating safe operation.

1.2 UTA FrontRunner System Overview

In April 2008, UTA introduced the state’s first commuter rail line, FrontRunner, as FrontRunner North. The FrontRunner South territory was opened for service in 2012.

The UTA FrontRunner commuter rail system consists of two mainline track segments – Provo to Salt Lake and Salt Lake to Ogden, which are further described below.

Version 3.0 5 December, 2, 2022

The FrontRunner Provo to Salt Lake (FRS) mainline track segment begins just south of UTA’s Provo Center Station (UTA MP S44.26) and extends north on track paralleling the existing Union Pacific Railroad (UPRR) line through UTA’s Salt Lake City Intermodal Center Station (UTA MP0.0). The FrontRunner Salt Lake to Ogden segment begins at UTA’s Salt Lake City Intermodal Center Station (UTA MP0.0), and extends north on track paralleling the existing UPRR, until just past UTA’s Ogden Station (UTA MP N37.7) at the UPRR control point known as Southern Pacific (SP) Junction.

The total FrontRunner territory runs from Ogden to Provo with a total length of 81.96 miles (~134 km).

Frontrunner is a push/pull diesel locomotive system complete with bi-level cab cars and refurbished single-level vehicles. FrontRunner can travel up to 79 miles per hour along the 81.96-mile corridor.

UTA provides FrontRunner commuter rail service on two distinct mainline track segments, as described above and depicted in Figure 1-1. Figure 1-1 shows the FrontRunner commuter rail system mainline track segments using a split image format to depict the entire territory; Provo to Salt Lake City in blue, Salt Lake City to Ogden in red and the discontinued segment from Ogden to Pleasant View in gray. UTA operates 65 passenger trains per normal weekday, as well as 42 trains per normal Saturday on the host mainline track segment. There is also service on some holidays, but no scheduled Sunday service.

The FrontRunner route uses a portion of the right-of-way of the historic Utah Central Railroad, built in 1869 to connect the First Transcontinental Railroad with Salt Lake City and acquired by the Union Pacific Railroad in 1878.

Version 3.0 6 December, 2, 2022

Figure 1-1 – Map of FrontRunner Service

Version 3.0 7 December, 2, 2022

The following Table 1-1 provides the passenger statistics for the FrontRunner Commuter Rail Service. This table includes all available data, noting that service began in April 2008, and that the most recent available data is from 2018.

Table 1-1 – Passenger Statistics

2008 * ! 2009 * 2010 * 2011 2012 ** 2013 2014 2015 2016 2017 2018

Average Daily Passengers 7070 4000 4044 4462 4881 10,414 12,253 12,733 16,286 17,590 18,431

Average Monthly Passengers 160,000 120,000 122,997 135,352 148,876 316,754 372,695 387,293 379,959 404,364 423,323

Total Passengers 1,280,000 1,440,000 1,475,965 1,624,227 1,786,514 3,801,051 4,472,348 4,647,522 4,559,512 4,852,372 5,079,873

* Passenger counts were done using a manual method ! May 2008 was opening for FrontRunner North ** December 2012 was opening for FrontRunner South

1.3 Document Overview

This Section 1.3 provides an overview of the UTA PTC Safety Plan for the implementation of a PTC system in accordance with the mandate of RSIA08, and the requirements of the final regulations primarily consisting of 49 CFR 236, Subpart I.

This document consists of 36 main sections and several appendices containing documents that are referenced by the PTCSP sections and support the safety case and analysis. The Appendices provide reference material required by the regulations in order to fully demonstrate the PTC System’s compliance with the FRA regulations.

This PTCSP:

1. Directly follows the structure of 49 CFR Part 236, Subpart I, §236.1015(d), beginning with PTCSP Section 8.

2. Incorporates by reference the Type Approved E-ATC PTCDP under FRA-granted Type Approval: FRA-TA-2013-01-A [13];

3. Provides specific responses to all regulatory requirements for a PTCSP.

Because the correlation between this PTCSP document and the clauses in 49 CFR Part 236, Subpart I, is not always one-to-one, a cross-reference between the applicable Subpart I requirement and the relevant PTCSP Section, subsection, or Appendix is provided in Table 1-2 below.

Version 3.0 8 December, 2, 2022

Table 1-2 – 49 CFR 236, Subpart I Cross-Reference from Regulation to PTCSP

Regulatory Reference Summary of Regulatory Requirement

Description of Regulatory Requirement PTCSP Section / Chapter Reference

§236.1001(c)(2) Subpart doesn’t exempt RR from A-H compliance unless in approved PTCSP

… subpart does not exempt a railroad from compliance with…subparts A through H … or parts 233, 234, and 235 …, unless the applicable PTCSP, as defined under §

236.1003 and approved by FRA under § 236.1015, provides for such an exception per § 236.1013.

PTCDP

§236.1005(a)(1) PTC system prevents hazards Demonstrate that the PTC system will reliably and functionally prevent stated hazards

3, 8 - 13

§236.1005(a)(1)(i) Alternative arrangements to prevent train-to-train collisions

Specify alternative arrangement described in §236.1005(a)(1)(i) refers to rail to rail at grade crossings providing an equivalent level of safety in regards to train-to-train collisions, if applicable.

§236.1005(a)(2) Include safety-critical integration of authorities and indications from wayside or cab

Include safety-critical integration of all authorities and indications of a wayside or cab signal system, or other similar appliance, method, device, or system of equivalent safety, in a manner by which the PTC system shall provide associated warning and enforcement to the extent, and except as, described and justified in the FRA approved PTCDP or PTCSP, as applicable;

3, 6

Version 3.0 9 December, 2, 2022

Regulatory Reference Summary of Regulatory Requirement

Description of Regulatory Requirement PTCSP Section / Chapter Reference

§236.1005(a)(4)(i) Derail or switch protecting access to the main line

A derail or switch protecting access to the main line required by § 236.1007, or otherwise provided for in the applicable PTCSP, is not in its derailing or protecting position, respectively;

3, 6

§236.1005(a)(4)(v) Hazard detection detects unsafe condition

A hazard detector integrated into the PTC system that is required by paragraph (c) of this section, or otherwise provided for in the applicable PTCSP, detects an unsafe condition or transmits an alarm;

§236.1005(c)(1) Hazard detector integrated into a signal or train control system

Describes the appropriate and timely enforcement of warnings of integrated hazard detectors

§236.1005(c)(2) Additional non-integrated hazard detectors

Specifies actions to be taken by the system and crewmembers based on the receipt and presentation to the operator and train crew of warnings generated as the result of any additional non-integrated hazard detectors.

§236.1005(c)(3) Hazard analysis for any new service conducted over 90mph

Describe the hazard analysis for operations over 90 miles an hour, to include hazards based on specific routes, the basis for decisions concerning hazard detectors and the manner in which such hazard detectors will be interfaced with the PTC system.

(UTA FrontRunner has no operations over 90 mph)

Version 3.0 10 December, 2, 2022

Requirement

Description of Regulatory Requirement PTCSP Section / Chapter Reference

§236.1005(d)(i), (ii) Event recorder operation (Concerning the items of locomotive data to be archived to the FRA Event Recorder or an equivalent crash-hardened memory module, regardless of its configuration).

Lead locomotive operating PTC must be equipped with an operative event recorder that shall record safety-critical train control data routed to the operator’s display with which the operator is required to comply, specifically including text messages conveying mandatory directives and maximum authorized speed.

§236.1005(d)(1)(iii) Event recorders - How info will be displayed, examples, retention

Include examples of how the captured data will be displayed during playback along with the format, content, and data retention duration requirements specified in the PTCSP submitted and approved pursuant to this paragraph.

§236.1005(e)(3) Switch position detection A PTC system required by this subpart shall be designed, installed, and maintained to perform the switch position detection and enforcement described in paragraphs (e)(1) and (e)(2) of this section, except as provided for and justified in the applicable, FRA approved PTCDP or PTCSP.

PTCDP

Version 3.0 11 December, 2, 2022

Requirement

Description of Regulatory Requirement PTCSP Section / Chapter Reference

§236.1005(e)(4) Exceptions to the switch protection

Circuits or electronic equivalent shall be arranged so that any movement authorities less restrictive than those prescribed in paragraphs (e)(1) and (e)(2) of this section can only be provided when each switch, movable-point frog, or derail in the route governed is in proper position, and shall be in accordance with subparts A through G of Part 236, unless it is otherwise provided in a PTCSP approved under Subpart I.

§236.1005(g) – (k) Emergency and planned maintenance re-routing plan

Describes requirements for re-routing of trains based on PTC territory and the operation under planned maintenance or emergency conditions

§236.1006(a) Each train operating on PTC track shall be controlled by equipped locomotive in accordance with PTCSP

Each train operating on PTC track segment equipped with a PTC system shall be controlled by a locomotive and or cab car equipped with an onboard PTC apparatus that is operative and functioning in accordance with the applicable PTCSP.

3, 25

§236.1007 Additional requirements for high speed service

Operations conducted for passenger trains at greater than 90 mph.

(UTA has no operations over 90 mph)

Version 3.0 12 December, 2, 2022

Requirement

Description of Regulatory Requirement PTCSP Section / Chapter Reference

§236.1009(d)(1) Reference to PTCDP A PTC System Certification for a PTC system may be obtained by submitting an acceptable PTCSP. If the PTC system is the subject of a Type Approval, the safety case elements contained in the PTCDP may be incorporated by reference into the PTCSP, subject to finalization of the human factors analysis contained in the

PTCDP.

§236.1009(d)(2) PTCSP document overview Each requirement under 1015 shall be supported by information and analysis to establish the requirements of this subpart have been met.

1.3

§236.1015(a) Must File PTCSP Before placing a PTC system … in service, the host railroad must submit to FRA a PTCSP and receive a PTC System Certification.

§236.1015(b) PTCSP may utilize Type Approval

Type Approval Reference 4.1 5.1

§236.1015(b)(1) PTCPVL Maintains a continually updated PTCPVL pursuant to §236.1023

33.1

§236.1015(b)(2) Shows supplier has appropriate Safety measures

Demonstrate Supplier has Quality Control System

§236.1015(b)(3) Provides applicable licensing info

Applicable Licensing Information

Version 3.0 13 December, 2, 2022

Requirement

Description of Regulatory Requirement PTCSP Section / Chapter Reference

§236.1015(c)(1) Include PTCDP or Type Approval

PTCDP or TA incorporation

§236.1015(c)(2)(i) Document any variances from

DP

Variances in Operating conditions from description in PTCDP

§236.1015(c)(2)(ii) or attest there are none Attestation of no variances in operating conditions from PTCDP

§236.1015(c)(3) Attest system was built in accordance with DP and achieves level of safety

Attest that the system was otherwise built in accordance with the applicable PTCDP and PTCSP and achieves the level of safety represented therein.

§236.1015(d) Include same info as in PTCDP, must include final human factors analysis

A PTCSP shall include the same information required for a PTCDP under § 236.1013(a). If a PTCDP has been filed and approved prior to filing of the PTCSP, PTCSP may incorporate the PTCDP by reference, with the exception that a final human factors analysis shall be provided.

§236.1015(d)(1) Hazard log A HL consisting of a comprehensive description of all safety-relevant hazards not previously addressed by the vendor to be addressed during the life cycle of the PTC system, including maximum threshold limits for each hazard (for unidentified hazards, the threshold shall be exceeded at one occurrence).

Version 3.0 14 December, 2, 2022

Requirement

Description of Regulatory Requirement PTCSP Section / Chapter Reference

§236.1015(d)(2) SACs A description of the Safety Assurance Concepts (SACs) used in the product design, including an explanation of the design principles and assumptions.

§236.1015(d)(3) Risk assessment A risk assessment of the as-built PTC system described;

§236.1015(d)(4) Hazard mitigation analysis A hazard mitigation analysis, including a complete and comprehensive description of each hazard and the mitigation techniques used;

§236.1015(d)(5) V&V description A complete description of the safety assessment and Verification and Validation processes applied to the PTC system, their results, and whether these processes address the safety principles described in 49 CFR 236 Appendix C to this part directly, using other safety criteria, or not at all.

§236.1015(d)(6) Training plan A complete description of the railroad’s training plan for railroad and contractor employees and supervisors necessary to ensure safe and proper installation, implementation, operation, maintenance, repair, inspection, testing, and modification of the PTC system;

Version 3.0 15 December, 2, 2022

Requirement

Description of Regulatory Requirement PTCSP Section / Chapter Reference

§236.1015(d)(7) Test procedures for equipment installs, repair, operations, etc.

A complete description of the specific procedures and test equipment necessary to ensure the safe and proper installation, implementation, operation, maintenance, repair, inspection, testing, and modification of the PTC system on the railroad and establish safety-critical hazards are appropriately mitigated.

§236.1015(d)(8) Additional warnings A complete description of each warning to be placed in the Operations and Maintenance Manual identified in §236.919, and of all warning labels required to be placed on equipment as necessary to ensure safety.

§236.1015(d)(9) Configuration control A complete description of the configuration or revision control measures designed to ensure that the railroad or its contractor does not adversely affect the safety functional requirements and that safety-critical hazard mitigation processes are not compromised as a result of any such change;

§236.1015(d)(10) Initial implementation procedures

A complete description of all initial implementation-testing procedures necessary to establish that safety-functional requirements are met and safety-critical hazards are appropriately mitigated.

Version 3.0 16 December, 2, 2022

Requirement

Description of Regulatory Requirement PTCSP Section / Chapter Reference

§236.1015(d)(11) Post implementation procedures

A complete description of all post-implementation testing (validation) and monitoring procedures, including the intervals necessary to establish that safety-related functional requirements, safety-critical hazard mitigation processes, and safety-critical tolerances are not compromised over time, through use, or after maintenance (adjustment, repair, or replacement) is performed;

§236.1015(d)(12) Description of records to ensure system safety

A complete description of each record necessary to ensure the safety of the system that is associated with periodic maintenance, inspections, tests, adjustments, repairs, or replacements, and the system’s resulting conditions, including records of component failures resulting in safety-relevant hazards (see §236.1037)

§236.1015(d)(13) Safety Analysis A safety analysis to determine whether, when the system is in operation, any risk remains of an unintended incursion into a roadway work zone due to human error. If the analysis reveals any such risk, the PTCDP and PTCSP shall describe how that risk will be mitigated;

§236.1015(d)(14) Description of alternate arrangements made in 236.1005(a)(1)(i)

A more detailed description of any alternative arrangements as already provided under §236.1005(a)(1)(i).

Version 3.0 17 December, 2, 2022

Requirement

Description of Regulatory Requirement PTCSP Section / Chapter Reference

§236.1015(d)(15) PTC enforcement of authorities A complete description of how the PTC system will enforce authorities and signal indications, unless already completely provided for in the PTCDP;

§236.1015(d)(16) How does system comply with 236.1019(f)

A description of how the PTCSP complies with §236.1019(f), if applicable;

§236.1015(d)(17) Deviation of procedures for en route failures

A description of any deviation in operational requirements for en route failures as specified under §236.1029(c), if applicable and unless already completely provided for in the PTCDP;

§236.1015(d)(18) Enforcement of Integrated hazard detectors

A complete description of how the PTC system will appropriately and timely enforce all integrated hazard detectors in accordance with § 236.1005(c);

§236.1015(d)(19) Emergency re-routing plan An emergency and planned maintenance temporary rerouting plan indicating how operations on the subject PTC system will take advantage of the benefits provided under §236.1005(g) – (k);

§236.1015(d)(20) High Speed Rail and Comms Security Documents

The documents and information required under §236.1007 and § 236.1033.

§236.1015(d)(21) Locations for Repair of Failed PTC Apparatus

Identify where exchange or repair of failed PTC apparatus will take place

Version 3.0 18 December, 2, 2022

Requirement

Description of Regulatory Requirement PTCSP Section / Chapter Reference

§236.1015(d)(21) Location of Repair to be specified for PTC failed locomotive apparatus.

Movements over 500 miles to repair to be specified.

A list of each location where a locomotive or cab car with a failed onboard PTC apparatus will be regularly be exchanged or repaired pursuant to § 236.1029(b)(6) and a list of each movement that could take place pursuant to § 236.1029(b)(6) if the movement potentially could exceed 500 miles.

§236.1015(e)(2)(i) Reliably execute functions in 236.1005

Reliably perform the functions stated in

236.1005 when employing a vital overlay PTC system

§236.1015(e)(2)(ii) Sufficient documentation to demonstrate as built fulfills SACs

Compliance required with 49 CFR 236 Appendix C, risk assessment may be abbreviated as defined in Subpart H.

§236.1015(f) Adequate data regarding safety impacts of proposed changes

The FRA may consider reliability and availability data in determining if the PTCSP adequately complies with section 236.1015(d). In any case, where the PTCSP lacks adequate data regarding safety impacts of the proposed changes, the Associate Administrator may request the necessary data from the applicant. If the requested data is not provided, the Associate Administrator may find that potential hazards could or will arise.

Version 3.0 19 December, 2, 2022

Requirement

Description of Regulatory Requirement PTCSP Section / Chapter Reference

§236.1015(g) PTC system replacing an existing PTC system provides same level of safety as old version

When replacing existing certified PTC system: a PTCSP establishes with a high degree of confidence that the new system will provide a level of safety not less than the level of safety provided by the system to be replaced.

N/A

§236.1015(h) Potential data error identification and mitigation

Potential Data Errors: PTCSP must include a careful identification of each of the risks and a discussion of each applicable mitigation. In an appropriate case, such as a case in which the residual risk after mitigation is substantial or the underlying method of operation will be significantly altered, the Associate Administrator may require submission of a quantitative risk assessment addressing these potential errors.

§236.1017(a) Supported by independent 3rd party assessment

The PTCSP must be supported by an independent third-party assessment when the Associate Administrator concludes that it is necessary…

§236.1019(f) MTEA, RR must certify that no changes have been made to PTCIP previously approved

Main Line Track Exceptions: No PTCSP— filed after the approval of a PTCIP with an MTEA—shall be approved by FRA unless it attests that no changes, except for those included in an FRA approved RFA, have been made to the information in the PTCIP and MTEA required by paragraph (b) or (c) of this section.

Version 3.0 20 December, 2, 2022

Requirement

Description of Regulatory Requirement PTCSP Section / Chapter Reference

§236.1021(a)(1) No changes as defined by this section to a PTCSP shall be made unless:

No changes, as defined by this section, to a PTC system, PTCIP, PTCDP, or PTCSP, shall be made unless the railroad files a request for amendment (‘‘RFA’’), and per §236.1021(a)(2) the RFA is approved by the Associate Administrator.

1.4

§236.1023(a) PTCPVL PTCPVL 4

§236.1023(b)(1) All contractual relationships with hardware and software vendors

Specify all contractual arrangements with hardware and software suppliers or vendors for immediate notification between the parties of any and all safety-critical software failures, upgrades, patches, or revisions, as well as any hardware repairs, replacements, or modifications for their PTC system, subsystems, or components.

§236.1023(c)(1) Procedures for actions when notified of safety critical failure

Specify the railroad’s process and procedures for action upon their receipt of notification of safety-critical failure, as well as receipt of a safety-critical upgrade, patch, revision, repair, replacement, or modification.

§236.1023(c)(2) Configuration management to ensure safety isn’t compromised as a result of a change

Identify configuration/revision control measures that are designed to ensure the safety-functional requirements and the safety-critical hazard mitigation processes are not compromised because of any change and that such a change can be audited.

Version 3.0 21 December, 2, 2022

Requirement

Description of Regulatory Requirement PTCSP Section / Chapter Reference

§236.1023(e) After in service, RR shall maintain database of all safety-relevant hazards

After PTC is in service, a database of safety-relevant hazards occurring in the system is to be maintained. If occurrence of a hazard exceeds a threshold limit, reporting shall be performed as per this regulation.

§236.1023(e)(3) Take prompt counter measures to reduce the number of safety-relevant hazards…

…take prompt counter measures to reduce or eliminate the frequency of the safety-relevant hazards below the threshold identified in the PTCSP.

§236.1023(j) When safety-critical PTC system fails to perform, RR shall take appropriate action

When any safety-critical PTC system, subsystem, or component fails to perform its intended function, the cause shall be determined and the faulty product adjusted, repaired, or replaced without undue delay. Until corrective action is completed, a railroad shall take appropriate action to ensure safety and reliability as specified within its PTCSP.

§236.1027(a) Role of Office Automation Systems

Any office automation system that performs safety-critical functions or directly controls the movements of a train in a PTC system is subject to the requirements of Subpart I

§236.1027(c)(4) Primary train control systems cannot be integrated with locomotive electric system unless included in the PTCDP and PTCSP

Primary train control systems cannot be integrated with locomotive electronic systems unless the complete integrated systems…Are included in the approved and applicable PTCDP and PTCSP.

UTA FrontRunner locomotive electronic systems are independent from E-ATC systems

Version 3.0 22 December, 2, 2022

Requirement

Description of Regulatory Requirement PTCSP Section / Chapter Reference

§236.1029(a)

Specify actions to ensure proper logging and correction of failures

Any failures in PTC equipment must be identified, logged, corrected, and normal service restored without undue delay.

Actions to accomplish this are to be specified in the PTCSP.

§236.1029(b)

En route failures When any safety-critical PTC System component fails to perform its intended function…., a railroad shall take appropriate action as specified in its

PTCSP.

In general. * * * Until repair of such essential components is completed, a railroad shall take appropriate action as specified in its PTCSP.

§236.1029(c) Exception for alternative system failure procedure.

Deviation of operational procedures for en route failures

§236.1031 Previously approved PTC systems

Previous approval or recognition of a train control system may be credited towards safety case

N/A

§236.1031(e) Previously approved PTC system differing significantly

To the extent that the PTC system proposed for implementation under this subpart is different in significant detail from the system previously approved or recognized, the changes shall be fully analyzed in the PTCDP or PTCSP, as would be the case absent prior approval or recognition.

5.2

Version 3.0 23 December, 2, 2022

Requirement

Description of Regulatory Requirement PTCSP Section / Chapter Reference

§236.1033(e)(2)

Security information to protect data

All wireless PTC communications must be protected by cryptographic means to assure message integrity and authentication as described in the PTCSP.

§236.1033(f) Service restoration and mitigation plan

Each railroad, or its vendor or supplier, shall have a prioritized service restoration and mitigation plan for scheduled and unscheduled interruptions of service. This plan shall be included in the PTCDP or PTCSP as required by §§ 236.1013 or 236.1015, as applicable.

§236.1037

Records retention Identified PTC-related records shall be maintained by the railroad as per regulation at designated location(s) on the railroad. Occurrence of hazards and incidents must be reported and corrective action taken.

§236.1039

Operations and Maintenance Manual

All documents specified in the PTCDP and PTCSP related to operations and maintenance shall be located in one manual readily available to personnel required to perform such tasks.

§236.1041 Training and qualification program

Training program for PTC personnel and competencies

§236.1043(a) Training Structure and Delivery The Employer shall, at a minimum…identify the specific goals of the training program…

Version 3.0 24 December, 2, 2022

Requirement

Description of Regulatory Requirement PTCSP Section / Chapter Reference

§236.1043 Task Analysis and basic requirements

Training structure and training records 14

§236.1045

Training Specific to Office control Personnel

Any person responsible for issuing or communicating mandatory directives in territory where PTC systems are or will be in use shall be trained in the following areas, as applicable…Instructions concerning the interface between the computer-aided dispatching system and the train control system…

§236.1047 Training for operating personnel

Training for locomotive engineers and conductors

§236.1049 Training specific to Roadway Workers

Training requirements specific to roadway workers

Appendix B Risk assessment criteria The risk metric for the proposed product must describe…risk … over the designated life cycle of the product.

Appendix A1

Appendix C

Safety assurance criteria and processes

Safety principals to be followed or explained in PTCSP

Appendix A1

Appendix C(b)(4)

SACs The product design must include one or more of the following Safety Assurance Concepts as described in IEEE–1483 standard …

Appendix A1

Version 3.0 25 December, 2, 2022

Requirement

Description of Regulatory Requirement PTCSP Section / Chapter Reference

Appendix C(b)(5)

Human factors engineering The product design must sufficiently incorporate human factors engineering that is appropriate to the complexity of the product…

Version 3.0 26 December, 2, 2022

1.4 Update of…