MODURBAN FP6 Project: TIP EC Contract n :

Transcription

1 MODURBAN FP6 Project: TIP EC Contract n : MODSYSTEM SUBPROJECT DOCUMENT Deliverable ID: Deliverable Title: Responsible partner: Contributors: D121 Examples of Mass Transit Operations scenarios RATP Task WP21.3 partners (Criteria Group) PROPRIETARY RIGHTS STATEMENT This document contains information, which is proprietary to the MODURBAN Consortium. Neither this document nor the information contained herein shall be used, duplicated or communicated by any means to any third party, in whole or in parts, except with prior written consent of the MODURBAN consortium.

2 Document Information Document Name: Examples of Mass Transit Operations scenarios Document ID: D121 Revision: Draft V2 Revision Date: Author: RATP Security: MODURBAN Consortium only Approvals Name Company Date Visa Technical Management Committee Coordinator Subproject Coordinator Quality Manager B. VON WULLERSTORFF G. POITRASSON- RIVIERE D. DIMMER G. LEGOFF L. LINDQUIST A.PRICE / U. HENNING M. NOCK J.P. RICHARD / D. COINEAU Y. AMSLER C. GOUTORBE B. VON WULLERSTORFF J.P. RICHARD B. VON WULLERSTORFF H. ZSCHIEDRICH UNIFE ALSTOM THALES CSEE BOMBARDIER SIEMENS KNORR-BREMSE RATP UITP ALMA UNIFE RATP UNIFE ALMA Revision: V2 Page 2/51

3 Documents history Revision Date Modification Author V Initial version of this document (structure) RATP V Integration of first received contributions (ML, RATP, BVG) RATP V Integration of up-to-date contribution from ML RATP V Version based on V0.3, resulting from the review made during 11 th CG meeting, and of the last received contributions (BVG, ML, RATP and STS) RATP V Version based on V0.4 resulting from the review made during 12 th CG meeting (and a contribution from LU) V Version based on V1.0 with an updating of definitions in 1.4 for Train in sleeping state, Train in isolated state, Train in Standby state and train in Service state accordingly with the final version of the MODURBAN Glossary (D129), as decided during the 24 th WP20 meeting RATP RATP V Version for public availability RATP Revision: V2 Page 3/51

4 SECTION I DELIVERABLE SUMMARY Deliverable ID, associated WP & Subproject Type of Deliverable Examples of Mass Transit Operations scenarios. MODSYSTEM-WP21 Internal document Input / Starting stage Output / Final stage Lead partner(s) RATP Achievement to date (%) 100% Expected date of achievement October 2007 Type of exploitation Exploitation potential Expected budget Actual costs Expected costs to completion Protection Protection date IP s Pre-existing Know-How Exploitation Rights Not relevant Not relevant Partners, (type, identification, date) Not relevant Not relevant Associated Risk analysis Type, solution envisaged, action, actors Actual Reduction Before start Not relevant During task implementation Not relevant Revision: V2 Page 4/51

5 Examples of Mass Transit Operations scenarios. Deliverable Abstract The goal of this document is to list some examples about Mass Transit operations and about Migration Paths. It is based on experience related to lines in revenue service (different GOA), or can correspond to what is expected by some operators. The part about Mass Transit Operations is issued from inputs provided by operators. The scenarios are listed according to a typology applying for nominal operation or degraded one. The part about Migration Paths is issued from inputs provided by operators and suppliers. The Migration Paths are listed according types of Migration in terms of involved GOA. This document shows the purpose of some critical functional requirements described in deliverables such as D77, D78 or D120. Associated Milestone (if relevant): Not relevant. Contribution to MODURBAN Objectives as mentioned in the Description of Work Objective Definition Comments Quantification Objective 1 Objective 2 Objective 3 Objective 4 Revision: V2 Page 5/51

6 TABLE OF CONTENT Document Information Approvals Documents history SECTION I DELIVERABLE SUMMARY SECTION 2 DELIVERABLE DETAILED DESCRIPTION Introduction Objectives References Abbreviations Definitions Mass Transit Operations scenarios Nominal operation Scenarios related to the opening of a line Scenarios related to the putting into service of a train Scenarios related to the serving of a station Scenarios that imply a change of driving modes Scenarios related to a modification of the planned timetable Scenarios related to the coupling trains for nominal reconfiguration Uncoupling trains for nominal reconfiguration of train lengths Scenarios related to the Operation of non-equipped trains (e.g. engineering trains, driving school ones) Scenarios related to the Operation of equipped special trains (e.g. engineering trains) Scenarios related to the turn-back in terminus or in other parts of mainline Scenarios related to the management of emergency requests from trains Scenarios related to the management of emergency requests from platforms Scenarios related to the of parking a train and putting it out of service Scenarios related to the closing of a line Scenarios related to planned maintenance Degraded operation Scenarios related to the Alarms management Scenarios related to the poor-adhesion Scenarios related to shuttle services Scenarios related to shortened services Scenarios related to evacuation Scenario related to rescue Scenarios related to the intrusion of persons Scenarios related to the overshooting of a station Scenarios related to the load shedding running Scenarios related to emergency maintenance Fire/smoke management when fire is in tunnel migration paths Constraints of the migration to be considered Type of upgrading to be considered Upgrading made from a GOA1a system to a GOA2 system Upgrading made from a GOA2 system to a GOA2 system Upgrading made from a GOA2 system to a GOA4 system Revision: V2 Page 6/51

7 SECTION 2 DELIVERABLE DETAILED DESCRIPTION 1 INTRODUCTION 1.1 Objectives The goal of this document is to list some examples about Mass Transit operations and about Migration Paths. It is based on experience related to lines in revenue service (different GOA), or can correspond to what is expected by some operators. The part about Mass Transit Operations is derived from inputs provided by operators. The part about Migration Paths is issued from inputs provided by operators and suppliers. Even if D121 is mainly an informative document as it compiles only some examples, the aim is to enable WP22 partners to finalise the architecture, especially in terms of robustness and adaptability to different constraints. In addition the Mass Transit Operations scenarios should help to check if nothing is missing in existing MODURBAN functional specification documents, and to understand what operators require in such documents. 1.2 References MODURBAN Glossary V Abbreviations See MODURBAN Glossary (referred in 1.2). 1.4 Definitions Train State: A train can be in five states: Train in the Service state, meaning that all functions of train necessary for convenient, reliable and safe revenue service are active, tested and are working according to site specific guidelines and regulations. Train is ready to be put in service right away. Train in the Standby state, meaning that all functions of train necessary for reliable and safe revenue service are available and tested. Functions related to passenger comfort are partially active, e.g. no or reduced lighting, air cooling, heating or ventilation no passenger information. Train in Awakened state, meaning that all functions of the train are available but not all have been tested Train in Sleeping state: basic train functions (e.g. battery charging, air pressure, lighting, ventilation) are on, depending on site specific operating rules, the rest is off. If equipped the MODURBAN onboard equipment or a subpart of it is active and tested to exchange commands and information between OCC and train. The command and information link can be used to remotely command transitions to other train states and to send test results to OCC. Train in Isolated state: the electric equipment of the train is completely switched off and de-energized from traction power. An awakening can then only be done manually Other terms: See MODURBAN Glossary (referred in 1.2). Revision: V2 Page 7/51

8 2 MASS TRANSIT OPERATIONS SCENARIOS 2.1 Nominal operation Scenarios related to the opening of a line RATP case Conventional lines (GOA2 or lower GOA) The opening of stations is ensured by the station staff coming on duty in the place where they are appointed. In the OCC The OCC operator: - checks that all the engineering trains and any engineering equipment that have been used during the night have been removed from the line, - checks the status of the points and of the track circuits after their passage on the Overall Display System (ODS), - reenergises the sections and subsections that have been cut off during the night, - carries out the test of the power cut off; the OCC operator checks that the command for cutting off of the power in a given section implies the effective cutting off of energy in this section, and triggers the corresponding alarm, - checks the departure time of the first trains (particularly at the intermediate terminal) In the local control centre The terminal manager: - reenergises the terminal (in normal situation the traction power in the terminal is cut off after the passenger service), - carries out the test of the points by moving them, - carries out the test of the power cut off; the terminal manager checks that the command for the cutting off of the power in a terminal implies the effective cutting off of energy in the terminal, and triggers the corresponding alarm, - checks the train's daily timetable, established according to the season and the day of week The driver: The driver calls the OCC operator in order to check the voice communication system and enters manually the train number into a specific device located on the departure platform. The driver of the first train in each direction runs towards the opposite terminal in Manual Driving. Fully Automated line (GOA4 implemented on line 14) The OCC Operator: - checks that all the engineering trains and any engineering equipment that have been used during the night have been removed from the line, - re-energises the sections and sub sections that have been cut during the night, - carries out the test related to the alarm power maintenance, - reenergises the terminal, - validates the timetable of the day, this action allows the awakening of trains, As on line 14 some parts of the main line, called zones, are used either as stablings during night, either as normal tracks during Passenger Service, the concerned zones switch between two states: line zone and stabling zone. The states of these parts of the main line depend of the current operations phase (Passenger Service or night) or of the need of the operator. Hence, when the opening of the line is performed, the OCC operator has then to: - make sure that all the trains present in zones to be switched from stabling zone to line zone are parked as expected, Revision: V2 Page 8/51

9 - make sure that all the trains in these zones are awakened, - make sure that the platform screen doors of the concerned zone are closed and locked The OCC operator switches then the zone from the stabling zone state to the line zone one. The OCC operator activates the missions attributed to the first two trains, in order to perform the sweeping of the tracks: the sweeping of the line is made separately with two trains on each track, each train starting from one extremity of the line; these first two trains run without passengers, but they carry the operation staff, and dispatch them according to their appointment in the different stations of the line. Then, when the sweeping is performed, the OCC operator launches the command that permits to obtain the predefined positioning of the trains in the main stations before the effective starting of the Passenger Service (this in order to obtain quickly the optimal headway) TMB case The same procedure as the RATP conventional line case is applied. Revision: V2 Page 9/51

10 2.1.2 Scenarios related to the putting into service of a train By putting into service we mean that the train is ready to ensure a normal service for passengers (for the notion of Train state, please refer to 1.4 for the five defined ones) BVG case The phrase Implemented for GOA1a: means that the state described is currently implemented for the daily operation made by BVG metro, because GOA1a is implemented on all BVG metro lines. Tested for GOA4 (Research project Star): means that the state described has been tested by BVG in automatic operation within the research project Star or in former projects such as M-Bahn, SELTRAC or LZB 500 and found to meet the demands of BVGspecifications for automatic operation Isolated state Implemented for GOA1a: Train is completely switched off and de-energised. Train is located in stabling areas or depot tracks. Tested for GOA4 (Research project Star): The same as in GOA1a Sleeping state Implemented for GOA1a: Train is switched off and de-energised, except basic train functions for air pressure and battery charging. Train is located in stabling areas or depot tracks. Tested for GOA4 (Research project Star): Train is switched off and de-energised, except basic train functions for air pressure and battery charging and all functions required to awaken the train by command from OCC. These functions, mainly the trainborne ATP communication system, remain energised. Train is located in stabling areas or depot tracks. The following procedure is the same in both GOAs and implemented for GOA1a and tested for GOA4 (Research project Star): To change an isolated train into the sleeping state staff (driver, attendant, shunter) has to be sent to train to switch on battery power main switch and put the collector shoes on the third rail. In GOA4 trainborne ATP communication system will be switched on automatically when battery power main switch is switched on. To change from sleeping to the isolated state staff (driver, attendant, shunter) has to be sent to train to switch off battery power main switch and remove the collector shoes from the third rail Awakened state Implemented for GOA1a: Train is switched on and energised including all train functions as traction and breaking control systems, MMI-systems, ATP-Systems, communication systems, air pressure, lighting, heating, air condition and passenger information systems. Train is located in station tracks, stabling areas or depot tracks. To change from sleeping to the awakened state the train functions have to be switched on manually by staff (driver, attendant, shunter). To change from awaken to the sleeping state all train functions except the basic train functions have to be switched off manually by staff (driver, attendant, shunter). Basic train functions for sleeping state remain switched on. Revision: V2 Page 10/51

11 Tested for GOA4 (Research project Star): To change from sleeping to the awakened state the train receives a command by the OCC to switch on and energise all train functions as traction and braking control systems, door control systems, ATP and ATO Systems, communication systems, air pressure, lighting, heating, air conditioning and passenger information systems. To change from awakened to the sleeping state the train receives a command by the OCC to switch off and de-energise all train functions. Basic train functions needed for the sleeping state remain switched on Standby state Implemented for GOA1a: To change from awakened to the standby state the train is checked by staff (driver) by performing a test which includes the checking of brake functions, traction functions, condition of air pressure, data transmission functions and general train condition. Train is in standby state if all checks are successful. Failures have to be reported to OCC by staff (driver), which decides how to proceed. Train is located in station tracks, stabling areas or depot tracks. Driver remains on board a standby train. Tested for GOA4 (Research project Star): To change from awakened to the standby state the train receives a command by OCC to perform a test sequence which includes checking of the emergency brake, doors, air pressure, data transmission of safety relevant functions, trip stop and other site specific actions. The train changes to the standby state and is ready for being assigned if all tests are successful. Test failures are reported to the OCC automatically, the OCC then has to adapt train service to actual situation. To keep the train in standby state tests have to be repeated at least every 60 minutes Service state Implemented for GOA1a: Train in Service state is a train in Standby state with driver on board and ready to be put in service at any time (all functions including those related to passenger comfort are active and tested) TMB case Tested for GOA4 (Research project Star): Train in Service state is an assigned train with updated mission data in standby mode, ready to be put in service as required (all functions including those related to passenger comfort are active and tested). Assigning a train means to update mission data of that train. Mission data are information necessary to perform a trip (departure time, operation schedule, line number and destination), all data necessary for passenger information on that trip and other site specific data. Agreement with the five states referred in introduction. Revision: V2 Page 11/51

12 2.1.3 Scenarios related to the serving of a station ML case Scenario used for GOA1a, GOA1b and GOA2. a) Train enters a station with a maximum speed of 40 km/h. In GOA1a there s a discrete speed control on the entry to the station. b) Train Decelerates and stops near the end of the platform (In GOA1a the departure signal stays restrictive for the first 20 seconds of occupation of the station s track circuit). c) Driver opens doors. d) Driver closes doors. e) Driver waits for authorisation to proceed (GOA1a-Green Signal or GOA1b and GOA2-Speed Objective). f) Driver presses the departure buttons (GOA2 only). g) Train departs the station TMB case In Barcelona network the scenario is similar to the ML case. GOA1a, GOA1b and GOA2: 1. The train enters the station with a maximum speed of 50Km/h. In GOA1a there s a discrete speed control at the entry to the station. 2. The train stops at the prescribed specific point of the platform (GOA1a and b: manually by driver, GOA2: automatically). 3. Driver opens doors. 4. Driver closes doors. 5. Driver waits for authorisation to proceed: GOA1a: Green light GOA1b and GOA2: Green light and Speed Objective. 6. Driver presses the departure buttons (GOA2 only). 7. Train departs the station. Revision: V2 Page 12/51

13 2.1.4 Scenarios that imply a change of driving modes RATP case In our network, except on Line 14 equipped with a GOA4 system, other lines are equipped with a GOA2 system (called PA), except on Line 3bis, 7bis and 10 where PA is not implemented. In addition, independently of the PA system is deployed a GOA1a system (called RPS) which ensures some punctual controls (prevention of SPADs). Note: historically speaking about our network, RATP puts at first two persons onboard (one driver and a train captain in charge of passenger exchanges), then one driver + the PA system, then we introduce the RPS which controls that the driver does not pass a red signal when the driving is manual. Now, since N.D.-de-Lorette accident, RATP considers that RPS is not enough to ensure a good level of safety, so we introduce a new system, OURAGAN, to ensure a continuous control of speed whatever the type driving (manual or automatic). Before the deployment of OURAGAN is effective on its conventional lines, RATP has installed in addition to existing systems a new GOA1a system called KPVA for the punctual control of possible over speeds on some parts of our network. For the conventional lines equipped with such GOA2 system, the driver is able to change the driving mode during the mission. Most of the time the selected driving mode is the automated mode (especially during peak hours), but for any reasons (e.g. training, degraded modes), the driver can switch from the mode "automatic" to the mode "manual" and vice-versa. When the train is driven in manual mode, the safety of the train is only ensured by the GOA1a system. The transition between the two driving modes manual and automatic has to be made when the train is completely stopped. The switch of the driving selector from the position "manual" to the position "automatic", or vice versa, while the train is stopped triggers the maximal service braking. The switch of driving selector from the position "manual" to the position "automatic", or vice versa, while the train is moving triggers an irreversible emergency braking and the opening of circuit breakers LU case All lines except the Central and Victoria lines are equipped to operate at GOA1a. In tripcock protection mode (TCP), no change of driving mode is possible. However, there is a temporary degraded mode that is enforced by the system when a train trips past a signal at danger. In this situation, the train enforces a maximum speed of 17kph for a nominal period of 3 minutes. This system is known as Speed Control After Tripping (SCAT), and was introduced after several collisions were caused by drivers failing to comply with the rule after tripping that require them to drive at 17kph past two green signals before resuming normal line speed. On the Central and Victoria lines where the signalling provides a coded track circuit implementation of continuous ATP, drivers can select a Restricted Manual mode of driving. This driving mode is used under failure conditions, when the trains are being driven on sight. The mode can only be selected when the train is stopped. Speed enforcement at a maximum speed of 17kph is carried out by a system onboard the train that is independent of the ATP system. The other available driving modes are ATO and Protected Manual (PM). In PM mode the train is driven manually in accordance with the displayed speed codes, and overspeed protection is provided by the ATP system ML case The Red line is equipped with a GOA2 system that allows three driving modes: Revision: V2 Page 13/51

14 a) Manual: Driver follows classical signalling; movement protected by electromagnetic trip stops. b) ATP: Driver follows onboard Movement Authorities; movement protected by ATP system. c) ATO: Driver only opens and closes doors and gives authorization to depart to the ATO; Movement protected by ATP. The standard driving modes are ATO during the day and ATP between 22:00 and 01:00. The transition between driving modes must be made at standstill, if not the train will get an irreversible emergency breaking. The change from Manual to ATP or ATO driving modes can only be done in specific places along the line (ATP initialisation areas) BVG case Currently Implemented for GOA1a-equipped lines: No changes are actually made in the existing network, GOA1a on all lines. Tested for a GOA4 system (Research project STAR): Transition between driving modes is possible in stations, in stabling or crossover areas or in depots only. The train has to stop and new mode has to be selected by staff (driver, operation supervisor, attendant). Before proceeding after change of mode, safety related train conditions and devices have to be tested according to certification and proof of safety and other site specific regulations. Stations or areas in which transitions of driving modes take place have to be equipped with technical equipment necessary for both GOAs, if these stations or area are at the boundary of two sections of line with a different GOA TMB case GOA1b to GOA2: Train must be stopped in station so as it can receive the ATO radio signal codes. GOA2 to GOA1b: It can be done anywhere, anytime. No need to have the train stopped. GOA2/ GOA1b to GOA1a: Only when there is a degraded situation or previously programmed by the OCC. The maximum speed is set to 25 km/h. Not possible by the driver. Note: in case of a degraded situation implying a loss of ATP/ATO track codes, the OCC can force the transition to a GOA1a mode in the concerned area. The OCC informs all the drivers of the line about the new situation. The transition to GOA1a is fully automatic in the area and can not be forced by the driver in any case. Once the problematic zone is left behind, the train automatically returns to its previous GOA1b/GOA2 mode. The driver has to communicate with the OCC during all the process when driving through the problematic zone. Revision: V2 Page 14/51

15 2.1.5 Scenarios related to a modification of the planned timetable LU case All Lines on LU run to a pre-planned timetable. A very significant proportion of the railway is controlled from OCCs. Areas of the railway that are not under OCC supervision are controlled by local signal cabins. The signalling control systems on LU have a distributed architecture for automatic route setting, where each interlocking has either a local site computer (LSC) or a programme machine containing a timetable for that local area. The computer based control systems provide operator commands in the OCC for editing the timetable in real-time, for inserting new time-table entries for extra trains and for cancelling entries for trains that will not run. All these timetable modifications are automatically transmitted to the distributed LSCs. In the case of programme machine implementations of centralised control, the operator in the OCC is provided with push buttons to run introduce extra trains and to cancel train paths, but in this case, each individual programme has to be modified by the operator TMB case Depending on the time of day, the number of trains varies (peak hours, etc ). Train entries and exits are controlled by the OCC operator who gives instructions to the drivers according to an established plan. Revision: V2 Page 15/51

16 2.1.6 Scenarios related to the coupling trains for nominal reconfiguration BVG case Couplings take place in stations, stabling areas or in depots and are performed manually by staff (driver, operation supervisor, shunter). It is done several times a day, according to the traffic and the number of passengers. It is based on pre established timetables written according to Passenger demand related statistics. The manual coupling takes generally between 5 and 10 minutes. The automatic coupling has been tested during the research project STAR Coupling in station or stabling area Currently implemented for GOA1a-equipped lines: The coupling is performed manually by staff (one person). The train resulting from coupling has to be tested and prepared for standby state. Tested for GOA4 (Research project STAR): The train which has to be coupled stops a train length ahead of the second train standing in station or stabling area. The train to be coupled performs a coupling approach with a maximum speed of 5 km/h in direction of the standing train. After coupling the new train performs testing sequences of safety related train conditions and other system tests to get in standby state Coupling in depot: Implemented for GOA1a / tested for GOA4 (Research project STAR): All couplings in depot are done manually by staff TMB case Not used in Barcelona network Uncoupling trains for nominal reconfiguration of train lengths BVG case Un-couplings take place in stations, stabling areas or in depots and are performed manually by staff (driver, operation supervisor, shunter). The automatic uncoupling has been tested during the research project STAR Uncoupling in station or stabling area Currently implemented for GOA1a-equipped lines: The uncoupling is performed manually by staff (one person). The trains resulting from the uncoupling have to be tested and prepared for the standby state. Tested for a GOA4 system (Research project STAR): The uncoupling valve is commanded from the OCC, the train which is to be uncoupled moves a small distance by command of OCC, trains resulting from the uncoupling perform testing sequences of safety related train conditions and other system tests to get in the standby state Uncoupling in depot Currently implemented for GOA1a-equipped lines / tested for a GOA4 system (Research project STAR): All the un-couplings in depots are done manually by staff. Revision: V2 Page 16/51

17 2.1.8 Scenarios related to the Operation of non-equipped trains (e.g. engineering trains, driving school ones) LU case It is not LU s normal practice to operate unequipped trains during traffic hours. During Engineering Hours a number of different types of unequipped Engineers trains are permitted to operate in accordance with LU rules and procedures. However, LU may permit an unequipped train to be moved to a work site after the passage of the last passenger train, and generally this is by special arrangement, which involves a Safety Plan to control the risks associated with the movement Scenarios related to the Operation of equipped special trains (e.g. engineering trains) LU case LU operates an arrangement where rolling stock types and formations are approved to run on specified routes. On GOA1a lines with TCP, approved rolling stock may be permitted to run between service trains, but at a lower speed than service trains. On GOA2 lines engineer trains must be equipped with appropriate ATP onboard systems. Trains are manually driven in protected manual mode, and are normally required to be driven at a speed lower than the line speed. Below are examples of Engineer s Trains that run on the LU Network: Weed Killing Train The train normally operates only during Traffic Hours. It must follow a service train to the worksite and then work (spray) at a maximum speed of 48 kph over the section of track to be treated. The length of track to be treated will be such that delays to the passenger train service will not normally occur. At the end of the section, treatment must stop and, if the train is to move to stabling or reversing point, it must do so at normal running speeds. Track Recording Train The track recording train contains electronic equipment for measuring and recording track geometry data. The train can run or work in either direction at speeds up to, but not exceeding, 110 kph and is driven by two suitably qualified train operators. This train must not exceed the speed limit of the line on which it travels, and must also obey all temporary and permanent speed restrictions. The train is equipped with continuous ATP equipment for operation on the Central Line. Rail Adhesion Trains Rail adhesion trains operate during the leaf fall season. They apply sandite to the running rails, which contributes towards annual leaf fall mitigation activities by increasing adhesion between the wheel and the rail. (Sandite is a slurry consisting of sharp sand and stainless steel shot.) While sandite is being applied the rail adhesion train must not exceed a maximum speed of 50 kph. When sandite is not being dispensed, it is permissible for the train to operate up to a maximum speed of 70 kph. Revision: V2 Page 17/51

18 Scenarios related to the turn-back in terminus or in other parts of mainline ML case 1 Scenario used for GOA1a and GOA1b. a) Train is at the last station before turn-back, having been cleared of all passengers and closed doors. b) Driver waits for authorisation to proceed (GOA1a-White Signal or GOA1b-Movement Authority). c) Driver takes the train to the turn back platform. d) Driver changes cabin. e) Driver waits for authorisation to proceed (GOA1a-White Signal or GOA1b-Movement Authority). f) Driver takes the train to the Departure platform. 2 Scenario used for GOA2 with semi-automatic turn-back. a) Train is at the last station before turn-back, having been cleared of all passengers and closed doors. Last Station Turn back platform Last Station b) Driver waits for a speed objective. c) Driver presses the departure buttons. d) Train goes to the beginning of the turn back platform. Last Station Turn back platform Turn back platform Last Station Turn back platform e) Driver exits the train and uses the train key in the turn-back lock located in the turn back platform. f) Train automatically proceeds until the rear cabin faces the driver. Last Station Turn back platform Last Station g) Driver enters what is now the front cabin. h) Driver waits for a speed objective. i) Driver presses the departure buttons. Turn back platform Revision: V2 Page 18/51

19 j) Train departs to the Departure platform. Note: ML has stopped to use the automatic turn-back functionality due to reinforced security measures (inspections to be made inside the train by the driver) after the bomb attacks in Madrid 2004.The use of the automatic turn-back is currently reassessed for a project of extension TMB case 1. GOA1a and GOA1b. a) Train is at the last station before turn-back, having been cleared of all passengers and closed doors. b) Driver waits for authorisation to proceed (GOA1a: Green Signal or GOA1b: Green signal + Speed Objective). c) Driver takes the train to the turn back track circuit. d) Driver changes cabin. e) Driver waits for authorisation to proceed (GOA1a: Green Signal or GOA1b: Green signal + Speed Objective). f) Driver takes the train to the Departure platform. 2. GOA2 with semi-automatic turn-back. At present not used in Barcelona network, but in case of utilization the procedure is programmed the same way as in Lisbon: a) Train is at the last station before turn-back, having been cleared of all passengers. b) Driver waits for a speed objective. c) Driver presses the departure buttons. d) Train goes to the beginning of the turn back platform. e) Driver exits the train and uses the train key in the turn-back lock. f) Train automatically proceeds until the rear cabin faces the driver. g) Driver enters what is now the front cabin. h) Driver waits for a speed objective. i) Driver presses the departure buttons. j) Train departs to the Departure platform. 3. GOA4 It will be the future case of Lines 11 and Line 9. Although there will be an agent in the train for passenger attendance (in fact it will be staff roving from one train to other to provide information for passengers, or possibly to quicken the recovery in degraded situation), it will not take part in the turn back operation. Revision: V2 Page 19/51

20 Scenarios related to the management of emergency requests from trains ML case Scenario used for GOA1a, GOA1b and GOA2. The Onboard Emergency Handle only triggers an EB when the train is stopped or leaving a station (e.g. if the train can stop with at least one door facing the platform then the EB triggers) 1 - Train triggers EB a) Onboard Video Surveillance saves images on the non-erasable memory from a few seconds before the event until the driver resets the Handle. b) Communication is established between driver and pulled Handle. c) Driver communicates the event to the OCC d) Driver goes to the pulled handle in order to make an assessment of the event. e) Driver resets the handle. f) If safety conditions are fulfilled, movement of the train may be resumed. g) If the ATP (GOA1b and GOA2) doesn t allow train movement to resume, driver must contact OCC and await further instructions. 2 - Train doesn t trigger EB a) Onboard Video Surveillance saves images on the non-erasable memory from a few seconds before the event until the driver resets the Handle. b) Communication is established between driver and pulled Handle. c) Driver continues until next station unless there s risk for passengers or trains. d) Driver resets the handle TMB case GOA1a, GOA1b and GOA2: The Onboard Emergency Handle only triggers the EB when the train is stopped in a station. Between stations, the train doesn t stop but the driver communicates with passengers through the public address system. a. Communication is established between driver and pulled handle either through the public address system or the interphone. b. Driver communicates the event to the OCC c. Driver goes to the pulled handle in order to make an assessment of the event. d. Driver resets the handle. e. If safety conditions are fulfilled, movement of the train may be resumed. f. If the ATP (GOA1b and GOA2) doesn t allow train movement to resume, driver must contact OCC and await further instructions. Revision: V2 Page 20/51

21 Scenarios related to the management of emergency requests from platforms BVG case Station track surveillance Tested for a GOA4 system (Research project STAR): If the system detects an intrusion on station track and is activated all trains approaching this station track will be automatically stopped. Service brake is used if the trains will not enter station track, emergency brake is used if trains are too close to platform area and can not be stopped before entering station track Intrusion detection Tested for GOA4 system (Research project STAR): If the system detects an intrusion on track outside station and is activated it has to be assumed that persons are in that area. All trains in concerned area are stopped by emergency brake at once Emergency stop switch Currently implemented for GOA1a-equipped lines: At least three switches along each platform side. When they are activated (by pulling a handle), it switches on emergency signals, and makes interlocking signals in the concerned area in the restrictive state. The emergency signals (three red lights) are located on each track before station and one train length (100 m) after station. Driver has to react to these signals (that are equipped with trip stops) to stop the train at once. Tested for a GOA4 system (Research project STAR): At least three switches along each platform side. Activation (pulling a handle) will automatically stop train approaching or leaving the station at once. For approaching trains, the service brake is used if the train remains outside station track, emergency brake is used if trains are too close to platform area and can not be stopped before entering station track. Trains leaving station are stopped by emergency brake as long as train or part of train is in station Platform communication system Currently implemented for GOA1a-equipped lines: At least two Help-Points installed on each platform. If actuated, a communication link between passenger and OCC is established. Passengers can report situation to OCC, OCC can switch on emergency stop switch in concerned area (see ). Tested for GOA4 (Research project STAR): At least two Help-Points installed on each platform. If actuated, a communication link (audio bidirectional, video to OCC) between passenger and OCC is established. Audio and video recording is actuated. Passengers can report situation to OCC, OCC can send stop signal to concerned trains. Trains stop by emergency brake. Revision: V2 Page 21/51

22 Scenarios related to the of parking a train and putting it out of service RATP case Conventional line At the Local control centre the terminal manager parks trains according to the departure of the next day. The Driver: At the last Platform served by the train, the driver invites all the passengers to get off the train by an announcement and checks that nobody remains in the train. The driver takes the train to the place indicated on the garage board. The driver proceeds to the stabling of the train, By applying the immobilization brake if the train is provided with it, Or by applying one or several handbrakes according to the slope of the parking zone, And by putting wedges if necessary, Then he checks that no drift of the train occurs. The driver turns off the power onboard the train, permitting to put the train to sleep. Fully automated line The OCC operator makes sure through video surveillance means that there are no more passengers onboard. After this check, the operator switches the concerned zone from the line zone state to stabling zone state (see ). Doing this permits to put to sleep the train TMB case Trains are parked according to the departure scheme of the next day. The driver takes the train to the defined place and proceeds to stabilize it applying the immobilization brake. The driver turns off the train. The driver checks that nobody is in the train and communicates with the OCC Scenarios related to the closing of a line RATP case Conventional line Stations are closed after the departure of the last train from each station by the operation staff. In the OCC When all the trains are parked, the service is considered as ended on the line. In Local control centre The terminal manager parks trains according to their departure of the next day, by taking into account the planned timetable. The terminal manager switches off the traction power supply in the terminal. Fully automated line When the passenger service is finished, the OCC operator launches a specific command to pick up the operation staff, then after that the trains are parked automatically in their stabling. The operator switches off the traction power supply in the terminals TMB case Stations are closed after the departure of the last train from each station by the operation staff In the OCC: When all the trains are parked, the service is considered as ended on the line. In Local control centre: Revision: V2 Page 22/51

23 The terminal manager parks trains according to their departure by taking into account the timetable of the next day In the OCC: The terminal manager switches off the traction power supply. Revision: V2 Page 23/51

24 Scenarios related to planned maintenance Some planned maintenance interventions can occur during the Passenger Service BVG case Bi-directional traffic The line is fully served, but in the maintenance area one track is closed. The second track is used in both directions. Crossovers between both main tracks have to be available on both sides of the maintenance area. Fig. 1: Bi-directional traffic Currently implemented for GOA1a-equipped lines: Safety is ensured by an interlocking system which is capable of route setting in both directions in concerned area. Otherwise safety has to be ensured by regulations and staff action. Tested for a GOA4 system (Research project STAR): Safety is ensured by an interlocking system which is capable of route setting in both directions in concerned area. Timetable has to be edited accordingly Stitch traffic All stations of line are fully served but line is divided. In the maintenance area one track is closed, the second track is interrupted on one side. Trains which are entering this track have to shuttle. Fig. 2: Stitch traffic Currently implemented for GOA1a-equipped lines: Safety is ensured by an interlocking system which is capable of route setting in both directions on the stitch-track. Otherwise safety has to be ensured by regulations and staff action. In case of reduced overlaps 1, additional safety measures (speed signals, speed controls, permanent trip-stops) have to be installed. Tested for a GOA4 system (Research project STAR): Safety is ensured by an interlocking system which is capable of route setting in both directions in concerned area. Timetable has to be edited according to travel time on stitch track Shuttle traffic All stations of the line are fully served but line is divided. In the maintenance area one track is closed. The second track is interrupted on both sides. Service on shuttle track is done by one train only which is locked in the shuttle track. 1 A reduced overlap is an overlap which, under certain conditions, is shorter than normal. A selection of the route with a reduced overlap will apply approach control to enforce a slower-speed approach to this point. Revision: V2 Page 24/51

25 Fig. 3: Shuttle traffic Currently implemented for GOA1a-equipped lines: Safety is ensured by an interlocking system which is capable of route setting in both directions in transfer area. Otherwise safety has to be ensured by regulations and staff action. In case of reduced overlaps, additional safety measures (speed signals, speed controls, permanent trip-stops) have to be installed. Generally operation on remaining parts of line is regular. Tested for a GOA4 system (Research project STAR): Regular operation on both parts of line. The shuttle train may run under GOA1a with additional safety measures (reduced speed, speed control, permanent trip-stops on both ends of stitch track) Rail replacement service All stations of the line are fully served. Transportation is partly done by a replacement service (Bus, tram, taxi). Normally the line is divided in two parts. In the maintenance area all tracks are closed and the transportation means are provided by an external carrier. Fig. 4: Rail replacement service Currently implemented for GOA1a-equipped lines: Safety is ensured by an interlocking system which is capable of route setting in both directions in transfer area. Otherwise safety has to be ensured by regulations and staff action. In case of reduced overlaps, additional safety measures (speed signals, speed controls, permanent trip-stops) have to be installed. Tested for a GOA4 system (Research project STAR): Regular operation on both parts of line. Revision: V2 Page 25/51

26 2.2 Degraded operation Scenarios related to the Alarms management RATP case Example for the treatment of the alarm "traction power supply" for a conventional line In the OCC: On the working station HMI Triggering of alarm produces a sound alarm and the illumination of an indicator "traction power supply" and the indicators provided on each platform to hold the trains in station are shown. On the Overall Display System (ODS) The section where the traction power is cut off is displayed with the red aspect. The OCC operator has to check that the traction power has been effectively cut off. The OCC operator gets the information from train driver or/and station staff in the concerned zone to determine the exact location of the problem and its characteristics. If the incident is identified: The OCC operator reenergises the not concerned subsections, sets up the shortened service removes the indication "train hold" where needed informs the drivers, the station staff and the terminus manager of any modification of the operation refreshes the information intended to the travellers (public announcements stations and trains) When the incident is finished, the OCC operator: checks that the emergency cut off device is resettled informs the drivers that the traction power supply is available removes the shortened service informs the terminus manager of conditions of operation If the incident is not identified: The OCC operator asks the station staff to check the emergency cut off device, the station staff has to find the emergency cut off alarm device at the origin of incident, the incident could be located in the platform or in tunnel. When the origin of incident is found, we apply the above described treatment. Revision: V2 Page 26/51

27 2.2.2 Scenarios related to the poor-adhesion LU case On areas of LU operating at GOA1a, the driver is required to use his skill and judgement to determine low adhesion conditions. In areas where low adhesion and poor shunting of track circuits is a risk, it is LU s practice to run special sleet trains or sandite trains before start of service to reduce the risk of disruption ( sandite is a mixture containing metal filings in paste, which is applied to the railhead to improve shunting performance during the leaf fall season). The Victoria Line (GOA2) is entirely below ground and therefore generally, poor adhesion scenarios do not apply (the failure of rail greasers, where too much lubrication is applied to the wheel/rail interface is a condition that must be understood and appropriately managed to maintain safety). The Central Line (GOA2) operates in both underground and outside areas. To mitigate the risks associated with poor adhesion, the first train(s) in the morning is(are) operated in PM driving mode to help determine whether conditions are acceptable for ATO operation. These procedural controls are supported by a software based system called the Adhesion Controller s Condition Assessment Tool (ACCAT), which uses real-time and past data to advise whether trains should operate in ATO. This tool has been developed for use on the Metropolitan Line, where leaf fall problems are experienced each year, and this version of the tool is known as MLACCAT. It is anticipated that such tools will be used by other lines when the planned programme of upgrades to GOA2 systems are implemented Scenarios related to shuttle services BVG case Setting of shuttle service Currently implemented for GOA1a-equipped lines: Passengers and staff have to be informed about the change from regular service to shuttle service. The succession and number of trains on shuttle track and on bordering tracks have to be adjusted. It may be that trains on both remaining parts of the line have to be taken out of service to adjust the line capacity to the shuttle capacity. Additional staff has to be sent in the shuttle terminus stations for passenger information and for speeding up travelling time (assisting by changing train direction on shuttle track and on terminus tracks). Trains remaining for service have to be assigned accordingly. Measures which have to be taken for safety are site specific depending on available interlocking system and on regulations. Tested for a GOA4 system (Research project STAR): Passengers and staff have to be informed about the change from regular to shuttle service. The succession and number of trains in shuttle track and bordering tracks have to be adjusted. It may be that trains on both remaining parts of line have to be taken out of service to adjust the line capacity to the shuttle capacity. All trains remaining for service have to be assigned accordingly to timetable. Additional staff for passenger information has to be sent to shuttle terminus stations and for driving the shuttle train if the train can not run under GOA4. Measures to be taken for safety on shuttle track are site specific and depend on installed interlocking system in concerned area Removal of shuttle service Currently implemented for GOA1a-equipped lines: It has to be checked that shuttle track and connection tracks to bordering tracks are clear and ready for service, passengers and staff have to be informed about the change to regular service. First trains of regular service have to be identified, all trains for service have to be disposed according to timetable, withdrawn trains have to be manned and all trains have to be assigned for regular service. Revision: V2 Page 27/51

28 Tested for a GOA4 system (Research project STAR): It has to be checked that shuttle track and connection tracks to bordering tracks are clear and ready for service, passengers and staff have to be informed about change to regular service First trains of regular service have to be identified, all trains for service have to be disposed according to timetable, all trains have to be assigned for regular service. Revision: V2 Page 28/51

29 2.2.4 Scenarios related to shortened services RATP case Shortened Services The mainline crossovers are used to allow shuntings in order to make the train change of tracks from track 1 to 2 or vice versa. V2A Q2 Q2 V2B V1A Q1 These shuntings are distinguished according to two cases: "post-station" or "pre- station" shuntings. Shortened service operated from the OCC a) post-station shunting Q2 V2B Q1 The commands of the shortened service are realized from the OCC The OCC operator activates a command "V2 / V1 " which provokes: At once: Some indicators at the concerned platforms are provided to inform the driver that the shortened service is established Revision: V2 Page 29/51

30 After a temporization of 30 seconds: route release V1A Q1 hold the signal M1 These conditions being satisfied, the shortened service can work If presence of a train on V2B Q2 V2B is automatically released If absence of a train on V2B Q2 V2B that was commanded in automatic route goes in automatic release In the 2 cases, as soon as the release of Q2 V2B, we shall have the route authorisation for V2B Q1 either by phase of automatic release during the running of the train V2B Q1 or by escape, the train on V2B goes to the track 2. From the release of V2B Q1, Q2 V2B is commanded in automatic release. Cancellation of the shortened service The OCC operator deactivates the command " V2 / V1 ", we shall have at once the extinction of the indicator "SP" on the platform of the station B, the setting in automatic route of Q2 V2B and of V1A Q1 (if the platform 1 is free) if the shunting conditions are realized. From the setting of V1A Q1 we will have extinction of departure on order at the head of platform 1 of the station A b) pre-station shunting When the shunting is made pre-station, the operator who manages the shunting can send directly trains from the arrival platform to avoid stopped trains on main track which could be provoked by the shunting. V1A Q1 V2B Q2 V2B V2 (pattern Q2) or V1A Q1 V2B V2 (pattern Départ) The commands of the shortened service are realized from the mimic panel or work station, the OCC operator activates a command "V1 / V2" which provokes: At once: Some indicators at the concerned platforms are provided to inform the driver that the SP is established After a temporization of 30 seconds: route release V1A Q1 (hold the signal M2) These conditions being satisfied, the shortened service can work: then Revision: V2 Page 30/51

31 Route release of Q2 V2B Approach locking of signal Z2 is inactive The transit zone of the route is free If presence of a train on Q1 V1A Q1 is automatically released and the pattern Q2 turned on If absence of a train on Q1 V1A Q1 that was commanded in automatic route goes in automatic release In the 2 cases, as soon as the release of V1A Q1, we shall have route authorisation for Q1 V2B by phase of automatic release during the running of Q1 V2B by the train or by escape, the train on platform 1 runs to the track 1. (The command "V1 / V2 " having beforehand been deactivated to have the opening of the exit signal of track 1 of the station B) From the release of Q1 V2B (train in V2B) because we had the ignition of the pattern Q2, route V2B Q2 is commanded. We will have by phase of automatic release during the running by the train V2B Q2 or by escape, train on V2B runs to the track 2. In that case the indicator "Q2 " will illuminate again for the next train which will enter platform 1. If the release of V2B Q2 is obtained by automatic release, we shall have the setting of Q2 V2B after temporization of one minute if no train comes, during this minute, to occupy the platform 1. On the contrary if a train comes to occupy the platform 1 during the temporization, it is the route Q1 V1B that will be commanded. In that case the indicator "Depart" will illuminate at the head of platform 1 of the station B, as soon as the release of Q1 V2B routes Q2 V2B and V1A Q1 will be commanded. Cancellation of the shortened service The OCC operator deactivates the command "V1/ V2 ", we shall have at once: the extinction of the indicator "SP" on the platform of the station B, the setting in automatic route of V1A Q1, of Q2 V2B and of V2A Q2 (if the platform 2 is free) if the shunting conditions are realized. From the setting of V2A Q2 we will have the extinction of departure on order at the head of platform 2 of the station C TMB case Same case as RATP example. All the shortened services are set by the OCC. They can be activated using the preprogrammed cases or manually by the OCC. Revision: V2 Page 31/51

32 2.2.5 Scenarios related to evacuation RATP case Some incidents can bring long duration train stopping in the tunnel and it is necessary to proceed to an evacuation to avoid such a long wait for the passengers. In France the law limits the duration of the wait to 30 minutes. Conventional lines The evacuation of the passengers of a train stopped in the track must be decided only by the OCC operator or an operation manager, in addition some passengers announcements must be made by the driver or OCC operator to prevent panic. When it is time to proceed to the evacuation of the passengers on track: the power traction shall be switched off the traffic shall be interrupted on all neighbouring tracks, the driver applies all handbrakes or immobilization brakes and makes a test of not drift, the driver opens the train doors and puts the escape ladder at the opposite side of the track spacing; the driver invites the passengers to come down and he shall recommend them not to approach the neighbouring tracks; the direction to be followed must be indicated to them, in tunnel: in the case of presence of smoke or of fire, they are directed towards the opposite of the disaster, on the contrary case, they are directed towards the nearest station. The operation staff working in proximity has to cooperate with the driver, and make sure the passengers do not go in a wrong direction and help the people in difficulty Full automated line (line 14 case) The treatments related to evacuation are similar to conventional lines ones, but some additional constraints have to be taken into account: the main one is related to the fact that the decision for evacuation has to be correctly anticipated because no driver is present onboard, and it takes a certain time to reach the train to evacuate. Announcements from the OCC have to be made ASAP in order to prevent any panic among passengers as the system is unattended. And the design of Line 14 makes that one inter-station is quite long (2 km between Châtelet and Gare de Lyon stations) ML case Scenario used for GOA1a, GOA1b and GOA2. 1 When to evacuate a) Whenever safety is threatened (e.g. Type A defect; fire) the OCC should order the evacuation of the train, preferably on a nearby station. b) If it s foreseen that a train will remain in the tunnel for 30 minutes or longer, without the possibility of rescue, the OCC should order the evacuation. c) The OCC must choose the type of evacuation (track or another train) depending on local conditions. 2 Evacuation to another train a) The train receiving the passengers should be empty, be located on a parallel track and it should have platforms in order to connect with the stranded train. b) The OCC must cut the power to the third rail and the local responsible for the evacuation must activate the nearest emergency circuit-breaker. As an additional measure the third rail must be connected to the track. 3 Evacuation to the track a) The train must be provided with stairs. b) The OCC must cut the power to the third rail and the local responsible for the evacuation must activate the nearest emergency circuit-breaker. As an additional measure the third rail must be connected to the track. c) Previously to the evacuation, passengers must be informed of the operation and supported by personnel carrying hand lights until they reach the nearest station. d) In case of immediate danger to the passengers, the driver must order the evacuation to the track. The nearest emergency circuit-breaker must be activated and the third rail connected to the track. Revision: V2 Page 32/51

33 BVG case Passenger evacuation - train Currently implemented for GOA1a-equipped lines: 1. Stranded train between two stations is unable to continue trip, driver informs OCC, decision by OCC to evacuate train if no others measures are available. 2. Check of current situation in concerned area by OCC. Check is site specific and includes location of trains, staff, working groups and actual state of communication system. 3. Additional attendants are sent towards stranded train to support evacuation. Support at evacuation site has to be available within less than 10 minutes. 4. Stop of all trains in concerned area by command to drivers / interlocking means. 5. Switch off traction power by OCC, short circuit of traction power by driver / attendant, switch on tunnel light by OCC in concerned area. 6. Passengers are instructed by driver or by OCC via communication system. 7. Door release by driver or door opening by emergency door opening device by passengers. 8. Disembarking, driver / attendant supported passengers self rescue. 9. Attended walk to next station or emergency exit. 10. All passengers and staff in station (safe place), train evacuated Tested for a GOA4 system (Research project STAR): 1. Stranded train between two stations is unable to continue trip, decision by OCC to evacuate train if no others measures are available. 2. Check of current situation in concerned area by OCC. Check is site specific and includes location of trains, staff, working groups and actual state of communication system. 3. Additional attendants are sent towards stranded train to support evacuation. Support at evacuation site has to be available within less than 10 minutes. 4. Stop of all trains in concerned area by OCC. 5. Switch off traction power and short circuit of traction power by OCC, switch on tunnel light by OCC. 6. OCC gets information about situation in train from passengers and gives instructions to passengers via high reliable communication system to stranded train ( Help points in train). 7. Train door release by OCC, opening of train door by emergency door opening device by passengers. 8. Disembarking, passengers self rescue. 9. Attended or unattended walk to next station or emergency exit. 10. All passengers and staff in station (safe place), train evacuated Passenger evacuation - station Currently implemented for GOA1a-equipped lines / tested for a GOA4 system (Research project STAR): 1. Because of dangerous situation in station decision by OCC to evacuate station and/or stranded train in station 2. Check of current situation in concerned area by OCC. Check is site specific and includes location of trains, staff, working groups and actual state of communication system. 3. Additional attendants are sent towards station to support evacuation. Support at evacuation site has to be available within less than ten minutes. 4. Stop of all trains in concerned area by command to drivers / interlocking means. 5. Instruct passengers by driver / attendant or by means of OCC. 6. Attended or unattended walk to safe place LU case Evacuation may be required for many different reasons, such as smoke, fire, power failure, serious signalling failure, accidents, suicides and stalled trains. Revision: V2 Page 33/51

34 The evacuation arrangements apply to all grades of automation, currently GOA1a and GOA2. The most serious conditions for evacuation tend to apply to tube of the railway, which can be deep below the surface. Generally cut and cover and outside areas are easier to manage, because saloon temperatures are less of a problem and safe routeways for detraining passengers are easier to identify. The decision to evacuate trains may be made by the Line Controller, but when serious incidents occur on the railway a procedure is immediately put in place whereby the Duty Officer from the railway operations department may assume overall responsibility for the management of the incident. If at all possible trains will be held at platforms when an incident occurs. If the decision is taken to detrain and evacuate passengers, then the particular arrangements will depend on local conditions. It is always preferable to de-train passengers in station areas or at designated evacuation locations. To achieve this, trains may be moved into platform areas for detrainment, and then when empty moved forward into the next tunnel section to allow a following train to move into the platform. In the case of a train that cannot be moved, the technique of drawing up other trains to the failed train to provide a passage way through these trains to a platform may be used. If it necessary to de-train passengers onto the track then the traction power is switched off and passengers gain access to the track through the drivers cab. Generally access to the track via saloon doors is not possible because of the very small clearances between the train cars and the tube tunnel. Reliable communication between the driver and the OCC is considered to be an absolute safety requirement for trains operating in a tube environment. This means that trains with failed radios are not permitted to enter or remain in service. If there is a failure of the wayside radio transmission system, it is LU policy to suspend the service until it has been repaired. Keeping passengers informed about developing situations is imperative to avoid panic and possible damage to trains (e.g. breaking windows to improve ventilation). Because of the high tunnel temperatures experienced on parts of the underground network, the decision to evacuate may be made after as little as 15 minutes. The process can take a long time, and other strategies would always be considered before making such a decision. Fully functional tunnel lighting is an absolute requirement for service operation and helps facilitate safe evacuation. Drivers and local station staff help to guide passengers through the detrainment process TMB case If a train is stopped in the tunnel, the driver must communicate immediately to the OCC and try to assess the situation. According to the information provided by the driver, both the driver and the OCC operator analyze the situation. If the estimated waiting time before resuming normal operation is likely to be greater than 15 minutes, the evacuation procedure is activated. This decision is taken only by the OCC. The driver must wait until a local agent arrives to initiate the evacuation. In case the communication with the OCC is not possible, after 15 minutes of waiting the driver is allowed to evacuate the train itself. The passengers are informed immediately of the situation. The evacuation can be to a side train (preferable) or to the track. Both evacuation procedures are identical as explained in the RATP case. Only one train is allowed to be in an interstation. Due to the short length of the interstations, no intermediate emergency exits exist. Revision: V2 Page 34/51

35 2.2.6 Scenario related to rescue RATP case The rescue of a train is only requested after application of the safety prescriptions relative to the damages suffered by the rolling stock. The OCC operator, in agreement with the drivers of the concerned trains, determines the means the most suited to carry out the rescue operation (rescue by the back or by the front). When the driver of the rescuing train has driven its train at low speed up to the coupler of stranded train, the effective coupling (mechanical and electrical) is performed with the involvement of the driver of the stranded train. The technical measures stipulated in the procedures book having been applied to the stranded train and to the rescue train, the start of the two trains as a convoy is only authorized, after coupling, by the OCC operator when the measures which follow are taken: - A try of brakes is carried out on the whole of the convoy; - The location and the role of each agent are specified, and in particular for the traction and braking commands; - The means of communication between the agents have been tested. The speed of the convoy is limited to 20 km/h ML case Scenario used for GOA1a, GOA1b and GOA2. Parking scenarios with or without coupling are excluded from this scenario. 1 A train pushes or pulls a stranded train a) The rescue train must be evacuated prior to the rescue. The stranded train may remain with passengers. b) The driving mode, of the rescue train for this operation, must be manual. c) The station personnel must give a written authorization to the driver of the rescue train in order to pass a red signal d) The station personnel who wrote the authorization must walk in front of the train for the last 50 meters of the coupling. He must carry a signalling hand light. 2 - A train pushes or pulls a stranded train with a point between them a) The rescue train must be evacuated prior to the rescue. The stranded train may remain with passengers. b) The driving mode, of the rescue train for this operation, must be manual. c) The local LCC must take command from the OCC. d) If it s not possible to have local command, the OCC must give authorization to the point isolating device (called Monobloco) of the point and the station personnel must take the key from the point isolating device, blocking the points from any external command. e) The station personnel must be adjacent to the point in order to control its position and locking. f) The station personnel must give a written authorization to the driver of the rescue train in order to pass a red signal g) The station personnel who wrote the authorization must walk in front of the train for the last 50 meters of the coupling. He must carry a signalling hand light BVG case Passenger rescuing - train Currently implemented for GOA1a-equipped lines / tested for a GOA4 system (Research project STAR): 1. If evacuation did not cover all passengers or staff a rescue operation has to be launched. The decision by OCC to call for emergency services and the decision by officer-in-charge to start rescue mission can be made on any step of evacuation process depending on actual situation. Revision: V2 Page 35/51

36 2. OCC decides to start rescue operation. Measures for evacuation of train are foregoing or included in rescue operation (see ). 3. Emergency services are sent by OCC to the nearest station or emergency exit, services include police, fire brigade, and medical care. A safe place for medical treatment has to be prepared. 4. Decision by officer-in-charge to start rescue mission. Course of action is site specific and is ordered by officer-in-charge. 5. In case of unclear or dangerous situation site specific and situation specific additional measures have to be taken as there is forced ventilation, closing of flood gates, fire fighting. 6. Emergency services are sent to stranded train. 7. By emergency services attended walk or transport of passengers and staff to safe place. 8. All passengers and staff at safe place, disabled persons under medical care, train evacuated, end of rescue operation. 9. Recovery of materials or goods is not part of a rescue mission Passenger rescuing - station Currently implemented for GOA1a-equipped lines / tested for GOA4 system (Research project STAR): 1. If evacuation did not cover all passengers or staff a rescue operation has to be launched. The decision by OCC to call for emergency services and the decision by officer-in-charge to start rescue mission can be made on any step of evacuation process depending on actual situation. 2. OCC decides to start rescue operation. Measures for evacuation of station are foregoing or included in rescue operation (see ). 3. Emergency services are sent by OCC to the station, services include police, fire brigade, and medical care. A safe place for medical treatment has to be prepared. 4. Decision by officer-in-charge to start rescue mission. Course of action is site specific and is ordered by officer-in-charge. 5. In case of unclear or dangerous situation site specific and situation specific additional measures have to be taken as there is forced ventilation, closing of flood gates, fire fighting. 6. Emergency services are sent inside station. 7. By emergency services attended walk or transport of passengers and staff to safe place. 8. All passengers and staff at safe place, disabled persons under medical care, station evacuated, end of rescue operation. Recovery of materials or goods is not part of a rescue mission. Revision: V2 Page 36/51

37 2.2.7 Scenarios related to the intrusion of persons ML case Scenario used for GOA1a, GOA1b and GOA2 In case of an unexpected person on the tracks: a) ML s station personnel must activate the nearest emergency circuit-breakerwhich will cut the traction power of the third rail. b) If there s still danger from incoming trains, the tracks must be signalised with red hand lights. c) When the train lacks traction power, it should try to reach the next station if carrying passengers and the signalling allows or stop otherwise. d) The OCC must be contacted and told the details about the event. e) After the event is resolved, only the OCC may authorise the rearming of the emergency circuitbreaker. f) The OCC reconnects the traction power to the third rail. g) The OCC gives instructions to the trains in order to resume movement. h) The OCC must order the resealing of the emergency circuit-breaker. Note: emergency circuit-breakers are installed all along the tracks and on technical and operational areas accessible to ML s personnel only TMB case Due to the increase of false alarms in the case of a warning of intrusion of persons, two cases are used: 1. Confirmed intrusion by a driver or local agent: In this case the OCC gives instruction to stop all the trains and send the security personnel to inspect the zone. 2. Non confirmed intrusion by a driver or local agent: In this case, the OCC stops all the trains and gives instructions to the nearest train in the zone to proceed at reduced speed and check the presence of people on the track. In both cases when the problem is solved, the OCC instructs the nearest train to proceed at reduced speed to finally check the situation, and if everything is correct, resumes the normal operation Scenarios related to the overshooting of a station ML case Scenario used for GOA1a, GOA1b and GOA2 1 Train overshoots a station and stops with at least one passenger door facing the platform. (OR train stops with at least one passenger door facing the platform just after depart) a) Train is allowed to travel backwards. b) Because the ATP (GOA1b and GOA2) doesn t allow the train to move backwards, driver must change the driving mode to manual in order to move the train backwards. c) Train resumes movement until the next station. 2 - Train overshoots a station and stops with all passenger doors outside of the platform. a) Train is not allowed to travel backwards. b) Driver must communicate the situation to the OCC. c) If the ATP (GOA1b and GOA2) doesn t allow train movement to resume, driver must contact OCC and await further instructions. d) Train resumes movement until the next station. Revision: V2 Page 37/51

38 Note: ML mentions that there is no safety problem in the train reversing after an overshoot as long as the track circuit has not been freed. It has to be noted that the case happens three or four times a week. Revision: V2 Page 38/51

39 2.2.9 Scenarios related to the load shedding running RATP case The general load shedding corresponds to a severe degraded mode, and is applied when there is loss of all the supplies of the Electricity network impacting all High Voltage substations and rectifiers. The duration of such event is an external constraint depending only on our electricity supplier. The control energy facilities operator informs the technical manager about the event and in the absence of information on quick resumption of the power supply, the technical manager warns the operation manager who initiates the evacuation of the network. The operation manager forbids any movement of trains, gives the instructions to evacuate the trains, and make the passengers exit out of the network. The control energy facilities operator applies the instruction which notably consists in putting in service electric generating sets and in feeding arteries for the lighting of the underground network in order to increase the available power for the lighting provided by the dedicated emergency generating unit, and for some critical equipment such as fans, pumps, etc.. Traffic resumption: The control energy facilities operator informs the technical manager, then he re-configures electrically the network, rectifier substations included (the supply of traction power can be commanded only by the OCC). The control energy facilities operator gives then the authorization to the operation staff via the technical manager and the operation manager to resume train operation, if necessary step by step. The partial load shedding on the whole network or relative to a part of the network: Two possible causes for this partial load shedding: it has for origin a loss of power provided by the Electricity supplier, and imposes not to exceed a certain threshold for the consumption at the level of the total RATP network, or not to exceed a threshold for the consumption at the level of some concerned High Voltage substations and rectifiers. it has for origin a defect of supply from one or several sources of electricity network or of all or any of one or several High Voltage substations and rectifiers of the RATP. The load shedding can also result from a fortuitous accumulation of defects coming from the Electricity supplier and the RATP power network. The measures: In such a case, the control energy facilities operator proceeds immediately to application of the load shedding on all or on specific parts of the network. The control energy facilities operator communicates the measures taken to the OCC operators and warns the technical manager. The instructions vary according to the emergency degree, and it is up to the OCC operators to apply them. They can consist in: a percentage of traffic to be ensured for the concerned line(s) or applying at the level of the global RATP network, with regard to the traffic practised at the time of the incident, a maximum number of trains in service for the concerned line(s), a minimum headway authorized for the concerned line(s), or in the most favourable cases, the application of the instructions for train departures These instructions can be completed by measures such as: for conventional lines, application of the economic running (or half effort running) on all or any part of a line, application of the economic running on line 14 cut off of heating on all or any part of a line ) stop of one escalator out of two, switch off of trains in the Standby state Revision: V2 Page 39/51

40 Principles to be applied by the OCC operators: The operators use the available regulation tools (departures on order, order to train(s) via the usual communications means) to limit as far as possible the power consumption, and especially peaks beyond the maximum tolerated threshold. The objective is to get as soon as possible a number of trains on the line in accordance with the maximum tolerated number (limitation of trains in movement). Traffic resumption: Principles to be applied by the control energy facilities operator the control energy facilities operator informs the technical manager and re-configures electrically the network. He gives then the authorization to the operation staff for the normal resumption of the traffic, by clarifying if needed the instructions related to the stopping of load shedding measures. Principles to be applied by the regulation managers: The stopping of load shedding measures intervenes only when it is confirmed by the control energy facilities operator. To limit the power consumption (overload of the rectifying unit) the stopping of the load shedding measures can require in certain cases the application of transitory phases requested by the manager of the control energy facilities. Revision: V2 Page 40/51

41 Scenarios related to emergency maintenance TMB case In case of an emergency situation that can not be solved in non operational hours, the damaged zone is isolated, setting shortened services in the nearest stations possible and cutting the traction power, to allow the maintenance staff to work in the zone. Special bus services are offered to the passengers. Revision: V2 Page 41/51

42 Fire/smoke management when fire is in tunnel RATP case The presence of smoke in a tunnel or in an underground area of a subway station is a potential aggravating factor in any emergency situation. Indeed, because of the confinement in space, smoke may render difficult the evacuation of passengers and the intervention of emergency services. Optimized management of smoke extraction during a fire is therefore a measure critical to ensuring the safety of persons. The object of smoke extraction is to extract, at the beginning of fire, the amount of smoke and combustion gases necessary to maintain practicable the pathway provided for the evacuation of the public. Smoke extraction should also contribute to: limit the advance of the fire; facilitate the intervention of the emergency services; Control the direction of smoke propagation. The two main objectives are as follow: Remove the smoke as much as possible from the evacuation path; Prevent smoke from spreading from the area affected by the fire to other areas of the railway, for example tunnels. To achieve this, the following means can be implemented (using natural or mechanical means): Extract the air in the vicinity of the fire so that the flow of air created prevents the smoke from spreading to the evacuation path and other areas and removes smoke already there; Blow air into the area affected by the fire from adjacent areas of the railway to prevent smoke from spreading to these other areas; Combination of the two. Revision: V2 Page 42/51

43 3 MIGRATION PATHS 3.1 Constraints of the migration to be considered type of upgrading from GOA-x to GOA-y operations or not complete upgrading partial renewal: re-using an existing interlocking, OCC, trackside equipment (signals, track circuits) duration (from a big bang transition to a duration of several months) impact on operations (no impact, partial, closing of the line during the migration on specific days), partial closing of the upgraded line, closing of stations deployment of new onboard equipment deployment of new trackside equipment organisation of tests (including trial operation): during Passenger Service (safety concerns, stablings, etc), during nights, facilities for testing (additional devices, test track), commutation between Normal mode and Test mode overlay with an existing command-control system (and how long: only during the migration phase, or as well after the migration, possibly to use the existing system as a back-up) infrastructure (platform, technical rooms, tunnels, adaptation of existing equipment to new safe dynamic envelop, safeguard of the existing old infrastructure, power supply) rolling stock (equipment space, regenerative braking, performances of the new RS) training of staff (OCC, drivers) de-commissioning of existing command-control system Revision: V2 Page 43/51

44 3.2 Type of upgrading to be considered Upgrading made from a GOA1a system to a GOA2 system LU case Central Line The Central Line was upgraded during the 1990 s from a traditional signalling system with mechanical interlockings, ac fed track circuits (125Hz and 33.33Hz) and trainstop protection (TCP) to a new ATC system with coded track circuits and modern interlockings (either relay based or SSI). Prior to the upgrade, control was exercised from signal boxes distributed along the line. The first stage of the migration was to replace the 33.33Hz track circuits, with an audio frequency jointless track circuit. This was to address EMI/EMC issues associated with the modern ac controlled traction packages deployed in the new rolling stock that would be required to operate with the old TCP signalling arrangements while the signalling was being renewed. Because the old signalling was designed using the performance criteria of the rolling stock that was being replaced, it was necessary to de-tune the new trains to this lower performance so that safety distances (overlaps) would not be exceeded in the event of trains being tripped on passing signals at danger. The next stage involved re-signalling the line. Because of the problems associated with changing driving modes from TCP to ATC, the first sections of the railway were re-signalled with line-side signals with both TCP and continuous ATP functionality. To minimise installation work, the signalling was designed so that track circuits were in their final position and configuration. At this stage all new interlockings were controlled using emergency local control panels located either on station or in the redundant signal boxes. When the central and western sections had been re-signalled, it was decided to commission that ATP on the trains. This meant that trains had to change driving modes when moving between TCP and continuous ATP territories. At about this time ATS from a new OCC was progressively introduced starting at the western end of the line. The remaining sites at the eastern end of the line were then re-signalled with final design (i.e. without TCP) in an order that allowed the TCP/continuous ATP boundary to be progressively moved east. While this was being implemented, redundant circuits, cables, lineside signals and trainstops were removed from the central and western sections of the line. Finally, the line was completely re-signalled, and ATS was rolled out to the remaining interlocking areas. The completion of the safety signalling meant that it was then safe to upgrade the trains to full performance. The final phase of the project was to introduce ATO throughout the line. Jubilee Line The Jubilee Line is being re-signalled using the Thales Seltrac IS system. This system uses inductive loops installed between the running rails to provide bi-directional communications and positional references for train location. Axle counters are used for train detection under failure and degraded mode conditions. In this case the migration strategy is much simpler because the new signalling can be overlaid onto the existing working signalling system without problems. The trackside point equipment is the only equipment that is common between the existing and the new signalling system. Testing needs to be undertaken in non-traffic hours, and it is essential that maximum use is made of this short period between traffic days. To facilitate over and back testing the trackside points equipment is being wired to a change-over cubicles which will enable quick and easy change over between the two systems. Revision: V2 Page 44/51

45 The cut-over to the new signalling will be done in 5 stages starting at the east end of the line. When revenue service with the new system commences, the changeover switch will be left the points connected to the S40 system and the old equipment will become redundant. At some later date the change-over cubicle will be wired out and removed, to provide the final signalling arrangement. As with the Central Line, it will be necessary for trains to move from ATC territory to TCP territory. There will be only one transition per trip. The S40/TCP boundary will move westward as the various stages are commissioned. The new OCC system will be commissioned in the same stages as the S40 system ML case (Red Line) The installation of a full ATC system in the new Red line was contracted in 1996, but delays in the excavation of the tunnel led to the opening to the public in April 1998 with a traditional signalling system and a simplified OCC. All the trackside ATP equipment was installed prior to the opening and there were no major constraints regarding the installation of the onboard ATP. Some of these equipments were installed during rolling stock fabrication. The installed ATP works like an add-on to the traditional signalling system (Trackside ATP uses track circuits for train detection and information from the interlocking for movement authority), which led to a very simple migration strategy. From April 1998 to September 1998, it wasn t possible to start any ATP tests on the line due to the International Exposition taking place. A limited number of tests were carried out on the depot test track during this period On October 1998, dynamic tests started during the night (2:00AM to 5:30AM), using a maximum of three to four nights a week, the other nights being used for normal scheduled maintenance of various equipments. All the ATP testing was carried out without disturbing the operation of the line. The normal operation of the ATP/ATO system started by the end of the year The last software upgrade to the ATP was made in March 2004, in order to improve the reliability of the system. The last software upgrade to the OCC was made in October Final testes to the overall ATC system were carried out in December Revision: V2 Page 45/51

46 3.2.2 Upgrading made from a GOA2 system to a GOA2 system RATP case (OURAGAN) RATP has launched a renewal program called "OURAGAN" to replace existing GOA2 system (called PA ) by a CBTC GOA2 system. One of the essential challenges of the project OURAGAN is to make the on-line replacement of the obsolete equipments by the new equipments, without ever degrading the safety of the persons and the equipment, nor the service provided to the passengers (mode of functioning, availability). It is a challenge considering the preparation and the organization of the migration: indeed, the related tests have to be made during the night (between 1 am and 5 am). Considering the incompressible periods of implementations and checks at the end of construction site, the real duration of working night is thus about three hours. RATP implements a step by step integration of the system, based on methodological plans, a testing strategy in factory then on a test track, in order to deploy the system on the line through mastered milestones Test of the system in factory The strategy of test and validation is widely based on tests " in factory " which are realized as soon as possible, from the phase of development of the system and in much better working conditions than if they were directly operated on site (schedules, environment, equipments): - The equipments are individually tested (electronic cards, drawers, cubicles), then assembled and tested globally (functional tests, tests of environment). - The software is individually tested on "host environment" then on "target environment" The sub-systems then the complete system of automatisms are tested on a platform of integration and tested in factory, by means of simulators of environment which recreate around the system in test a representative environment of the reality of the site (rolling stock, line signalling, OCC). This platform of tests remains operational during all the duration of the tests on-site, to establish a "rear base" for the treatment of all the abnormalities met during later test (checks of corrections of abnormalities, tests of no regression). Line tests and progressive changeover from the former to the new system The line test and the changeover of the former to the new system obey a policy "by phases" which allows a progressive migration from the current situation to the definitive situation, without disturbance of the operation. This policy has to take into account a strong constraint: the available volumes on a train do not allow the coexistence, on a given train, of the former and the new equipments; it is thus on the wayside that it is necessary to implement at first this cohabitation, before modifying gradually the rolling stock, in order to never degrade the conditions of operation of the system (safety, available functions, operational availability). The general changeover of system in line is split into five phases: Phase 1: pre-qualification of all the functions of the system on a test base (located on line or outside the line, according to the project). The system is then in version prototype called "A version ". This phase is without impact on the operation (if the test base is located on line, the test takes place exclusively at night). Phase 2: installation, integration and tests of the sub-system OURAGAN wayside on the whole line, at night, without interaction with the operation: devices of changeover "in the daytime" allow to pass quickly and safely from the former to the new system. The system is in "version B - or B1 according to the projects ": its functionalities, its setting-up along the line make it totally compatible with the existing system. This phase ends with the starting of the sub-system wayside in version B (or B1), ready "to welcome" OURAGAN equipped trains. Phase 3: this phase sees the taking place in parallel of two types of activities: In workshops of the Rolling stock, the park of trains is gradually "migrated" from the former to the new system; as the RATP does not have two parks of trains for a given line, every modified train must be Revision: V2 Page 46/51

47 immediately qualified for the operation and put on line. During all the phase 3, the operation of the line continues with a heterogeneous rolling stock constituted by trains "OURAGAN" and by "former" trains: we speak then about mixed operation. On line, exclusively at night, take place the works and the test of the version C (or B2) of the system, intended for the operation of the system with its maximal performances. Phase 4: this phase, which begins when all the trains are equipped with OURAGAN and when the C version (or B2) of the system is qualified on the whole line, is particularly critical because it consists in changing over and in putting in operation, by zones of line, the C version (or B2) of the system. This phase has to be the shortest possible, because it imposes a constraint of heterogeneousness to the operator: indeed, the line is cut in two zones (VB / VC or VB1 / VB2), whose limit moves after each phase of changeover. This phase ends when all the line is changed over in version C (or B2), by the starting of the complete system authorizing the operation of the line with the maximal performances. Phase 5: this phase consists in dismantling the former wayside system and all the temporary installations required by the previous phases. It is also used to observe and measure the behaviour of the system in operation, notably to prove its adequacy to the objectives of reliability, availability and maintainability that have been requested in the contracts. This phase ends by the definitive reception of the system LU case Case of Victoria Line The Victoria Line is a currently a GOA2 system. The line is being upgraded with a more modern GOA2 system. The current system uses coded track circuits to transmit the maximum safe speed to trains. The new system will be the Westinghouse Distance to Go by Radio (DTG-R). This system transmits track states and some interlocking states to the trains in a local area (typically a local area extends about 1km each side of a station). In the case of the Victoria Line, the rolling stock is being renewed at the same time as the signalling renewal. It is necessary to upgrade the line without any extended line closure. As a consequence, it must be possible during migration to run both old and new trains on the line under full ATP. It is not practicable to equip the new trains with the train borne elements of the existing system (i.e. the ATP and ATO controllers), or to equip the old trains with the new ATP system. Because of this constraint the migration is being designed so that the old trains are protected by the existing signalling system, and the new trains will be protected by the new ATP system. Revision: V2 Page 47/51

48 The first stage of the migration involves overlaying the DTG-R system on the existing signalling system. (Thus DTG-R will use the existing interlockings and track circuits). This will allow the new trains to be introduced onto the railway. For a period of time the railway will be served by a mixed fleet. When all the old trains have been replaced, the interlockings and track circuits will be replaced. The new signalling arrangements will provide greater capacity by introducing more track circuits and allowing the new trains to operate at full performance. The new OCC will be commissioned while mixed signalling and fleets are in operation. Thus there will be a number of stages Revision: V2 Page 48/51

49 3.2.3 Upgrading made from a GOA2 system to a GOA4 system RATP case (Line 1 driverless conversion) RATP has launched a full automated conversion of line 1. The major challenge when re-signaling lines in revenue service lies in the validation of the system in the specific case of Line 1, the OCC and the CBTC onboard equipment without impairing the quality of service offered to passengers during daily operation and compromising safety. A fundamental feature of this solution is therefore the ability to be operated in shadow mode, whereby the system receives and sends all necessary information as if under CBTC control, but without any actual outputs being activated. A second challenge which makes this project unique is the coexistence of: Totally different automatic train control technologies speed code and CBTC, Different modes of train operation manually operated trains and driverless trains. The migration strategy is organized into three main time periods corresponding to the three key milestones scheduled by RATP. Period 1 is concerned with all the installation and testing work requested for operating the line with the new OCC. The main technical difficulty lies in testing and commissioning all the functions available in the new OCC, while still ensuring the safety of daily train operations under the control of the old OCC. This work is carried out during both daily operations and night-time hours. It involves having the two OCC working in parallel: until the first milestone is reached, the old one remains active and the new one operates in shadow mode; at the end of this period, the new OCC becomes active, but the old one remains available for operation if necessary. Revision: V2 Page 49/51

50 Period 2 focuses on the testing and commissioning of the driverless CBTC solution to enable the first driverless train to operate on the line together with manually operated trains. It should be noted that all the wayside CBTC equipment is installed during the Period 1. The testing covers ATP and ATO functions. The main difficulty is how to perform all the necessary tests and customizations without interfering with work already done. For this, the system will first be extensively tested on the test track in Valenciennes, France. In addition, a CBTC system installed on a MP 89 train will be tested in shadow mode on Line 1. Revision: V2 Page 50/51

51 Period 3 is concerned with the progressive introduction into revenue service of the new MP05 rolling stock equipped with the driverless CBTC. Manually operated trains are progressively removed from service. The final functionality of the system is tested, including automatic train regulation and management of the depot. Revision: V2 Page 51/51