About 19:20 on 16 Jun 1995 the firebox crownsheet of Gettysburg Passenger Services Inc., steam locomotive 1278 failed while the locomotive was pulling a six-car excursion train about 15 mph near Gardners, Pennsylvania. The failure resulted in an instantaneous release (explosion) of steam through the firebox door and into the locomotive cab, seriously burning the engineer and the two firemen. The firemen were taken by ambulance to area hospitals. The engineer, who had third-degree burns over 65 percent of his body, was airlifted to a burn center near Philadelphia. None of the 310 passengers or other crew members were injured. Locomotive damage was limited to the firebox grates and crownsheet, with some ancillary smoke and debris damage to the locomotive cab.

Investigators found that the crownsheet failed from overheating because the train crew had allowed the water in the locomotive boiler to drop to a level that was insufficient to cover the crownsheet. When the investigators examined the locomotive components closely, they found that the boiler and its associated equipment had not been maintained well enough to ensure safe operation and that some repairs had been done incorrectly. Investigators determined that the deficiencies were the result of a lack of the specialized knowledge, skills, and training necessary to properly maintain a steam locomotive. It was further determined that those operating the locomotive did not understand the full scope of their duties and did not coordinate their efforts to ensure the highest degree of safety.

The National Transportation Safety Board determines that the probable cause of the firebox explosion on steam locomotive 1278 was the failure of Gettysburg Passenger Services Inc. management to ensure that the boiler and its appurtenances were properly maintained and that the crew was properly trained.

Because the Safety Board believes the circumstances surrounding this accident are not unique but reflect an ongoing attrition of specialized knowledge and skills within the tourist steam-excursion industry, the Board did a special investigation of the accident. As a result of its investigation, the Safety Board makes seven recommendations to the Federal Railroad Administration, three recommendations to the National Board of Boiler and Pressure Vessel Inspectors, and four recommendations to the Tourist Railway Association Inc.

At about 19:20 on 16 Jun 1995 the crownsheet of Gettysburg Passenger Services Inc., steam locomotive 1278 failed while the train was pulling a six-car excursion train about 15 mph near Gardners, Pennsylvania. The failure caused fire and steam to be explosively released through the firebox door into the locomotive cab, seriously burning the engineer and two firemen. The engineer suffered third-degree burns over 65 percent of his body. None of the 310 passengers or the other crew members were injured.

The cause of this accident was determined to be the failure of the train operating crew to maintain a water level in the locomotive boiler that was sufficient to cover the crownsheet. Because of the inadequate water level, the crownsheet overheated and weakened. When it weakened, it could no longer withstand the pressure of the steam above it. The pressure forced a section of the crownsheet to pull away from its staybolts and collapse inward, the staybolt holes in the collapsed section then exposed superheated water and steam in the boiler to the atmospheric pressure of the firebox. With the sudden reduction of pressure in the boiler, the superheated water flashed instantaneously and explosively into steam. The investigation of this accident revealed that those responsible for maintaining, repairing, and operating locomotive 1278 lacked the specialized training and experience that have long been judged to be prerequisites for the safe operation of steam locomotive equipment.

Approximately 150 steam locomotives are still operated in the United States by more than 82 organizations. Virtually all of them are used by tourist railroads, museums, historical groups, and steam-excursion groups. Although there are no exact figures about how many people ride steam locomotive trains each year, the Tourist Railway Association Inc., (TRAIN) estimates that approximately 4.8 million people, or the equivalent of 12 percent of Amtrak's annual intercity ridership for 1995, visit tourist railways, museums, and excursion operations annually. A significant number of these people ride trains pulled by steam locomotives. According to Gettysburg Passenger Services officials, about 50,000 people rode Gettysburg Passenger Services steam trains in 1994, and this is only one of more than 80 organizations belonging to TRAIN that use steam excursion trains.

This accident illustrates the hazards that are always present in the operation of steam locomotives. The Safety Board is concerned that these hazards may be becoming more significant because Federal regulatory controls are outdated and because expertise in operating and maintaining steam locomotives is diminishing steadily. The Safety Board believes that the reasons for the explosion on locomotive 1278, especially those reasons having to do with deficiencies in steam locomotive maintenance and operations, may not be unique.

Because of its concern about the safety of passengers and crews on steam trains, the Safety Board conducted a special investigation of the Gettysburg Passenger Services Inc. accident and developed recommendations to address inadequacies it found in regulations, standards, and certification requirements regarding steam locomotive inspection, maintenance, and operation.

  Accident

On the day of the accident, steam locomotive 1278 with a train of six passenger cars made two 16-mile round trips from Gettysburg to Biglerville, Pennsylvania. About 18:00, as a dinner train, it started its third and last trip of the day. It left Gettysburg with 310 passengers for a round trip to Mount Holly Springs, Pennsylvania, where the passengers were to have a catered 2 hour dinner in local restaurants before they returned to Gettysburg.

After the train left Gettysburg, the co-owner and operator of Gettysburg Passenger Services Inc., (Gettysburg Passenger Services) closed the Gettysburg station and followed the excursion train. The purpose of her chase by automobile (she would meet the train at road crossings) was to provide a contingency service to the train and, if necessary, limited emergency transportation. She carried a cellular telephone and a two-way radio that she used to monitor and talk to the crew. Her husband, the locomotive engineer, also carried a radio and cellular phone. The conductors and passenger-service personnel on the train had two-way radios.

When the dinner train left Gettysburg, it passed a Gettysburg Railroad freight train¹. It was routine procedure for the Gettysburg Railroad freight-train locomotive to act as a helper.

Near Aspers, Pennsylvania (MP 15, the "Wolf Pit"), the dinner train stopped and waited to receive the helper train, which consisted of a diesel-electric locomotive pulling four freight cars. It took several minutes to couple the helper to the rear of the dinner train, after which the combined consist proceeded. (See figure 1.)

According to testimony, a check valve (a one-way valve) between the feed-water heater pump (feed pump)² and the boiler had been leaking all day, even though the valve had recently been repaired. On a previous trip that day, when locomotive 1278 was running backward next to a double-tiered, open-air observation passenger car, the spray from the leaking check valve necessitated clearing the first half of the car. Consequently, according to the first fireman³, when the train left Wolf Pit the feed pump was shut off. He said:

We shut the feed pump off whenever we started up Wolf Pit because the check valve was putting water on the track and the locomotive drivers⁴ slipped. But as soon as we were moving, the feed pump was turned back on.

The second fireman⁵ testified that when he relieved the first fireman at Gardners⁶, the feed pump was still turned off. The second fireman said he then turned the feed pump on "all the way". When the firemen were later asked how they could tell whether the feed pump was working, they both indicated that the sound and visual movement of the feed-pump rod told them the feed pump was working. Both firemen felt such cues were sufficient to ensure that water was flowing into the boiler. Safety Board investigators agreed that the feed pump can continue to move with little or no water flow.

Both firemen stated that they checked the water glass⁷ frequently during the trip. The first fireman stated that he "always" watched the water glass. The second fireman said he checked it "once every 5 minutes or so". He also said the engineer leaned back in his seat to check the glass about three times during the trip. Neither fireman noted anything unusual about the level of water in the glass. They said that the level appeared to be normal and that it appeared to fluctuate about a half to a full inch, a fluctuation they considered normal, considering the grade of the track and the vibrations.

At Pond Road, MP 18, the second fireman relieved the first. About a mile later, at Gardners, while the train was moving about 15 mph, the firebox explosion occurred. According to the first fireman:

We got to the top of the grade and leveled off and, we had a normal water reading, had plenty of steam⁸. I got up about 30 seconds before the crownsheet⁹ failed. I got up to put coal in the corners, because it's an automatic stoker¹⁰, and it fans the coal so it won't hit the corners, and I decided to wait until we got across the crossing and up around the bend before we started up the next grade. The second fireman took the fireman's seat, and I decided against putting coal in. So, I went to the door and waved to all the people at the crossing. And about 5 seconds later is when we had the accident.

Well, when the crownsheet failed... it just sounded like a muffled .22 rifle pop. I instinctively turned towards the noise. I remember getting hit with, it just got dark because of all the soot and the smoke in the cab. And I remember feeling intense heat and thinking I've got to get out of here. I jumped out and yelled at the engineer's wife to call 911. And then I thought about the engineer, and I started back up just past the other fireman. I knew he (the second fireman) was all right then, because I saw him. He was limping, but I knew he was all right. Then I went up to find the engineer and found him on the other side of the train lying there. And he asked for his wife. So I ran back and got her. And she handed me the phone, and I finished the 911 call.

The second fireman testified:

The first fireman stepped down to fire the back corners of the firebox, and I told him to take a break and I'd take over firing, which, I guess, gave a time span of about 5 minutes from that point until the explosion. There was like an initial poof sound, but then there was like a second explosion, which is what jarred the fire doors open and dumped everything back into the cab. All the steam and a lot of the coal just blew back into the cab. We had the feed pump on and had the stoker on. I shut the stoker and the feed pump down. And at first, just not knowing where everything was coming from, I jumped forward in the cab between the boiler and the outside wall of the cab to try to get away from it. After about 10 or 15 seconds, I realized it wasn't getting any better, and that's when I came back to the seat. And you couldn't see anything as far as the doorway or anything. So, that's when I climbed up on the seat and jumped out the window. Almost immediately after the explosion, the first fireman went out the doorway. And to my knowledge... the engineer apparently stayed on until it stopped.

According to the helper engineer, the engineer applied the air brakes. A conductor announced on the radio, "Emergency! Stop! Stop! Stop!" When the train stopped, the engineer managed to get down out of the locomotive cab by himself and lie on the ground. He was then helped by the firemen and other members of the train crew. Ambulances arrived minutes later.

The firemen were taken by ambulance to area hospitals. The first fireman, who had immediately left the locomotive cab by the doorway, had second and third-degree burns over 10 percent of his body. He was initially taken to the hospital in Gettysburg and was later transferred to York, Pennsylvania, for a week. His recovery took about 1 1/2 months.

The second fireman also had second and third-degree burns on his legs, arms, chest, and had fractured his legs when he jumped through the locomotive cab window. He was hospitalized for several weeks and had extensive therapy for his shoulder.

The engineer was airlifted to Crozer-Chester Medical Center, a burn center near Philadelphia. He had third-degree burns over 65 percent of his body. He spent the next 6 months undergoing multiple surgeries and extensive therapy and was still undergoing therapy and follow-up surgery 9 months later. None of the passengers or other crew members were injured.

  Train Damage

A post accident inspection of locomotive 1278 revealed that the firebox was the only area to sustain major damage. (See figures 2, 3, and 4.) The crownsheet toward the front of the locomotive next to the rear tube-sheet knuckle¹¹ had bulged downward a maximum of about a foot in a "bag" shape that covered an area encompassing about 60 crown stays. The crownsheet holes around the crown stays had been deformed and elongated, creating gaps about the crown-stay heads. The crownsheet knuckle next to the flue sheet had a 6 inch tear. Also, two front (near the flue sheet) right firebox grate panels of the firebox floor had broken and fallen onto the ashpan below.

It is not possible to estimate the monetary cost of the accident. Because each steam locomotive is unique and because very few facilities can do major repairs for a steam locomotive, there are no flat rates for repairs. Instead, the repair facility estimates the price of each repair on a cost plus basis. Costs vary extensively from facility to facility.

  Gettysburg Passenger Services

Gettysburg Passenger Services is an outgrowth of the steam powered excursion services begun on the Gettysburg Railroad in June 1978. The Gettysburg Railroad is a shortline freight railroad that connects CSX at Gettysburg with Conrail at Carlisle Junction, a distance of 23.7 statute miles. In 1986, the owner of Gettysburg Railroad formed Gettysburg Passenger Services to run the excursion service of Gettysburg Railroad, and he transferred ownership of Gettysburg Passenger Services to his son and daughter-in-law.

The son and his wife were responsible for hiring and supervising the company's employees, and the son was also primarily, if not solely, responsible for the care and operation of the excursion equipment, including the steam locomotives. His responsibilities included maintaining and testing steam locomotive 1278 in accordance with the Federal Railroad Administration's (FRA's) regulations. (The FRA's regulations are recorded in 49 Code of Federal Regulations [CFR] Part 230). He was also the primary engineer of locomotive 1278, and he was operating the locomotive at the time of the accident.

In 1994, Gettysburg Passenger Services carried about 50,000 passengers. It leased track and equipment, including steam locomotives and passenger cars, from Gettysburg Railroad. Gettysburg Passenger Services and Gettysburg Railroad shared locomotive maintenance facilities and some train crew personnel. Gettysburg Railroad diesel-electric locomotives frequently doubled as helpers or backup relief for the excursion service. The two companies accounted separately for labor, services, equipment, and supplies.

  Engineer

At the time of the accident, the engineer was 48-years-old. He had obtained most of his knowledge of railroad and steam locomotive operation while growing up. He said he had been surreptitiously allowed to be the fireman on Pennsylvania Railroad locomotives near his home starting when he was about 15-years-old. His father began developing a steam tourist railroad in Blairsville, Pennsylvania, in 1959, which became fully operational in 1964. The father testified that his son had first officially started running a steam locomotive when he was 18-years-old, receiving instruction from professional railroaders. The engineer told Safety Board investigators that he had no formal railroad or steam locomotive training¹².

Between 1978, when Gettysburg Railroad had started its steam powered excursion service, and the time of the accident, the engineer had been the primary operator of the steam locomotives. He was also the primary service, maintainer, and repairer of the locomotives and cars, however, he contracted out work that required specialized skills and/or tools or was beyond routine maintenance or the capability of one or two people. He did many of the jobs himself with little or no assistance. The FRA requires that a form No. 1 be signed after routine maintenance, such as washing the boiler and cleaning the spindles¹³, has been done on a locomotive. The person who signs the form is certifying the work has been done. The owner must keep the forms on file for FRA review. The engineer signed all the forms having to do with the accident locomotive.

According to his wife, the engineer had a routine day up until the time of the accident. He had started work at 06:45, done the necessary pre-trip work, made excursion trips at 11:00 and 13:00 and finished about 15:00, more than 8 hours after he had started. After a 2 hour break, he reported back for the dinner train, about 17:00.

  First Fireman

The first fireman, age 18, who fired the locomotive from the time the dinner train left Gettysburg until the crossing at Gardners, had been employed by Gettysburg Passenger Services since 1992. At the time of the accident, he was a student working full time for the excursion service while on summer break.

He had no prior railroad experience, and his training as a steam locomotive fireman had been on the job training (OJT). He had been trained by the engineer, by one other full-time employee, and to some extent, by the fireman with whom he was working at the time of the accident. He described his training as consisting of observation, demonstration, and then performance.

He said he was well rested on the day of the accident. From 07:30 to 15:30, or for about 8 hours, he had worked on building an earthen ramp with a backhoe. After 15:30, he took a break until about 17:00, when he reported for the dinner train.

  Second Fireman

The second fireman, 32, was a full-time supervisor at a local industry. He had worked for Gettysburg Passenger Services for 5 years as a part-time fireman. Like the first fireman, he had no previous railroad experience and was given OJT, principally by the engineer. As a fireman, he had made about 50 trips each season during his first 3 years and about two dozen in the 2 years preceding the accident.

On the day of the accident, he arrived at the engine house at about 17:00, after working a full day at his regular job.

  Helper Engineer

The helper engineer, 21, started railroading in 1989 as a part-time summer employee with Gettysburg Passenger Services, firing locomotive 1278. He had no previous railroad experience and took OJT from the engineer. After graduating from high school, he became the only full-time train crew member with Gettysburg Passenger Services other than the engineer. When the helper engineer was 18, the engineer taught him how to operate diesel-electric locomotives, as well as steam locomotives. During the off season, when the tourist train did not make excursions, he helped the engineer maintain the locomotives and cars.

He testified that his normal hours were 07:30 to 16:00. On the day of the accident, he said, he came to work at the regular time, worked freight from 07:30 to 12:30, and worked in the train yard from 12:30 to 15:30, for a total of about 8 hours. He then went home for a break, reporting back for helper duty at 17:30. He said he followed the excursion train "about 15 or 20 minutes behind" until Wolf Pit.

  Training

According to the engineer's wife, the company had started a formal training program 2 years ago. The training consisted of classroom and hands-on training and included showing a safety film from Tourist Railway Association Inc., (TRAIN), followed by a question-and-answer period. The engineer taught the course, which lasted 4 or 5 hours, once a year, before the start of the tourist season. Although the company did not keep attendance records, all the employees attended the course. Employees interviewed by Safety Board investigators stated that they had a training session some time in April 1995.

Gettysburg Passenger Services did not have a formal program for training or certifying an engineer as qualified, nor was it required to have one. The company was able to meet the FRA's definition of certifying an engineer (49 CFR 2430.101) by filling out a generic, American Short Line Association, fill-in-the-blank document and sending it to the FRA.

Beyond the recent pre-season training described above, each Gettysburg Passenger Services employee described his or her training as being OJT typified by watching others do the work, demonstrating the ability to do the work, and then performing the work in the context of day-to-day operations. The company did not use training records, task lists, tests, or other training organization or documentation papers. Training was random, based on the day's operations. The employees were not taught regulatory requirements, standardized industry practices, or the theory of steam-boiler operation. Such training is not required.

  Delineation of Duties

The following exchange with the first fireman took place during his testimony:

Q: Who was operating the feed pump most of the time during the trip?
 
A: That would have been me.
 
Q: Would you say you were the one running the feed pump all the time on that trip?
 
A: Not all the time. We had two firemen. Two firemen.
 
Q: But was your role the lead fireman that day?
 
A: I would not, we don't have a lead fireman. We have others here to back everyone up.
 
Q: What I meant by that was, was there an agreement between you and the second fireman that you would do most of the duties and he would back you up, or vice versa?
 
A: No.
 
Q: So you had a kind of division in responsibilities, but it wasn't clear who exactly was in charge of the fireman's duties?
 
A: Well, no. There's, we both are competent firemen. We both know what we are doing.

The second fireman, referring to operation of the feed pump, testified as follows:

Q: When you and the first fireman were sharing the duties, had you actually turned the feed pump on yourself in the few minutes, I mean, on that leg of the trip just before the incident, you had relieved the first fireman, more or less?
 
A: Yes.
 
Q: So you were acting as kind of the fireman.
 
A: Yes.
 
Q: in charge?
 
A: (Shrugs shoulders)
 
Q: So, when the two of you were working together, you had a clear understanding of who would do what, who would be responsible for what?
 
A: Pretty much. But I basically left it up to him. I was there to give him a break and such.

  Locomotive 1278

Canadian Locomotive Company Ltd., in Kingston, Ontario, Canada, built locomotive 1278 for the Canadian Pacific Railway in April 1948. The locomotive had a 4-6-2¹⁴ Pacific¹⁵ wheel arrangement and was designed for passenger service. Its cylinders were 20 by 28 inches, boiler pressure was 250 psi, and driver diameter was 70 inches. It weighed 234,000 pounds, with 151,000 pounds on drivers, and had 34,000 pounds of tractive effort. Its cab had side doors and was an enclosed all-weather, or winter-type, cab. (See figure 5.)

The locomotive had a variety of owners and operators. In May 1965, the Canadian Pacific Railway sold the locomotive to a man in New Hampshire. In 1969, he donated it to Steamtown, a railroad museum then located at Bellows Falls, Vermont, and it was renumbered 127. From June 1970 to August 1971, it was leased to the Cadillac & Lake City Railroad in Lake City, Michigan, as locomotive 127. In September 1971, it was returned to Bellows Falls and renumbered 1278. In 1984, it was moved, along with Steamtown, to Scranton, Pennsylvania. In June 1987, Gettysburg Railroad bought the locomotive and leased it to Gettysburg Passenger Services.

  Boiler Information

According to form No. 4¹⁶, locomotive 1278 had a radial-stay, straight-bottom, wagon-top boiler with three courses, or diameters. The boiler was constructed of three connected rings or courses of different diameters. The lowest tensile strength of the steel was 72,100 psi for the first course, 80,030 for the second course, and 70,840 for the third course. The crownsheet was 3/8 inch thick when new. The water space at the firebox back was 3 1/2 inches. The firebox grate was 45.6 feet square. The lowest level of water in the boiler that the water glass could indicate was a level 3 1/8 inches above the highest point of the crownsheet. The height of the lowest gage cock¹⁷ above the crownsheet was 3 1/4 inches¹⁸.

In accordance with Canadian Pacific policy, the crown stays, which supported the crownsheet from the boiler roof sheet¹⁹, were alternating rows of straight-thread and button-head crown stays. (See figures 6 and 7.) The first five rows from the rear tubesheet knuckle (next to the tubes and flues) were straight-thread crown stays followed by rows of button-head crown stays. The boiler had been made that way so that if the crownsheet failed because it was not covered by water, it would be pushed off the straight thread crown stays first. Consequently, although the crownsheet would buckle, it would be retained for a time by the buttonhead crown stays. Thus, if the crownsheet failed because of too little water, the failure would occur progressively and in stages, rather than instantaneously and catastrophically²⁰. Other than being designed to make a failure a progressive, rather than an instantaneous event, the boiler did not have any low-water protection devices.

  Cab Equipment and Arrangement

The cab of locomotive 1278 surrounded the backhead of the boiler²¹. (See figure 8.) A number of devices, including gages and the water glass, were mounted on the backhead. The backhead was also the location of the back of the firebox and the firebox door. Below the firebox door was the automatic stoker-auger entrance used to deliver coal to the firebox. The backhead had a number of washout plugs²². The engineer's seat was to the right side of the boiler and slightly to the rear of the backhead. Similarly, the fireman's seat was along the left side of the boiler.

On the engineer's side of the cab were the air-brake controls and gages, throttle lever, reverser (valve cut-off control), boiler-pressure gage, injector operating lever²³, the three gage-cock operating handles, and a number of other accessory controls, handles, and levers. On the fireman's side of the locomotive cab were a number of gages and controls for managing the boiler and steam production. Three gages, stoker jet-pressure gage, steam-heat pressure gage, and feed pump pressure gage, had been removed from a mounting plate on the fireman's side²⁴, leaving only a stoker-engine steam pressure gage, and a boiler-pressure gage. (See figure 9.)

The engineer told Safety Board investigators that he removed the original feed-pump gage after it failed and that when the replacement also failed he had decided not to replace it.

A fireman uses the feed-pump pressure gage to ensure that heated feed water is overcoming boiler pressure and is flowing into the boiler. The gage provides a direct indication that water is entering the boiler without the fireman looking at the water glass. At the time of the accident, a distinctive pentagon-shaped brass control knob with "feed-water pump" cast into it controlled the feed pump. Steam was delivered from the boiler through the left turret, or distributing valve, to the feed pump via the control knob. The feed pump, like the injector, could be adjusted to allow a variable amount of water into the boiler, or none when the feed pump was turned off.

The turret also provided steam to a number of other auxiliary devices, including the dynamo. The dynamo was a steam-turbine powered generator for the locomotive headlight, cab lights, and water glass light. At the time of the accident, the dynamo was connected to the turret, but the dynamo governor and the governor cap were missing, rendering the dynamo inoperative. A portable gasoline-powered generator that sat on the tender provided the power for the headlight. In violation of the FRA's requirements (49 CFR 230.42), the water glass did not have a working light. There were no working cab lights.

  Locomotive Maintenance Records

According to FRA regulations (49 CFR 230.51 and .53), a railroad company must inspect each of its locomotives every month and keep on file an inspection report (Form No. 1) for later FRA review. The company must do a yearly inspection and hydrostatic test²⁵ and document the result, on Form No. 3. Item 10 of Form No. 1 asks, "Was the boiler washed and the gage cocks and water glass cock spindle removed and the cocks cleaned?" Item 12 of Form No. 3 asks the same question without reference to removal, although cleaning implies the necessary removal.

According to a review of the most recent steam locomotive maintenance for the accident locomotive, the "Officer in Charge", who was both the co-owner of Gettysburg Passenger Services and the accident engineer, had signed forms No. 1 for April and May 1995 and Form No. 3, dated May 1995. According to Gettysburg Passenger Services employees, he was the person in charge of all equipment maintenance and repairs. All forms indicated that the boiler had been washed and that the gage cocks and gage cock pipes²⁶ had been removed and cleaned. The forms also indicated that the locomotive had been out of service for 6 months, from 1 Nov 1994 to 1 May 1995.

  Crownsheet Failure

The following, taken from the October 1943 Railway Mechanical Engineer, a respected industrial publication of the time, describes what happens when the crownsheet is not sufficiently covered by water:

The flames and hot gases in a locomotive firebox at a temperature of from 1,500 degrees F to 2,500 degrees F heat the firebox sheets²⁷ which, while covered by water, remain at about the temperature of the water. This temperature is dependent on the steam pressure in the boiler, and is in the neighborhood of 400 degrees F. If, however, sufficient water is not at all times present to keep the firebox sheets at the proper temperature, the sheets become overheated. Firebox steel when heated becomes slightly stronger until about 500 degrees F is reached, after which the strength falls off very rapidly until at 1,600 degrees F the steel has lost about 85 percent of its strength at normal temperatures. At some stage during this overheating, the strength of some part of the boiler, usually the crownsheet²⁸, becomes less than that required to withstand the load of steam pressure, and rupture occurs. The force of the resulting explosion is in proportion to the size and the suddenness of the rupture, and the temperature and amount of water in the boiler. At the instant the steam is released from the boiler, the water in the boiler flashes into steam until a heat balance is effected. This steam, generated so instantaneously, occupies a space vastly greater than that occupied by the water in the boiler, perhaps 1,500 or 2,000 times as great. The terrific rush of the steam to occupy this greater space often tears the boiler off the locomotive frame and results in rocket like behavior of the boiler.

The FRA requires that "every boiler be equipped with at least one water glass and three gage cocks" (49 CFR 230.37). In other words, each steam locomotive is required to have two independent systems to monitor the level of water in the boiler. The rationale for having redundant systems is that if one fails, there will be another to prevent low water and a resulting explosion. The two systems for monitoring boiler water are the water glass and the gage cocks. The FRA also requires that every steam locomotive have two independent and redundant systems for supplying the boiler with water, the injector system and the feed-pump system.

  Water Glass

The water glass is the primary means for the engineer and fireman to monitor the water level in the boiler. (See figure 10.) Mounted on the backhead of the boiler, the water glass is a vertical glass tube that shows the level of water in the boiler.

The FRA requires that "the lowest reading that the water glass shows shall not be less than 3 inches above the highest part of the crownsheet" (49 CFR 230.37). Consequently, as long as the water glass shows a water level, the crownsheet is covered by at least 3 inches of water at all times if the locomotive is on level terrain, and somewhat less if the locomotive is going downhill. According to Form No. 4 for locomotive 1278, the lowest level of water in the boiler that the water glass could indicate was at least 3 1/8 inches above the highest part of the crownsheet.

The water level in the water glass will fluctuate somewhat in response to track conditions, vibrations, and such conditions as a surge of water in the boiler caused by starting or stopping the train. An experienced engine crew can still accurately estimate the level of water in the boiler by noting the midpoint between the maximum and minimum changes in the indicated water level in the water glass. Some steam locomotives are equipped with dampeners that smooth out the water level movement in the water glass in an attempt to provide a more accurate, if not instantaneous, indication of the boiler's true water level. The accident locomotive did not have a dampener.

The accident firemen testified that the fluctuation in the water glass was about 1/2 inch up or down. Neither fireman took exception to this amount of movement, and both indicated that such movement was normal. One industry expert²⁹ stated that such limited fluctuation "clearly indicates a problem with the glass" and that normal fluctuation is as much as 4 inches plus or minus 2 inches. The expert further said he believed that a water level movement of only 1/2 inch "is a serious indication of an obstructed glass."

The locomotive cab was covered in ash, dust, and small cinders from the explosion. Therefore, it was not possible to determine the conspicuity of the water glass before the accident. The light for the water glass was inoperative, the wiring appeared to have been grounded for some time. According to FRA regulations (49 CFR 230.42, "Water Glass Lamps"), all water glasses must have a lamp that is located in such a way that the engineer can easily see the water in the glass. The firemen indicated that they carried no light source, such as a flashlight, with which to check the water glass. The second fireman said that at night the crew used the cab lights powered by the gasoline generator on the tender and that they had an electric lantern that sat on the floor by either the engineer's or the fireman's seat.

The water glass had a protective glass covering, or shield, as the FRA required (49 CFR 230.41), to stop pieces of flying glass if the water glass broke, however, the covering was also covered with debris from the firebox explosion, making it difficult to read the water glass with any accuracy. The shield was subsequently removed for further tests. The water glass system was disassembled and inspected. (See figure 11.)

The investigators removed and inspected the two valves, or shutoff cocks, (top and bottom) that connected the water glass to the boiler, as well as the water glass drain cock. This assembly included the two spindles that go through the boiler shell. According to FRA requirements, "all water glasses must be blown out and gage cocks tested before each rip and maintained in such a condition that they can be easily opened and closed by hand without the aid of a wrench or other tool." Also, "the spindles of all gage cocks and water glass cocks shall be removed and cocks thoroughly cleaned of scale and sediment at least once a month" (49 CFR 230.40 and .39, respectively). After the accident, the passages had significant deposits. The water glass spindles were 75 to 85 percent plugged by hard scale. The investigators could not determine how much, if any, soft deposit or scale had been blown out during the explosion. (See figure 12.)

According to the regulations, the boiler must be washed once a month and the spindles must be reamed. When asked if the amount of scale found in the spindles could have accumulated between monthly cleanings, one steam locomotive expert said, "No, no possible way." Another said, "I have never seen a locomotive that had as much scale inside the water glass spindle as the 1278. I worked on a lot of locomotives all over the country and never saw anything like this." The chief mechanical officer (CMO) of the Strasburg Railroad speculated that in such a restricted condition, the spindles would be much more susceptible to being blocked by floating material or scale flake. The investigators were unanimous in their conviction that the amount of scale found in the spindles could not possibly have accumulated within the relatively short time between monthly boiler washings, regardless of the condition of the water used. (See figure 13.)

Safety Board investigators used a flexible clear plastic hose to measure the response of the water in the water glass to changes in the level of water in the boiler and to determine how visible the water level in the water glass was to the cab's occupants. The water glass system was reassembled in order to conduct this test. The water level was changed by moving the hose attached to the boiler tap, thus simulating water level changes in the boiler. The changes appeared immediately in the water glass, and the water glass system appeared to function as designed under these non-pressure, non-operating, conditions.

  Water Glass Blowdown

One of the basic tasks an engineer and fireman must be able to perform is to "blow down," or verify that the water glass and the spindles are not blocked or restricted. According to the FRA (49 CFR 230.40), "All water glasses must be blown out and gage cocks tested before each trip." However the regulations do not prescribe the blowdown procedure.

The National Board Inspection Code of the National Board of Boiler and Pressure Vessel Inspectors (NBBPVI) is recognized nationally by the CFR as an American National Standard and internationally as ANSI/NB-23. According to that code, the proper method of blowing down a water glass is as follows (from Chapter II part I-204.3, "Water Level Gage (Steam Boilers)"):

The inspector should ensure that the water level indicated is correct by having the gage tested as follows:

a. Close the lower gage glass valve, then open the drain cock and blow the glass clear.
 
b. Close the drain cock and open the lower gage glass valve. Water should return to the gage glass immediately.
 
c. Close the upper gage glass valve, then open the drain cock and allow the water to flow until it runs clear.
 
d. Close the drain cock and open the upper gage glass valve. Water should return to the gage glass immediately.

If the water return is sluggish, the operation should be repeated. A sluggish response could indicate an obstruction in the pipe connections to the boiler. Any leakage at these fittings should be corrected to avoid damage to the fittings or a false waterline indication.

Although 49 CFR 230.40 requires that water glasses be blown down, the procedure for doing so is not given or specified in any applicable Federal rules. Nor are any other rules of the National Board Inspection Code applicable by law or regulation to steam locomotives not governed by the National Board Inspection Code. The Gettysburg Passenger Services employees did not have any reference materials that explained the proper method of blowing down a water glass,

When Safety Board investigators asked the first fireman to demonstrate the proper method of blowing down the water glass, he failed to demonstrate the correct method. Similarly, the second fireman failed to show and explain the proper method. He said he had no formal training on blowing down the water glass, but that he had been shown how to do it. When the helper engineer was asked to describe the blow-down procedure, he said, "Open the bottom valves on the sight glass, and it blows steam through the glass to clean it." He also said this was not to check the validity of the glass but "just the drain." No crew member was officially responsible for knowing the approved method of blowing down the water glass. The owner of Gettysburg Railroad (the engineer's father) and a Gettysburg Passenger Services employee who was qualified as both a steam locomotive fireman and an engineer were each asked to explain and demonstrate how they would go about blowing down and verifying the water glass. Only the owner demonstrated the correct method. Neither the accident engineer nor the firemen knew how to properly validate the water glass.

  Gage Cocks

Mounted near the engineer's seat are three gage cocks that tap into the backhead of the boiler at various levels. The cocks are a backup system for the water glass and help ensure that water is maintained over the crownsheet. To check the water level, the engineer opens one of the gage cocks. Theoretically, if water drains from the valve, the engineer is assured that the level of water over the crownsheet is at least as high as the gage cock is. This may not always be the case if there is a false head, which will be explained later. As with the water glass, the lowest gage cock is mounted at least 3 inches above the highest point of the crownsheet. The height of the lowest gage cock on locomotive 1278 was 3 1/4 inches above the crownsheet.

Removing the three gage cocks revealed that the lowest cock was totally obstructed by deposits and that the middle cock was half obstructed. Only the highest cock was clear of restrictions. The accident firemen stated that they did not test the gage cocks and did not know whether the engineer ever did.

  Boiler Water Behavior

Since the water glass and gage cocks are redundant, they should indicate the same water level. However, depending on the arrangement and maintenance of the boiler water monitoring equipment, this may not be the case.

In the early part of the century, a number of locomotive boilers exploded in locomotives that had only gage-cock monitoring systems. Consequently, the Bureau of Locomotive Inspection of the Interstate Commerce Commission (ICC) launched an investigation in 1919. The Bureau conducted a number of tests and documented the movement of boiler water around the firebox, as discussed below³⁰.

Upon entering the boiler, water from the tender is relatively cool and dense. The water moves from the front and lower parts of the boiler, which are "colder," to the "hot" rear and top of the boiler, which are warmer because they are around the firebox, where the heat is generated and where the greatest exchange of heat takes place. When the water is heated, it rises as its density decreases. As the water finally migrates around the sides and back of the firebox, water heating and movement are greatly accelerated, and steam bubbles begin to form and rise to the surface. This rapid movement upward creates momentum and an up-welling of water above and along the outside of the crownsheet. The up-welling of water is most rapid at the firebox rear, especially between the door sheet and the backhead, creating a standing head of water (a false head) above the crownsheet rear where the gage cocks are installed.

Depending upon the placement and length of the pipes leading from the gage cocks into the boiler, the false head may cause the gage cocks to indicate that the water level over the crownsheet is higher than it actually is. Thus, while the gage cocks may indicate plenty of water, in reality there may be little or no water over the crownsheet. Consequently, gage cocks are problematic when used by themselves and questionable as long-term redundant devices for a water glass. Because of this documented phenomenon, the United States Railroad Administration's Committee on Standards adopted the water column as a recommended practice in February 1920.

The water column is a small cylindrical device that is connected to the boiler in much the same fashion as a water glass, however, the water column is really a platform on which to mount a water glass and three gage cocks. (See figures 15 and 16.) The water column has a limited dampening effect and prevents the high level of water (false head) in the back of the boiler from being falsely indicated by the gage cocks as the true water level. This arrangement ensures that the water glass and the gage cocks indicate the same and a true water level.

Steam locomotive maintenance literature states that maintenance has a significant effect on water monitoring devices, particularly the water glass. If the spindles that lead from the boiler to the water monitoring devices are not clean, the water level indication may be false. When steam locomotives were in common use, the standard practice was to clean the interior of the spindles, water glass, water column body, gage cocks, and associated piping of scale with a reamer or drill sized to fit the interior diameter of the pipe or component. The reaming restored the parts to their original condition.

FRA regulations imply that unless the gage cock pipes are periodically cleaned, the pipes may become so plugged by scale that water is unable to pass through them and the gage cocks, as a result, might inaccurately indicate a low level of water in the boiler. At first, it might seem that indicating that the water level is lower than it actually is, would not be a problem. If the engine crew thought that there was less water in the boiler than there actually was, they might increase the water flow to a boiler that already had enough water. Raising the level of water in the boiler unnecessarily is not necessarily dangerous, but it is not efficient and could increase the chance of incompressible water entering a cylinder (called "working water"³¹) and causing a cylinder head to be blown off.

When water glass spindles become progressively encrusted with scale, unpredictable and unreliable indications may result. As moving water at the boiler backhead moves past one or both spindle orifices of the water glass, a slight pressure drop is created. Normally, this has little or no effect on the height of the column of water in the water glass, however, should one or both spindle orifices become partially closed off by the gradual buildup of scale, the height of the column of water in the water glass may be affected, depending on the location and extent of the buildup.

The result of water glass spindles being partially closed by scale might be a falsely high water level indication. Also, if the valves at the top or bottom of the water glass are not completely open, the result again may be a falsely high water level indication.

According to a leading mechanical engineer and recognized boiler expert with ABB Combustion Engineering, several crownsheet failures occurred in England during World War II because the water glass spindle valves were only partially open. The English crews of U.S. Army 2-8-O locomotives were unaware that the top valve of the water glass had to be completely open. Partially opened valves resulted in the water glass showing a water level that was higher than the actual water level in the boiler. The crownsheets became overheated, and explosions occurred. Those locomotives, like the accident locomotive, had one water glass and one set of gage cocks.

  Boiler Water Supply System

The investigators also examined the devices used to supply water to the boiler. Two types of water supply systems are used on steam locomotives, the injector system, and the feedwater system. Most steam locomotives have both systems, but older steam locomotives may have two injector systems instead. Locomotive 1278 had both systems. The injector and feedwater systems can be used separately or together and can act as backups for each other, however, the injector system functions more efficiently when the locomotive is standing, while the feedwater system functions more efficiently when the locomotive is moving.

The boiler water supply system consists of (in order of flow) treated or untreated water from the tender, strainers in the tender and delivery hose, the feedwater heater (if the locomotive has one), the feed pump or the injector(s) with their respective check valves to prevent pressure backup, and two stop valves to shut off leaking check valves.

The injector pumps unheated water directly from the tender into the boiler, heating it in the process. The feed pump supplies water to the boiler indirectly through the feedwater heater. The feedwater heater is a heat exchanger that absorbs heat from used cylinder exhaust steam that is otherwise lost up the exhaust stack. The feedwater heater is more efficient when the locomotive is moving because there is more exhaust heat and steam.

The engineer controls the injector with a knob on his side of the cab. The fireman controls the feedwater system with a pump control valve that is on his side of the cab. After the accident, the injector was found closed, and the feed-pump control valve was found open 1 1/2 turns. The amount of water these devices supply to the boiler depends on boiler demand, so their valve control or knob positions do not indicate whether a sufficient amount of water is being provided. It is therefore critical for the fireman to closely monitor the water glass and/or gage cocks.

After the accident, the CMO of the Valley Railroad at Essex, Connecticut, examined the injector of locomotive 1278 and reported:

Upon entering the cab of the locomotive I found that the turret valve for the injector was shut off. Later on the next day, the steam valve of the injector itself was disassembled to see if any problem could be found. Upon disassembly, it was found that the steam valve disk inside the injector was not the correct steam valve disk for that model injector. The Edna Type L lifting injector has to prime to get water up into the body of the injector. To do that, the steam valve disk has a protrusion on the end of it which allows when opened just a little bit of steam to come by that protrusion and enter the annular nozzle, which creates a vacuum which raises the water. The disk that we found inside the 1278's injector did not have that protrusion. Therefore, when the steam valve was opened, it would be very difficult to prime the injector. If a lifting injector cannot prime, it cannot operate. Now, it's possible that the injector might function, but only with some difficulty.

According to their testimony, none of the train crew members were aware of the need for a specific disk type in the injector.

  Water Treatment

Water used in boilers is frequently treated with chemicals and processes to minimize the buildup of scale inside the boiler and inside all the other devices that come in contact with the steam and boiler water. Treating the water also reduces corrosion and maximizes heat transfer. Water monitoring and supply systems are dependent on the free flow of water and do not work correctly if the boilers and their attached devices are not free of scale. Thus the cleanliness of the boilers and devices has safety implications.

Depending on the source of the water, it can be softened shortly before it is put into the tender, or it can be treated while it is in reservoirs and holding tanks. Safety Board investigators explored the nature of water treatment used by Gettysburg Passenger Services.

During testimony, the investigator from Gettysburg Passenger Services was asked if the company had water treatment facilities. He replied:

Well, I saw some evidence of water treatment. There were some empty containers around. But we saw no evidence of a regular program in place. And by a regular program, I mean a written procedure for doing an analysis of the boiler water every day, recording, testing the water every day for the presence of oxygen, pH, how much hardness is in the water, the conductivity of the water, how much stuff is in there. Typically, what people do is they test for these things every day, they record it on a chart and then make a determination of the chemicals based on what's in the boiler that day to correct whatever deficiency there is in the water. And we found no evidence of that whatsoever.

The owner of Gettysburg Railroad said:

I noticed that the accident engineer had put a water softener in several years ago to soften the water due to the fact that Gettysburg has very, very, hard water to work with. I will go a little further. When we first come to Gettysburg, we were foolish enough to leave water sit in that engine about 2 months. It cost us to have the boiler acid cleaned. So, he put the water softener in.

According to testimony, the accident engineer sent boiler and/or supply water samples to the Water Chemical Services (Water Chem) of Aberdeen, Maryland³² for testing. However, Water Chem has no record of dealing with Gettysburg Passenger Services except for filling an order for 100 pounds of sodium tri-phosphate, a suspension agent that was delivered 19 May 1995 less than a month before the accident.

The engineer told Safety Board investigators in a post accident interview that he performed his own water testing with a kit, much like that used for swimming pools. He stated that he kept a journal of the water testing that he performed. No test results were found or provided.

  Boiler Washing

The interior of a boiler is washed to minimize scale buildup in order to ensure that the boiler and its devices operate safely and efficiently. According to FRA regulations (49 CFR Part 230.45, "Time of Washing"):

All boilers shall be thoroughly washed as often as the water conditions require, but not less frequently than once each month. All boilers shall be considered as having been in continuous service between washouts unless the dates of the days that the boiler was out of service are properly certified on washout reports and the report of inspection.

Locomotive 1278 had 29 washout plugs, and the FRA regulations (49 CFR 230) require that all washout plugs be removed when a boiler is washed. The regulations also require that special attention be given to removing scale on arch and water bar tubes and that a record be kept of all washing (49 CFR 230.46 and .230 and .48, respectively). Since a boiler wash and inspection are both required monthly, they are usually recorded and filed together on Form No. 1.

The FRA regulations do not specify what constitutes a proper washing. The railroad industry has long had detailed methods and special equipment for boiler washing. In 1915, the American Railroad Administration (ARA) adopted a recommended practice for boiler washing that included a number of recommended designs for boiler wash nozzles. The Advisory Mechanical Committee, Equipment Engineering Department, of the C&O Railway, the Erie Railroad, the Nickel Plate, and the Pere Marquette Railway issued Standard Maintenance Equipment Instructions #105 on 3 Aug 1936 for boiler washing and blow down. In November 1995, the members of TRAIN, in an effort to promote safe steam locomotive operation, sponsored seminars on the proper method of boiler washing.

During his testimony, the first fireman described how he washed the boiler of locomotive 1278 by himself:

You take the four plugs out. In the boiler under, by the firebox, there's a plug in the right-hand side and on the left-hand side up front, and there's two in the back, both sides. You take those out. There's three plugs along the top in the cab right above the firebox doors. You take them out and then you wash the boiler out. You run, we have, I believe it's a 2 inch hose that we run through it. We wash it to the point where we get no sediment out anymore and the water is clear.

The CMO of the Strasburg Railroad in Pennsylvania summarized how a steam locomotive boiler should be washed out:

Take out all the washout plugs, and essentially that's any plug in the boiler that allows access into the boiler. And when you do that, then basically we use a hose to try and get the highest pressure we can. And we go to each washout hole, and we attempt to wash all surfaces, the interior surfaces of the boiler. And that's more or less difficult depending upon the design of the locomotives. Our little locomotive has 34 washout plugs on it. Our biggest locomotive has 17. It was just the way the locomotive was built according to the railroad specifications. So you just wash it as thoroughly as you can and wash the stuff basically from the top down, from the front to back, collect everything in the mud ring, then use your four corner plugs to wash that stuff out of there. And you make a special attempt to rattle your arch tubes, which is a mechanical cleaning process.

The CMO was asked whether he thought the boiler in locomotive 1278 had been recently washed out. He replied:

It could have been, I don't know. I have never seen a locomotive that blew up before, so I don't know what effect that had on things. It had a lot of scale in it. It had a lot more scale than I would like to see in a boiler if that boiler was in service at Strasburg.

  Low Water Devices

During the investigation, the Safety Board explored the availability of devices that can prevent or warn of low water or mitigate the effects of such a condition. Research revealed that the railroad industry has over the years developed several such devices.

Low Water Alarms - Railroad industry manufacturers and suppliers developed a variety of devices that warned that the level of water in the boiler was too low. The devices warned engine crew members before the boiler exploded or the crownsheet burned. Low water alarms were made by the Nathan Manufacturing Company of New York, the Ohio Injector Company of Illinois, and the Barco Manufacturing Company Inc. Some of the alarms used floats while others detected abnormal expansion and/or temperature. Once activated, the alarm signaled the cab crew, using a warning whistle that continued to blow until the level of water in the boiler rose or a crew member reduced the heat of the crownsheet by releasing the fire in the firebox into the ashpan.

There was and is no Federal requirement that steam locomotives have low water alarms. Opinions about the effectiveness of low water alarms do and did vary widely among steam locomotive experts of today and railroad officials from the days of steam. Depending on the sensitivity of the alarm, locomotive crews were known to treat the alarm as a nuisance and muffle the whistle. Mechanical employees found the alarms to be an additional burden and expense to maintain. Some railroads favored low water alarms, others did not. Some steam locomotives still operating are equipped with low water alarms³³. Locomotive 1278 had no low water alarm.

Fusible Plugs - The crew members cannot tamper with fusible plugs, also called "drop plugs", as they can with low water alarms. Fusible plugs consist of a short, pipe shaped brass body that is screwed into the crownsheet at specified locations. (See figure 17.) Within the brass body is a brass plug held in place by a ring of fusible alloy metal that softens or melts at temperatures between 500 and 575 degrees F. Once the crownsheet reaches the critical temperature, the ring melts and allows the brass plug to fall into the firebox, allowing steam to spray the fire, attracting the crew's attention, and relieving steam pressure. Depending on the number and placement of the plugs, the activation may continue, effectively preventing permanent damage or an explosion, but at the same time disabling the locomotive. Once fusible plugs have been activated, the locomotive must be taken to a maintenance facility for repair. This disadvantage makes fusible plugs, like low water alarms, controversial. As with low water alarms, the use of fusible plugs varied widely, depending on the railroad.

Federal regulations do not require the use of fusible plugs but do require that if the plugs are used, they must be maintained. According to the FRA's regulations (49 CFR 230.14, "Fusible Plugs"):

If boilers are equipped with fusible plugs they shall be removed and cleaned of scale at least once every month. Their removal must be noted on the report of inspection.

Locomotive 1278 did not have fusible plugs.

  Regulation and Oversight

Observers have long recognized the dangers inherent in employing steam to power industry and transportation. In 1863, British Royal Astronomer George B. Airy calculated that at a pressure of only 60 psi, every cubic foot of boiler water has the same destructive energy as a pound of black gunpowder³⁴.

The first steam locomotive boiler explosion occurred on 17 Jun 1831, when the South Carolina Railroad's Best Friend of Charleston blew up because a man annoyed by the sound of the safety valve sat on it to prevent it from hissing. Boilers continued to blow up or fail for a variety of reasons, including poor construction and/or design. With the introduction of the firebox into the boiler, however, the most spectacular and deadly forms of failures have been those that have resulted from a crownsheet that has been overheated and weakened because of a low level of water in the boiler, as in this accident³⁵.

The types of boiler explosions that could affect the public were regulated quickly and early. Congress passed a steamboat inspection law in 1838 after the steamboat Moselle blew up, killing 300 people. The first State boiler inspection law went into effect in 1867 in New York after stationary boiler explosions in the 1850s killed scores of people. Historically, the public risk from steam locomotive boiler explosions has been minimal. Unlike steamboat and stationary boiler explosions, generally the only people affected by steam locomotive boiler explosions have been, as in this accident, the trainmen and engine crew. Consequently, it was not until 1909 that the first bills to regulate locomotive safety were introduced in Congress³⁶.

Specifics of the locomotive safety bill, such as the provision requiring water glasses, were supported by labour and opposed by the railroads. The railroads' greatest objections were to provisions that required government inspection but left responsibility for safety and accountability for accidents solely with the carrier railroad. Finally, a compromise was reached. An amended version of locomotive inspection dropped requirements for specific safety devices and no longer required direct government inspection. Instead, the carriers were required to file inspection rules with the ICC and to do their own inspections. The government inspectors only spot checked and oversaw the process and investigated accidents. Essentially, this level of oversight remains in effect today, with the FRA, rather than the ICC, taking the regulatory role. The bill that required "Railroads to equip their locomotives with safe and suitable boilers and appurtenances thereon" was passed on 17 Feb 1911 and became law 4 months later. Federal inspection started with fiscal year 1912³⁷.

There are now three sources of boiler regulation and oversight in the United States, one of them private and the other two governmental. Insurance companies are the private source. The insurers, such as the Hartford Steam Boiler Inspection & Insurance Company, the insurer in this accident, will generally inspect a boiler to determine whether it is safe enough to be insured and, if so, at what risk level. However, the insurer is not required to inspect. Although the Hartford Steam Boiler Inspection & Insurance Company insured the accident locomotive, it never inspected it.

Some local and most State governments regulate, inspect, and license the operation of stationary boilers, such as those used in heating and power plants, but generally not steam locomotive boilers. This is primarily because the FRA already has regulatory authority over steam locomotives. State boiler inspectors may, however, be responsible for steam locomotive boilers operated on railroads that do not fall under FRA jurisdiction, such as small tourist lines not connected to the railroad interchange system. Steam railroads that are not regulated by the FRA are not required to file a Form No. 4. The FRA has discussed bringing these lines under its jurisdiction.

As discussed above, the Federal regulations involving steam locomotives are found in 49 CFR Part 230. This title is no longer published each year as the rest of the CFR is, but must be requested separately from the FRA or other sources. Most of the standards, specifications, and procedures in 49 CFR Part 230 are from earlier railroad industry standards or early regulations of the ICC and date from between 1912 and 1916. The last major revision of the material was in 1946, long before the FRA was created (1966) and the Rail Safety Act of 1970 was passed.

FRA Responsibility - Generally, FRA motive power and equipment (MP&E) inspectors inspect a steam locomotive boiler only if the locomotive's owner files for an extension of the 4 year boiler-and-flue-tube inspection required by 49 CFR Part 230.10. At that time, the FRA inspector must inspect the boiler, but otherwise, boiler inspection is largely a self-certifying process, with the FRA checking to make sure that required inspection forms are filed according to the regulations, in the 1912 tradition set by the ICC. The FRA is not required to inspect a steam locomotive boiler unless an extension of the 4 year boiler-and-flue-tube inspection is requested, nor is such an inspection possible without the cooperation of the steam locomotive maintenance personnel, since a hot pressurized boiler cannot be inspected on short notice because it may require several days to cool down. The rest of the steam locomotive is subject to FRA inspection at any time, as is most other railroad equipment. However, given the limited number of FRA inspectors, not to mention the limited number of inspectors with steam locomotive expertise, and the high demands of commercial interchange railroad inspection, FRA inspectors are able to inspect steam locomotives only infrequently at best.

Steam locomotives for commercial railroad motive power had all but disappeared by the early 1960s because most major carriers had finished converting to diesel-electric locomotive power. The last common carrier railroad steam locomotive³⁸ was replaced by a diesel-electric locomotive in September 1970. Consequently there are no FRA and few railroad inspectors whose expertise is based on first-hand knowledge of steam locomotives. FRA inspectors now gain their expertise from limited classroom instruction. Unfortunately, many of the FRA's regulations are written in such a way that the inspector's ability to adhere to them depends heavily on his subjective experience and practical expertise. Testing for broken crown stays by tapping and listening for broken crown stays as required by 49 CFR 230.21 through .24 is one example of a procedure that requires an inspector who can rely on some level of continuous daily experience.

The regulations in 49 CFR 230.102 and 103 assign the responsibility for inspection and repairs and define the term "inspector".

230.102 Responsibility for inspection and repairs. The mechanical officer in charge, at each point where repairs are made, will be held responsible for the inspection and repair of all parts of locomotives and tenders under his jurisdiction. He must know that inspections are made as required and that defects are properly repaired before the locomotive is returned to service.

230.103 Term "inspector". The term inspector as used in the rules and instructions in this subpart means unless otherwise specified, the railroad company's inspector.

The regulations do not specify the level of education or experience needed by someone who inspects steam locomotives or repairs and maintains them. The regulations assume that an individual with extensive practical experience in boiler construction and maintenance will be available to do the work.

According to the FRA, the agency has attempted to maintain some level of inspection proficiency by organizing two 1-week seminars, which are taught by industry and operating museum experts on boilers and steam locomotives, about steam locomotives and boilers, including maintenance and inspection. The FRA gives priority for steam locomotive seminars to those MP&E inspectors who have steam locomotive operations in their territory.

  Industry Efforts

In 1990, members of the tourist railroad industry who owned and operated steam locomotives became concerned that steam locomotive inspection and safety standards were slowly degenerating. Twelve representatives formed an unofficial, ad hoc group to formalize some type of recommended practice for the repair of steam locomotive boilers. (The 12 representatives included people from tourist railroad mechanical departments and insurance inspectors, Class I railroad steam operators, and experts knowledgeable in the theory and practice of steam locomotive boiler construction.) The group contacted the NBBPVI, the private agency that publishes and administers the National Boiler Inspection Code applicable to all boilers used in industry other than railroads. In 1990, the group of 12 representatives began as the Engineering Standards Committee for Steam Locomotives (ESC) to develop standards for the repair and alteration of steam locomotive boilers. Guidance was provided by NBBPVI as to modern engineering practices for boilers.

In 1995, the National Board Inspection Code Committee adopted the standards developed by the ESC as an American National Standard for the repair and alteration of steam locomotive boilers that are repaired or altered by NBBPVI certified boiler engineering firms³⁹. In 1995, the ESC also became an official task group of the NBBPVI. Appendix 3 of the 1995 National Boiler Inspection Code contains the NBBPVI rules for steam locomotive boiler repair. These rules, however, are only voluntary for railroads under FRA jurisdiction, since 49 CFR Part 230 makes no reference to any national standard or the NBBPVI Code. In lieu of Federal standards, the ESC and the NBBPVI have volunteered to provide a tailored training program on steam locomotive boiler inspection and repair to the tourist railroad industry.

Since the accident, the FRA has formed a Steam Locomotive Safety Improvement Committee, which began meeting in September 1995. The ESC became a part of the committee and has met with the FRA in an initial step to update 49 CFR Part 230. The ESC also has a representative on a larger FRA committee looking into all aspects of rail safety.

  General

The phenomenon of crownsheet failure has been well known and understood for many years. That such a failure had occurred in this accident was evident from the start of the investigation. All parties to the investigation agreed that the nature of the damage, the statements of the locomotive crew, and the post accident examination of the boiler confirmed that the crownsheet failure was due to low water. The Safety Board therefore concludes that the explosion in locomotive 1278 resulted from crownsheet failure caused by having too little water in the boiler.

The investigators found that it was not a single event or condition that caused the water to be too low. It was too low because of the cumulative result of a number of steam locomotive boiler maintenance and operational factors that resulted from a lack of training, knowledge, and application. The following is a brief synopsis of the accident chronology and the inherent factors involved. Each of these factors will be explained in greater detail in the rest of the analysis.

The events leading to the crownsheet failure began when the locomotive stopped at Wolf Pit to pick up the helper. There, the first fireman shut off the feed pump, thus preventing any water from entering the boiler. He turned off the feed pump because a one-way check valve between the feed pump and the boiler was leaking to the extent that he believed that the locomotive's drivers (wheels) might slip on the rail. The feed pump remained off for about the next 10 minutes as the train climbed the grade until the second fireman took over at the top of the grade, near Gardners. The distance between the start of the grade and Gardners was about 2 miles, and according to the engineer, while the train was going up the grade, it was "working hard", using more steam and, consequently, more water than usual. The first fireman said that as steam was used during the ascent, the pressure in the boiler dropped from about 230 psi to 175 psi. The firemen were unconcerned about the drop in pressure because they assumed that the water glass would warn them if the level of water in the boiler became dangerously low, thus allowing them to correct the problem.

Even before the water was cut off, its level had been purposely kept low as a matter of standard operating procedure. The engineer told Safety Board investigators that he normally kept the level of water so low that the water glass was only 1/3 to 1/2 full even while the train ascended the grade to Gardners. The second fireman testified that the highest water glass level that he remembered was "3/4 at most with fluctuation". The engineer said that keeping the water low in the boiler was a way of minimizing the chance of water entering the cylinders (working water). He also said that having less water in the boiler made for "good steaming", or the rapid creation of the steam that the train needed to climb the grade to Gardners. However, keeping the water so low reduced the layer of safety over the vulnerable crownsheet, particularly as the water level changed with changes in grade and terrain.

As the locomotive moved uphill, the water maintained its level, moving to the back of the boiler, which was tilted up grade. Since the crownsheet was at the back of the boiler, the water should have covered it even more deeply than when the train was on level track. Accordingly, the water glass, which was on the back of the boiler, should have shown the level of water as higher than it was when the train was on level terrain.

However, according to the crew, when the locomotive tilted up grade, the water glass was still only 1/2 full (unchanged from the start at Wolf Pit), which should have warned the firemen that either the boiler held very little water or that the water glass was inaccurate. With the feed pump shut down and the locomotive working hard and using steam, the water level continued to drop. At some point, the boiler held so little water that the highest point of the crownsheet became uncovered and, as a result, failed. By the time the locomotive crested the grade at Gardners, where the second fireman turned the feed pump back on, it was already too late to prevent the inevitable failure.

The firemen should have seen a progressive drop in the water glass level but did not. The restricted condition of the spindles leading to the water glass was affected by one or both of the following circumstances, a higher-than-normal water head (a false head) at the back of the boiler, and/or free floating scale. A false head may have been created by the increased momentum of water moving upward as the formation of steam became progressively more violent because the level of water was dropping. The more violent formation of steam and water flow may also have freed and/or picked up scale from the encrusted boiler deposits, which then partially or totally blocked the already restricted orifices of the water glass spindles. The firemen's statements that the water level movement in the water glass was 1/2 to 1 inch, rather than the 4 to 5 inches that the engineer said was normal, show that there was some form of restriction, or blockage, probably from scale, in the already restricted spindles.

The Safety Board investigation focused on why the water in the boiler had been allowed to drop to such a low level. The investigation found locomotive mechanical conditions, maintenance practices, and crew training practices and procedures that individually or in combination allowed the low-water condition to develop.

  Water Monitoring Devices

Since the water glass was the primary tool that the engineer and firemen had to monitor the level of water in the boiler, the investigators examined the glass and its related valves and spindles to determine their condition at the time of the accident. The passages of the valves had significant deposits. Hard scale plugged about 75 to 85 percent of the spindles. It could not be determined how much, if any, soft deposit or scale had been blown out during the explosion, but steam locomotive experts agreed that it is reasonable to believe that soft scale and/or scale flakes further restricted or blocked the spindle passages. The Safety Board concludes that because the water glass spindles were restricted, the water glass could not accurately represent the water level in the boiler.

The lowest gage cock was totally plugged by deposits, the middle gage cock was half plugged, and the highest gage cock was clear. Again, steam locomotive experts who participated as investigators were convinced that such a large amount of scale could not possibly have accumulated between monthly boiler washings. The pattern of deposits in the gage cocks also suggested that the engineer was accurate when he said that the level of water in the boiler was routinely low. The amount of scale in each gage cock appeared to correlate with the amount of time it spent in the boiler water, the bottom gage cock was always covered with water, the middle gage cock about half the time, and the highest gage cock almost never.

Both the first fireman and the engineer acknowledged that their method of washing the boiler was not thorough and that the spindles were not cleaned and reamed out on a monthly basis as, according to the FRA's regulations, they were supposed to be. The gage cocks were also not cleaned and reamed. The amount of scale and mineral deposit found in the spindles and the gage cocks supported the engineer's admissions that he did not follow the monthly cleaning requirements. The Safety Board concludes that although the engineer had signed the FRA's Forms No. 1, certifying that the work had been done, the spindles and gage cocks were not cleaned on a monthly basis.

Investigators also examined the adequacy of the water-monitoring systems (water glass and gage cocks) in this accident since the systems would have been crucial in detecting the level of the water before the crownsheet failed. At the turn of the century, both the government and the railroad industry had recognized the shortcomings of gage cocks by requiring the use of a water glass, thus relegating gage cocks to the status of a redundant back-up system.

Government and industry knew that gage cocks were particularly subject to the false head phenomenon and did not present a readily apparent indication of the level of the boiler water as the water glass did. Government and industry knew that the water column was the optimal solution but did not require the use of a water column. Instead, the CFR said, "Every boiler must be equipped with at least one water glass and three gage cocks". In 1920, the U.S. Railroad Administration's Committee on Standards recommended the adoption of the water column as a recommended practice. The Safety Board believes that the FRA now should require that, at a minimum, each operating steam locomotive have in addition to the required water glass and three gage cocks, either another water glass or a water column. While it can be argued that inadequate maintenance, as in this accident, would eventually allow any and all water-monitoring devices to become plugged with scale, the Safety Board believes that the chance that all the devices will be plugged at the same time is remote and that, therefore, two devices provide a degree of redundancy and accuracy that the currently required single water glass and gage cocks do not.

  Water Glass Lighting and Conspicuity

Title 49 CFR Part 230.42, "Water Glass Lamps", requires that all water glasses be supplied with a suitable lamp that is located where it enables the engineer to easily see the water in the glass. In the accident locomotive, the light for the water glass did not work. The firemen indicated that they carried no other light source, such as a flashlight, with which to check the water glass. The second fireman said that at night the crew used the cab lights powered by the gasoline generator on the tender and that they had an electric lantern that sat on the floor by the seat of either the engineer or the fireman. The Safety Board concludes that the water glass was not illuminated as required.

Although it was not possible to determine the pre-accident conspicuity of the water glass, both firemen testified that they had no trouble seeing the water glass. The cab of the locomotive was an all-weather enclosed one of the type commonly found on steam locomotives used in northern climates. The cab had side doors and other features that limited the entrance of light and air. Given the lengthening shadows and the light of early evening, it is possible the amount of light in the cab and on the water glass was restricted.

While the Safety Board does not dispute the claims of the firemen that they had no problem reading the water glass, the Board believes that a working light on the water glass, as required by the regulations, would have made reading the water glass easier and might have yielded more accurate information about the action of the water level in the water glass and, thus, the amount of water in the boiler. A working light might also have allowed the engineer, who indicated that the water-level movement was normally 4 to 5 inches, to see that the level was moving only an inch or less before the accident. He might have realized that something was wrong and been able to take preventive action.

  Water Treatment

Since scale, particularly as it affected the water-monitoring devices, became a factor in the investigation, Safety Board investigators explored how Gettysburg Passenger Services treated its water in order to control the mineral content. According to experienced steam locomotive operators and historical railroad documentation, water treatment is critical to the maintenance and safe operation of steam locomotives. Testimony from steam locomotive experts and investigators, from the owner of Gettysburg Railroad, and from representatives of Gettysburg Passenger Services showed that water treatment for locomotive 1278 was, at best, undocumented and inconsistent.

The attempts at water treatment appeared to be irregular, rather than part of a planned and researched policy. According to his testimony, the engineer sent boiler and/or supply-water samples to Water Chem for testing. However, Water Chem has no record of doing any testing for Gettysburg Passenger Services. The engineer told Safety Board investigators that he did his own water testing with a kit and that he kept a journal of his testing. There was no documented evidence that this was done on a regular, program-type basis or that anything was done with any test result information. Investigators were unable to determine the effectiveness of such irregular water treatment, since no test results were found or provided. The Safety Board concludes that Gettysburg Passenger Services did not have a comprehensive water treatment program. The Safety Board believes that the FRA should require steam locomotive operators to have a documented water-treatment program as a basis for boiler maintenance and operation.

  Boiler Washing

The first fireman's testimony about boiler washing described the manner in which Gettysburg Passenger Services personnel washed the boiler. Contrary to the regulatory requirement that all washout plugs be removed, the fireman removed only 4 of the boiler's 29 washout plugs. With only four plugs removed, it is doubtful that even the most conscientious effort to wash out the boiler would have been very effective in removing a significant amount of sediment.

There was also a discrepancy between the method the fireman said he used to wash out a boiler and the methods described in maintenance literature or described by the Strasburg Railroad CMO. The fireman did not use any special nozzles or equipment, which the ARA had adopted as recommended practice in 1915. His casual description of the procedure displayed his lack of knowledge and training in this critical procedure. The Safety Board concludes that the boiler washing procedure described by the fireman was inadequate to ensure that the boiler was properly and thoroughly cleaned as required by FRA regulations.

Although the CFR requires boiler washings, it does not describe the procedure. When all railroads depended on steam, the railroad industry had detailed methods and special equipment for boiler washing, however, much of this expertise has disappeared. Despite TRAIN's recent efforts to promote the proper boiler washing methods, it is obvious from this accident that some steam locomotive operators do not have the initiative or the resources to find and employ proven and accepted boiler washing methods. Therefore, the Safety Board believes that the FRA should describe the proper boiler washing methods and techniques in its regulations in order to set some basic safety standard for steam locomotive operators.

  Feed Pump and Gage

According to testimony from the two firemen, they did not use the water injector during the accident trip, they used only the feed pump. When the train left Aspers with the helper, the first fireman stated, the feed pump was shut off to prevent the locomotive drivers from slipping on the wet rail, which was wet because of the leaking check valve between the feed pump and the boiler. Consequently, for the time the feed pump was shut off, no water entered the boiler. As soon as the train began moving, the first fireman said, the feed pump was turned back on. However, the second fireman testified that when he relieved the first fireman at Gardners, the feed pump was still turned off and that he (the second fireman) turned it on. The Safety Board believes the feed pump was off on the ascent to Gardners.

On the fireman's side of the locomotive cab, three gages had been removed from a mounting plate, leaving only a stoker-engine steam pressure gage and a boiler-pressure gage. Gages displaying stoker-jet pressure, steam-heat pressure, and feed-pump pressure had been removed. Firemen use the feed pump pressure gage to ensure that heated feed water is overcoming boiler pressure and flowing into the boiler. Consequently, the investigation steam locomotive experts were concerned to find locomotive 1278 lacked the gage.

When the accident firemen were asked how they could tell whether the feed pump was working, they both said they relied upon the sound and movement of the feed pump rod. Yet without a feed pump gage to show that the pressure was high enough to force water into the boiler, the feed pump rod could have been moving only because pressure was being relieved by the leaking of the check valve. The Safety Board concludes that because the feed pump gage was missing, the train crew had no reliable way to determine whether the feed pump pressure was overcoming the boiler pressure and delivering water into the boiler.

  Malfunctioning Check Valve

Investigators also examined another defect in the water supply system. A check valve between the feed pump and the boiler had been leaking all day, although the valve had recently been returned from repair. While it is not known how much water was leaking from the valve, it was enough water to necessitate clearing half an open-decked observation car when the locomotive was pulling in reverse. If nothing else, the leak reduced the efficacy of water delivery to the boiler. It should also be noted that had the accident locomotive been equipped with a feed pump gage, the gage would not have provided an accurate pressure indication, since it would have been connected between the feed pump and the leaking check valve, which was relieving pressure.

The leaking of the check valve indirectly contributed to the lack of water in the boiler. Because the valve leaked, the feed pump was shut down, cutting off the water supply to the boiler and contributing to the cause of the crownsheet failure.

  Injector

The other means of water delivery to the boiler was the injector, which was not used, according to the locomotive crew. Post accident examination of the injector showed that it had the wrong type of steam valve disk. Such a disk would make it difficult to prime the injector, and if a lifting injector cannot be primed, it will not operate correctly. It would be possible for the injector to function, but only with some difficulty. Although the injector does not appear to have been involved in the crownsheet failure, it is typical of another device on locomotive 1278 that either did not function or functioned marginally. The Safety Board concludes that because the wrong type of disk had been installed in the injector, it would have been difficult to use the injector to add water to the boiler.

  Water Glass and Gage Cock Testing

During the testimony, both accident firemen, the helper engineer (who also worked as a steam locomotive engineer), the helper fireman, another Gettysburg Passenger Services employee (who was qualified as both a steam locomotive fireman and an engineer), and the owner of Gettysburg Railroad each described and demonstrated how he would blow down and verify the water glass. Only the owner of Gettysburg Railroad, the engineer's father, demonstrated the correct method of blowing down. All the Gettysburg Passenger Services employees had been taught by the engineer. No one said that he also tested the gage cocks when he blew down the water glass, as required by regulation. The Safety Board therefore concludes that the firemen did not know, because they had not been properly taught, how to blow down the water glass or test the gage cocks. The lack of knowledge about such basic procedures reflects the lack of an effective training program at Gettysburg Passenger Services.

  Delineation of Responsibilities

According to the testimony of the two firemen, responsibility was not clearly divided among the members of the crew, particularly between the two firemen. Each fireman felt he had a firm grasp of the tasks that needed to be done and how to do them, however, neither was totally aware of who was responsible for what tasks. The situation is much the same as the one in which two baseball outfielders run toward a fly ball. Each may know how to catch the ball, but unless there is a clear understanding of responsibility, each may expect the other to catch the ball, and the ball may fall to the ground. Or each may attempt to catch the ball, resulting in a collision and the ball's being dropped. In either case, delineation of responsibility is critical. In this case, instead of a ball, the critical item dropped was the feed pump. The Safety Board concludes that there was no clear division of responsibility among the members of the crew in this accident, particularly between the two firemen.

Unlike modern electric and diesel-electric locomotives, which may be operated with some degree of safety by the engineer alone, operating a steam locomotive requires the close coordination of both fireman and engineer. Such coordination is impossible unless everyone involved has a clear understanding of his responsibilities. While 49 CFR 230.40 states that before each trip, the water glass must be blown out and each gage cock must be tested, the regulation does not assign anyone this specific responsibility. The Safety Board believes that the FRA should delineate such basic levels of responsibility and duties, since close coordination between and among the engineer and fireman (firemen) is critical to the safe operation of the steam locomotive. The Safety Board also believes that until the FRA specifies who is responsible for what, Gettysburg Passenger Services should specify.

  Hours of Service

Although fatigue does not appear to have been a factor in this accident, the Safety Board is concerned that the cumulative and consecutive hours worked by employees, particularly part-time employees, of tourist railroads such as Gettysburg Passenger Services, may make such employees susceptible to accidents caused at least in part by fatigue or sleep deprivation. Such an accident exposes the public to danger. The members of the engine crew of locomotive 1278 had worked a full day, taken a 2 or 3 hour break, and then returned at 17:00 expecting to work until midnight. Whether part-time or full-time, such a day today pattern can easily cause sleep deprivation and tiredness. This is particularly disturbing in the case of the engineer who, as co-owner of Gettysburg Passenger Services, had duties and responsibilities beyond running and maintaining the entire operation.

While the Safety Board acknowledges that it is up to the FRA to enforce the Hours of Service Act⁴⁰, the work-rest routine of Gettysburg Passenger Services train personnel exceeds the intent of the legislation and might threaten the safety of the public. The Safety Board concludes that Gettysburg Passenger Services management was not aware of the Hours of Service Act. The Safety Board believes that the FRA, in cooperation with TRAIN, should promote awareness of and compliance with the Hours of Service Act.

  Training

Based on the description provided of the formal training given to Gettysburg Passenger Services employees, the training was a 1-day recurrent or refresher training module, rather than a comprehensive training program. The closest thing that Gettysburg Passenger Services had to a comprehensive training program was a generic fill-in-the-blank document from the American Shortline Association used to satisfy FRA engineer certification requirements of 49 CFR 230.101.

Gettysburg Passenger Services employees said they received their training through OJT. But the company's OJT program was not organized enough to be comprehensive or complete. The greatest failing of the OJT was that it was built upon either misunderstood instructions or misinformation that had come second or third-hand from a certified or professional commercial railroad source. Thus, misunderstood, incomplete, or incorrect information was continually passed on until it became the norm. Therefore, the Safety Board concludes that Gettysburg Passenger Services had no effective formal training or certification program and that its OJT was dependent on second and third-hand expertise.

  Progressive Crown Stay Failure

Although not a warning or preventative device, the design of the accident locomotive boiler appeared to mitigate the effects of the crownsheet failure. As previously discussed, the locomotive had alternating rows of straight-thread and button-head crown stays to help ensure that any crownsheet failure due to low water would occur relatively gradually and in stages, rather than instantaneously and catastrophically.

The design was suggested in the 1922 Master Boiler Association manual report. It appears to have been unique to the Canadian Locomotive Company, Ltd. and may well have prevented a more sudden catastrophic failure of the crownsheet, which could have sent the boiler rocketing off the frame, killing or injuring the crew and passengers. The Safety Board believes such a design may be worthy of further study for incorporation in steam locomotives when they are repaired or rebuilt. The Safety Board also believes that the FRA, in cooperation with the NBBPVI and the tourist-railroad industry steam locomotive operators should explore the feasibility of requiring progressive crown-stay failure features in steam locomotives.

  Steam Locomotive Maintenance Expertise

The Safety Board is concerned that the incorrect injector disk, the leaking check valve, the missing feed pump gage, the inoperative dynamo, and the non-functioning water glass light together reflect a disturbing pattern of poor maintenance and/or improper repair. Such maintenance, in the opinions of the investigation steam locomotive experts, clearly indicated a lack of knowledge and expertise on the part of the locomotive owners and crew. As previously noted, steam locomotive expertise is gone from most modern commercial railroads, and generally only a small number of experts and a limited supply of knowledge and skill remain. Today, many operating steam locomotives are in the hands of a generation who have had to develop steam locomotive maintenance and operation second or third-hand, much like the personnel of Gettysburg Passenger Services. One way to establish a minimum level of steam locomotive expertise and thereby better ensure the safety of operators and the public would be to establish an education and certification program that establishes and enforces basic standards for steam locomotive operation and maintenance.

The NBBPVI and the tourist-railroad industry steam locomotive operators have agreed to establish a program for the safe maintenance and operation of boilers. The Safety Board supports such efforts and believes that the FRA, in cooperation with the NBBPVI and the tourist-railroad industry steam locomotive operators, should develop certification criteria and require steam locomotive operators and maintenance personnel to be periodically certified to operate and/or maintain a steam locomotive.

The Safety Board believes that the FRA, in cooperation with the NBBPVI, should update 49 CFR Part 230 to take advantage of accepted practical modern boiler inspection techniques and technologies, to minimize interpretation based on empirical experience, and to maximize the use of objective measurable standards.

1. The explosion in the locomotive resulted from crownsheet failure caused by having too little water in the boiler.

2. Because the water glass spindles were restricted, the water glass could not represent the water level in the boiler accurately.

3. Although the engineer had signed the Federal Railroad Administration's Forms No. 1, certifying that the work had been done, the water glass spindles and gage cocks were not cleaned on a monthly basis.

4. The water glass was not illuminated as required.

5. Gettysburg Passenger Services Inc., did not have a comprehensive water treatment program.

6. The boiler washing procedure described by the fireman was inadequate to ensure that the boiler was properly and thoroughly cleaned as required by Federal Railroad Administration regulations.

7. Because the feed pump gage was missing, the train crew had no reliable way to determine whether feed pump pressure was overcoming boiler pressure and delivering water to the boiler.

8. Because the wrong type of disk had been installed in the injector, it would have been difficult to use the injector to add water to the boiler.

9. The firemen did not know, because they had not been properly taught, how to blow down the water glass or test the gage cocks.

10. There was no clear division of responsibility among the members of the crew in this accident, particularly between the two firemen.

11. Gettysburg Passenger Services Inc., management was not aware of the Hours of Service Act.

12. Gettysburg Passenger Services Inc., had no effective formal training or certification program, and its on-the-job training was based on second and third-hand expertise.

The National Transportation Safety Board determines that the probable cause of the firebox explosion on steam locomotive 1278 was the failure of Gettysburg Passenger Services Inc., management to ensure that the boiler and its appurtenances were properly maintained and that the crew was properly trained.

As a result of this special investigation, the National Transportation Safety Board makes the following recommendations:

-- to the Federal Railroad Administration:

Require that each operating steam locomotive have either a water column or a water glass in addition to the water glass and three gage cocks that are already required. (R-96-53).

Require steam locomotive operators to have a documented water-treatment program. (R-96-54)

Describe basic responsibilities and procedures for functions required by regulation, such as blowing down the water glass and washing the boiler. (R-96-55)

In cooperation with the Tourist Railway Association Inc., promote awareness of and compliance with the Hours of Service Act. (R-96-56)

In cooperation with the National Board of Boiler and Pressure Vessel Inspectors and the Tourist Railway Association Inc., explore the feasibility of requiring a progressive crown-stay feature in steam locomotives. (R-96-57)

In cooperation with the National Board of Boiler and Pressure Vessel Inspectors and the Tourist Railway Association Inc., develop certification criteria and require that steam locomotive operators and maintenance personnel be periodically certified to operate and/or maintain a steam locomotive. (R-96-58)

In cooperation with the National Board of Boiler and Pressure Vessel Inspectors and the Tourist Railway Association Inc., update 49 Code of Federal Regulations Part 230 to take advantage of accepted practical modern boiler inspection techniques and technologies, to minimize interpretation based on empirical experience, and to maximize the use of objective measurable standards. (R-96-59)

-- to the National Board of Boiler and Pressure Vessel Inspectors:

Cooperate with the Federal Railroad Administration and the Tourist Railway Association Inc., in exploring the feasibility of Federal regulations requiring progressive crown-stay failure features in steam locomotives. (R-96-60)

Participate with the Federal Railroad Administration and the Tourist Railway Association Inc., in developing criteria to be used in the periodic certification of steam locomotive operators and maintenance personnel. (R-96-61)

Participate with the Federal Railroad Administration and the Tourist Railway Association Inc., in updating 49 Code of Federal Regulations Part 230 to take advantage of accepted practical modern boiler inspection techniques and technologies, to minimize interpretation based on empirical experience, and to maximize the use of objective measurable standards. (R-96-62)

-- to the Tourist Railway Association Inc.:

In cooperation with the Federal Railroad Administration, promote awareness of and compliance with the Hours of Service Act. (R-96-63)

Encourage its members who operate steam locomotives to cooperate with the Federal Railroad Administration and the National Board of Boiler and Pressure Vessel Inspectors in exploring the feasibility of Federal regulations requiring progressive crown-stay failure features in steam locomotives. (R-96-64)

Encourage its members who operate steam locomotives to participate with the Federal Railroad Administration and the National Board of Boiler and Pressure Vessel Inspectors in developing criteria to be used in periodically certifying steam locomotive operators and maintenance personnel. (R-96-65)

Encourage its members who operate steam locomotives to participate with the Federal Railroad Administration and the National Board of Boiler and Pressure Vessel Inspectors in updating 49 Code of Federal Regulations Part 230 to take advantage of accepted practical modern boiler inspection techniques and technologies, to minimize interpretation based on empirical experience, and to maximize the use of objective measurable standards. (R-96-66)

BY THE NATIONAL TRANSPORTATION SAFETY BOARD
 
James E. Hall - Chairman
 
Robert T. Francis II - Vice Chairman
 
John A. Hammerschmidt - Member
 
John J. Goglia - Member
 
George W. Black, Jr. - Member
 
15 Nov 1996

Investigation and Sworn Testimony Proceeding

The accident occurred about 19:30 EDT on Friday, 16 Jun 1995, and was reported to the Coast Guard's National Response Center (NRC) in Washington, D.C., the following morning at 07:17. The NRC incident report number was 295913. The incident report was electronically sent to the National Transportation Safety Board (NTSB) at 07:39 on Saturday, 17 Jun 1995.

The NTSB investigator arrived at the Gettysburg Railroad about 10:00 on Tuesday, 20 Jun 1995, and initiated the accident investigation. The Gettysburg Railroad, Gettysburg Passenger Services Inc., the Federal Railroad Administration, the Hartford Steam Boiler Inspection and Insurance Co., and members of the Tourist Railway Association Inc., participated and assisted in the investigation.

As part of the investigation, a 2 day sworn testimony proceeding was held at the Holiday Inn in Gettysburg, Pennsylvania, on 27 and 28 Sep 1995. Parties to the proceeding included the Gettysburg Railroad, Gettysburg Passenger Services Inc., the Federal Railroad Administration, the Hartford Steam Boiler Inspection and Insurance Co., the National Board of Boiler and Pressure Vessel Inspectors Inc., and members of the Tourist Railway Association Inc. Twelve witnesses testified.

Abbreviations Used in this Publication

ARA: American Railroad Administration
CFR:  Code of Federal Regulations
CMO:  chief mechanical officer
ESC:  Engineering Standards Committee for Steam Locomotives
FRA:  Federal Railroad Administration
ICC:  Interstate Commerce Commission
MP&E:  motive power and equipment
NBBPVI:  National Board of Boiler and Pressure Vessel Inspectors
OJT:  on-the-job training
psi:  pounds per square inch
TRAIN:  Tourist Railway Association, Inc.

¹  All the equipment used by Gettysburg Passenger Services Inc., (Gettysburg Passenger Services) is leased from Gettysburg Railroad.
 

²  The feed-water heater is a heat exchanger located in the front of the steam locomotive, usually in the smokebox. Cylinder exhaust steam is used to pre-heat water from the tender before the water is pumped into the boiler. This boosts energy efficiency and lowers fuel usage.
 

³  The fireman tends and stokes the fire in the boiler's firebox.
 

⁴  The drivers are the wheels that propel the locomotive.
 

⁵  It was the policy of Gettysburg Passenger Services to have two firemen on the dinner train trip because the trip was an extended one.
 

⁶  The firemen did not agree in their testimony about where the transfer of responsibility took place. There was no clear transfer of duty. To some extent, each was acting in the capacity of fireman between Pond Road and Gardners.
 

⁷  The water glass, also called the "sight glass" and "water gage", is a device that enables an engineman or fireman to observe the height of the water in a locomotive boiler. It consists of two brass fittings screwed into the back head, one above the other, and connected by a stout glass tube or a metal frame in which a glass is inserted which communicates, through the fittings, with the water and steam in the boiler. The water level showing in the glass is the same as that water level inside the boiler.
 

⁸  Because of the location of the water glass, it indicates the level of water in the back of the boiler. As a steam locomotive ascends a grade, water fills the back end of the boiler, causing the water glass to indicate that the boiler has more water than it does.
 

⁹  The metal sheet or plate that forms the roof of the firebox. The crownsheet is normally covered with water to a depth of at least 3 to 4 inches. Because the crownsheet is exposed to intense heat on one side and is covered with water on the other, there is a violent formation of steam on its surface. This steam bubbles to the surface of the water and fills the steam space between the surface of the water and the top of the boiler.
 

¹⁰  An automatic stoker is a steam-powered auger that moves coal from the tender to the firebox. The fireman controls the speed of the auger and therefore the amount of coal delivered to the firebox.
 

¹¹  The rear tube-sheet knuckle is the top corner of the firebox where the horizontal crownsheet meets the vertical tube-sheet.
 

¹²  Formal training is defined as classroom and/or training approved by some authority.
 

¹³  The spindle, also called the spud, is the probe like pipe that extends from the water glass into the boiler. It is the connection through which water reaches the water glass.
 

¹⁴  Whyte's system of steam locomotive classification. In this system, numerals are used to represent the number of wheels in each group of wheels. The first number denotes the number of wheels in the leading truck, the second, the number of drivers, and the third, the number of wheel in the trailing truck.
 

¹⁵  Common wheel arrangements often took on names, which were usually associated with the place where the arrangement of the wheels originated.
 

¹⁶  Form No. 4 is a steam locomotive boiler specification document required by the FRA in 49 CFR 230.54. Gettysburg Railroad had only one Form No. 4, the one that had been filed by the Cadillac & Lake City Railroad, a lessee of the locomotive. The FRA does not require a Form No. 4 to reflect the actual condition of the boiler in its present configuration or to be completed or submitted by a qualified person.
 

¹⁷  Gage cocks are used as a backup system for the water glass.
 

¹⁸  The gages are position so that the lowest reading on the gage will indicate more than 3 inches of water over the crownsheet, which is the minimum as required by 48 CFR 230.37.
 

¹⁹  The outer boiler shell above the crownsheet.
 

²⁰  Note that (1) such a failure will still, as in this accident, be very sudden and "explosive" and (2) no construction method will prevent a catastrophic failure, although it may attenuate the damage.
 

²¹  The backhead is the rearmost boiler sheet, which is located in the cab.
 

²²  Boiler designers incorporate a minimal but necessary number of washout plugs in a boiler to ensure that it can be thoroughly washed and cleaned of the sediment that contributes to scale.
 

²³  The injector is a device for forcing water into a steam boiler. A jet of steam imparts its velocity to the water and thus forces it into the boiler against the boiler pressure. The injector on locomotive 1278 was of the lifting type, which is generally used when the locomotive is standing still.
 

²⁴  The missing gages were identified from a photograph of locomotive 1278 taken several years before the accident.
 

²⁵  A hydrostatic test is a test in which the boiler is filled with water and pressurized to check for weak points.
 

²⁶  The gage cock pipes extend into the boiler and are the connection through which water reaches the gage cocks.
 

²⁷  The firebox sheets are the metal interior walls of the firebox, which are heated directly from combustion of the coal, wood, or oil.
 

²⁸  The front section of the crownsheet, which is attached to the rear tube sheet knuckle, usually incurs the initial overheating because it is the highest point in the crownsheet and therefore is the first to be uncovered when the water level drops.
 

²⁹  Several steam locomotive experts were involved in the investigation. Two, the chief mechanical officers of the Strasburg Railroad and The Valley Railroad Company, were brought into the investigation by Gettysburg Passenger Services. Two others, the curator of transportation for the Smithsonian Institution and a representative of Combustion Engineering of Teaneck, New Jersey, are recognized authorities in the field of steam locomotive boilers and mechanics. All four are referred to as experts for the purposes of this report.
 

³⁰  Railway Mechanical Engineer, Vol. 94, No. 10, P. 630.
 

³¹  Since water is an incompressible liquid, any water that might enter the cylinders might damage the cylinders or bend a drive rod.
 

³²  This company was mis-identified as Water Chemical Company during testimony.
 

³³  Kentucky Railway Museum steam locomotive No. 152, a 1905 Rogers 4-6-2, is equipped with a Nathan low water alarm.
 

³⁴  Airy, G.B., "On the Numerical Expression of the Destructive Energy in the Explosion of Steam Boilers and Its Comparison with the Destructive Energy of Gunpowder", Philosophical Magazine, 26329-336 (1863).
 

³⁵  Aldrich, Mark, "Safe and Suitable Boilers:  The Railroads, the Interstate Commerce Commission, and Locomotive Safety, 1900-1945", The Railway & Locomotive Historical Society Inc., Railroad History #171, Autumn 1994.
 

³⁶  Ibid.
 

³⁷  Shortly thereafter, on 18 Mar 1912, Southern Pacific locomotive 704 exploded in the San Antonio, Texas, yards sending and 8-ton piece of boiler more than 1,200 feet and killing 26 employees and injuring 32 more. This was the deadliest explosion in the history of railroading.
 

³⁸  Mobile & Gulf Railroad 2-6-0 No. 97.
 

³⁹  These are firms holding an "R" stamp issued by the NBBPVI for boiler repair.
 

⁴⁰  First enacted in 1907, the Hours of Service Act was substantially revised in 1969 by Public Law 91-169. Further amendments were enacted as part of the Federal Railroad Safety Authorization Act of 1976. Public Law 94-348, and the Rail Safety Improvement Act of 1988, Public Law 100-342. The purpose of the law is "to promote the safety of employees and travellers upon railroads by limiting the hours of service of employees."