PB96-917008NTSB/SIR-96/05

NATIONALTRANSPORTATIONSAFETYBOARD

WASHINGTON, DC 20594

SPECIAL INVESTIGATION REPORT

STEAM LOCOMOTIVE FIREBOX EXPLOSIONON THE GETTYSBURG RAILROADNEAR GARDNERS, PENNSYLVANIAJUNE 16, 1995

Illlr.

6768

Abstract: On June 16, 1995, the firebox crownsheet of Gettysburg Passenger Services, Inc.,steam locomotive 1278 failed while the locomotive was pulling a six-car excursion train about15 mph near Gardners, Pennsylvania. The failure resulted in an instantaneous release (explosion)of steam through the firebox door and into the locomotive cab, seriously burning the engineerand the two firemen.

This accident illustrates the hazards that are always present in the operation of steamlocomotives. The Safety Board is concerned that these hazards may be becoming moresignificant because Federal regulatory controls are outdated and because expertise in operatingand maintaining steam locomotives is diminishing steadily.

As a result of its investigation, the National Transportation Safety Board issued safetyrecommendations to the Federal Railroad Administration, the National Board of Boiler andPressure Vessel Inspectors, and the Tourist Railway Association, Inc.

The National Transportation Safety Board is an independent Federal agency dedicated to promotingaviation, railroad, highway, marine, pipeline, and hazardous materials safety. Established in 1967,the agency is mandated by Congress through the Independent Safety Board Act of 1974 toinvestigate transportation accidents, determine the probable causes of the accidents, issue safetyrecommendations, study transportation safety issues, and evaluate the safety effectiveness ofgovernment agencies involved in transportation. The Safety Board makes public its actions anddecisions through accident reports, safety studies, special investigation reports, safetyrecommendations, and statistical reviews.

Information about available publications may be obtained by contacting:

National Transportation Safety BoardPublic Inquiries Section, RE-51490 L'Enfant Plaza, SWWashington, DC 20594(202) 314-6551

Safety Board publications may be purchased, by individual copy or by subscription, from:

National Technical Information Service5285 Port Royal RoadSpringfield, Virginia 22161(703) 487-4600

STEAM LOCOMOTIVE FIREBOX

EXPLOSION

ON THE GETTYSBURG RAILROAD

NEAR GARDNERS, PENNSYLVANIA

JUNE 16, 1995

SPECIAL INVESTIGATION REPORT

Adopted: November 15, 1996Notation 6768

NATIONALTRANSPORTATION

SAFETY BOARD

��������� � �����

iii

EXECUTIVE SUMMARY ........................................................................................................... v

INTRODUCTION ......................................................................................................................... 1

INVESTIGATION

Accident .......................................................................................................................................... 3

Train Damage.................................................................................................................................. 6

Gettysburg Passenger Services........................................................................................................ 9

Personnel Information ................................................................................................................... 10

Engineer ................................................................................................................................. 10

First Fireman .......................................................................................................................... 10

Second Fireman...................................................................................................................... 11

Helper Engineer ..................................................................................................................... 11

Training.................................................................................................................................. 11

Delineation of Duties ............................................................................................................. 12

Train and Equipment Information................................................................................................. 12

Locomotive 1278 ................................................................................................................... 12

Boiler Information.................................................................................................................. 13

Cab Equipment and Arrangement.......................................................................................... 14

Locomotive Maintenance Records......................................................................................... 18

Postaccident Inspections, Tests, and Research.............................................................................. 19

Crownsheet Failure ................................................................................................................ 19

Water Glass ............................................................................................................................ 19

Water-Glass Blowdown ......................................................................................................... 24

Gage Cocks ............................................................................................................................ 26

Boiler-Water Behavior ........................................................................................................... 26

Boiler-Water Supply System.................................................................................................. 29

Water Treatment .................................................................................................................... 30

Boiler Washing ...................................................................................................................... 31

Low-Water Devices ............................................................................................................... 32

Oversight and Regulation of Steam Locomotives......................................................................... 33

Regulation and Oversight.......................................................................................................35

Industry Efforts ...................................................................................................................... 37

CONTENTS

iv

ANALYSIS

General .......................................................................................................................................... 39

Investigation .................................................................................................................................. 40

Water-Monitoring Devices..................................................................................................... 40

Water-Glass Lighting and Conspicuity.................................................................................. 41

Water Treatment .................................................................................................................... 42

Boiler Washing ...................................................................................................................... 42

Feed Pump and Gage .............................................................................................................43

Malfunctioning Check Valve ................................................................................................. 43

Injector ................................................................................................................................... 44

Water-Glass and Gage-Cock Testing..................................................................................... 44

Delineation of Responsibilities .............................................................................................. 44

Hours of Service..................................................................................................................... 45

Training.................................................................................................................................. 45

Progressive Crown-Stay Failure............................................................................................. 46

Steam-Locomotive Maintenance Expertise ........................................................................... 46

CONCLUSIONS ......................................................................................................................... 48

PROBABLE CAUSE .................................................................................................................. 49

RECOMMENDATIONS ............................................................................................................ 50

APPENDIXESAppendix A—Investigation and Sworn Testimony Proceeding ................................................... 53Appendix B—Abbreviations Used in this Publication ................................................................. 55

v

About 7:20 p.m. on June 16, 1995, thefirebox crownsheet of Gettysburg PassengerServices, Inc., steam locomotive 1278 failedwhile the locomotive was pulling a six-carexcursion train about 15 mph near Gardners,Pennsylvania. The failure resulted in aninstantaneous release (explosion) of steamthrough the firebox door and into thelocomotive cab, seriously burning theengineer and the two firemen. The firemenwere taken by ambulance to area hospitals.The engineer, who had third-degree burnsover 65 percent of his body, was airlifted toa burn center near Philadelphia. None of the310 passengers or other crewmembers wereinjured. Locomotive damage was limited tothe firebox grates and crownsheet, withsome ancillary smoke and debris damage tothe locomotive cab.

Investigators found that the crownsheetfailed from overheating because the train-crew had allowed the water in thelocomotive boiler to drop to a level that wasinsufficient to cover the crownsheet. Whenthe investigators examined the locomotivecomponents closely, they found that theboiler and its associated equipment had notbeen maintained well enough to ensure safeoperation and that some repairs had beendone incorrectly. Investigators determined

that the deficiencies were the result of a lackof the specialized knowledge, skills, andtraining necessary to properly maintain asteam locomotive. It was further determinedthat those operating the locomotive did notunderstand the full scope of their duties anddid not coordinate their efforts to ensure thehighest degree of safety.

The National Transportation SafetyBoard determines that the probable cause ofthe firebox explosion on steam locomotive1278 was the failure of GettysburgPassenger Services, Inc., management toensure that the boiler and its appurtenanceswere properly maintained and that the crewwas properly trained.

Because the Safety Board believes thecircumstances surrounding this accident arenot unique but reflect an ongoing attrition ofspecialized knowledge and skills within thetourist steam-excursion industry, the Boarddid a special investigation of the accident.As a result of its investigation, the SafetyBoard makes seven recommendations to theFederal Railroad Administration, threerecommendations to the National Board ofBoiler and Pressure Vessel Inspectors, andfour recommendations to the TouristRailway Association, Inc.

EXECUTIVE SUMMARY

1

At about 7:20 p.m. on June 16, 1995, thecrownsheet of Gettysburg Passenger Serv-ices, Inc., steam locomotive 1278 failedwhile the train was pulling a six-car excur-sion train about 15 mph near Gardners,Pennsylvania. The failure caused fire andsteam to be explosively released through thefirebox door into the locomotive cab, seri-ously burning the engineer and two firemen.The engineer suffered third-degree burnsover 65 percent of his body. None of the 310passengers or the other crewmembers wereinjured.

The cause of this accident was deter-mined to be the failure of the train operatingcrew to maintain a water level in the loco-motive boiler that was sufficient to cover thecrownsheet. Because of the inadequate waterlevel, the crownsheet overheated and weak-ened. When it weakened, it could no longerwithstand the pressure of the steam above it.The pressure forced a section of the crown-sheet to pull away from its staybolts andcollapse inward; the staybolt holes in thecollapsed section then exposed superheatedwater and steam in the boiler to the atmos-pheric pressure of the firebox. With the sud-den reduction of pressure in the boiler, thesuperheated water flashed instantaneouslyand explosively into steam. The investiga-tion of this accident revealed that those re-sponsible for maintaining, repairing, andoperating locomotive 1278 lacked the spe-cialized training and experience that havelong been judged to be prerequisites for thesafe operation of steam-locomotive equip-ment.

Approximately 150 steam locomotivesare still operated in the United States bymore than 82 organizations. Virtually all ofthem are used by tourist railroads, museums,historical groups, and steam-excursiongroups. Although there are no exact figuresabout how many people ride steam-locomo-tive trains each year, the Tourist RailwayAssociation, Inc., (TRAIN) estimates thatapproximately 4.8 million people, or theequivalent of 12 percent of Amtrak’s annualintercity ridership for 1995, visit touristrailways, museums, and excursion opera-tions annually. A significant number of thesepeople ride trains pulled by steam lo-comotives. According to Gettysburg Pas-senger Services officials, about 50,000 peo-ple rode Gettysburg Passenger Servicessteam trains in 1994—and this is only one ofmore than 80 organizations belonging toTRAIN that use steam-excursion trains.

This accident illustrates the hazards thatare always present in the operation of steamlocomotives. The Safety Board is concernedthat these hazards may be becoming moresignificant because Federal regulatory con-trols are outdated and because expertise inoperating and maintaining steam locomo-tives is diminishing steadily. The SafetyBoard believes that the reasons for the ex-plosion on locomotive 1278, especiallythose reasons having to do with deficienciesin steam-locomotive maintenance and op-erations, may not be unique.

INTRODUCTION

2

Because of its concern about the safety ofpassengers and crews on steam trains, theSafety Board conducted a special investiga-tion of the Gettysburg Passenger Services,Inc., accident and developed recommenda-

tions to address inadequacies it found inregulations, standards, and certification re-quirements regarding steam-locomotive in-spection, maintenance, and operation.

3

Accident

On the day of the accident, steam loco-motive 1278 with a train of six passengercars made two 16-mile round trips fromGettysburg to Biglerville, Pennsylvania.About 6:00 p.m., as a “dinner train,” itstarted its third and last trip of the day. It leftGettysburg with 310 passengers for a roundtrip to Mount Holly Springs, Pennsylvania,where the passengers were to have a catered2-hour dinner in local restaurants before theyreturned to Gettysburg.

After the train left Gettysburg, the co-owner and operator of Gettysburg PassengerServices, Inc., (Gettysburg Passenger Serv-ices) closed the Gettysburg station and fol-lowed the excursion train. The purpose ofher “chase” by automobile (she would meetthe train at road crossings) was to provide acontingency service to the train and, if nec-essary, limited emergency transportation.She carried a cellular telephone and a two-way radio that she used to monitor and talkto the crew. Her husband, the locomotiveengineer, also carried a radio and cellularphone. The conductors and passenger-serv-ice personnel on the train had two-way ra-dios.

When the dinner train left Gettysburg, itpassed a Gettysburg Railroad freight train.1

It was routine procedure for the GettysburgRailroad freight-train locomotive to act as ahelper.

1All the equipment used by Gettysburg PassengerServices, Inc., (Gettysburg Passenger Services) isleased from Gettysburg Railroad.

Near Aspers, Pennsylvania (MP 15, “theWolf Pit”), the dinner train stopped andwaited to receive the helper train, whichconsisted of a diesel-electric locomotivepulling four freight cars. It took severalminutes to couple the helper to the rear ofthe dinner train, after which the combinedconsist proceeded. (See figure 1.)

According to testimony, a check valve (aone-way valve) between the feed-waterheater pump (feed pump)2 and the boiler hadbeen leaking all day, even though the valvehad recently been repaired. On a previoustrip that day, when locomotive 1278 wasrunning backward next to a double-tiered,open-air observation passenger car, the sprayfrom the leaking check valve necessitatedclearing the first half of the car.Consequently, according to the firstfireman,3 when the train left Wolf Pit thefeed pump was shut off. He said,

We shut [the feed pump] off wheneverwe started up Wolf Pit because [thecheck valve] was putting water on thetrack and [the locomotive drivers4]slipped. But as soon as we weremoving, [the feed pump] was turnedback on.

2The feed-water heater is a heat exchanger located inthe front of the steam locomotive, usually in thesmokebox. Cylinder exhaust steam is used to pre-heatwater from the tender before the water is pumped intothe boiler. This boosts energy efficiency and lowersfuel usage.3The fireman tends and stokes the fire in the boiler’sfirebox.4The drivers are the wheels that propel the loco-motive.

INVESTIGATION

4

The second fireman5 testified that whenhe relieved the first fireman at Gardners,6

the feed pump was still turned off. Thesecond fireman said he then turned the feedpump on “all the way.” When the firemenwere later asked how they could tell whetherthe feed pump was working, they both indi-cated that the sound and visual movement ofthe feed-pump rod told them the feed pump

5It was the policy of Gettysburg Passenger Services tohave two firemen on the dinner train trip because thetrip was an extended one.6The firemen did not agree in their testimony aboutwhere the transfer of responsibility took place. Therewas no clear transfer of duty. To some extent, eachwas acting in the capacity of fireman between PondRoad and Gardners.

was working. Both firemen felt such cueswere sufficient to ensure that water wasflowing into the boiler. Safety Boardinvestigators agreed that the feed pump cancontinue to move with little or no waterflow.

Both firemen stated that they checked thewater glass7 frequently during the trip. The

7The water glass, also called the “sight glass” and“water gage,” is a device that enables an enginemanor fireman to observe the height of the water in alocomotive boiler. It consists of two brass fittingsscrewed into the back head, one above the other, andconnected by a stout glass tube or a metal frame inwhich a glass is inserted which communicates,through the fittings, with the water and steam in theboiler. The water level showing in the glass is thesame as that water level inside the boiler.

Figure 1. Key locations.

5

first fireman stated that he “always” watchedthe water glass. The second fireman said hechecked it “once every 5 minutes or so.” Healso said the engineer leaned back in his seatto check the glass about three times duringthe trip. Neither fireman noted anything un-usual about the level of water in the glass.They said that the level appeared to benormal and that it appeared to fluctuateabout a half to a full inch, a fluctuation theyconsidered normal, considering the grade ofthe track and the vibrations.

At Pond Road, MP 18, the secondfireman relieved the first. About a mile later,at Gardners, while the train was movingabout 15 mph, the firebox explosionoccurred. According to the first fireman:

We got to the top of the grade and lev-eled off and…we had a normal waterreading, had plenty of steam.8 I got upabout 30 seconds before the crown-sheet9 failed. I got up to put coal in thecorners, because it’s an automaticstoker,10 and it fans [the coal] so itwon’t hit the corners, and I decided towait until we got across the crossing

:$GECWUG" QH" VJG" NQECVKQP" QH" VJG" YCVGT" INCUU." KVKPFKECVGU"VJG"NGXGN"QH"YCVGT"KP"VJG"DCEM"QH"VJG"DQKNGT0#U"C" UVGCO" NQEQOQVKXG"CUEGPFU"C"ITCFG."YCVGT" HKNNUVJG"DCEM"GPF"QH"VJG"DQKNGT."ECWUKPI"VJG"YCVGT"INCUU"VQKPFKECVG"VJCV"VJG"DQKNGT"JCU"OQTG"YCVGT"VJCP"KV"FQGU0;6JG"OGVCN"UJGGV"QT"RNCVG" VJCV" HQTOU" VJG"TQQH"QH" VJGHKTGDQZ0" 6JG" ETQYPUJGGV" KU" PQTOCNN[" EQXGTGF" YKVJYCVGT"VQ"C"FGRVJ"QH"CV"NGCUV"5"VQ"6"KPEJGU0"$GECWUG"VJGETQYPUJGGV" KU" GZRQUGF" VQ" KPVGPUG" JGCV" QP" QPG" UKFGCPF" KU" EQXGTGF"YKVJ"YCVGT" QP" VJG" QVJGT." VJGTG" KU" CXKQNGPV"HQTOCVKQP"QH"UVGCO"QP"KVU"UWTHCEG0"6JKU"UVGCODWDDNGU" VQ" VJG" UWTHCEG" QH" VJG" YCVGT" CPF" HKNNU" VJGUVGCO"URCEG"DGVYGGP"VJG"UWTHCEG"QH"VJG"YCVGT"CPF"VJGVQR"QH"VJG"DQKNGT032#P"CWVQOCVKE"UVQMGT"KU"C"UVGCO/RQYGTGF"CWIGT"VJCVOQXGU" EQCN" HTQO" VJG" VGPFGT" VQ" VJG" HKTGDQZ0" 6JGHKTGOCP"EQPVTQNU"VJG"URGGF"QH"VJG"CWIGT"CPF"VJGTGHQTGVJG"COQWPV"QH"EQCN"FGNKXGTGF"VQ"VJG"HKTGDQZ0

and up around the bend before westarted up the next grade. [The secondfireman] took the fireman’s seat, and Idecided against…putting coal in. So, Iwent to the door and waved to all thepeople at the crossing. And about 5seconds later is when we had the acci-dent.

Well, [when] the crownsheetfailed…it just sounded like a muffled.22 [rifle] pop. I instinctively turnedtowards the noise….I remembergetting hit with—it just got darkbecause of all the soot and the smokein the cab. And I remember feelingintense heat and thinking…I’ve got toget out of here. I jumped outand…yelled at [the engineer’s wife] tocall 911. And then I thought about [theengineer], and I started back up justpast [the other fireman]. I knew he[the second fireman] was all rightthen, because I saw him. He waslimping, but I knew he was all right.Then I went up to find [the engineer]and found him on the other side of thetrain lying there. And he asked for [hiswife]. So I ran back and got [her]. Andshe handed me the phone, and Ifinished the 911 call.

The second fireman testified:

[The first fireman] stepped down tofire the back corners of the firebox,and I told him to take a break and I’dtake over firing, which, I guess, gave atime span of about 5 minutes from thatpoint until the explosion. There waslike an initial poof sound, but thenthere was like a second explosion,which is what jarred the fire doorsopen and dumped everything back intothe cab. All the steam and a lot of thecoal just blew back into the cab. Wehad the feed pump on and had the

6

stoker on. I shut the stoker and thefeed pump down. And at first, just notknowing where everything wascoming from, I jumped forward in thecab between the boiler and the outsidewall of the cab to try to get away fromit. After about 10 or 15 seconds, Irealized it wasn’t getting any better,and that’s when I came back to theseat. And you couldn’t see anything asfar as the doorway or anything. So,that’s when I climbed up on the seatand jumped out the window. Almostimmediately after the explosion, [thefirst fireman] went out the doorway.And to my knowledge…[the engineer]apparently stayed on until it stopped.

According to the helper engineer, theengineer applied the air brakes. A conductorannounced on the radio, “Emergency! Stop!Stop! Stop!” When the train stopped, theengineer managed to get down out of thelocomotive cab by himself and lie on theground. He was then helped by the firemenand other members of the traincrew.Ambulances arrived minutes later.

The firemen were taken by ambulance toarea hospitals. The first fireman, who hadimmediately left the locomotive cab by thedoorway, had second- and third-degreeburns over 10 percent of his body. He wasinitially taken to the hospital in Gettysburgand was later transferred to York,Pennsylvania, for a week. His recovery tookabout 1 1/2 months.

The second fireman also had second- andthird-degree burns on his legs, arms, andchest and had fractured his legs when hejumped through the locomotive cab window.

He was hospitalized for several weeks andhad extensive therapy for his shoulder.

The engineer was airlifted to Crozer-Chester Medical Center, a burn center nearPhiladelphia. He had third-degree burns over65 percent of his body. He spent the next 6months undergoing multiple surgeries andextensive therapy and was still undergoingtherapy and follow-up surgery 9 monthslater. None of the passengers or othercrewmembers were injured.

Train Damage

A postaccident inspection of locomotive1278 revealed that the firebox was the onlyarea to sustain major damage. (See figures 2,3, and 4.) The crownsheet toward the frontof the locomotive next to the rear tube-sheetknuckle11 had bulged downward a maximumof about a foot in a “bag” shape that coveredan area encompassing about 60 crown stays.The crownsheet holes around the crownstays had been deformed and elongated,creating gaps about the crown-stay heads.The crownsheet knuckle next to the fluesheet had a 6-inch tear. Also, two front (nearthe flue sheet) right firebox grate panels ofthe firebox floor had broken and fallen ontothe ashpan below.

It is not possible to estimate the monetarycost of the accident. Because each steamlocomotive is unique and because very fewfacilities can do major repairs for a steamlocomotive, there are no flat rates forrepairs. Instead, the repair facility estimatesthe price of each repair on a cost plus basis.

336JG"TGCT"VWDG/UJGGV"MPWEMNG"KU"VJG"VQR"EQTPGT"QH"VJGHKTGDQZ" YJGTG" VJG" JQTK\QPVCN" ETQYPUJGGV" OGGVU" VJGXGTVKECN"VWDG"UJGGV0

n! t

---

Kaae=

2—

—

—_

__

——

____

-m

mw

u-*

——

—-

_

_

7

8

Figure 4. Bag in crownsheet.

Costs vary extensively from facility tofacility.

Gettysburg Passenger Services

Gettysburg Passenger Services is anoutgrowth of the steam-powered excursionservices begun on the Gettysburg Railroadin June 1978. The Gettysburg Railroad is ashortline freight railroad that connects CSXat Gettysburg with Conrail at CarlisleJunction, a distance of 23.7 statute miles. In1986, the owner of Gettysburg Railroadformed Gettysburg Passenger Services torun the excursion service of GettysburgRailroad, and he transferred ownership ofGettysburg Passenger Services to his sonand daughter-in-law.

The son and his wife were responsible forhiring and supervising the company’s em-ployees, and the son was also primarily, if

not solely, responsible for the care and op-eration of the excursion equipment—in-cluding the steam locomotives. His respon-sibilities included maintaining and testingsteam locomotive 1278 in accordance withthe Federal Railroad Administration’s(FRA’s) regulations. (The FRA’s regula-tions are recorded in 49 Code of FederalRegulations [CFR] Part 230). He was alsothe primary engineer of locomotive 1278,and he was operating the locomotive at thetime of the accident.

In 1994, Gettysburg Passenger Servicescarried about 50,000 passengers. It leasedtrack and equipment, including steam loco-motives and passenger cars, from Gettys-burg Railroad. Gettysburg Passenger Serv-ices and Gettysburg Railroad shared loco-motive-maintenance facilities and sometraincrew personnel. Gettysburg Railroaddiesel-electric locomotives frequently dou-

9

10

bled as helpers or backup relief for the ex-cursion service. The two companies ac-counted separately for labor, services, equip-ment, and supplies.

Personnel Information

Engineer--At the time of the accident, theengineer was 48 years old. He had obtainedmost of his knowledge of railroad andsteam-locomotive operation while growingup. He said he had been surreptitiouslyallowed to be the fireman on PennsylvaniaRailroad locomotives near his home startingwhen he was about 15 years old. His fatherbegan developing a steam tourist railroad inBlairsville, Pennsylvania, in 1959, whichbecame fully operational in 1964. The fathertestified that his son had first officiallystarted running a steam locomotive when hewas 18 years old, receiving instruction fromprofessional railroaders. The engineer toldSafety Board investigators that he had hadno formal railroad or steam-locomotivetraining.12

Between 1978, when Gettysburg Railroadhad started its steam-powered excursionservice, and the time of the accident, theengineer had been the primary operator ofthe steam locomotives. He was also theprimary servicer, maintainer, and repairer ofthe locomotives and cars; however, hecontracted out work that required specializedskills and/or tools or was beyond routinemaintenance or the capability of one or twopeople. He did many of the jobs himselfwith little or no assistance. The FRArequires that a form No. 1 be signed afterroutine maintenance, such as washing the

34(QTOCN" VTCKPKPI" KU" FGHKPGF" CU" ENCUUTQQO" CPF1QTVTCKPKPI"CRRTQXGF"D["UQOG"CWVJQTKV[0

boiler and cleaning the spindles,13 has beendone on a locomotive. The person who signsthe form is certifying the work has beendone. The owner must keep the forms on filefor FRA review. The engineer signed all theforms having to do with the accident lo-comotive.

According to his wife, the engineer hadhad a routine day up until the time of theaccident. He had started work at 6:45 a.m.,done the necessary pre-trip work, madeexcursion trips at 11:00 a.m. and 1:00 p.m.,and finished about 3:00 p.m., more than 8hours after he had started. After a 2-hourbreak, he reported back for the dinner train,about 5:00 p.m.

First Fireman--The first fireman, age 18,who fired the locomotive from the time thedinner train left Gettysburg until the crossingat Gardners, had been employed byGettysburg Passenger Services since 1992.At the time of the accident, he was a studentworking full time for the excursion servicewhile on summer break.

He had had no prior railroad experience,and his training as a steam-locomotivefireman had been on the job (OJT). He hadbeen trained by the engineer, by one otherfull-time employee, and, to some extent, bythe fireman with whom he was working atthe time of the accident. He described histraining as consisting of observation,demonstration, and then performance.

He said he was well rested on the day ofthe accident. From 7:30 a.m. to 3:30 p.m., orfor about 8 hours, he had worked on

356JG"URKPFNG."CNUQ"ECNNGF" VJG"KURWF.L" KU" VJG"RTQDG/NKMG"RKRG" VJCV"GZVGPFU" HTQO" VJG"YCVGT"INCUU" KPVQ" VJGDQKNGT0" +V" KU" VJG" EQPPGEVKQP" VJTQWIJ" YJKEJ" YCVGTTGCEJGU"VJG"YCVGT"INCUU0

11

building an earthen ramp with a backhoe.After 3:30, he took a break until about 5:00p.m., when he reported for the dinner train.

Second Fireman--The second fireman, 32,was a full-time supervisor at a local industry.He had worked for Gettysburg PassengerServices for 5 years as a part-time fireman.Like the first fireman, he had had noprevious railroad experience and was givenOJT, principally by the engineer. As afireman, he had made about 50 trips eachseason during his first 3 years and about“two dozen” in the 2 years preceding theaccident.

On the day of the accident, he arrived atthe engine house at about 5:00 p.m., afterworking a full day at his regular job.

Helper Engineer--The helper engineer, 21,started railroading in 1989 as a part-timesummer employee with Gettysburg Passen-ger Services, firing locomotive 1278. He hadhad no previous railroad experience andtook OJT from the engineer. After graduat-ing from high school, he became the onlyfull-time train crewmember with GettysburgPassenger Services other than the engineer.When the helper engineer was 18, the engi-neer taught him how to operate diesel-elec-tric locomotives, as well as steam locomo-tives. During the off season, when the touristtrain did not make excursions, he helped theengineer maintain the locomotives and cars.

He testified that his normal hours were7:30 a.m. to 4:00 p.m. On the day of theaccident, he said, he came to work at theregular time, “worked freight” from 7:30a.m. to 12:30 p.m., and worked in the trainyard from 12:30 p.m. to 3:30 p.m., for a totalof about 8 hours. He then went home for abreak, reporting back for helper duty at 5:30p.m. He said he followed the excursion train

“about 15 or 20 minutes behind” until WolfPit.

Training--According to the engineer’swife, the company had started a formaltraining program “2 years ago.” The trainingconsisted of classroom and hands-on train-ing and included showing a safety film fromTourist Railway Association, Inc., (TRAIN),followed by a question-and-answer period.The engineer taught the course, which lasted4 or 5 hours, once a year, before the start ofthe tourist season. Although the companydid not keep attendance records, all the em-ployees attended the course. Employees in-terviewed by Safety Board investigatorsstated that they had a training session sometime in April 1995.

Gettysburg Passenger Services did nothave a formal program for training orcertifying an engineer as qualified, nor wasit required to have one. The company wasable to meet the FRA’s definition ofcertifying an engineer (49 CFR 2430.101) byfilling out a generic, American Short LineAssociation, fill-in-the-blank document andsending it to the FRA.

Beyond the recent pre-season trainingdescribed above, each Gettysburg PassengerServices employee described his or hertraining as being OJT typified by watchingothers do the work, demonstrating the abilityto do the work, and then performing thework in the context of day-to-day operations.The company did not use training records,task lists, tests, or other training organizationor documentation papers. Training wasrandom, based on the day’s operations. Theemployees were not taught regulatoryrequirements, standardized industrypractices, or the theory of steam-boileroperation. Such training is not required.

12

Delineation of Duties.--The following ex-change with the first fireman took placeduring his testimony:

Q: Who was operating the feed pumpmost of the time during the trip?

A: That would have been me.

Q: Would you say you were the onerunning the feed pump all the time onthat trip?

A: Not all the time. We had twofiremen. Two firemen.

Q: But was your role the lead firemanthat day?

A: I would not—we don’t have a leadfireman. We have [others] here toback everyone up.

Q: What I meant by that was, wasthere an agreement between you and[the second fireman] that you woulddo most of the duties and he wouldback you up, or vice versa?

A: No.

Q: So you had a kind of division inresponsibilities, but it wasn’t clearwho exactly was in charge of thefireman’s duties?

A: Well, no. There’s—we both arecompetent firemen. We both knowwhat we are doing.

The second fireman, referring tooperation of the feed pump, testified asfollows:

Q: When you and [the first fireman]were sharing the duties, had youactually turned the feed pump onyourself in the few minutes—I mean,on that leg of the trip just before theincident, you had relieved [the firstfireman], more or less?

A: Yes.

Q: So you were acting as kind of thefireman—

A: Yes.

Q:—in charge?

A: (Shrugs shoulders)

Q: So, when the two of you wereworking together, you had a clearunderstanding of who would do what,who would be responsible for what?

A: Pretty much. But I basically left itup to him. I was there to give him abreak and such.

Train and Equipment Information

Locomotive 1278--Canadian LocomotiveCompany, Ltd., in Kingston, Ontario,Canada, built locomotive 1278 for theCanadian Pacific Railway in April 1948.The locomotive had a 4-6-214 “Pacific”wheel arrangement15 and was designed forpassenger service. Its cylinders were 20 by28 inches; boiler pressure was 250 psi; anddriver diameter was 70 inches. It weighed234,000 pounds, with 151,000 pounds ondrivers, and had 34,000 pounds of tractiveeffort. Its cab had side doors and was anenclosed all-weather, or winter-type, cab.(See figure 5.)

369J[VGIU"U[UVGO"QH"UVGCO/NQEQOQVKXG"ENCUUKHKECVKQP0+P" VJKU" U[UVGO." PWOGTCNU" CTG" WUGF" VQ" TGRTGUGPV" VJGPWODGT"QH"YJGGNU"KP"GCEJ"ITQWR"QH"YJGGNU0"6JG"HKTUVPWODGT"FGPQVGU"VJG"PWODGT"QH"YJGGNU"KP"VJG"NGCFKPIVTWEM=" VJG" UGEQPF." VJG" PWODGT" QH" FTKXGTU=" CPF" VJGVJKTF."VJG"PWODGT"QH"YJGGNU"KP"VJG"VTCKNKPI"VTWEM037%QOOQP"YJGGN"CTTCPIGOGPVU"QHVGP"VQQM"QP"PCOGU.YJKEJ"YGTG"WUWCNN["CUUQEKCVGF"YKVJ" VJG"RNCEG"YJGTGVJG"CTTCPIGOGPV"QH"VJG"YJGGNU"QTKIKPCVGF0

Figure 5. Locomotive 1278.

The locomotive had had a variety ofowners and operators. In May 1965, theCanadian Pacific Railway sold the lo-comotive to a man in New Hampshire. In1969, he donated it to Steamtown, a railroadmuseum then located at Bellows Falls,Vermont, and it was renumbered 127. FromJune 1970 to August 1971, it was leased tothe Cadillac & Lake City Railroad in LakeCity, Michigan, as locomotive 127. InSeptember 1971, it was returned to BellowsFalls and renumbered 1278. In 1984, it wasmoved, along with Steamtown, to Scranton,Pennsylvania. In June 1987, GettysburgRailroad bought the locomotive and leased itto Gettysburg Passenger Services.

Boiler lnformation-According to form No.4, locomotive 1278 had a radial-stay,straight-bottom, wagon-top boiler with three

courses, or diameters. 16 The boiler wasconstructed of three connected rings orcourses of different diameters. The lowesttensile strength of the steel was 72,100 psifor the first course, 80,030 for the secondcourse, and 70,840 for the third course. Thecrownsheet was 3/8 inch thick when new.The water space at the firebox back was 31/2 inches. The firebox grate was 45.6 feetsquare. The lowest level of water in theboiler that the water glass could indicate wasa level 3 1/8 inches above the highest pointof the crownsheet. The height of the lowest

16Form No. 4 is a steam-locomotive boiler specifi-cation document required by the FRA in 49 CFR230.54. Gettysburg Railroad had only one form No.4, the one that had been filed by the Cadillac &Lake City Railroad, a lessee of the locomotive. TheFRA does not require a form No. 4 to reflect theactual condition of the boiler in its present configu-ration or to be completed or submitted by a qualifiedperson.

13

14

gage cock17 above the crownsheet was 3 1/4inches.18

In accordance with Canadian Pacificpolicy, the crown stays, which supported thecrownsheet from the boiler roof sheet,19

were alternating rows of straight-thread andbutton-head crown stays. (See figures 6 and7.) The first five rows from the rear tube-sheet knuckle (next to the tubes and flues)were straight-thread crown stays followed byrows of button-head crown stays. The boilerhad been made that way so that if thecrownsheet failed because it was not coveredby water, it would be pushed off the straight-thread crown stays first. Consequently, al-though the crownsheet would buckle, itwould be retained for a time by the button-head crown stays. Thus, if the crownsheetfailed because of too little water, the failurewould occur progressively and in stages,rather than instantaneously and catastrophi-cally.20 Other than being designed to make afailure a progressive, rather than an instanta-neous, event, the boiler did not have anylow-water protection devices.

Cab Equipment and Arrangemen t--The cabof locomotive 1278 surrounded the backhead

17Gage cocks are used as a backup system for thewater glass.18The gages are positioned so that the lowest readingon the gage will indicate more than 3 inches of waterover the crownsheet, which is the minimum asrequired by 49 CFR 230.37.19The outer boiler shell above the crownsheet.20Note that (1) such a failure wil l still, as in thisaccident, be very sudden and “explosive” and (2) noconstruction method will prevent a catastrophicfailure, although it may attenuate the damage.

of the boiler.21 (See figure 8.) A number ofdevices, including gages and the water glass,were mounted on the backhead. The back-head was also the location of the back of thefirebox and the firebox door. Below thefirebox door was the automatic stoker-augerentrance used to deliver coal to the firebox.The backhead had a number of washoutplugs.22 The engineer’s seat was to the rightside of the boiler and slightly to the rear ofthe backhead. Similarly, the fireman’s seatwas along the left side of the boiler.

On the engineer’s side of the cab were theair-brake controls and gages, throttle lever,reverser (valve cut-off control), boiler-pres-sure gage, injector operating lever,23 thethree gage-cock operating handles, and anumber of other accessory controls, handles,and levers. On the fireman’s side of the lo-comotive cab were a number of gages andcontrols for managing the boiler and steamproduction. Three gages—stoker jet-pressuregage, steam-heat pressure gage, and feed-pump pressure gage—had been removedfrom a mounting plate on the fireman’sside,24 leaving only a stoker-engine steam-pressure gage and a boiler-pressure gage.(See figure 9.)

21The backhead is the rearmost boiler sheet, which islocated in the cab.22Boiler designers incorporate a minimal butnecessary number of washout plugs in a boiler toensure that it can be thoroughly washed and cleanedof the sediment that contributes to scale.23The injector is a device for forcing water into asteam boiler. A jet of steam imparts its velocity to thewater and thus forces it into the boiler against theboiler pressure. The injector on locomotive 1278 wasof the liftin g type, which is generally used when thelocomotive is standing still.24The missing gages were identified from aphotograph of locomotive 1278 taken several yearsbefore this accident.

Radial

ater

Section

I

Button Head Crown Stay

W a t e r

Figure 6. Radical stay boilers and stays. 15

Roof Sheet of Boiler

/ — “ - — - —-— - — — .~- —

Firebox

—-— -

Knuckle/

---—.II

I

1

Figure 7. Alternating pattern of stays.

Figure 8. Backhead.

The engineer to ld Safety Board like the injector, could be adjusted to allow ainvestigators that he removed the original variable amount of water into the boiler, orfeed-pump gage after it failed and that when none when the feed pump was turned off.the replacement also failed, he had decidednot to replace it. The turret also provided steam to a

number of other auxiliary devices, includingA fireman uses the feed-pump pressure the dynamo. The dynamo was a steam-

gage to ensure that heated feed water is turbine-powered generator for theovercoming boiler pressure and is flowing locomotive headlight, cab lights, and water-into the boiler. The gage provides a direct glass light. At the time of the accident, theindication that water is entering the boiler dynamo was connected to the turret, but thewithout the fireman looking at the water dynamo governor and the governor cap wereglass. At the time of the accident, a missing, rendering the dynamo inoperative.distinctive pentagon-shaped brass control A portable gasoline-powered generator thatknob with “feed-water pump” cast into it sat on the tender provided the power for thecontrolled the feed pump. Steam was headlight. In violation of the FRA’s re-delivered from the boiler through the left quirements (49 CFR 230.42), the water glassturret, or distributing valve, to the feed did not have a working light. There were nopump via the control knob. The feed pump, working cab lights.

17

19

of service for 6 months, from November 1,1994, to May 1, 1995.

Postaccident Inspections, Tests, andResearch

Crownsheet Failure--The following, takenfrom the October 1943 Railway MechanicalEngineer, a respected industrial publicationof the time, describes what happens whenthe crownsheet is not sufficiently covered bywater:

The flames and hot gases in a loco-motive firebox at a temperature offrom 1500 °F to 2500 °F heat the fire-box sheets27 which, while covered bywater, remain at about the temperatureof the water. This temperature is de-pendent on the steam pressure in theboiler, and is in the neighborhood of400 °F. If, however, sufficient water isnot at all times present to keep thefirebox sheets at the proper tempera-ture, the sheets become overheated.Firebox steel when heated becomesslightly stronger until about 500 °F isreached, after which the strength fallsoff very rapidly until at 1600 °F thesteel has lost about 85 percent of itsstrength at normal temperatures. Atsome stage during this overheating,the strength of some part of the boiler,usually the crownsheet,28 becomes lessthan that required to withstand theload of steam pressure, and rupture

496JG" HKTGDQZ" UJGGVU" CTG" VJG"OGVCN" KPVGTKQT"YCNNU" QHVJG"HKTGDQZ."YJKEJ"CTG"JGCVGF"FKTGEVN["HTQO"EQODWU/VKQP"QH"VJG"EQCN."YQQF."QT"QKN04:6JG" HTQPV" UGEVKQP" QH" VJG" ETQYPUJGGV." YJKEJ" KUCVVCEJGF" VQ" VJG" TGCT" VWDG/UJGGV" MPWEMNG." WUWCNN[" KP/EWTU" VJG" KPKVKCN"QXGTJGCVKPI"DGECWUG" KV" KU" VJG"JKIJGUVRQKPV" KP" VJG"ETQYPUJGGV"CPF" VJGTGHQTG" KU" VJG" HKTUV" VQDG"WPEQXGTGF"YJGP"VJG"YCVGT"NGXGN"FTQRU0

occurs. The force of the resulting ex-plosion is in proportion to the size andthe suddenness of the rupture, and thetemperature and amount of water inthe boiler. At the instant the steam isreleased from the boiler, the water inthe boiler flashes into steam until aheat balance is effected. This steam,generated so instantaneously, occupiesa space vastly greater than that occu-pied by the water in the boiler—per-haps 1500 or 2000 times as great. Theterrific rush of the steam to occupythis greater space often tears the boileroff the locomotive frame and results inrocket-like behavior of the boiler.

The FRA requires that “every boiler beequipped with at least one water glass andthree gage cocks” (49 CFR 230.37). In otherwords, each steam locomotive is required tohave two independent systems to monitorthe level of water in the boiler. The rationalefor having redundant systems is that if onefails, there will be another to prevent lowwater and a resulting explosion. The twosystems for monitoring boiler water are thewater glass and the gage cocks. The FRAalso requires that every steam locomotivehave two independent and redundantsystems for supplying the boiler with water:the injector system and the feed-pumpsystem.

Water Glass--The water glass is the pri-mary means for the engineer and fireman tomonitor the water level in the boiler. (Seefigure 10.) Mounted on the backhead of theboiler, the water glass is a vertical glass tubethat shows the level of water in the boiler.

Toward front of Band Steam loco

I

(

motiveTopWater Glass !

II

I

C-:- AI... \/-t. ,- —1

Steam Area200 Psl

——====..— ————j_+—————————.

Bottom ~—=—~=~~‘ — _ — ——

I

————————.—— —-—”.———~.—_. ———_—__ — —————=-—.———————_————’==————--——.’=-’==-==

! Drain Valve

*

I&

Figure 10. Typical water glass.

20

21

The FRA requires that “the lowestreading that the water glass shows shall notbe less than 3 inches above the highest partof the crownsheet” (49 CFR 230.37). Conse-quently, as long as the water glass shows awater level, the crownsheet is covered by atleast 3 inches of water at all times if thelocomotive is on level terrain, and somewhatless if the locomotive is going downhill.According to form No. 4 for locomotive1278, the lowest level of water in the boilerthat the water glass could indicate was atleast 3 1/8 inches above the highest part ofthe crownsheet.

The water level in the water glass willfluctuate somewhat in response to trackconditions, vibrations, and such conditionsas a surge of water in the boiler caused bystarting or stopping the train. An experi-enced enginecrew can still accurately esti-mate the level of water in the boiler by not-ing the midpoint between the maximum andminimum changes in the indicated waterlevel in the water glass. Some steam loco-motives are equipped with dampeners thatsmooth out the water-level movement in thewater glass in an attempt to provide a moreaccurate, if not instantaneous, indication ofthe boiler’s true water level. The accidentlocomotive did not have a dampener.

The accident firemen testified that thefluctuation in the water glass was about 1/2inch up or down. Neither fireman tookexception to this amount of movement, andboth indicated that such movement wasnormal. One industry expert29 stated that

29Several steam-locomotive experts were involved inthe investigation. Two, the chief mechanical officersof the Strasburg Railroad and The Valley RailroadCompany, were brought into the investigation byGettysburg Passenger Services. Two others, the cu-rator of transportation for the Smithsonian Institutionand a representative of Combustion Engineering ofTeaneck, New Jersey, are recognized authorities in

such limited fluctuation “clearly indicates aproblem with the glass” and that normalfluctuation is as much as 4 inches ± 2inches. The expert further said he believedthat a water-level movement of only 1/2 inch“is a serious indication of an obstructedglass.”

The locomotive cab was covered in ash,dust, and small cinders from the explosion.Therefore, it was not possible to determinethe conspicuity of the water glass before theaccident. The light for the water glass wasinoperative; the wiring appeared to havebeen grounded for some time. According toFRA regulations (49 CFR 230.42, “WaterGlass Lamps”), all water glasses must have alamp that is located in such a way that theengineer can easily see the water in theglass. The firemen indicated that they carriedno light source, such as a flashlight, withwhich to check the water glass. The secondfireman said that at night the crew used thecab lights powered by the gasoline generatoron the tender and that they had an electriclantern that sat on the floor by either theengineer’s or the fireman’s seat.

The water glass had a protective glasscovering, or shield, as the FRA required (49CFR 230.41), to stop pieces of flying glass ifthe water glass broke; however, the coveringwas also covered with debris from thefirebox explosion, making it difficult to readthe water glass with any accuracy. Theshield was subsequently removed for furthertests. The water-glass system was dis-assembled and inspected. (See figure 11.)

the field of steam-locomotive boilers and mechanics.All four are referred to as experts for the purposes ofthis report.

Figure 12. End view of plugged spindle.

According to the regulations, the boilermust be washed once a month and thespindles must be reamed. When asked if theamount of scale found in the spindles couldhave accumulated between monthlycleanings, one steam-locomotive expert said,“No, no possible way.” Another said, “Ihave never seen a locomotive that had asmuch scale inside the water-glass spindle asthe 1278. I worked on a lot of locomotivesall over the country and never saw anythinglike this.” The chief mechanical officer(CMO) of the Strasburg Railroad speculatedthat in such a restricted condition, thespindles would be much more susceptible tobeing blocked by floating material or scaleflake. The investigators were unanimous intheir conviction that the amount of scalefound in the spindles could not possiblyhave accumulated within the relatively shorttime between monthly boiler washings,

regardless of the condition of the water used.(See figure 13.)

The water glass itself was a glass tubeabout 12 inches long and 1/2 inch in di-ameter. Running the length of the glass wasa 1/4-inch-wide faded red background linethat was barely visible. The diameter of thebore (about 1/8 inch) appeared smaller thanthe 3/8-inch bore with which the inspectorswere more familiar. They consideredwhether a smaller bore would be moresusceptible to some form of capillary actionor to being plugged by lose scale (either ofwhich could yield a false reading). However,after they examined and tested the glass,they decided the diameter of the bore wasacceptable. (See figure 14.)

Safety Board investigators used a flexibleclear plastic hose to measure the response of

23

Figure 13. Plugged spindle after removal.

the water in the water glass to changes in thelevel of water in the boiler and to determinehow visible the water level in the water glasswas to the cab’s occupants. The water-glasssystem was reassembled in order to conductthis test. The water level was changed bymoving the hose attached to the boiler tap,thus simulating water-level changes in theboiler. The changes appeared immediately inthe water glass, and the water-glass systemappeared to function as designed under thesenon-pressure, non-operating conditions.

Wafer-Glass Blowdown-One of the basictasks an engineer and fireman must be ableto perform is to “blow down,” or verify thatthe water glass and the spindles are notblocked or restricted. According to the FRA(49 CFR 230.40), “All water glasses must beblown out and gage cocks tested before each

trip.” However the regulations do notprescribe the blow-down procedure.

The National Board Inspection Code ofthe National Board of Boiler and PressureVessel Inspectors (NBBPVI) is recognizednationally by the CFR as an AmericanNational Standard and internationally asANSI/NB-23. According to that code, theproper method of blowing down a waterglass is as follows (from Chapter II part I-204.3, “Water Level Gage [SteamBoilers]”):

The inspector should ensure that thewater level indicated is correct byhaving the gage tested as follows:

a. Close the lower gage glass valve,then open the drain cock and blow theglass clear.

24

Figure 14. Water-glass tube.

b. Close the drain cock and open thelower gage glass valve. Water shouldreturn to the gage glass immediately.

c. Close the upper gage glass valve,then open the drain cock and allow thewater to flow until it runs clear.

d. Close the drain cock and open theupper gage glass valve. Water shouldreturn to the gage glass immediately.

If the water return is sluggish, theoperation should be repeated. Asluggish response could indicate anobstruction in the pipe connections tothe boiler. Any leakage at thesefittings should be corrected to avoiddamage to the fittings or a falsewaterline indication.

Although 49 CFR 230.40 requires thatwater glasses be blown down, the procedure

for doing so is not given or specified in anyapplicable Federal rules. Nor are any otherrules of the National Board Inspection Codeapplicable by law or regulation to steamlocomotives not governed by the NationalBoard Inspection Code. The GettysburgPassenger Services employees did not haveany reference materials that explained theproper method of blowing down a waterglass,

When Safety Board investigators askedthe first fireman to demonstrate the propermethod of blowing down the water glass, hefailed to demonstrate the correct method.Similarly, the second fireman failed to showand explain the proper method. He said hehad had no formal training on blowing downthe water glass, but that he had been shownhow to do it. When the helper engineer wasasked to describe the blow-down procedure,

25

26

he said, “Open the bottom valves on thesight glass, and it blows steam through theglass to clean it.” He also said this was notto check the validity of the glass but “justthe drain.” No crewmember was officiallyresponsible for knowing the approvedmethod of blowing down the water glass.The owner of Gettysburg Railroad (the en-gineer’s father) and a Gettysburg PassengerServices employee who was qualified asboth a steam-locomotive fireman and an en-gineer were each asked to explain anddemonstrate how they would go aboutblowing down and verifying the water glass.Only the owner demonstrated the correctmethod. Neither the accident engineer northe firemen knew how to properly validatethe water glass.

Gage Cocks--Mounted near the engineer’sseat are three gage cocks that tap into thebackhead of the boiler at various levels. Thecocks are a backup system for the waterglass and help ensure that water ismaintained over the crownsheet. To checkthe water level, the engineer opens one ofthe gage cocks. Theoretically, if water drainsfrom the valve, the engineer is assured thatthe level of water over the crownsheet is atleast as high as the gage cock is. This maynot always be the case if there is a falsehead, which will be explained later. As withthe water glass, the lowest gage cock ismounted at least 3 inches above the highestpoint of the crownsheet. The height of thelowest gage cock on locomotive 1278 was 31/4 inches above the crownsheet.

Removing the three gage cocks revealedthat the lowest cock was totally obstructedby deposits and that the middle cock washalf obstructed. Only the highest cock wasclear of restrictions. The accident firemenstated that they did not test the gage cocks

and did not know whether the engineer everdid.

Boiler-Water Behavior--Since the waterglass and gage cocks are redundant, theyshould indicate the same water level.However, depending on the arrangement andmaintenance of the boiler-water-monitoringequip-ment, this may not be the case.

In the early part of the century, a numberof locomotive boilers exploded in locomo-tives that had only gage-cock monitoringsystems. Consequently, the Bureau of Lo-comotive Inspection of the Interstate Com-merce Commission (ICC) launched an in-vestigation in 1919. The Bureau conducted anumber of tests and documented the move-ment of boiler water around the firebox, asdiscussed below.30

Upon entering the boiler, water from thetender is relatively cool and dense. Thewater moves from the front and lower partsof the boiler, which are “colder,” to the“hot” rear and top of the boiler, which arewarmer because they are around the firebox,where the heat is generated and where thegreatest exchange of heat takes place. Whenthe water is heated, it rises as its densitydecreases. As the water finally migratesaround the sides and back of the firebox,water heating and movement are greatlyaccelerated, and steam bubbles begin toform and rise to the surface. This rapidmovement upward creates momentum andan upwelling of water above and along theoutside of the crownsheet. The upwelling ofwater is most rapid at the firebox rear,especially between the door sheet and thebackhead, creating a standing head of water

524CKNYC["/GEJCPKECN"'PIKPGGT."8QN0";6."0Q0"32."R08520

27

(a false head) above the crownsheet rearwhere the gage cocks are installed.

Depending upon the placement andlength of the pipes leading from the gagecocks into the boiler, the false head maycause the gage cocks to indicate that thewater level over the crownsheet is higherthan it actually is. Thus, while the gagecocks may indicate plenty of water, in realitythere may be little or no water over thecrownsheet. Consequently, gage cocks areproblematic when used by themselves andquestionable as long-term redundant devicesfor a water glass. Because of thisdocumented phenomenon, the United StatesRailroad Administration’s Committee onStandards adopted the water column as arecommended practice in February 1920.

The water column is a small cylindricaldevice that is connected to the boiler inmuch the same fashion as a water glass;however, the water column is really aplatform on which to mount a water glassand three gage cocks. (See figures 15 and16.) The water column has a limiteddampening effect and prevents the high levelof water (false head) in the back of the boilerfrom being falsely indicated by the gagecocks as the true water level. Thisarrangement ensures that the water glass andthe gage cocks indicate the same and a truewater level.

Steam-locomotive maintenance literaturestates that maintenance has a significant ef-fect on water-monitoring devices, particu-larly the water glass. If the spindles that leadfrom the boiler to the water-monitoring de-vices are not clean, the water-level indica-tion may be false. When steam locomotiveswere in common use, the standard practicewas to clean the interior of the spindles,water glass/water column body, gage cocks,and associated piping of scale with a reamer

or drill sized to fit the interior diameter ofthe pipe or component. The reaming restoredthe parts to their original condition.

FRA regulations imply that unless thegage-cock pipes are periodically cleaned, thepipes may become so plugged by scale thatwater is unable to pass through them and thegage cocks, as a result, might inaccuratelyindicate a low level of water in the boiler. Atfirst, it might seem that indicating that thewater level is lower than it actually is wouldnot be a problem. If the enginecrew thoughtthat there was less water in the boiler thanthere actually was, they might increase thewater flow to a boiler that already hadenough water. Raising the level of water inthe boiler unnecessarily is not necessarilydangerous, but it is not efficient and couldincrease the chance of incompressible waterentering a cylinder (called “working wa-ter”31) and causing a cylinder head to beblown off.

When water-glass spindles becomeprogressively encrusted with scale, un-predictable and unreliable indications mayresult. As moving water at the boilerbackhead moves past one or both spindleorifices of the water glass, a slight pressuredrop is created. Normally, this has little orno effect on the height of the column ofwater in the water glass; however, shouldone or both spindle orifices become partiallyclosed off by the gradual buildup of scale,the height of the column of water in thewater glass may be affected, depending onthe location and extent of the buildup.

535KPEG"YCVGT"KU"CP"KPEQORTGUUKDNG"NKSWKF."CP["YCVGTVJCV" OKIJV" GPVGT" VJG" E[NKPFGTU" OKIJV" FCOCIG" VJGE[NKPFGTU"QT"DGPF"C"FTKXG"TQF0

Water Glass .(reflect type)

Bottom WaterGlass valve —

/

/

/.;.;

Steam Area200 Psi

Toward Front of Boilerand Steam locomotive

uper Helater

ated

Figure 15. Drawing of water column.

28

valves at the top or bottom of the water glassare not completely open, the result againmay be a falsely high water-level indication.

According to a leading mechanical engi-neer and recognized boiler expert with ABBCombustion Engineering, several crown-sheet failures occurred in England duringWorld War II because the water-glass spin-dle valves were only partially open. TheEnglish crews of U.S. Army 2-8-O locomo-tives were unaware that the top valve of the

water glass had to be completelyopen. Partially opened valves re-sulted in the water glass showing awater level that was higher than theactual water level in the boiler. Thecrownsheets became overheated,and explosions occurred. Thoselocomotives, like the accidentlocomotive, had one water glassand one set of gage cocks.

Boiler- Water Supply System-Theinvestigators also examined thedevices used to supply water to theboiler. Two types of water-supplys ystems are used on steamlocomotives: the injector systemand the feed-water system. Moststeam locomotives have both sys-tems, but older steam locomotivesmay have two injector systems in-stead. Locomotive 1278 had bothsystems. The injector and feed-water systems can be usedseparately or together and can actas backups for each other; how-ever, the injector system functionsmore efficiently when the loco-motive is standing, while the feed-water system functions more effi-ciently when the locomotive is

The boiler-water supply system consistsof (in order of flow) treated or untreatedwater from the tender, strainers in the tenderand delivery hose, the feed-water heater (ifthe locomotive has one), the feed pump orthe injector(s) with their respective checkvalves to prevent pressure backup, and twostop valves to shut off leaking check valves.

The injector pumps unheated waterdirectly from the tender into the boiler,heating it in the process. The feed pump

29

30

supplies water to the boiler indirectlythrough the feed-water heater. The feed-water heater is a heat exchanger that absorbsheat from used cylinder exhaust steam that isotherwise lost up the exhaust stack. Thefeed-water heater is more efficient when thelocomotive is moving because there is moreexhaust heat and steam.

The engineer controls the injector with aknob on his side of the cab. The firemancontrols the feed-water system with a pump-control valve that is on his side of the cab.After the accident, the injector was foundclosed, and the feed-pump control valve wasfound open 1 1/2 turns. The amount of waterthese devices supply to the boiler dependson boiler demand, so their valve control orknob positions do not indicate whether asufficient amount of water is being provided.It is therefore critical for the fireman toclosely monitor the water glass and/or gagecocks.

After the accident, the CMO of theValley Railroad at Essex, Connecticut,examined the injector of locomotive 1278and reported:

Upon entering the cab of thelocomotive…I found that the turretvalve for the injector was shut off.Later on the next day, the steam valveof the injector itself was disassembledto see if any problem could be found.Upon disassembly, it was found thatthe steam valve disk inside the injectorwas not the correct steam valve diskfor that model injector. The Edna TypeL liftin g injector has to prime to getwater up into the body of the injector.To do that, the steam valve disk has aprotrusion on the end of it whichallows when opened just a little bit ofsteam to come by that protrusion and

enter the annular nozzle, which createsa vacuum which raises the water. Thedisk that we found inside the 1278’sinjector did not have that protrusion.Therefore, when the steam valve wasopened, it would be very difficult toprime the injector. If a lifting injectorcannot prime, it cannot operate. Now,it’s possible that the injector mightfunction, but only with somedifficulty.

According to their testimony, none of thetrain crewmembers were aware of the needfor a specific disk type in the injector.

Water Treatment--Water used in boilers isfrequently treated with chemicals andprocesses to minimize the buildup of scaleinside the boiler and inside all the otherdevices that come in contact with the steamand boiler water. Treating the water alsoreduces corrosion and maximizes heattransfer. Water-monitoring and -supplysystems are dependent on the free flow ofwater and do not work correctly if theboilers and their attached devices are notfree of scale. Thus the cleanliness of theboilers and devices has safety implications.

Depending on the source of the water, itcan be softened shortly before it is put intothe tender, or it can be treated while it is inreservoirs and holding tanks. Safety Boardinvestigators explored the nature of watertreatment used by Gettysburg PassengerServices.

During testimony, the investigator fromGettysburg Passenger Services was asked ifthe company had water-treatment facilities.He replied:

Well, I saw some evidence of watertreatment. There were some emptycontainers around. But we saw no

31

evidence of a regular program inplace. And by a regular program, Imean a written procedure for doing ananalysis of the boiler water every day,recording, testing the water every dayfor the presence of oxygen, pH, howmuch hardness is in the water, theconductivity of the water, how muchstuff is in there. Typically, whatpeople do is they test for these thingsevery day, they record it on a chart andthen make a determination of thechemicals based on what’s in theboiler that day to correct whateverdeficiency there is in the water. Andwe found no evidence of thatwhatsoever.

The owner of Gettysburg Railroad said:

I noticed that [the accident engineer]had put a water softener in severalyears ago to soften the water due to[the fact] that Gettysburg has very,very hard water to work with. I will goa little further. When we first come toGettysburg, we were foolish enough toleave water sit in that engine about 2months. It cost us to have the boileracid cleaned. So, he put the watersoftener in.

According to testimony, the accidentengineer sent boiler and/or supply watersamples to the Water Chemical Services(Water Chem) of Aberdeen, Maryland32 fortesting. However, Water Chem has norecord of dealing with Gettysburg PassengerServices except for filling an order for 100pounds of sodium tri-phosphate, asuspension agent that was delivered May 19,1995, less than a month before the accident.

546JKU"EQORCP["YCU"OKUKFGPVKHKGF"CU"K9CVGT"%JGOK/ECN"%QORCP[L"FWTKPI"VGUVKOQP[0

The engineer told Safety Board investigatorsin a postaccident interview that heperformed his own water testing with a kit,much like that used for swimming pools. Hestated that he kept a journal of the watertesting that he performed. No test resultswere found or provided.

Boiler Washing--The interior of a boiler iswashed to minimize scale buildup in orderto ensure that the boiler and its devicesoperate safely and efficiently. According toFRA regulations (49 CFR Part 230.45,“Time of Washing”):

All boilers shall be thoroughly washedas often as the water conditionsrequire, but not less frequently thanonce each month. All boilers shall beconsidered as having been incontinuous service between washoutsunless the dates of the days that theboiler was out of service are properlycertified on washout reports and thereport of inspection.

Locomotive 1278 had 29 washout plugs,and the FRA regulations (49 CFR 230)require that all washout plugs be removedwhen a boiler is washed. The regulationsalso require that special attention be given toremoving scale on arch and water bar tubesand that a record be kept of all washing (49CFR 230.46 and .230. 48, respectively).Since a boiler wash and inspection are bothrequired monthly, they are usually recordedand filed together on a form No. 1.

The FRA regulations do not specify whatconstitutes a proper washing. The railroadindustry has long had detailed methods andspecial equipment for boiler washing. In1915, the American Railroad Administration(ARA) adopted a recommended practice forboiler washing that included a number ofrecommended designs for boiler wash

32

nozzles. The Advisory Mechanical Com-mittee, Equipment Engineering Department,of the C&O Railway, the Erie Railroad, theNickel Plate, and the Pere Marquette Rail-way issued Standard Maintenance Equip-ment Instructions #105 on August 3, 1936,for boiler washing and blow down. InNovember 1995, the members of TRAIN, inan effort to promote safe steam-locomotiveoperation, sponsored seminars on the propermethod of boiler washing.

During his testimony, the first firemandescribed how he washed the boiler oflocomotive 1278 by himself:

You take the four plugs out. In theboiler under—by the firebox, there’s aplug in the right-hand side and on theleft-hand side up front, and there’s twoin the back, both sides. You take thoseout. There’s three plugs along the topin the cab right above the fireboxdoors. You take them out and then youwash the boiler out. You run—wehave, I believe it’s a 2-inch hose thatwe run through it. We wash it to thepoint where we get no sediment outanymore and the water is clear.

The CMO of the Strasburg Railroad inPennsylvania summarized how a steam-locomotive boiler should be washed out:

Take out all the washout plugs, andessentially that’s any plug in the boilerthat allows access into the boiler. Andwhen you do that, then basically weuse a hose to try and get the highestpressure we can. And we go to eachwashout hole, and we attempt to washall surfaces, the interior surfaces of theboiler. And that’s more or less diffi-cult depending upon the design of thelocomotives. Our little locomotive has34 washout plugs on it. Our biggest

locomotive has 17. It was just the waythe locomotive was built according tothe railroad specifications. So you justwash it as thoroughly as you can andwash the stuff basically from the topdown, from the front [to] back, collecteverything in the mud ring, then useyour four corner plugs to wash thatstuff out of there. And you make aspecial attempt to rattle your archtubes, which is a mechanical cleaningprocess.

The CMO was asked whether he thoughtthe boiler in locomotive 1278 had beenrecently washed out. He replied:

It could have been; I don’t know. Ihave never seen a locomotive thatblew up before, so I don’t know whateffect that had on things. It had a lot ofscale in it. It had a lot more scale thanI would like to see in a boiler if thatboiler was in service at Strasburg.

Low-Water Devices--During the investi-gation, the Safety Board explored theavailability of devices that can prevent orwarn of low water or mitigate the effects ofsuch a condition. Research revealed that therailroad industry has over the yearsdeveloped several such devices.

Low–Water Alarms-–Railroad industrymanufacturers and suppliers developed a va-riety of devices that warned that the level ofwater in the boiler was too low. The deviceswarned engine crewmembers before theboiler exploded or the crownsheet burned.Low-water alarms were made by the NathanManufacturing Company of New York, theOhio Injector Company of Illinois, and theBarco Manufacturing Company, Inc. Someof the alarms used floats while others de-tected abnormal expansion and/or tempera-ture. Once activated, the alarm signaled the

33

cab crew, using a warning whistle that con-tinued to blow until the level of water in theboiler rose or a crewmember reduced theheat of the crownsheet by releasing the firein the firebox into the ashpan.

There was and is no Federal requirementthat steam locomotives have low-wateralarms. Opinions about the effectiveness oflow-water alarms do and did vary widelyamong steam-locomotive experts of todayand railroad officials from the days of steam.Depending on the sensitivity of the alarm,locomotive crews were known to treat thealarm as a nuisance and muffle the whistle.Mechanical employees found the alarms tobe an additional burden and expense tomaintain. Some railroads favored low-wateralarms; others did not. Some steamlocomotives still operating are equippedwith low-water alarms.33 Locomotive 1278had no low-water alarm.

Fusible Plugs--The crewmembers cannottamper with fusible plugs, also called “drop”plugs, as they can with low-water alarms.Fusible plugs consist of a short, pipe-shapedbrass body that is screwed into the crown-sheet at specified locations. (See figure 17.)Within the brass body is a brass plug held inplace by a ring of fusible alloy metal thatsoftens or melts at temperatures between500 and 575 °F. Once the crownsheetreaches the critical temperature, the ringmelts and allows the brass plug to fall intothe firebox, allowing steam to spray the fire,attracting the crew’s attention, and relievingsteam pressure. Depending on the number

55-GPVWEM[" 4CKNYC[" /WUGWO" UVGCO" NQEQOQVKXG0Q0374." C" 3;27" 4QIGTU" 6/8/4." KU" GSWKRRGF" YKVJ" C0CVJCP"NQY/YCVGT"CNCTO0

and placement of the plugs, the activationmay continue, effectively preventing perma-nent damage or an explosion, but at the sametime disabling the locomotive. Once fusibleplugs have been activated, the locomotivemust be taken to a maintenance facility forrepair. This disadvantage makes fusibleplugs, like low-water alarms, controversial.As with low-water alarms, the use of fusibleplugs varied widely, depending on the rail-road.

Federal regulations do not require the useof fusible plugs but do require that if theplugs are used, they must be maintained.According to the FRA’s regulations (49CFR 230.14, “Fusible Plugs”):

If boilers are equipped with fusibleplugs they shall be removed andcleaned of scale at least once everymonth. Their removal must be notedon the report of inspection.

Locomotive 1278 did not have fusibleplugs.

Oversight and Regulation of SteamLocomotives

Observers have long recognized thedangers inherent in employing steam topower industry and transportation. In 1863,British Royal Astronomer George B. Airycalculated that at a pressure of only 60 psi,every cubic foot of boiler water has the samedestructive energy as a pound of (black)gunpowder.34

56#KT[.")0"$0."K1P"VJG"0WOGTKECN"'ZRTGUUKQP"QH"VJG&GUVTWEVKXG" 'PGTI[" KP" VJG" 'ZRNQUKQP" QH" 5VGCO$QKNGTU" CPF" +VU" %QORCTKUQP" YKVJ" VJG" &GUVTWEVKXG'PGTI["QH")WPRQYFGT.L"2JKNQUQRJKECN"/CIC\KPG."4854;/558"*3:85+0

35

The first steam-locomotive boiler ex-plosion occurred on June 17, 1831, when theSouth Carolina Railroad’s Best Friend ofCharleston blew up because a man annoyedby the sound of the safety valve sat on it toprevent it from hissing. Boilers continued toblow up or fail for a variety of reasons,including poor construction and/or design.With the introduction of the firebox into theboiler, however, the most spectacular anddeadly forms of failures have been those thathave resulted from a crownsheet that hasbeen overheated and weakened because of alow level of water in the boiler—as in thisaccident.35

Regulation and Oversight--The types ofboil-er explosions that could affect thepublic were regulated quickly and early.Congress passed a steamboat inspection lawin 1838 after the steamboat Moselle blew up,killing 300 people. The first State boiler-inspection law went into effect in 1867 inNew York after stationary boiler explosionsin the 1850s killed scores of people.Historically, the public risk from steam-locomotive boiler explosions has beenminimal. Unlike steamboat- and stationary-boiler explosions, generally the only peopleaffected by steam-locomotive boiler ex-plosions have been, as in this accident, thetrainmen and enginecrew. Consequently, itwas not until 1909 that the first bills toregulate locomotive safety were introducedin Congress.36

Specifics of the locomotive safety bill,such as the provision requiring waterglasses, were supported by labor and

57#NFTKEJ." /CTM." K5CHG" CPF" 5WKVCDNG" $QKNGTU<" 6JG4CKNTQCFU." VJG" +PVGTUVCVG" %QOOGTEG" %QOOKUUKQP.CPF".QEQOQVKXG"5CHGV[."3;22/3;67.L"6JG"4CKNYC["(.QEQOQVKXG" *KUVQTKECN" 5QEKGV[." +PE0." 4CKNTQCF*KUVQT["%393."#WVWOP"3;;6058+DKF0

opposed by the railroads. The railroads’greatest objections were to provisions thatrequired government inspection but leftresponsibility for safety and accountabilityfor accidents solely with the carrier railroad.Finally, a compromise was reached. Anamended version of locomotive inspectiondropped requirements for specific safetydevices and no longer required directgovernment inspection. Instead, the carrierswere required to file inspection rules withthe ICC and to do their own inspections. Thegovernment inspectors only spot checkedand oversaw the process and investigatedaccidents. Essentially, this level of oversightremains in effect today, with the FRA, ratherthan the ICC, taking the regulatory role. Thebill that required “Railroads to equip theirlocomotives with safe and suitable boilersand appurtenances thereon” was passed onFebruary 17, 1911, and became law 4months later. Federal inspection started withfiscal year 1912.37

There are now three sources of boilerregulation and oversight in the UnitedStates, one of them private and the other twogovernmental. Insurance companies are theprivate source. The insurers, such as theHartford Steam Boiler Inspection &Insurance Company, the insurer in thisaccident, will generally inspect a boiler todetermine whether it is safe enough to beinsured and, if so, at what risk level.However, the insurer is not required toinspect. Although the Hartford Steam BoilerInspection & Insurance Company insured

595JQTVN[" VJGTGCHVGT." QP" /CTEJ" 3:." 3;34." 5QWVJGTP2CEKHKE"NQEQOQVKXG"926"GZRNQFGF"KP"VJG"5CP"#PVQPKQ.6GZCU."[CTFU."UGPFKPI"CP":/VQP"RKGEG"QH"DQKNGT"OQTGVJCP" 3.422" HGGV" CPF" MKNNKPI" 48" GORNQ[GGU" CPFKPLWTKPI"54"OQTG0"6JKU"YCU"VJG"FGCFNKGUV"GZRNQUKQP"KPVJG"JKUVQT["QH"TCKNTQCFKPI0

36

the accident locomotive, it never inspectedit.

Some local and most State governmentsregulate, inspect, and license the operationof stationary boilers, such as those used inheating and power plants, but generally notsteam-locomotive boilers. This is primarilybecause the FRA already has regulatoryauthority over steam locomotives. Stateboiler inspectors may, however, be respon-sible for steam-locomotive boilers operatedon railroads that do not fall under FRAjurisdiction, such as small tourist lines notconnected to the railroad interchange sys-tem. Steam railroads that are not regulatedby the FRA are not required to file a formNo. 4. The FRA has discussed bringingthese lines under its jurisdiction.

As discussed above, the Federalregulations involving steam locomotives arefound in 49 CFR Part 230. This title is nolonger published each year as the rest of theCFR is, but must be requested separatelyfrom the FRA or other sources. Most of thestandards, specifications, and procedures in49 CFR Part 230 are from earlier railroadindustry standards or early regulations of theICC and date from between 1912 and 1916.The last major revision of the material wasin 1946, long before the FRA was created(1966) and the Rail Safety Act of 1970 waspassed.

FRA Responsibility--Generally, FRAmotive power and equipment (MP&E)inspectors inspect a steam-locomotive boileronly if the locomotive’s owner files for anextension of the 4-year boiler-and-flue-tubeinspection required by 49 CFR Part 230.10.At that time, the FRA inspector must inspectthe boiler; but otherwise, boiler inspection islargely a self-certifying process, with theFRA checking to make sure that required

inspection forms are filed according to theregulations--in the 1912 tradition set by theICC. The FRA is not required to inspect asteam-locomotive boiler unless an extensionof the 4-year boiler-and-flue-tube inspectionis requested, nor is such an inspectionpossible without the cooperation of thesteam-locomotive maintenance personnel,since a hot pressurized boiler cannot beinspected on short notice because it mayrequire several days to cool down. The restof the steam locomotive is subject to FRAinspection at any time, as is most otherrailroad equipment. However, given thelimited number of FRA inspectors, not tomention the limited number of inspectorswith steam-locomotive expertise, and thehigh demands of commercial interchangerailroad inspection, FRA inspectors are ableto inspect steam locomotives only infre-quently at best.

Steam locomotives for commercial-railroad motive power had all butdisappeared by the early 1960s because mostmajor carriers had finished converting todiesel-electric locomotive power. The lastcommon carrier railroad steam locomotive38

was replaced by a diesel-electric locomotivein September 1970. Consequently there areno FRA and few railroad inspectors whoseexpertise is based on first-hand knowledgeof steam locomotives; FRA inspectors nowgain their expertise from limited classroominstruction. Unfortunately, many of theFRA’s regulations are written in such a waythat the inspector’s ability to adhere to themdepends heavily on his subjective experienceand practical expertise. Testing for brokencrown stays by tapping and listening forbroken crown stays as required by 49 CFR230.21 through .24 is one example of a

5:/QDKNG"(")WNH"4CKNTQCF"4/8/2"0Q0";90

37

procedure that requires an inspector who canrely on some level of continuous dailyexperience.

The regulations in 49 CFR 230.102 and103 assign the responsibility for inspectionand repairs and define the term “inspector.”

230.102 Responsibility for inspectionand repairs.

The mechanical officer in charge, ateach point where repairs are made,will be held responsible for theinspection and repair of all parts oflocomotives and tenders under hisjurisdiction. He must know thatinspections are made as required andthat defects are properly repairedbefore the locomotive is returned toservice.

230.103 Term “inspector.”

The term inspector as used in the rulesand instructions in this subpart meansunless otherwise specified, the railroadcompany’s inspector.

The regulations do not specify the levelof education or experience needed bysomeone who inspects steam locomotives orrepairs and maintains them. The regulationsassume that an individual with extensivepractical experience in boiler constructionand maintenance will be available to do thework.

According to the FRA, the agency hasattempted to maintain some level of inspec-tion proficiency by organizing two 1-weekseminars, which are taught by industry andoperating museum experts on boilers andsteam locomotives, about steam locomotivesand boilers, including maintenance and in-spection. The FRA gives priority for steam-locomotive seminars to those MP&E

inspectors who have steam-locomotiveoperations in their territory.

Industry Efforts--In 1990, members of thetourist-railroad industry who owned and op-erated steam locomotives became concernedthat steam-locomotive inspection and safetystandards were slowly degenerating. Twelverepresentatives formed an unofficial, ad hocgroup to formalize some type of recom-mended practice for the repair of steam-lo-comotive boilers. (The 12 representativesincluded people from tourist-railroadmechanical departments and insurance in-spectors, Class I railroad steam operators,and experts knowledgeable in the theory andpractice of steam-locomotive boiler con-struction.) The group contacted theNBBPVI, the private agency that publishesand administers the National Boiler Inspec-tion Code applicable to all boilers used inindustry other than railroads. In 1990, thegroup of 12 representatives began as theEngineering Standards Committee for SteamLocomotives (ESC) to develop standards forthe repair and alteration of steam-locomotiveboilers. Guidance was provided by NBBPVIas to modern engineering practices forboilers.

In 1995, the National Board InspectionCode Committee adopted the standardsdeveloped by the ESC as an AmericanNational Standard for the repair andalteration of steam-locomotive boilers thatare repaired or altered by NBBPVI-certifiedboiler engineering firms.39 In 1995, the ESCalso became an official task group of theNBBPVI. Appendix 3 of the 1995 NationalBoiler Inspection Code contains theNBBVPI rules for steam-locomotive boiler

5;6JGUG" CTG" HKTOU" JQNFKPI" CP" K4L" UVCOR" KUUWGF" D[VJG"0$$28+"HQT"DQKNGT"TGRCKT0

38

repair. These rules, however, are onlyvoluntary for railroads under FRAjurisdiction, since 49 CFR Part 230 makesno reference to any national standard or theNBBVPI Code. In lieu of Federal standards,the ESC and the NBBVPI have volunteeredto provide a tailored training program onsteam-locomotive boiler inspection andrepair to the tourist-railroad industry.

Since the accident, the FRA has formed aSteam-Locomotive Safety ImprovementCommittee, which began meeting inSeptember 1995. The ESC became a part ofthe committee and has met with the FRA inan initial step to update 49 CFR Part 230.The ESC also has a representative on alarger FRA committee looking into allaspects of rail safety.

39

General

The phenomenon of crownsheet failurehas been well known and understood formany years. That such a failure had occurredin this accident was evident from the start ofthe investigation. All parties to theinvestigation agreed that the nature of thedamage, the statements of the locomotivecrew, and the postaccident examination ofthe boiler confirmed that the crownsheetfailure was due to low water. The SafetyBoard therefore concludes that the explosionin locomotive 1278 resulted from crown-sheet failure caused by having too littlewater in the boiler.

The investigators found that it was not asingle event or condition that caused thewater to be too low. It was too low becauseof the cumulative result of a number ofsteam-locomotive boiler-maintenance andoperational factors that resulted from a lackof training, knowledge, and application. Thefollowing is a brief synopsis of the accidentchronology and the inherent factorsinvolved. Each of these factors will beexplained in greater detail in the rest of theanalysis.

The events leading to the crownsheetfailure began when the locomotive stoppedat Wolf Pit to pick up the helper. There, thefirst fireman shut off the feed pump, thuspreventing any water from entering theboiler. He turned off the feed pump becausea one-way check valve between the feedpump and the boiler was leaking to theextent that he believed that the locomotive’sdrivers (wheels) might slip on the rail. Thefeed pump remained off for about the next

10 minutes as the train climbed the gradeuntil the second fireman took over at the topof the grade, near Gardners. The distancebetween the start of the grade and Gardnerswas about 2 miles; and according to theengineer, while the train was going up thegrade, it was “working hard,” using moresteam and, consequently, more water thanusual. The first fireman said that as steamwas used during the ascent, the pressure inthe boiler dropped from about 230 psi to 175psi. The firemen were unconcerned aboutthe drop in pressure because they assumedthat the water glass would warn them if thelevel of water in the boiler becamedangerously low, thus allowing them tocorrect the problem.

Even before the water was cut off, itslevel had been purposely kept low as amatter of standard operating procedure. Theengineer told Safety Board investigators thathe normally kept the level of water so lowthat the water glass was only 1/3 to 1/2 fulleven while the train ascended the grade toGardners. The second fireman testified thatthe highest water-glass level that heremembered was “3/4 at most withfluctuation.” The engineer said that keepingthe water low in the boiler was a way ofminimizing the chance of water entering thecylinders (working water). He also said thathaving less water in the boiler made for“good steaming,” or the rapid creation of thesteam that the train needed to climb thegrade to Gardners. However, keeping thewater so low reduced the layer of safety overthe vulnerable crownsheet, particularly asthe water level changed with changes ingrade and terrain.

ANALYSIS

40

As the locomotive moved uphill, thewater maintained its level, moving to theback of the boiler, which was tilted upgrade. Since the crownsheet was at the backof the boiler, the water should have coveredit even more deeply than when the train wason level track. Accordingly, the water glass,which was on the back of the boiler, shouldhave shown the level of water as higher thanit was when the train was on level terrain.

However, according to the crew, whenthe locomotive tilted up grade, the waterglass was still only 1/2 full (unchanged fromthe start at Wolf Pit), which should havewarned the firemen that either the boilerheld very little water or that the water glasswas inaccurate. With the feed pump shutdown and the locomotive working hard andusing steam, the water level continued todrop. At some point, the boiler held so littlewater that the highest point of the crown-sheet became uncovered and, as a result,failed. By the time the locomotive crestedthe grade at Gardners, where the secondfireman turned the feed pump back on, itwas already too late to prevent the inevitablefailure.

The firemen should have seen aprogressive drop in the water-glass level butdid not. The restricted condition of thespindles leading to the water glass wasaffected by one or both of the followingcircumstances: a higher-than-normal waterhead (a false head) at the back of the boilerand/or free floating scale. A false head mayhave been created by the increasedmomentum of water moving upward as theformation of steam became progressivelymore violent because the level of water wasdropping. The more violent formation ofsteam and water flow may also have freedand/or picked up scale from the encrustedboiler deposits, which then partially or

totally blocked the already restricted orificesof the water-glass spindles. The firemen’sstatements that the water-level movement inthe water glass was 1/2 to 1 inch, rather thanthe 4 to 5 inches that the engineer said wasnormal, show that there was some form ofrestriction, or blockage, probably from scale,in the already restricted spindles.

The Safety Board investigation focusedon why the water in the boiler had beenallowed to drop to such a low level. Theinvestigation found locomotive mechanicalconditions, maintenance practices, and crewtraining practices and procedures thatindividually or in combination allowed thelow-water condition to develop.

Investigation

Water-Monitoring Devices--Since the waterglass was the primary tool that the engineerand firemen had to monitor the level ofwater in the boiler, the investigatorsexamined the glass and its related valves andspindles to determine their condition at thetime of the accident. The passages of thevalves had significant deposits. Hard scaleplugged about 75 to 85 percent of thespindles. It could not be determined howmuch, if any, soft deposit or scale had beenblown out during the explosion, but steam-locomotive experts agreed that it isreasonable to believe that soft scale and/orscale flakes further restricted or blocked thespindle passages. The Safety Board con-cludes that because the water-glass spindleswere restricted, the water glass could notaccurately represent the water level in theboiler.

The lowest gage cock was totally pluggedby deposits; the middle gage cock was halfplugged; and the highest gage cock wasclear. Again, steam-locomotive experts who

41

participated as investigators were convincedthat such a large amount of scale could notpossibly have accumulated between monthlyboiler washings. The pattern of deposits inthe gage cocks also suggested that theengineer was accurate when he said that thelevel of water in the boiler was routinelylow. The amount of scale in each gage cockappeared to correlate with the amount oftime it spent in the boiler water: the bottomgage cock was always covered with water,the middle gage cock about half the time,and the highest gage cock almost never.

Both the first fireman and the engineeracknowledged that their method of washingthe boiler was not thorough and that thespindles were not cleaned and reamed out ona monthly basis as, according to the FRA’sregulations, they were supposed to be. Thegage cocks were also not cleaned andreamed. The amount of scale and mineraldeposit found in the spindles and the gagecocks supported the engineer’s admissionsthat he did not follow the monthly cleaningrequirements. The Safety Board concludesthat although the engineer had signed theFRA’s forms No. 1, certifying that the workhad been done, the spindles and gage cockswere not cleaned on a monthly basis.

Investigators also examined the adequacyof the water-monitoring systems (water glassand gage cocks) in this accident since thesystems would have been crucial indetecting the level of the water before thecrownsheet failed. At the turn of the century,both the government and the railroadindustry had recognized the shortcomings ofgage cocks by requiring the use of a waterglass, thus relegating gage cocks to thestatus of a redundant back-up system.

Government and industry knew that gagecocks were particularly subject to the false-

head phenomenon and did not present areadily apparent indication of the level of theboiler water as the water glass did. Govern-ment and industry knew that the water col-umn was the optimal solution but did not re-quire the use of a water column. Instead, theCFR said, “Every boiler [must] be equippedwith at least one water glass and three gagecocks.” In 1920, the U.S. Railroad Admini-stration’s Committee on Standards recom-mended the adoption of the water column asa recommended practice. The Safety Boardbelieves that the FRA now should requirethat, at a minimum, each operating steam lo-comotive have in addition to the requiredwater glass and three gage cocks, eitheranother water glass or a water column.While it can be argued that inadequatemaintenance, as in this accident, wouldeventually allow any and all water-monitor-ing devices to become plugged with scale,the Safety Board believes that the chancethat all the devices will be plugged at thesame time is remote and that, therefore, twodevices provide a degree of redundancy andaccuracy that the currently required singlewater glass and gage cocks do not.

Water-Glass Lighting and Conspicuity--Title49 CFR Part 230.42, “Water Glass Lamps,”requires that all water glasses be suppliedwith a suitable lamp that is located where itenables the engineer to easily see the waterin the glass. In the accident locomotive, thelight for the water glass did not work. Thefiremen indicated that they carried no otherlight source, such as a flashlight, with whichto check the water glass. The second firemansaid that at night the crew used the cab lightspowered by the gasoline generator on thetender and that they had an electric lanternthat sat on the floor by the seat of either theengineer or the fireman. The Safety Boardconcludes that the water glass was notilluminated as required.

42

Although it was not possible to determinethe preaccident conspicuity of the waterglass, both firemen testified that they had notrouble seeing the water glass. The cab ofthe locomotive was an all-weather enclosedone of the type commonly found on steamlocomotives used in northern climates. Thecab had side doors and other features thatlimited the entrance of light and air. Giventhe lengthening shadows and the light ofearly evening, it is possible the amount oflight in the cab and on the water glass wasrestricted.

While the Safety Board does not disputethe claims of the firemen that they had noproblem reading the water glass, the Boardbelieves that a working light on the waterglass, as required by the regulations, wouldhave made reading the water glass easier andmight have yielded more accurate infor-mation about the action of the water level inthe water glass and, thus, the amount ofwater in the boiler. A working light mightalso have allowed the engineer, who indi-cated that the water-level movement wasnormally 4 to 5 inches, to see that the levelwas moving only an inch or less before theaccident. He might have realized that some-thing was wrong and been able to takepreventive action.

Water Treatment--Since scale, particularlyas it affected the water-monitoring devices,became a factor in the investigation, SafetyBoard investigators explored how Gettys-burg Passenger Services treated its water inorder to control the mineral content.According to experienced steam-locomotiveoperators and historical railroad documenta-tion, water treatment is critical to themaintenance and safe operation of steamlocomotives. Testimony from steam-lo-comotive experts and investigators, from theowner of Gettysburg Railroad, and from

representatives of Gettysburg PassengerServices showed that water treatment forlocomotive 1278 was, at best, undocu-mented and inconsistent.

The attempts at water treatment appearedto be irregular, rather than part of a plannedand researched policy. According to histestimony, the engineer sent boiler- and/orsupply-water samples to Water Chem fortesting. However, Water Chem has norecord of doing any testing for GettysburgPassenger Services. The engineer told SafetyBoard investigators that he did his ownwater testing with a kit and that he kept ajournal of his testing. There was nodocumented evidence that this was done ona regular, program-type basis or thatanything was done with any test resultinformation. Investigators were unable todetermine the effectiveness of such irregularwater treatment, since no test results werefound or provided. The Safety Boardconcludes that Gettysburg Passenger Ser-vices did not have a comprehensive water-treatment program. The Safety Boardbelieves that the FRA should require steam-locomotive operators to have a documentedwater-treatment program as a basis for boilermaintenance and operation.

Boiler Washing--The first fireman’s tes-timony about boiler washing described themanner in which Gettysburg PassengerServices personnel washed the boiler.Contrary to the regulatory requirement thatall washout plugs be removed, the firemanremoved only 4 of the boiler’s 29 washoutplugs. With only four plugs removed, it isdoubtful that even the most conscientiouseffort to wash out the boiler would havebeen very effective in removing a significantamount of sediment.

43

There was also a discrepancy between themethod the fireman said he used to wash outa boiler and the methods described in main-tenance literature or described by the Stras-burg Railroad CMO. The fireman did notuse any special nozzles or equipment, whichthe ARA had adopted as recommendedpractice in 1915. His casual description ofthe procedure displayed his lack of knowl-edge and training in this critical procedure.The Safety Board concludes that the boilerwashing procedure described by the firemanwas inadequate to ensure that the boiler wasproperly and thoroughly cleaned as requiredby FRA regulations.

Although the CFR requires boiler wash-ings, it does not describe the procedure.When all railroads depended on steam, therailroad industry had detailed methods andspecial equipment for boiler washing; how-ever, much of this expertise has disappeared.Despite TRAIN’s recent efforts to promotethe proper boiler washing methods, it is ob-vious from this accident that some steam-lo-comotive operators do not have the initiativeor the resources to find and employ provenand accepted boiler washing methods.Therefore, the Safety Board believes that theFRA should describe the proper boiler wash-ing methods and techniques in its regulat-ions in order to set some basic safetystandard for steam-locomotive operators.

Feed Pump and Gage--According to testi-mony from the two firemen, they did not usethe water injector during the accident trip—they used only the feed pump. When thetrain left Aspers with the helper, the firstfireman stated, the feed pump was shut offto prevent the locomotive drivers fromslipping on the wet rail, which was wetbecause of the leaking check valve betweenthe feed pump and the boiler. Consequently,for the time the feed pump was shut off, no

water entered the boiler. As soon as the trainbegan moving, the first fireman said, thefeed pump was turned back on. However,the second fireman testified that when herelieved the first fireman at Gardners, thefeed pump was still turned off and that he(the second fireman) turned it on. The SafetyBoard believes the feed pump was off on theascent to Gardners.

On the fireman’s side of the locomotivecab, three gages had been removed from amounting plate, leaving only a stoker-enginesteam-pressure gage and a boiler-pressuregage. Gages displaying stoker-jet pressure,steam-heat pressure, and feed-pump pressurehad been removed. Firemen use the feed-pump pressure gage to ensure that heatedfeed water is overcoming boiler pressure andflowing into the boiler. Consequently, theinvestigation steam-locomotive experts wereconcerned to find locomotive 1278 lackedthe gage.

When the accident firemen were askedhow they could tell whether the feed pumpwas working, they both said they relied uponthe sound and movement of the feed-pumprod. Yet without a feed-pump gage to showthat the pressure was high enough to forcewater into the boiler, the feed-pump rodcould have been moving only becausepressure was being relieved by the leaking ofthe check valve. The Safety Board concludesthat because the feed-pump gage wasmissing, the traincrew had no reliable way todetermine whether the feed-pump pressurewas overcoming the boiler pressure anddelivering water into the boiler.

Malfunctioning Check Valve--Investigatorsal-so examined another defect in the water-supply system. A check valve between thefeed pump and the boiler had been leakingall day, although the valve had recently been

44

returned from repair. While it is not knownhow much water was leaking from the valve,it was enough water to necessitate clearinghalf an open-decked observation car whenthe locomotive was pulling in reverse. Ifnothing else, the leak reduced the efficacy ofwater delivery to the boiler. It should also benoted that had the accident locomotive beenequipped with a feed-pump gage, the gagewould not have provided an accurate pres-sure indication, since it would have beenconnected between the feed pump and theleaking check valve, which was relievingpressure.

The leaking of the check valve indirectlycontributed to the lack of water in the boiler.Because the valve leaked, the feed pumpwas shut down, cutting off the water supplyto the boiler and contributing to the cause ofthe crownsheet failure.

Injector--The other means of water de-livery to the boiler was the injector, whichwas not used, according to the locomotivecrew. Postaccident examination of the in-jector showed that it had the wrong type ofsteam valve disk. Such a disk would make itdifficult to prime the injector, and if a liftinginjector cannot be primed, it will not operatecorrectly. It would be possible for theinjector to function, but only with somedifficulty. Although the injector does notappear to have been involved in the crown-sheet failure, it is typical of another deviceon locomotive 1278 that either did notfunction or functioned marginally. TheSafety Board concludes that because thewrong type of disk had been installed in theinjector, it would have been difficult to usethe injector to add water to the boiler.

Water-Glass and Gage-Cock Testing--Duringthe testimony, both accident firemen, thehelper engineer (who also worked as a

steam-locomotive engineer), the helper fire-man, another Gettysburg Passenger Servicesemployee (who was qualified as both asteam-locomotive fireman and an engineer),and the owner of Gettysburg Railroad eachdescribed and demonstrated how he wouldblow down and verify the water glass. Onlythe owner of Gettysburg Railroad, theengineer’s father, demonstrated the correctmethod of blowing down. All the GettysburgPassenger Services employees had beentaught by the engineer. No one said that healso tested the gage cocks when he blewdown the water glass, as required byregulation. The Safety Board thereforeconcludes that the firemen did not know,because they had not been properly taught,how to blow down the water glass or test thegage cocks. The lack of knowledge aboutsuch basic procedures reflects the lack of aneffective training program at GettysburgPassenger Services.

Delineation of Responsibilities--Accordingto the testimony of the two firemen, re-sponsibility was not clearly divided amongthe members of the crew, particularly be-tween the two firemen. Each fireman felt hehad a firm grasp of the tasks that needed tobe done and how to do them; however,neither was totally aware of who wasresponsible for what tasks. The situation ismuch the same as the one in which twobaseball outfielders run toward a fly ball.Each may know how to catch the ball, butunless there is a clear understanding ofresponsibility, each may expect the other tocatch the ball, and the ball may fall to theground. Or each may attempt to catch theball, resulting in a collision and the ball’sbeing dropped. In either case, delineation ofresponsibility is critical. In this case, insteadof a ball, the critical item “dropped” was thefeed pump. The Safety Board concludes thatthere was no clear division of responsibility

45

among the members of the crew in thisaccident, particularly between the two fire-men.

Unlike modern electric and diesel-electriclocomotives, which may be operated withsome degree of safety by the engineer alone,operating a steam locomotive requires theclose coordination of both fireman andengineer. Such coordination is impossibleunless everyone involved has a clear under-standing of his responsibilities. While 49CFR 230.40 states that before each trip, thewater glass must be blown out and each gagecock must be tested, the regulation does notassign anyone this specific responsibility.The Safety Board believes that the FRAshould delineate such basic levels ofresponsibility and duties, since closecoordination between and among theengineer and fireman (firemen) is critical tothe safe operation of the steam locomotive.The Safety Board also believes that until theFRA specifies who is responsible for what,Gettysburg Passenger Services shouldspecify.

Hours of Service--Although fatigue doesnot appear to have been a factor in this acci-dent, the Safety Board is concerned that thecumulative and consecutive hours workedby employees, particularly part-time em-ployees, of tourist railroads such as Gettys-burg Passenger Services, may make suchemployees susceptible to accidents caused atleast in part by fatigue or sleep deprivation.Such an accident exposes the public to dan-ger. The members of the enginecrew of lo-comotive 1278 had worked a full day, takena 2-or 3-hour break, and then returned at5:00 p.m. expecting to work until midnight.Whether part-time or full-time, such a day-to-day pattern can easily cause sleep depri-vation and tiredness. This is particularlydisturbing in the case of the engineer who,

as co-owner of Gettysburg Passenger Serv-ices, had duties and responsibilities beyondrunning and maintaining the entire opera-tion.

While the Safety Board acknowledgesthat it is up to the FRA to enforce the Hoursof Service Act,40 the work-rest routine ofGettysburg Passenger Services train person-nel exceeds the intent of the legislation andmight threaten the safety of the public. TheSafety Board concludes that Gettysburg Pas-senger Services management was not awareof the Hours of Service Act. The SafetyBoard believes that the FRA, in cooperationwith TRAIN, should promote awareness ofand compliance with the Hours of ServiceAct.

Training--Based on the description pro-vided of the formal training given to Gettys-burg Passenger Services employees, thetraining was a 1-day recurrent or refreshertraining module, rather than a comprehen-sive training program. The closest thing thatGettysburg Passenger Services had to a com-prehensive training program was a genericfill-in-the-blank document from theAmerican Shortline Association used to sat-isfy FRA engineer certification requirementsof 49 CFR 230.101.

Gettysburg Passenger Services employeessaid they received their training throughOJT. But the company’s OJT program wasnot organized enough to be comprehensiveor complete. The greatest failing of the OJT

62(KTUV" GPCEVGF" KP" 3;29." VJG" *QWTU" QH" 5GTXKEG" #EVYCU"UWDUVCPVKCNN["TGXKUGF"KP"3;8;"D["2WDNKE".CY";3/38;0" (WTVJGT" COGPFOGPVU" YGTG" GPCEVGF" CU" RCTV" QHVJG" (GFGTCN" 4CKNTQCF" 5CHGV[" #WVJQTK\CVKQP" #EV" QH3;98." 2WDNKE" .CY" ;6/56:." CPF" VJG" 4CKN" 5CHGV[+ORTQXGOGPV"#EV"QH"3;::."2WDNKE".CY"322/5640"6JGRWTRQUG" QH" VJG" NCY" KU" KVQ" RTQOQVG" VJG" UCHGV[" QHGORNQ[GGU" CPF" VTCXGNGTU" WRQP" TCKNTQCFU" D[" NKOKVKPIVJG"JQWTU"QH"UGTXKEG"QH"GORNQ[GGU0L

46

was that it was built upon either misunder-stood instructions or misinformation thathad come second- or third-hand from a certi-fied or professional commercial-railroadsource. Thus, misunderstood, incomplete, orincorrect information was continually passedon until it became the norm. Therefore, theSafety Board concludes that Gettysburg Pas-senger Services had no effective formaltraining or certification program and that itsOJT was dependent on second- and third-hand expertise.

Progressive Crown-Stay Failure--Althoughnot a warning or preventative device, the de-sign of the accident locomotive boilerappeared to mitigate the effects of thecrownsheet failure. As previously discussed,the locomotive had alternating rows ofstraight-thread and button-head crown staysto help ensure that any crownsheet failuredue to low water would occur relativelygradually and in stages, rather than instanta-neously and catastrophically.

The design was suggested in the 1922Master Boiler Association manual report. Itappears to have been unique to the CanadianLocomotive Company, Ltd. and may wellhave prevented a more sudden catastrophicfailure of the crownsheet, which could havesent the boiler rocketing off the frame,killing or injuring the crew and passengers.The Safety Board believes such a designmay be worthy of further study forincorporation in steam locomotives whenthey are repaired or rebuilt. The SafetyBoard also believes that the FRA, incooperation with the NBBPVI and thetourist-railroad industry steam-locomotiveoperators should explore the feasibility ofrequiring progressive crown-stay failurefeatures in steam locomotives.

Steam-Locomotive Maintenance Expertise--The Safety Board is concerned that theincorrect injector disk, the leaking checkvalve, the missing feed-pump gage, theinoperative dynamo, and the non-functioning water-glass light together reflecta disturbing pattern of poor maintenanceand/or improper repair. Such maintenance,in the opinions of the investigation steam-locomotive experts, clearly indicated a lackof knowledge and expertise on the part ofthe locomotive owners and crew. Aspreviously noted, steam-locomotiveexpertise is gone from most moderncommercial railroads, and generally only asmall number of experts and a limitedsupply of knowledge and skill remain.Today, many operating steam locomotivesare in the hands of a generation who havehad to develop steam-locomotive mainte-nance and operation second- or third-hand,much like the personnel of GettysburgPassenger Services. One way to establish aminimum level of steam-locomotive ex-pertise and thereby better ensure the safetyof operators and the public would be toestablish an education and certificationprogram that establishes and enforces basicstandards for steam-locomotive operationand maintenance.

The NBBPVI and the tourist-railroad in-dustry steam-locomotive operators haveagreed to establish a program for the safemaintenance and operation of boilers. TheSafety Board supports such efforts and be-lieves that the FRA, in cooperation with theNBBPVI and the tourist-railroad industrysteam-locomotive operators, should developcertification criteria and require steam-lo-comotive operators and maintenance per-sonnel to be periodically certified to operateand/or maintain a steam locomotive.

47

The Safety Board believes that the FRA,in cooperation with the NBBPVI, shouldupdate 49 CFR Part 230 to take advantage ofaccepted practical modern boiler-inspection

techniques and technologies, to minimizeinterpretation based on empirical experience,and to maximize the use of objectivemeasurable standards.

48

1. The explosion in the locomotive resultedfrom crownsheet failure caused byhaving too little water in the boiler.

2. Because the water-glass spindles wererestricted, the water glass could notrepresent the water level in the boileraccurately.

3. Although the engineer had signed theFederal Railroad Administration’s formsNo. 1, certifying that the work had beendone, the water-glass spindles and gagecocks were not cleaned on a monthlybasis.

4. The water glass was not illuminated asrequired.

5. Gettysburg Passenger Services, Inc., didnot have a comprehensive water-treatment program.

6. The boiler washing procedure describedby the fireman was inadequate to ensurethat the boiler was properly andthoroughly cleaned as required byFederal Railroad Administrationregulations.

7. Because the feed-pump gage wasmissing, the traincrew had no reliableway to determine whether feed-pumppressure was overcoming boiler pressureand delivering water to the boiler.

8. Because the wrong type of disk had beeninstalled in the injector, it would havebeen difficult to use the injector to addwater to the boiler.

9. The firemen did not know, because theyhad not been properly taught, how toblow down the water glass or test thegage cocks.

10. There was no clear division ofresponsibility among the members of thecrew in this accident, particularlybetween the two firemen.

11. Gettysburg Passenger Services, Inc.,management was not aware of the Hoursof Service Act.

12. Gettysburg Passenger Services, Inc., hadno effective formal training orcertification program, and its on-the-jobtraining was based on second- and third-hand expertise.

CONCLUSIONS

49

The National Transportation SafetyBoard determines that the probable cause ofthe firebox explosion on steam locomotive1278 was the failure of Gettysburg Passen-

ger Services, Inc., management to ensurethat the boiler and its appurtenances wereproperly maintained and that the crew wasproperly trained.

PROBABLE CAUSE

50

As a result of this special investigation,the National Transportation Safety Boardmakes the following recommendations:

--to the Federal Railroad Administration:

Require that each operating steamlocomotive have either a water columnor a water glass in addition to thewater glass and three gage cocks thatare already required. (R-96-53)

Require steam-locomotive operators tohave a documented water-treatmentprogram. (R-96-54)

Describe basic responsibilities andprocedures for functions required byregulation, such as blowing down thewater glass and washing the boiler. (R-96-55)

In cooperation with the TouristRailway Association, Inc., promoteawareness of and compliance with theHours of Service Act. (R-96-56)

In cooperation with the NationalBoard of Boiler and Pressure VesselInspectors and the Tourist RailwayAssociation, Inc., explore the feasibil-ity of requiring a progressive crown-stay feature in steam locomotives. (R-96-57)

In cooperation with the NationalBoard of Boiler and Pressure VesselInspectors and the Tourist RailwayAssociation, Inc., develop certificationcriteria and require that steam-loco-motive operators and maintenancepersonnel be periodically certified to

operate and/or maintain a steam loco-motive. (R-96-58)

In cooperation with the NationalBoard of Boiler and Pressure VesselInspectors and the Tourist RailwayAssociation, Inc., update 49 Code ofFederal Regulations Part 230 to takeadvantage of accepted practical mod-ern boiler-inspection techniques andtechnologies, to minimize interpreta-tion based on empirical experience,and to maximize the use of objectivemeasurable standards. (R-96-59)

--to the National Board of Boiler andPressure Vessel Inspectors:

Cooperate with the Federal RailroadAdministration and the Tourist Rail-way Association, Inc., in exploring thefeasibility of Federal regulations re-quiring progressive crown-stay failurefeatures in steam locomotives. (R-96-60)

Participate with the Federal RailroadAdministration and the Tourist Rail-way Association, Inc., in developingcriteria to be used in the periodic certi-fication of steam-locomotive operatorsand maintenance personnel. (R-96-61)

Participate with the Federal RailroadAdministration and the Tourist Rail-way Association, Inc., in updating 49Code of Federal Regulations Part 230to take advantage of accepted practicalmodern boiler-inspection techniquesand technologies, to minimizeinterpretation based on empiricalexperience, and to maximize the use

RECOMMENDATIONS

51

of objective measurable standards. (R-96-62)

--to the Tourist Railway Association,Inc.:

In cooperation with the Federal Rail-road Administration, promote aware-ness of and compliance with the Hoursof Service Act. (R-96-63)

Encourage its members who operatesteam locomotives to cooperate withthe Federal Railroad Administrationand the National Board of Boiler andPressure Vessel Inspectors in explor-ing the feasibility of Federal regula-tions requiring progressive crown-stayfailure features in steam locomotives.(R-96-64)

Encourage its members who operatesteam locomotives to participate with

the Federal Railroad Administrationand the National Board of Boiler andPressure Vessel Inspectors in devel-oping criteria to be used in periodi-cally certifying steam-locomotive op-erators and maintenance personnel.(R-96-65)

Encourage its members who operatesteam locomotives to participate withthe Federal Railroad Administrationand the National Board of Boiler andPressure Vessel Inspectors in updating49 Code of Federal Regulations Part230 to take advantage of acceptedpractical modern boiler-inspectiontechniques and technologies, to mini-mize interpretation based on empiricalexperience, and to maximize the useof objective measurable standards. (R-96-66)

BY THE NATIONAL TRANSPORTATION SAFETY BOARD

JAMES E. HALLChairman

ROBERT T. FRANCIS IIVice Chairman

JOHN A. HAMMERSCHMIDTMember

JOHN J. GOGLIAMember

GEORGE W. BLACK, JR.Member

November 15, 1996

APPENDIX A

53

Investigation and S worn Testimon y Proceeding

The accident occurred about 7:30 p.m. edt on Friday, June 16, 1995, and was reported to theCoast Guard’s National Response Center (NRC) in Washington, D.C., the following morning at7:17 a.m. The NRC incident report number was 295913. The incident report was electronicallysent to the National Transportation Safety Board (NTSB) at 7:39 a.m. on Saturday, June 17,1995.

The NTSB investigator arrived at the Gettysburg Railroad about 10 a.m. on Tuesday, June 20,1995, and initiated the accident investigation. The Gettysburg Railroad, Gettysburg PassengerServices, Inc., the Federal Railroad Administration, the Hartford Steam Boiler Inspection andInsurance Co., and members of the Tourist Railway Association, Inc., participated and assisted inthe investigation.

As part of the investigation, a 2-day sworn testimony proceeding was held at the Holiday Innin Gettysburg, Pennsylvania, on September 27 and 28, 1995. Parties to the proceeding includedthe Gettysburg Railroad, Gettysburg Passenger Services, Inc., the Federal Railroad Administra-tion, the Hartford Steam Boiler Inspection and Insurance Co., the National Board of Boiler andPressure Vessel Inspectors, Inc., and members of the Tourist Railway Association, Inc. Twelvewitnesses testified.

APPENDIX A

53

Abbreviations Used in this Publication

ARA: American Railroad Administration

CFR: Code of Federal Regulations

CMO: chief mechanical officer

ESC: Engineering Standards Committee for Steam Locomotives

FRA: Federal Railroad Administration

ICC: Interstate Commerce Commission

MP&E: motive power and equipment

NBBPVI: National Board of Boiler and Pressure Vessel Inspectors

OJT: on-the-job training

psi: pounds per square inch

TRAIN: Tourist Railway Association, Inc.

APPENDIX B