On Jan. 12, 2015, Washington Metropolitan Area Transit Authority (WMATA) experienced one of its “more serious” train accidents to date, according to the Federal Transit Administration (FTA). At 3:15 p.m. EST, train 302, which was headed southbound on the Yellow Line with about 380 passengers on board, stopped on the tracks after encountering smoke in the tunnel between the L’Enfant Plaza station and the Potomac River Bridge in Washington, D.C. Some passengers started to self-evacuate to escape the smoke, causing the train control center to shut off third rail power until emergency services could evacuate the victims. In total, the accident resulted in one death, 91 injured people and $120,000 in estimated damages.
TRAIN POWER AND TUNNEL VENTILATION
At the time of the accident, WMATA had managed a system since 1976 that grew to 91 rail stations over a 118-mile network of tracks. WMATA’s electric trains employed a 750-volt DC contact rail called the third rail. The WMATA’s 50.5-mile tunnel track system was ventilated by fans and vents using 82 fan shafts and 116 ventilation shafts. Of the 130 emergency exit shafts, 98 were also fan and ventilation shafts.
RAIL SYSTEM MONITORING AND CONTROL
WMATA used its Advanced Information Management System (AIMS) to monitor and control operations at a supervisory level. This system sent and received data to control wayside equipment (signals, power, smoke detectors and intrusion) from the Rail Operations Control Center (ROCC). Graphic data displays on ROCC controller screens allowed control operators to manage traffic flow and handle isolated equipment failures.
FEDERAL AND STATE SAFETY OVERSIGHT
At the federal level, the safety oversight of WMATA was regulated by the FTA within the U.S. Department of Transportation (DOT). The Tri-State Oversight Committee (TOC) was the designated state safety oversight agency (SSOA) for the WMATA rail system across District of Columbia, Maryland and Virginia.
NTSB RAIL RAPID TRANSIT INVESTIGATIONS
The National Transportation Safety Board (NTSB) has published safety concerns about U.S. rail rapid transit since 1967, investigating over 60 U.S. rail transit accidents. In 1980, the NTSB issued an evaluation of four re-related train accidents from across the country. At that time, the NTSB determined that industry self-regulation was reacting to accidents instead of preventing them. NTSB investigators found no effective process to develop safety performance standards. In addition, there was no effective oversight to assure a minimum level of safety. Thirty-five years later in 2015, the NTSB revealed the same findings in the L’Enfant Plaza accident investigation.
The NTSB has investigated 13 accidents on the WMATA rail system, resulting in 106 safety recommendations. Consider the conclusions drawn by the NTSB from the following investigations:
- Smithsonian Interlocking, Jan. 13, 1982: During this incident, a train car derailed and struck the end of a reinforced concrete barrier wall. The NTSB determined that a lack of proper training for the ROCC was one cause of the accident.
- Dupont Circle Station, May 14, 2006: A train struck and killed a WMATA employee. NTSB investigators found that right-of-way rules did not protect workers from trains. They also identified inadequate rule compliance testing and enforcement by WMATA.
- Eisenhower Ave. Station, Nov. 30, 2006: During this accident, a train struck and killed two employees who were performing a walking inspection of the main track. The same Dupont Circle findings were reported.
- Fort Totten Station, June 22, 2009: This severe train collision killed nine people and injured 52 others. The NTSB attributed the event to a lack of safety culture, a failure to effectively monitor and maintain the automatic train control system’s performance, and ineffective safety oversight by the WMATA board of directors. Read the full “Loss of Detection” Fort Totten Station NASA System Failure Case Study.
3:06 p.m. — An electrical circuit breaker tripped and remained open, degrading power to a portion of the third rail. The breaker was on a circuit feeding power from L’Enfant Plaza to the third rail of the southbound Yellow Line. A 16-foot section of the third rail had shorted to a puddle of standing water (short to ground). The third rail cover board (made of a plastic material) started melting, creating heavy smoke.
3:15 p.m. — Train 302 entered the south tunnel departing L’Enfant Plaza, bound for the Potomac River Bridge, and encountered thick smoke. The train operator stopped the train, per WMATA’s safety procedure, while it was still inside the tunnel. One of the two WMATA Metro Transit Police Department (MTP) officers on the train reported smoke via radio to MTP communications, which is separate from the ROCC. This information was relayed to the ROCC about 20 seconds later.
Train and arcing event locations in relation to L'Enfant Plaza
3:17 p.m. — The train 302 operator contacted the ROCC, reporting the stop in the tunnel due to heavy smoke and the need to return to L’Enfant Plaza. Awaiting permission, the train operator walked through the train and told passengers to remain calm. However, railcars began filling with smoke, and breathing became difficult. Passengers crouched on the foor of the railcars, and some called 9-1-1. The operator then configured the train to move back to L’Enfant Plaza. In the meantime, smoke had entered L’Enfant Plaza while train 510 arrived. The MTP evacuated all passengers and the operator from train 510, leaving it blocking the track for train 302. Train and arcing event locations in relation to L’Enfant Plaza.
3:21 p.m. — Back on train 302, the ROCC ordered the train operator to shut down the train’s ventilation system. The operator opened the ventilation circuit breaker on the railcar closest to L’Enfant Plaza. At 3:32 p.m., the operator reported that some passengers had evacuated railcars on their own. Because third rail power became degraded due to arcing, train 302 could no longer move.
3:22 p.m. — The ROCC called the District of Columbia Fire and Emergency Medical Services (FEMS) for response. FEMS responders arrived at the scene at 3:31 p.m., but did not arrive at the stopped train (located in the smoke-filled tunnel) until about 3:50 p.m.
3:50 p.m. — FEMS responders had to first disconnect third rail power to protect passengers in the tunnel. Then they evacuated passengers from train 302, including one passenger who later died. For at least 44 minutes (from the time the electrical breaker tripped to the power disconnection) the third rail arced and smoked. Ultimately, one passenger died, three passengers suffered serious injuries, 75 passengers suffered minor injuries, and 11 WMATA employees and two FEMS responders suffered minor injuries — all from smoke inhalation and related problems.
Fire-damaged cables and cable connector assemblies
According to NTSB investigators, “electrical arc tracking at improperly constructed power cable connector assemblies” within the third rail electrical power cable system caused a short circuit that generated fire and smoke in the tunnel. About 16 feet of third rail power cables and sections of the cable connector assemblies were consumed by the arcing event, which lasted nearly 45 minutes.
In addition to the electrical issues, the presence of water at the site of the arcing event increased the severity of the accident.
The NTSB determined that degraded infrastructure as well as a lack of proper maintenance, inspection and overall safety oversight contributed to the L’Enfant Plaza event. The smoke was not a rare occurrence; WMATA incident data collected in 2014 reported that the system averaged 69 fires and 35 smoke incidents annually.
Missing sealing sleeve and resulting gap between cable insulation and fiberglass cover
Sealing sleeves typically are used to keep cable assemblies weathertight in the presence of contaminants and moisture. Although WMATA’s engineering design specifications included sealing sleeves, NTSB investigators discovered that the third rail power cable connector assemblies were missing the sealing sleeves that are designed to protect the cable from water and debris.
During the four years prior to the accident, leaks were accepted as a common problem in the WMATA tunnel system. In fact, a WMATA representative reported between 3,000 and 5,000 water leaks within the system. While there were some reports of repair work, severe and active leaks were still present at the locations where the repairs took place.
Initially, WMATA conducted tunnel leak inspections on an annual basis. After 2012, it discontinued the dedicated leak inspections. However, biennial tunnel structural inspections continued to document leaks. Since 2010, inspections have found active leaks in the tunnel south of L’Enfant Plaza. These leaks were rated severe in 2011 and 2012. A 2014 survey confirmed that active leaks continued near the electrical arcing location while no Corrective Action was taken.
Ineffective ventilation strategy blanketed train 302 in smoke
WMATA did not hold any training or develop any procedure to evacuate smoke in train tunnels. Thus, the ROCC train control operator did what seemed best and activated under-platform fans in exhaust mode in the L’Enfant Plaza station, which blanketed train 302 in smoke. It took eight minutes for the ROCC to activate fans in ventilation shaft FL-1 to emergency exhaust mode. However, no fresh air was being moved in from the outside to help clear the smoke.
Without procedures or system training, the control operator’s action to put the fans in exhaust mode blew the smoke toward the train. Since the station fans and ventilation shaft were in exhaust mode, no fresh air supply could be introduced to help move the smoke through the tunnel, toward the outside and away from train 302.
The NTSB also discovered that proper maintenance procedures were not being used in the train tunnels. Two fans in FL-1 were not functioning. Even if the fans had been working, an ROCC remote command failure prevented the ROCC from remotely switching the operation mode of any fan in FL-1.
During much of the electrical arcing incident, the railcar ventilation system was still pulling smoke into the train because the train operator did not turn off the onboard ventilation system. According to the NTSB, there was a delay in the ROCC providing instructions to the train operator. Because of a lack of training and proper procedures, WMATA had no railcar ventilation system shutdown procedure for train operators — including one that would immediately disable the ventilation systems on all railcars, not just the lead railcar.
Location of smoke detectors in relation to trains and arc damage
At 3:04 p.m., the first smoke detector was activated. However, notification of this detection was never received by the ROCC or anyone else. The NTSB determined that a loose wire prevented the connection with AIMS, the result of inadequate maintenance.
The second smoke detector was activated at 3:19 p.m. in the L’Enfant Plaza station. While the ROCC received this notification, there was no specified procedure for control operators to take if smoke alarms were activated. In its report, the NTSB cited other transit agencies that have developed detailed procedures for smoke events in tunnels as part of industry-based best practice.
The NTSB also noted that WMATA lacked the capability to determine the precise location of smoke in the tunnel system since the detectors were spaced too far apart. According to the NTSB, precise location identification of smoke is vital for proper ventilation and survival.
The NTSB report revealed that despite WMATA’s standard operating procedure to stop trains in all directions when smoke or fire is reported, the ROCC continued allowing trains (56 total) to pass through the L’Enfant Plaza station (on the lower-level tracks and the upper level opposite the platform track) during the emergency response period. In addition, the ROCC told the operator of train 302 to look for smoke as it approached L’Enfant Plaza, a practice that put train passengers at risk. The ROCC radio controller said that reports of smoke were common and received every day.
A lack of training also affected the emergency response during the accident, according to the NTSB. ROCC control operators and supervisors were not properly trained in carrying out emergency procedures. WMATA had not conducted a full-scale tunnel evacuation drill since 2010 while the FEMS for the District of Columbia had not conducted WMATA tunnel evacuation drills within the past five years. In addition, the Office of Unified Communications (District of Columbia) did not participate in WMATA-specific training that was available in the past.
Prior to the event, the FEMS incident commander was not properly trained in the skills and practices of the incident command process. In addition to failing to take immediate action during the emergency, he excluded the MTP duty chief (who would have been able to supply key WMATA response support data to the incident commander) and operated the incident command process in a workspace that was too small to accommodate all necessary support personnel.
The NTSB discovered that poor infrastructure related to communication and tunnel signage/lighting complicated emergency response operations. As FEMS firefighters tried to find train 302 in smoky, low-visibility conditions, unreliable radio communication between the ROCC and FEMS, a lack of signage identifying track location and track direction, and dim lighting confused the response team — delaying its progress in finding the accident site.
OVERSIGHT AND MANAGEMENT
TIMELINE OF FUNDAMENTAL SAFETY ISSUES
1967: WMATA fails to include sealing sleeves in third rail cable assemblies.
1970s: WMATA built its ventilation system at a time when there was no established industry standard for emergency ventilation.
1970: NTSB recommended that WMATA develop in-tunnel emergency procedures. The recommendations were not followed.
1985: Third-party engineering studies proved the inadequacy of WMATA’s ventilation system. WMATA failed to address capacity problem.
2011–2012: Tunnel leaks near the accident site were ranked as severe; however, effective action was not taken to mitigate leaks through 2015.
2013: WMATA discontinued tunnel leak inspections. Instead, they were added to tunnel structural inspections every two years.
2014: WMATA system data revealed 5.8 res and 2.9 smoke incidents per month on average.
According to the NTSB, the TOC lacked the “sufficient resources, technical capacity and enforcement authority” needed to provide proper safety oversight of WMATA operations. While the FTA has made attempts to monitor and improve rapid rail safety at WMATA, the NTSB concluded that the FTA lacked “authority, expertise and resources to assume temporary, direct safety oversight of rail transit agencies.”
At WMATA, ineffective safety oversight and a historically weak safety culture have drawn the attention of NTSB investigators numerous times. WMATA’s strong reliance on technology required that senior managers “continuously review their organization’s performance and practices through monitoring, analysis and feedback systems,” according to the NTSB.
However, WMATA’s lagging Corrective Action in response to previous NTSB recommendations showed that the organization learned almost nothing from lessons collected during years of accidents. The NTSB found that WMATA made slight, incremental progress, but no critical changes were made as a permanent part of railway operations. In spite of minor changes to the safety climate, the NTSB found significant safety management deficiencies and an outdated Quality Assurance program.
Concluding its report, the NTSB found that “historic limitations of state and federal oversight have limited external capability and authority to identify and cause WMATA to correct safety deficiencies...” The NTSB called upon the TOC and FTA to hold the system owner accountable to improve and sustain effective safety controls.
Following the accident at L’Enfant Plaza, the U.S. DOT appointed three new federal representatives to the WMATA board of directors. With extensive backgrounds in transportation safety, these leaders were chosen to help address infrastructure challenges and cultivate a robust safety culture.
In December 2016, FTA Executive Director Matthew Welbes published a report on the safety and oversight status of WMATA. Although the FTA lacks the ability to direct operational decisions at WMATA, he emphasized the FTA’s role in directing funding for “safety-critical items” and stopping unsafe operations. The FTA has issued seven directives to WMATA that included 251 required actions. Welbes’ summarized his key findings as follows:
- WMATA recently took steps to improve its leadership and staff while “prioritizing safety over revenue service.”
- WMATA is reviewing and testing a new financial management software system to combat its restricted drawdown status from the FTA. According to Welbes, restricted drawdown status requires that WMATA’s invoices and related financial documents are verified by the FTA before federal funds are reimbursed to WMATA.
- WMATA has conducted multiple safety stand-downs designed to help employees refocus and “prioritize safety over service.”
- WMATA has addressed two-thirds of over 900 remedial actions identified by FTA inspections.
- The FTA has been updating a report dashboard to keep Congress and the public informed about WMATA oversight activities on a regular basis.
The FTA currently is exercising temporary safety oversight of WMATA operations. This arrangement will continue until Virginia, Maryland and the District of Columbia set up a functional, compliant SSOA to handle safety oversight responsibilities. The need for a permanent oversight agency has been recognized by the FTA as well as all three jurisdictions for the past six years.
FOR FUTURE NASA MISSIONS
In the clarity of hindsight, it is easy to see how the many indicators of this major accident piled up over time. One important aspect not revealed, however, was the context surrounding decisions to favor other priorities rather than maintaining aging infrastructure or implementing off-nominal procedures. What were the cost, schedule and political pressures on the decision-makers? What cues did they have access to besides inspections and incident data? How were the risks identified and assessed?
NASA centers and component facilities face challenges that accompany years of exposure to temperature and humidity extremes as well as corrosive environments. Over time, harsh environments may cause damage to fire protection systems, information technology and communication infrastructure, steel structures (including lightning protection), fragile shorelines, and even concrete flight line ramps. Due to high mission priorities, not all support systems have access to the resources needed for planned maintenance as designed. A high percentage of facilities exist beyond their design lifespan.
Hazards to infrastructure and mission-critical systems demand not only thorough identification upward and laterally throughout the NASA organization but also expert judgment to select feasible, powerful options that become effective corrective actions — namely physical change to mitigate risks. If the action does not match the nature of the hazard (e.g., a training workaround for a physically deteriorating system that is operating in run-to-failure mode), then ever-present latent conditions, such as gravity, corrosion, erosion, electricity or moisture, stand ready to threaten employees the instant they drop their guard. While we may know this intellectually, our hearts go out to the L’Enfant Plaza accident victims. We can refuel our vigilance as we learn from their difficult experience.
QUESTIONS FOR DISCUSSION
- Have you noticed any safety-critical systems in your facility that appear to have been inoperative or pending repairs for months or years? Is there an active corrective process in place?
- Does your organization welcome the reporting of hazards? Or does your organization discourage it in favor of competing risks such as cost and schedule? Is there an alternate reporting path?
- Which safety-critical systems or components do you encounter that were designed so long ago that modern safety defenses are completely missing from the design? How have employees adapted to these missing defenses?
- Are system operators, supervisors and emergency responders trained and skilled to respond to the actual scenarios that local systems and structures could encounter due to normal operation or known history?
- Do visible processes and priorities affecting mission support systems seem to be flexing toward lower margins of safety rather than holding or increasing current margins?
Gates, Angela: USDOT Picks Three New WMATA Board Members to Tackle Safety Culture. U.S. Department of Transportation. Washington, D.C. April 28, 2016.
National Transportation Safety Board: Railroad Accident Report: Washington Metropolitan Area Transit Authority L’Enfant Plaza Station Electrical Arcing and Smoke Accident. Washington, D.C. Jan. 12, 2015.
Welbes, Matthew: Testimony from FTA Executive Director Matthew Welbes: Oversight of the Washington Metropolitan Area Transit Authority. December 2, 2016.
Accessed March 30, 2017.
Visit nsc.nasa.gov/SFCS to read this and other case studies online or to subscribe to the Monthly Safety e-Message.
Responsible NASA Official: Steve Lilley
This is an internal NASA safety awareness training document based on information available in the public domain. The findings, proximate causes, and contributing factors identified in this case study do not necessarily represent those of the Agency. Sections of this case study were derived from multiple sources listed under References. Any misrepresentation or improper use of source material is unintentional.