Resonance
Insights

The Repair Nobody Wrote Down

Bill Carrick · October 23, 2026
A signal maintainer working at a mainline switch. The repair at Browns was made in good faith, checked by eye, and never written down.

Every maintenance team has done this. A technician spots a small problem, fixes it in twenty minutes, checks that it works, and moves on. There is no work order, because it was a minor adjustment, and nobody else needs to know.

On 14 July 2025, a Norfolk Southern track inspection supervisor did exactly that at a switch near Browns, Illinois. Four days later, 24 railcars derailed at that switch. In September 2026 the National Transportation Safety Board (NTSB), the US federal agency that investigates serious transport accidents, published its report. It tells the story of a repair that was done, and done in good faith, but never recorded and never properly tested.

This is not an article about rail safety. It is about what happens in any organization when a repair is treated as finished because the tools are back in the truck.

What happened at the switch?

The switch in question was a spring switch. A switch is the place where one track splits into two. It has a pair of movable, tapered rails, called the switch points, that press against the fixed rail beside them to steer the wheels one way or the other. In a spring switch, a spring holds the points in their normal position, so trains can pass through without anyone throwing the switch by hand.

A switch point against the stock rail. A gap of a quarter of an inch at this joint is where a wheel can catch.

On 14 July the supervisor found a gap of about a quarter of an inch between a switch point and the fixed rail. That matters, because a gap there is where a wheel can catch. A mounting bolt was blocking the spring mechanism. He and a colleague shifted the cross-tie that carries the mechanism "an inch or two" with a jack and a hammer, threw the switch several times, and saw it close properly. They judged it fixed.

According to the NTSB, he did not tell the signal department "because he believed the adjustment was minor," and he did not record the work on his inspection report or any other maintenance form.

On 17 July he came back with a backhoe, moved the tie about two more inches, and added anchors. This time he told the signal maintainer, the technician responsible for the electrical equipment that detects where the switch points are and feeds that to the signals. But again, the work was not formally documented.

What did the organization know, and when?

The switch has a detector that confirms the points are where they should be. When the detected position does not match what the signal system expects, it logs an out-of-correspondence condition: in plain terms, a position mismatch alarm.

From 10:53 a.m. on 17 July, after the second repair, until the derailment the next day, the switch logged 455 of these alarms. Each one cleared itself within seconds. The data sat on the railroad's positive train control (PTC) monitoring platform, part of the safety system that can stop trains automatically. But that display, the NTSB notes, "is not accessible to all NS employees." The dispatcher could not see switch positions at all.

At 1:17 p.m. on 18 July, one alarm did not clear. A trouble ticket was raised at 3:59 p.m., more than two and a half hours later. A colleague who "happened to have the display open" had spotted it and alerted the signal maintainer, and his supervisor sent him out. He arrived at 4:57 p.m., got the detector reporting the switch in position again, and ran the one electrical gauge test he was equipped to do. At 5:07 p.m. he released track authority, the permission that keeps trains off a section of track while people work on it, and handed the switch back to traffic.

From the second repair to the derailment: 455 self-clearing alarms, one that held, and 37 minutes between release and derailment. Times from NTSB RIR-26-16.

He did not run the two mechanical tests that Norfolk Southern's own standards require, which check whether the points are physically held tight against the rail. He had not been trained for them and did not have the tools. He knew about the 17 July work, but the NTSB found "no evidence the signal maintainer was aware of the July 14 maintenance activities."

At 5:44 p.m., 37 minutes after the release, an eastbound train derailed 24 cars at the switch. They struck a westbound train standing in the siding. Three tank cars of hazardous materials breached and there was a fire. Two of its crew were injured when they leapt out of the path of a derailing tank car. Damage came to $9.2 million.

What did the NTSB conclude?

The NTSB does not assign blame to individuals, and its finding does not rest on one supervisor or one maintainer. It names the probable cause as Norfolk Southern's "inadequate procedures to ensure proper repair, testing, and coordination between track and signal departments, which prevented verification of the mechanical integrity" of the switch after the repairs.

It also describes "an organizational gap": track work that affected the switch was done without coordinating with the signal department. Two crafts within the same maintenance organization each did part of the job. The asset failed in the space between them.

Why is this your problem too?

Most readers will never see a derailment. But the same three habits show up on pumps, breakers, conveyors and air handlers every week.

The minor job with no work order. As far as the records were concerned, the 14 July repair never happened. So the person who responded four days later could not know the geometry of the switch had been changed. When small jobs go unrecorded, the next technician starts blind, and nobody can trace a failure back to the work that caused it.

A test that checks the alarm, not the function. The maintainer restored the electrical signal, which was the one thing his kit could check, and the alarm cleared. That told him the detector was happy. It did not tell him the switch would hold under a train. A cleared alarm is not proof that a repair holds.

Work that crosses into another craft's equipment without a handshake. The track side changed something the signal side depended on, and told them only once, informally.

The cost of all three is the same: equipment goes back into service on trust, in a condition nobody has verified. NASA's reliability-centered maintenance guide puts the general point plainly: "The quality of the maintenance accomplished is reflected in the equipment post-maintenance mortality rate." In other words, how often equipment fails soon after it has been worked on tells you how good the work was. At Browns the bill was $9.2 million, two injuries, a hazardous materials release, and a switch that had to be replaced outright.

What does good look like?

Norfolk Southern's response is worth copying because it is short and needs no new technology. Within a week of the accident it worked with its track and signal departments to inspect all 205 spring switches on its mainline. In November 2025 it revised its rules. Translated into any maintenance shop, the fixes come down to four practices:

  1. Notify before you start. Anyone whose work could affect another craft's equipment tells that craft before the work begins, not afterwards and not by chance.
  2. No test, no return to service. If the other craft cannot test the equipment after the work, it is taken out of service, meaning removed from use and secured so nobody can run it, until the required testing is done. Norfolk Southern's rule says exactly that.
  3. One record of the work and the test. A joint inspection form captures what was changed and what was checked, so the next person to touch the asset knows its history.
  4. The right people with the right tools. Whoever is assigned to test has been trained for the required tests and carries the equipment to perform them.

One more habit is worth adding. When an asset starts throwing repeated alarms that clear on their own shortly after someone has worked on it, treat that as a sign the work may not be right, not as nuisance noise. And make sure the people who decide what to do next can actually see that data.

When is a repair finished?

The supervisor at Browns fixed a real problem and checked his work the way he knew how. The maintainer restored the signal and ran the test he was equipped to run. Each did a reasonable job on his own piece. The organization still put a switch back into service that nobody had verified.

That is the lesson for every maintenance leader. A repair is not finished when the tools go down. It is finished when someone has tested it against everything it touches, and the record says what was done. Until both are true, you are running on trust, and trust is not a maintenance standard.

Sources

Request a working session