← back to the reports
DR-013 Passenger express · Amtrak/CSX, USA 2018

Cayce (Amtrak 91) — One Reversed Switch, No Backstop, Two Dead

misaligned-switchpassenger2010s
Killed
2
Railway
Amtrak/CSX, South Carolina
Service
Silver Star (Amtrak 91)
Status
Operator

Summary

At about 2:35 a.m. on 4 February 2018, southbound Amtrak train 91 — the Silver Star, running overnight from New York to Miami — was diverted off the main track through a reversed hand-throw switch at Cayce, South Carolina, and collided head-on with a stationary CSX Transportation freight train parked on a siding. The two crew members in the lead locomotive, engineer Michael Kempf and conductor Michael Cella, were killed; about 116 other people aboard were injured out of the roughly 147 passengers and crew. The National Transportation Safety Board (NTSB) investigated and, in report RAR-19/02, found the collision was fundamentally an operational failure of risk management around a switch and a suspended signal system — not a track, equipment, or material defect.

The accident happened inside a stretch of CSX's Columbia Subdivision where the automatic signal system had been deliberately taken out of service. CSX was installing components for positive train control (PTC), the federally mandated overlay designed, among other things, to stop a train approaching a misaligned switch. With the signals suspended, trains in the area were being run by track warrant and verbal authority, and the normal electronic backstop that would have flagged a wrongly lined switch was gone. A CSX local freight crew that had used the Charleston Highway siding earlier that night failed to return the hand-throw switch to its normal position lining the main track. Nothing else in the system caught the error.

The NTSB's probable cause was unambiguous about where accountability lay. The board found that the collision was caused by CSX's failure to assess and mitigate the risk of operating through a signal suspension — a condition that eliminated the system redundancy for detecting a switch in the wrong position — compounded by the CSX conductor's failure to properly reposition the switch for the main track. The board further found that the Federal Railroad Administration's (FRA) failure to implement effective regulation against misaligned-switch accidents, and Amtrak's failure to conduct its own risk assessment before operating during the signal suspension, contributed to the accident. The verdict is therefore organizational and operational: a single human act of leaving a switch reversed was allowed to become lethal because the operators had stripped away every layer that should have stood behind it.

The Cayce collision came within a few weeks of two other high-profile Amtrak incidents and intensified scrutiny of the railroad's safety oversight and of the slow national rollout of PTC. Litigation followed, with claims against CSX and Amtrak, and the NTSB used the case to renew long-standing recommendations that railroads operate at restricted speed near switches whenever a signal suspension is in effect.

Timeline

Mid-2017 onward
Signals come down for PTC work
CSX takes the automatic block signal system on the Columbia Subdivision out of service to install positive train control components, placing the territory under a managed signal suspension.
Night of 3–4 Feb 2018
A local freight uses the siding
A CSX local crew operates onto and off the Charleston Highway siding at Cayce, throwing the hand-operated main-track switch to access the siding.
Before the collision
The switch is left reversed
The hand-throw switch is not restored to line the main track; it remains set — and locked — for the siding, leaving the freight standing clear on the siding but the main route diverted.
4 Feb 2018, ~2:35 a.m.
Diverted into the siding
Amtrak 91, the Silver Star, southbound under track warrant authority, follows the reversed switch off the main line and onto the siding toward the parked CSX freight.
4 Feb 2018, ~2:35 a.m.
Head-on collision
Train 91's locomotive strikes the stationary CSX freight; the lead Amtrak engineer and conductor are killed and about 116 others are injured.
4 Feb 2018
NTSB launches
A go-team deploys; investigators immediately focus on the disabled signals and the locked, reversed switch.
Spring 2018
Recorder and crew-action review
The NTSB reconstructs train movements, switch handling, and the communications among the CSX dispatcher, the freight crew, and the suspension protocol.
23 July 2019
Probable cause adopted
The NTSB publicly announces its findings, faulting CSX's and Amtrak's failure to assess and mitigate signal-suspension risk plus the conductor's switch error; report RAR-19/02 is issued.
2019
FRA advisory; NTSB pushback
The FRA issues a safety advisory on operating during signal suspensions; the NTSB labels the response inadequate, judging the advisory does not go far enough.
2018–2020s
Litigation and PTC completion
Wrongful-death and injury claims proceed against CSX and Amtrak; PTC installation across the affected network is completed under the federal mandate.

A Suspended Railroad in the Dark

The Columbia Subdivision at Cayce was, on the night of the collision, running without its automatic signal system. That was not a malfunction; it was a planned condition. CSX had taken the signals out of service to install equipment for positive train control — a federally mandated system that uses track-side and on-board technology to enforce speeds and, critically, to detect when a train is heading toward a switch that is lined the wrong way. The irony of Cayce is exact: the railroad was building the very safety overlay designed to prevent misaligned-switch collisions, and during the construction it had removed the existing electronic protection without putting an equivalent procedural protection in its place.

With signals suspended, the territory reverted to a far older and more fragile mode of operation, dependent on written and verbal authority rather than wayside indications. Trains moved on track warrants. The condition of a hand-operated switch — whether it lined the main track or a siding — was no longer reported automatically to any signal or dispatcher screen. It depended entirely on the crew that last used it returning it to its normal position, and on everyone downstream trusting that they had. There was no automatic indication in the locomotive cab, and no signal aspect, to tell an oncoming engineer that the route ahead had been diverted onto an occupied siding.

That is the structural hazard the NTSB centered. A hand-throw switch left reversed is one of the oldest known dangers in railroading. The whole point of a modern signal system is to make that single human act recoverable — to put a red signal or a cab warning between a misaligned switch and a fast-moving train. By suspending the signals for PTC work without imposing a compensating rule, such as requiring trains to approach all switches at restricted speed, CSX had removed the recovery layer and left a single unprotected point of failure on the main line.

The Switch and the Collision

Earlier that night, a CSX local freight crew had worked the Charleston Highway siding at Cayce. To get onto the siding they threw the hand-operated main-track switch, which is locked with a padlock when set. After completing their work and clearing onto the siding, the crew was responsible for restoring the switch to line the main track for through movements. They did not. The switch remained reversed and locked for the siding, and the CSX freight stood parked clear on that siding — itself not in anyone's path, but holding the route that the next main-track train would now be sent down.

The communications around the switch compounded the failure rather than catching it. The NTSB's account describes the conductor reporting that the switch had been realigned for the main track, and the engineer in turn informing the dispatcher that the switch was in the correct position. It was not. Under a functioning signal system, that misreport would have been overridden by the hardware; under the suspension, it became the operative truth on which the dispatcher cleared Amtrak 91.

When the Silver Star came south under its track warrant, it ran through the reversed switch and was diverted off the main line onto the siding, where the CSX freight sat directly ahead. There was no signal to stop it and no time to react. The head-on collision destroyed the lead locomotive and killed both crew members in it, engineer Michael Kempf and conductor Michael Cella. About 116 of the passengers and remaining crew were injured. The two trains were otherwise occupying their authorized spaces — the freight legitimately on its siding, the Amtrak legitimately under its warrant. What put them on the same rail was the one switch nobody had set back, in a railroad that, that night, had no machine left to notice.

The Board's Verdict

The NTSB adopted its findings on 23 July 2019 in report RAR-19/02. The board's probable cause was that the collision resulted from CSX Transportation's failure to assess and mitigate the risk associated with operating through a signal suspension, which eliminated the system redundancy for detecting a switch in the wrong position, together with the CSX conductor's failure to properly reposition the switch for the main track. In other words, the board attributed the disaster jointly to an organizational risk-management failure and to the specific human error it had failed to guard against — and it placed the organizational failure first.

The board did not stop at CSX. It found that the FRA's failure to implement effective regulation to mitigate the risk of misaligned-switch accidents contributed to the collision, as did Amtrak's failure to conduct its own risk assessment before running its trains through the signal suspension. This is a multi-layer indictment of the operating regime, but it is squarely an operational finding in the railroad-safety sense: nothing in the verdict turns on a defect in the rail, the rolling stock, or any component. Every link in the chain was a decision about how to run trains safely through a known-degraded condition.

The board's recommendations followed from that diagnosis. The NTSB pressed the FRA to require trains to operate at restricted speed when approaching switches during a signal suspension, so that a train confronting a wrongly lined switch could stop short — restoring procedurally the protection the suspended signals had removed. When the FRA responded with a safety advisory rather than a binding emergency order, the NTSB classified the response as inadequate, holding that an advisory did not go far enough to ensure the protection was actually in place. The disagreement underlined the board's core point: the failure at Cayce was a failure to manage a known risk, and managing it required an enforceable rule, not a suggestion.

The Five Factors

01
Removing protection without replacing it
CSX suspended the automatic signal system to install PTC but did not impose a compensating operating rule, such as approaching all switches at restricted speed. Whenever a primary safeguard is taken offline for upgrade work, an equivalent interim safeguard must replace it; degrading two layers of protection at once — the existing signals and the not-yet-working PTC — leaves none.
02
The single-point switch
A hand-throw switch left reversed is a classic single point of failure: one unrecovered human act can route a train onto an occupied track. Systems that depend on every crew restoring every switch, with nothing behind them, are brittle by design and demand either electronic locking, signal protection, or a hard restricted-speed rule.
03
Verbal authority without verification
The reported realignment of the switch was relayed up the chain — conductor to engineer to dispatcher — and accepted as fact when it was false. Where physical reality cannot be independently confirmed by hardware, verbal reports become unverified assumptions, and clearances issued on those assumptions inherit their errors.
04
Risk assessment as a shared duty
The NTSB faulted not only the track owner, CSX, but also Amtrak for running its passenger trains through the suspension without its own assessment. Operators that send trains over another railroad's degraded territory cannot delegate away the duty to evaluate the conditions their passengers will be carried through.
05
Advisory versus mandate
The FRA's preference for a safety advisory over a binding restricted-speed requirement left the protection optional. The board's rejection of that response is the generalizable lesson: a safety control that is recommended but not enforced is a control that the next pressured operation can quietly skip.

Aftermath

The Cayce collision arrived in a cluster of Amtrak incidents in late 2017 and early 2018 — including the fatal DuPont, Washington, derailment weeks earlier — that together sharpened national attention on Amtrak's safety culture and on the long-delayed deployment of positive train control across the U.S. network. CSX completed the PTC installation that the signal suspension had been serving, and the affected territory returned to signaled operation under the new overlay. The accident became a standard teaching case for the specific danger of running trains through a signal suspension and for the discipline required when safety systems are taken down for maintenance.

Civil litigation followed the deaths and injuries, with wrongful-death and personal-injury claims pursued against CSX and Amtrak; the responsibilities apportioned in the NTSB report — CSX's risk-management failure and conductor error foremost — framed the liability arguments. The most durable institutional consequence was the regulatory argument the case forced into the open: the NTSB's insistence that the FRA mandate, rather than merely advise, restricted-speed operation near switches during signal suspensions, and its formal finding that the agency's advisory response was insufficient. The two crew members lost in the lead locomotive, engineer Michael Kempf and conductor Michael Cella, were the human cost of a redundancy that had been switched off and never replaced.

Lessons

  1. When a primary safety system is taken offline for upgrade work, impose an equally protective interim rule before the first train runs; never let the upgrade itself create an unprotected gap.
  2. Treat a hand-throw switch left reversed as a foreseeable certainty, not an aberration — design the operation so that one unrestored switch cannot route a train onto an occupied track without a hard stop.
  3. Do not let a verbal report of a switch's position substitute for verification; clearances built on unconfirmed reports carry the errors of those reports straight to the train.
  4. Spread the duty of risk assessment to every operator on the line — the railroad that owns the degraded track and the railroad that runs trains over it both own the hazard.
  5. Make the safeguard mandatory, not advisory; a restricted-speed rule that depends on goodwill is the rule most likely to lapse under operating pressure.

References