Impact Assessment for Changes to Railway Group Standards

Transcription

1 Impact Assessment for Changes to Railway Group Standards Version: Publication Date: 16 February 2010 Relevant Railway Group Standard Title: Requirements for the Train Protection and Warning System (TPWS) Number: GE/RT8030 Issue: 1 Synopsis: Executive Summary This standard mandates the requirements for the Train Protection and Warning System, the primary purpose of which is to minimise the consequence of a train passing a TPWS fitted signal at danger and a train overspeeding at certain other locations on Network Rail managed infrastructure. The document has been updated to include a new appendix containing further requirements for an improved TPWS panel and functionality for new trains to address the issue of TPWS reset and continue. Reference to the amended requirements is made in the issue record. All other parts of the document are unchanged from the previous issue with the exception of a number of minor changes to address inaccuracies and typographical errors and others to enable the integration of the new appendix. The ATOC Operations Council, has proposed changes to GE/RT8030 that concerns requirements for the provision of TPWS in train cabs. The proposals introduce mandatory, industry-wide and cost-effective requirements for a common, enhanced TPWS Driver-Machine Interface (DMI) on new trains. The intention is to reduce the incidence of TPWS reset and continue through good human factors design and a standardised approach for new trains. The proposed enhancements will minimise the risk from accidents resulting from TPWS reset and continue, saving around 1.85E-4 FWI per cab over 25yrs and provide a positive business benefit. Although the proposed enhancements fall outside the scope of the RGS Code, as they are not interface related, a standard approach has been requested by common consent of industry stakeholders. This approach is designed to minimise both the risk from driver confusion when moving between cabs in different train fleets and the cost of installing the enhancements. Rail Safety & Standards Board Impact Assessment for GE/RT8030 Page 1 of 5

2 1 Initiators of change TPWS Reset and Continue remains an issue that the industry is endeavouring to address [1]. As of 13 October 2008 (the date of compilation of reference [1]) twentyeight TPWS reset and continue events following category A SPADs had occurred since TPWS was installed and five had occurred since the beginning of 2007, although none had occurred between January and September Subsequent to the compilation of reference [1], two more incidents occurred in October The ineffectiveness of the driver-machine interface, which can result in the driver failing to diagnose the cause of a brake demand, and the failure of the driver to contact the signaller have been cited as significant contributors to the propensity for TPWS reset and continue. While, to date, no accidents have resulted from TPWS reset and continue events, there is clearly significant potential for these events to lead to collisions or derailments involving passenger and staff fatalities as well as significant damage to rolling stock and infrastructure. It is estimated from the analysis that, if steps are not taken to reduce the possibility of TPWS reset and continue events, and taking due account of the timescales for ERTMS fitment, the number of train accidents resulting from TPWS reset and continue will be in the range 0.2 to 1.1 accidents over the next 25 years. There is therefore a high probability of a TPWS reset and continue related collision or derailment occurring in the next 25 years with potentially catastrophic consequences and the associated adverse publicity for the industry which such accidents inevitably bring. Proposal 08/128 addresses the amendment of GE/RT8030 to specify an enhanced driver machine interface for TPWS on new trains where this is to be provided as a conventional panel using push-buttons and indicator lamps. Where trains are fitted with ETCS the option of incorporating the TPWS indications into the ETCS DMI should also be available. This is the subject of a subsequent proposal (09/030) which will be incorporated in a further revision of GE/RT8030 following research to establish the requirement. 2 Summary of changed controls and implications for industry 2.1 Reset & Continue Changes are proposed to GE/RT8030 Issue 2 (August 2004) Requirements for the Train Protection and Warning System to address the issue of TPWS reset and continue. A tabular list of the changes is set out in Annex 1. Given the propensity for TPWS reset and continue on trains using the existing TPWS panel it has been proposed that the in-cab TPWS indications and brake reset functions should be modified to: Assist the driver in correctly diagnosing a brake demand initiated by (i) TPWS Train Stop (i.e. a SPAD), (ii) TPWS Overspeed and (iii) AWS late to cancel. Provide a unique driver operated TPWS brake demand reset facility that cannot be overridden by shutting down and restarting the cab. The proposals for new trains will be introduced as an additional mandatory appendix within the existing TPWS Railway Group Standard [GE/RT8030]. Rail Safety & Standards Board Impact Assessment for GE/RT8030 Page 2 of 5

3 The design to be adopted is the 3 indicator panel option (Option 4 see Reference 1 Appendix A) that provides separate indicators for SPAD, Overspeed and AWS late-tocancel and a manual brake release function that incorporates a brake state memory function such that the driver cannot reset the TPWS by shutting down and restarting the cab. The design has been developed to incorporate best practice in human factors design and was fully tested through a comprehensive programme of simulator trials. 2.2 Textual Changes A number of textual changes have been required in the standard to enable the integration of the new appendix covering the proposed enhancements. Other than those related to the enhanced DMI, the changes are in the nature of improved wording and clarification and have no safety or operational impact. 3 Impacts 3.1 Safety and Operational Impact The introduction of the proposed enhanced TPWS control panel will: a) Reduce the risk from TPWS reset and continue. b) Reduce the level of disruption and material damage costs that would result following a TPWS reset and continue related accident. c) Improve operational performance in terms of a quicker response to TPWS reset and continue incidents that do not result in an accident. d) Reduce the long term maintenance costs relating to the TPWS control units as the new control units will have improved reliability compared to the existing units. e) Reduce the propensity for companies to incur the accident investigation and legal costs that would result from a TPWS reset and continue related accident. f) Reduce the propensity for companies to lose revenue from passengers being averse to using the railway following a TPWS reset and continue related accident. No specific operational disadvantages have been identified with the proposed enhanced panel. The minimum legal (ALARP) and business case (including the estimated legal costs) cost and benefit analyses for Option 4 3 indicator light option, based on the retrofit of all 8000 cabs on the network, are presented in reference [1] Appendix A. Given the requirement for the mandatory fitment of TPWS to all trains in the current version of GE/RT8030, the cost of new trains will always have to include the cost TPWS control units and control panels (around 2,000 per cab). Review of the proposals for the enhanced panel by ATOC Operations Council suggested that for new trains the provision of the Option 4 3 indicator light option would result in little or no additional cost to that required for the provision of the existing TPWS control units and panels. The safety benefit to be gained from the provision of Option 4 has been estimated in [1] to be on average1.85e-04 FWI per cab based on the use of the equipment for 25 years. The average overall benefit for the minimum legal (ALARP) case has been estimated to be 605 per cab over 25 years and for the business case (including the Rail Safety & Standards Board Impact Assessment for GE/RT8030 Page 3 of 5

4 estimated legal costs) case has been estimated to be 1945 per cab over 25 years. The benefits will vary for different train fleets depending on the characteristics of the routes they are intended to be used on. With a little or no increase in the build costs for new trains, the provision of the proposed enhanced TPWS control panel is considered to be reasonably practicable. Reference 1 was based on the 2007 estimates of prices and value of preventing a fatality (VpF). 4 Relevant strategies and compliance with decision framework 4.1 RGS Decision framework Section 4.2, Scope, of the RGS Code states that: A measure shall be within the scope of RGS only if all of the following apply: a) It is railway specific b) It applies to duty holders c) It relates to an asset or process over which duty holders have control, d) It involves co-operation between any two or more duty holders. The proposed changes are not in scope because they do not meet condition (d) as per Section of the RGS Code. 4.2 Alignment with relevant strategies approved by the RSSB Board relevant to RGS The proposed enhanced requirements of the DMI are not in scope per Section 4.2 of the RGS Code. However, at the ATOC Operations Council meeting on 13 th October 2008 (which included a freight representative) industry-wide consent was that the design of the TPWS panel for new trains should be captured in an RGS. It was also proposed that a RIS be produced to address retrofitting enhanced DMIs to existing trains. 5 Conclusions The proposed enhancements to the TPWS Driver-Machine Interface for new trains are reasonably practicable as they will minimise the risk from accidents resulting from TPWS reset and continue, saving around 1.85E-4 FWI per cab over 25yrs, at little or no extra cost to the build cost of a new train Although the proposed enhancements fall outside the scope of the RGS Code, as they are not interface related, a standard approach has been requested by common consent of industry stakeholders. This approach is designed to minimise both the risk from driver confusion when moving between cabs in different train fleets and the cost of installing the enhancements. 6 References 1. Assessment of the proposed TPWS in-cab equipment modifications : a paper on the subject of TPWS in-cab equipment modifications presented by the ATOC TPWS Incab modifications working group to the ATOC Operations Council 13 October Rail Safety & Standards Board Impact Assessment for GE/RT8030 Page 4 of 5

5 Annex A Table A1: GE/RT8030 Issue 3 Requirements for the Train Protection and Warning System: New requirements for an enhanced DMI to address Reset & Continue. GE/RT8030 Iss3 Draft 1r clause(s) F2.1 Requirement name or content Appearance of the TPWS DMI including layout of indicators/push buttons. F2.2 Position of TPWS DMI as a primary control. F2.3 Appearance and function of the brake demand indicators. F2.4 Visual indication states. F2.5 F2.6 F2.7.1 F2.7.2 F2.7.3 Function and appearance of the temporary isolation/fault indicator. Function and appearance of the train stop override indicator/push button. Function and nature of the audible alerts for brake demands Function and nature of the audible alerts for TPWS system test and faults General requirements of audible alerts: electronic file size, type of electronic file, automatic volume adjustment, integration into the train cab and relation to other audible alarms and alerts. F2.8 Acknowledgement of SPAD alerts and Overspeed alerts F2.9 Function and appearance of the brake release button. F2.10 Labelling of the TPWS DMI. F2.11 Pushbutton resistance criteria. F2.12 Pushbutton/switch feedback to the driver. F3.1 Train brake application initiated by a TPWS brake demand. F3.3 F3.3.4 F3.4.1 F3.4.2 Brake release requirements following a brake application due to a TSS, OSS or AWS brake demand. Actions for brake release following a brake application due to a TSS, OSS, or AWS brake demand. Requirements for TPWS power up test. Requirements for in-service system monitoring of TPWS and indication of faults. F3.5 TPWS output to the on-train data recorder. F3.6 F3.7 TPWS equipment compatibility, including design requirements to prevent downgrading during maintenance or re-fitment and replacement of TPWS control units without requiring setting up. Capability of TPWS systems to power up at all times including whilst a train is standing over an active TPWS loop. Rail Safety & Standards Board Impact Assessment for GE/RT8030 Page 5 of 5