Electronic Version. CCMS Reference: Version History

Transcription

1

2 Electronic Version CCMS Reference: Version History Issue Date Comments /11/10 First Draft for Review /11/10 For Information Only in support of the HNIF ITT /06/13 Update to support Tender Process /06/14 Update from Reference Design for Internal Review /03/15 Update from Technical Author and Reference Design inputs /04/15 Updated for informal internal review /04/15 Updated from review comments /05/15 Review document with track changes enabled /05/15 Restructured to align content with European SRS /05/15 Unsigned Preliminary Draft Issue /03/15 First Issue /04/16 Update following Reference Design requirement harmonisation /08/16 Update for SRSG /08/16 Update from SRSG /09/16 Update for SRSG /09/16 Release for ESB / OSG review /02/17 Update from ESB / OSG review for commenter review /03/17 Updated from further comment review. DOORS update version /03/17 Further comments /03/17 Formal issue Disclaimer Network Rail has used its best endeavours to ensure that the content, layout and text of this document are accurate, complete and suitable for its stated purpose. It makes no warranties, expressed or implied, that compliance with the contents of this document shall be sufficient to ensure safe systems of work or operation. Network Rail will not be liable to pay compensation in respect of the content or subsequent use of this document for any purpose other than its stated purpose or for any purpose other than that for which it was prepared except where it can be shown to have acted in bad faith or there has been wilful default. NETWORK RAIL Page 2 of 48

3 Contents 1 INTRODUCTION Purpose of this Document Scope Context Abbreviations Specific Terminology Requirements: Formal, Applicability and Identification Requirement Functionality Basic Requirement Form Safety Requirement Unique ETCS System Requirement-Identifier (ESR-Identifier) Normative / Application-Specific / Preferred status Topics Requirements Assurance Requirements Change Areas for Development SYSTEM REQUIREMENTS Scheme Design Requirements Movement Authority, Modes & Levels Appropriate Supervision Level Movement Authorities Full Supervision Movement Authorities Start of Mission Degraded Starts Routing Information Speed Restrictions Possessions Shunting Occupied Sections Level Crossings NETWORK RAIL Page 3 of 48

4 2.3 Degraded and Emergency Signs and Indicators Other Systems Class B Systems Traction Switching Onboard Data Safety Security People Issues Workload/People/Training Driver Interface Whole Life Management Life Cycle Management Reliability, Availability, Maintainability (RAM) Maintenance Diagnostics Implementation Requirements Transitions Implementation and Migration Future Enhancements Design Rules Requirements for GB Rail Processes Requirements for the Control Layer APPENDIX A: ABBREVIATIONS APPENDIX B: LIST OF REFERENCES APPENDIX C: TOPICS LOOKUP TABLE APPENDIX D: AREAS FOR DEVELOPMENT (OPEN POINTS) NETWORK RAIL Page 4 of 48

5 1 INTRODUCTION 1.1 Purpose of this Document This document provides a specification that is intended to promote effective implementation of the ETCS. It is applicable to ETCS installations and provides requirements that are optimised for operation on the GB rail network. As stated in the industry-agreed and issued National ETCS Requirements Management Strategy [RD1] and Plan [RD2], the document provides the requirements which have been developed as part of a suite of ETCS requirements covering all elements required to optimise performance and operation of an ETCS railway. The document can be used as a standalone specification for the System aspect of the ETCS; further details of the requirements that drive the development of this specification are included within the Sub-system Requirements (Trackside, Onboard (Retrofit & New Trains), Telecoms and Operations [RD3], [RD4], [RD5], [RD6] & [RD7]). This Specification for the ETCS has been written to complement the Command, Control and Signalling Technical Specification for Interoperability (CCS TSI) and European Union Agency for Railways (known as The Agency ) specifications for Baseline 3 ETCS 1 [RD8] & [RD9]. Every effort has been made to avoid conflict with the CCS TSI and Baseline 3 specification but, in case of conflict, the CCS TSI (including the UK specific cases) and Baseline 3 specification take precedence. The document is set out in the form of standard requirements with the ETCS System Requirement (ESR) identifier, followed by rationale and guidance notes, where appropriate. 1.2 Scope This document consists of requirements which describe the functionality and application of the ETCS optimised for application on the GB rail network at all required levels of operation. These requirements are not expected to prevent the ETCS operating in conjunction with an Automatic Train Operation (ATO) system. Requirements will be added at a later date once the European specification for adding ATO to an ETCS has been finalised. Projects are encouraged to seek advice from the ERTMS Systems Body (ESB) if there is a wish to facilitate early introduction of ATO. These requirements are not expected to prevent the ETCS operating in conjunction with a Traffic Management (TM) system. No specific TM requirements have been identified for inclusion to date. Specific requirements and domain knowledge for a particular application are not included within this document and will need to be defined by the Contracting Entity or their appointed Agent. Nothing in this document obviates any legal requirement with which any of the parties must comply. Furthermore, it does not preclude operation of a TSI-compliant vehicle on the GB rail network, or a vehicle compliant to this specification operating on TSI-compliant infrastructure outside the GB rail network. 1 Note: This suite of requirements has been written to meet Baseline 3 Release 2, although the ETCS DOORS requirements database has the capability of producing a suite of requirements to meet Baseline 3 Maintenance Release 1. Should a suite of Baseline 3 Maintenance Release 1 requirements be needed, or if any background information be required for any specific requirement then an with specifics should be sent to: nationalertmsrequirements@networkrail.co.uk NETWORK RAIL Page 5 of 48

6 1.3 Context This document has been developed from a number of sources. Input from the ETCS programme, ETCS suppliers, and the wider rail industry has been used to develop the requirements. A series of workshops and industry consultations have identified new requirements for addition. Guidance has been added to justify changes. Requirements amended and deleted through this development process have been captured within the requirements database, along with justification for their amendment or removal. 1.4 Abbreviations Abbreviations are explained in full where used in Requirements. A fuller explanation of Terms and Abbreviations can be found in Appendix A: and the ETCS Glossary [RD10] Specific Terminology Specific terms are used within the requirements contained within this document: 1. ETCS solution This requirements specification has avoided identifying solutions as there is an opportunity for providing the ETCS functionality anywhere. Therefore, instead, the supplier will be identifying their own solution to the required functionality apportionment, and so the term ETCS solution has been used. 2. rail vehicle and / or train Installation of the ETCS functionality will be expected in all rail vehicles and trains. 3 Onboard This refers to the ETCS Onboard functionality. 4 on-board / on board This refers to any functionality on board the rail vehicle or train apart from the ETCS Onboard solution e.g. the onboard TPWS or the Class B systems on board the train. 5 ETCS Programme team These ETCS System Requirements need to be applied across many projects (routes, and rail vehicle or train), but there are some requirements that transcend this level and need to be undertaken and satisfied at a central level such that there will be commonality of use across all projects. The term ETCS Programme Team is used for the organisation that will undertake this work. 1.5 Requirements: Formal, Applicability and Identification Requirement Functionality Requirements may be functional or non-functional: Functional Requirements - Technical details that define what a system needs to accomplish, i.e. how suppliers equipment will be applied, what it needs to do, and what processes, procedures and rules need to be in place to achieve it. Non-Functional Requirements - Constraints on the design or implementation, such as performance, security, competence, training, and reliability requirements. Functional requirements have been derived through the Reference Design generation process [RD11], whereas non-functional requirements have mostly been derived from the Cambrian Requirements suite and supplemented by workshop input [RD12]. NETWORK RAIL Page 6 of 48

7 1.5.2 Basic Requirement Form All requirements are in the following form: Safety Requirement text. Unique ESR-Identifier Status: Normative/Application-Specific/Preferred (See Section below). Rationale: Shows applicability of the requirement. Guidance: Supplementary information to support Requirement interpretation and satisfaction. Topics: Safety Requirement Reference Design Topics (if applicable) (See Section below). Where a requirement has been associated with a Safety Measure, this is identified Unique ETCS System Requirement-Identifier (ESR-Identifier) Each requirement has been identified uniquely. The requirement numbers have been generated automatically within the DOORS database, which means that the requirement numbering may be neither sequential nor gap-free Normative / Application-Specific / Preferred status Each requirement within this document is identified as one of: normative, preferred, or application-specific. These are defined as follows: Normative o Necessary to achieve compatibility or optimisation of the system in relation to the GB rail network, or o A system feature that is deemed to be cost-effective and universally beneficial. Satisfaction of normative requirements in compliance with this document is expected to be a requirement of individual delivery contracts. Application-Specific o A requirement which may not be relevant or applicable to every implementation of the ETCS. It is expected that, where a requirement is applicable, it will be applied. Satisfaction of application-specific requirements in compliance with this document is expected to be a requirement of individual delivery contracts, as appropriate to the implementation being considered. Preferred o A requirement of lower importance which, whilst not essential, the industry would prefer were satisfied. It is expected that, where a requirement is applicable, it will be applied. Satisfaction of preferred requirements in compliance with this document is not expected to be a requirement of individual delivery contracts unless explicitly NETWORK RAIL Page 7 of 48

8 1.5.6 Topics specified within the relevant contract. Where applicable, the Reference Design Topic has been identified, as detailed in the Topics Lookup Table in Appendix C:. The Topic has been broken down, where applicable, into Options and Variants, e.g. Topic N1-2 refers to Topic N, Option 1, Variant 2. Where the Reference Design Topic has not yet achieved Release Version status, the requirements are marked (Provisional). 1.6 Requirements Assurance Requirements assurance has been explained in the ETCS Requirements Assurance Statement [RD13]. 1.7 Requirements Change The ETCS Requirements Change Control Process [RD14] will be used to raise Change Requests (CRs) to amend existing requirements or add new requirements. 1.8 Areas for Development Noting that this document represents the best understanding of the needs of the GB rail network at the time of publishing, it is recognised that there are a number of areas where the document may be deficient. New deficiencies may be identified as understanding of the ETCS develops, as well as areas being closed out through further work being undertaken. The current known areas of deficiency are listed in Appendix D:. NETWORK RAIL Page 8 of 48

9 2 SYSTEM REQUIREMENTS 2.1 Scheme Design Requirements This section contains specific requirements relating to the scheme design for individual routes. Lineside signals shall be provided or retained where essential. ESR-3 Rationale: There may be occasions when lineside signals are required to support operations. Guidance: Where it is not possible to provide a Movement Authority on the Driver Machine Interface (DMI) for regular moves (e.g. shunting), then a lineside signal should be considered. Topics: N1-2, O1 The ETCS application design shall not generate unwanted system braking interventions. Rationale: The odometer is corrected each time the Last Relevant Balise Group (LRBG) changes. It is possible that the change in location data could result in the application of brakes if the train is closer to the End of Authority (EOA) than the old reading had suggested. Guidance: The timing of messages (such as alterations in speed profile or track condition) from the Trackside could result in sudden changes in momentum if not considered as part of the overall system design. Other sources of unwanted brake interventions, such as on-train faults, should also be considered. Topics: A1-1, A1-2, J3, J4, J5, Y1 ESR-11 Measures shall be taken to mitigate the risk arising from trains stopping in undesirable locations. ESR-276 Rationale: To reduce the secondary risks to people or performance that may arise if a train stops in certain locations. Guidance: Undesirable locations will be determined on an application-specific basis. The risks that might arise in the event that a train stops in, or attempts to restart from certain locations, should be considered and mitigated. Examples of potentially undesirable stopping locations include tunnels, viaducts and neutral sections. Topics: J4 A train with an ETCS Movement Authority shall be supervised on the approach to buffer stops such that the potential collision speed is within that defined for the buffer stop. ESR-281 Rationale: At many locations, the buffer stops will already have been installed with an expectation of approach speed which is based on a designed approach speed. The ETCS can improve safety mitigation on the approach to buffer stops by supervising the train to this speed. Guidance: It is expected that the approach speed will be consistent with the current rules for the Train Protection and Warning System (TPWS). NETWORK RAIL Page 9 of 48

10 Topics: E1 Where conventional Proceed on Sight Authority (PoSA) functionality exists, ETCS with signals implementation shall provide equivalent functionality. Rationale: So that the existing flexibility under conventional signalling is not lost. Topics: G2, S5-3 ESR-372 Each ETCS application shall minimise the amount of bespoke design for projects and maximise the opportunity for automated design. Rationale: To reduce whole life costs. It shall be possible for trains to approach within 2m of a buffer stop. ESR-636 ESR-646 Rationale: To maximise the available standage capacity in terminal platforms and sidings. Guidance: At many locations, the length of terminal platforms and sidings are only just sufficient for operational needs. It is therefore important for trains to be able to get close to the buffer stops when operating under the ETCS to provide adequate capacity for present and future operational needs. Topics: E1 The ETCS shall provide the functionality and Quality of Service levels necessary to support the safety performance targets for the route. ESR-383 Rationale: ETCS Level 2 will provide the functionality to improve safety levels. Guidance: The safety performance targets for the route will be specified on an application basis. The ETCS shall provide the functionality and quality of train service levels necessary to support the operational performance targets for the route. Rationale: ETCS Level 2 will provide the functionality to improve performance levels. Guidance: The operational train service performance targets should include reliability, punctuality, journey time and capacity, and these will be specified on an application basis. ESR-327 Lineside equipment required to provide or support ETCS functionality shall be kept to a minimum. ESR-558 Rationale: Part of the business case for the introduction of the ETCS is improved safety and NETWORK RAIL Page 10 of 48

11 reduced maintenance costs as a result of the reduction in lineside equipment when compared to conventional signalling. Guidance: Some lineside equipment, such as balises, is unavoidable but track access and cost risks can be managed by keeping the numbers as low as possible whilst providing the requisite functionality and system safety levels. The location of announcements to, and acknowledgements by, the driver shall be determined for each site. ESR-99 Status: Application-Specific Rationale: A number of factors need to be taken into account when establishing the location of the announcement, border and acknowledgement. Guidance: Factors to be considered include: driver workload; advising the driver that they are routed into a depot / non-etcs facility; enabling the driver to stop and challenge a misrouting; and the requirement for the driver to check that the track is clear and that the points are set into a non-etcs facility. Topics: G1-2, G2, H1, H2, N1-1, N2-1, O2-1, O2-2, O3, V1, V2 National Values shall be determined and assigned to GB National Areas (i.e. NID_C) via a formal process. ESR-573 Rationale: To meet the safety and performance requirements of the application. Guidance: The process is currently contained within GE/RT8408 [RD15] but will be replaced by a Rail Industry Standard (RIS) in due course. This requirement remains extant until that RIS is issued. Topics: KK The ETCS shall be configured to provide bi-directional capability on all lines. ESR-657 Rationale: To ensure that the infrastructure gains the maximum benefits from ETCS deployment, that degraded mode working is not worsened, and that historic constraints are avoided. Guidance: As a minimum, a bidirectional route would exist between locations where trains could enter / leave the normally unidirectional line. Where a business case exists, then extra sections/capacity could be introduced. 2.2 Movement Authority, Modes & Levels This section contains specific requirements relating to the GB operational basis for mode and level selection. The ETCS shall be able to send a request to shorten a Movement Authority if it will not lead to an immediate brake application. ESR-817 Rationale: To avoid re-planning activities resulting in the application of braking. Guidance: This functionality is to be used by the signaller for route cancellation in situations other than emergencies. NETWORK RAIL Page 11 of 48

12 Topics: J Appropriate Supervision Level This section contains specific requirements relating to the level of supervision on the train. The ETCS solution shall be configured, operated and maintained to enable the highest level of supervision practicable for the type of operation being undertaken. ESR-611 Rationale: The ETCS is designed to monitor a vehicle's movement and avoid overspeeding and overrunning the Movement Authority. However, some modes of operation do not provide this level of supervision. Therefore, the safety and operational requirements need to be considered. Guidance: Sometimes it is desirable for movement not to be fully supervised, such as when shunting in a possession, or to keep trains moving in degraded operations. Modes of operation that are not fully supervised should only be applied where essential. Topics: A2-1, A2-2, B, G1-1, G1-2, G2, G4-1, H1, I On Sight (OS) shall be available at all ETCS Level 2 locations. ESR-670 Rationale: 1) To ensure that the protection and supervision provided by OS can be utilised across the ETCS Level 2 application. 2) To meet operational needs and give flexibility. Topics: A1-1, A1-2, G2, U2 Entry into SR shall only be achieved using the 'Override' function. ESR-381 Rationale: Following safety analysis and experience on Cambrian, it is considered that the driver should make a conscious act to take sole responsibility for the management of the train movements in Staff Responsible (SR). Guidance: A consistent rule is required to ensure that authorisation is necessary for any use of Staff Responsible (SR), which includes the driver receiving authority from a responsible person (normally the signaller) and operating the override control to enter SR. The driver instructions also need to cover situations where further operations of the override control may be required to pass stop markers. Topics: G3-1, U Movement Authorities The correct Movement Authority shall be issued to the correct train. Rationale: A critical function of the ETCS as train safety depends on it. Guidance: This will be achieved through a combination of technical and operational rules. Topics: A1-1, A1-2, A2-1, A2-2, G1-1, G1-2, G2 ESR-76 NETWORK RAIL Page 12 of 48

13 Movement Authority (MA) updates shall be issued by the Trackside sufficiently early to ensure that the driver does not have to respond to an indication point for braking unnecessarily. ESR-78 Rationale: MA updates should happen as seamlessly as possible and without the driver being aware of the process. Guidance: MA updates should occur sufficiently early to avoid the driver having to consider the possibility of braking. Topics: A1-1 The operational and technical requirements for each mode shall be specified. ESR-655 Rationale: The operational and technical requirements for each mode are not fully specified in the Control, Command and Signalling (CCS) [RD8] and Operation and Traffic Management (OPE) [RD16] TSIs. Guidance: This will require integration of the ETCS Radio Block Centre (RBC) and interlocking controls. Topics: U1, U2, U3, U4, U5, U6, U Full Supervision Movement Authorities Full Supervision shall not require the driver to confirm that the route is safe. ESR-374 Rationale: To clarify the division of responsibilities between the signalling system and the driver for establishing that the route is clear when operating in Full Supervision (FS). Guidance: The driver should not be expected to check anything that the signalling system can prove to be safe. Topics: G1-1, U1, JJ6 The ETCS shall send a Full Supervision Movement Authority to a train authorised to move in Staff Responsible as soon as the necessary conditions have been met. ESR-90 Rationale: The train should always be operating in the highest level of supervision available. Guidance: Trains will be in SR due to a system failure, such as a communications fault or indeterminate train position; once this issue is resolved, then ETCS Full Supervision (FS) must be re-established. Topics: A2-1, A Start of Mission The Track Ahead Free (TAF) facility shall be implemented where operationally required. ESR-27 Rationale: At all times, the ETCS should be under the highest level of supervision available. Guidance: Track Ahead Free enables the driver to confirm to the RBC that the line ahead is free (as far as a marked location), enabling the train to be granted a Full Supervision (FS) Movement Authority. NETWORK RAIL Page 13 of 48

14 Topics: A2-2, G1-2 The driver shall be able to undertake Start of Mission (SoM) at all locations. Rationale: To meet operational needs, and for flexibility. ESR Degraded Starts A safe starting procedure for the train shall be provided if the ETCS cannot provide a Movement Authority (MA). ESR-21 Rationale: Provision of an MA for a Full Supervision (FS) or On Sight (OS) movement is the preferred option for moving a train, but it must be possible to move a train where the preferred options are not available and the system will cater for this. Guidance: Options may have different combinations of technical and procedural safeguards. Topics: A4, G3-1, G3-3, G Routing Information The ETCS solution shall provide facilities to mitigate misrouting. ESR-625 Rationale: The provision of supplementary information to the driver via the ETCS will assist them in identifying possible routing errors and offer the opportunity to stop the train before an undesirable situation occurs. Guidance: Trains are sometimes routed in error onto lines with which they are not compatible. With the ETCS, some existing methods of mitigating these errors will be lost. Where site-specific conditions dictate, then the facilities will be identified and implemented. Topics: V1, V Speed Restrictions A facility shall be provided for temporarily applying speed limits through the ETCS at any given time. ESR-162 Rationale: Issues identified during the course of maintenance or due to climatic conditions that involve decreasing speed limits associated with sections of track and classes of train need to be addressed swiftly. Guidance: It must be possible to apply and change Temporary Speed Restrictions (TSRs) and Emergency Speed Restrictions (ESRs) at any time during the life of the system. Topics: F1, F2 The ETCS shall enable Infrastructure Managers to implement alterations to Permanent Speed Restrictions throughout the life of the system. Status: Normative ESR-481 NETWORK RAIL Page 14 of 48

15 Rationale: Speed restrictions may change as a result of changes to the infrastructure or rolling stock and the ETCS needs to be flexible enough to implement those changes. Guidance: Speed restrictions may increase due to improved capability of the infrastructure or rolling stock, or may decrease in response to maintenance issues (e.g. track deficiencies). Topics: Y3 Driveability shall be considered when designing speed profiles. ESR-672 Rationale: Frequent changes in speed can add to driver workload. Successive reductions in speed are particularly challenging for freight trains due to the delays in the braking system. Guidance: The design of the speed profile should consider the impact of the changes in speed on driveability or driver workload, e.g. regular changes in speed will cause an increase in the demands on the driver to monitor the system and react to the changes, and these may impact on other tasks the driver has, causing competing demands and an increased likelihood of error. Topics: A4 There shall be a technical system and processes to manage Temporary Speed Restrictions. Rationale: To ensure that temporary and emergency speed restrictions are planned, implemented and managed accurately, safely and with due regard to performance. Topics: F1, F Possessions ESR-815 The levels and modes of ETCS-fitted trains that enter a possession and move within it shall be the same on fitted and unfitted infrastructure. Rationale: To maintain consistency and avoid confusion when operating in possessions, drivers should have only one level to select and one process to apply whether operating on conventional, overlay or ETCS-only lineside. ESR-157 Topics: B Shunting The limits of shunting movements into an ETCS-fitted area from an unfitted area shall be marked and supervised. ESR-53 Rationale: A train in Shunting (SH) has a supervised speed but is not issued a Movement Authority. An alternative method is therefore required to constrain the area in which movements may be undertaken. Guidance: For designed shunt routes (such as into sidings or stabling locations, or for reversing a train onto a line returning in the direction from which it has come), the ETCS provides a Danger for Shunting information packet that can be NETWORK RAIL Page 15 of 48

16 permanently included in a balise message. Topics: N1-2 Shunting (SH) shall only be authorised when appropriate interlocking controls and operational restrictions are in place. ESR-380 Rationale: Movements in SH are largely unconstrained by the ETCS and require additional protection. Guidance: This includes both ETCS-controlled areas and areas outside ETCS control. Authorisation may be achieved by technical or procedural means. Topics: B, G4-1, G4-2, G4-3, U Occupied Sections The ETCS shall permit vehicle movements into occupied sections. ESR-30 Rationale: This allows for recovery of trains, movements into platforms to join trains as required by the timetable, and moves into stabling sections that can berth multiple vehicles. Guidance: In principle, moves into occupied sections should be in On Sight (OS) as the highest level of supervision available and should be possible anywhere on the railway (as failed trains could occur anywhere). Topics: G2, H1, I The ETCS shall facilitate attaching and detaching as required for operational purposes. ESR-111 Status: Application-Specific Rationale: Vehicles are required to be attached or detached in various operating scenarios, and these moves will be undertaken in the highest level of supervision available, where possible. Guidance: Movements in Standby (SB) negate the need for data entry. Topics: I The ETCS shall not authorise more than one train to move within the same train detection section at the same time unless required under specific arrangements. ESR-240 Rationale: To maintain the safest conditions for the operation being undertaken. Guidance: Two moving trains in the same section should be exceptional. Normal permissive working will involve one moving train entering a section occupied by a stationary train. Permissive freight lines are an example of where it could be permissible for two moving trains to occupy the same section. Topics: B, G2, H2 Passenger trains entering an occupied section shall have a target stopping location that is stationary. ESR-378 Rationale: To avoid collisions due to misjudgements in the handling of the train entering an NETWORK RAIL Page 16 of 48

17 occupied section. Guidance: Incidents have occurred where drivers have failed to realise until too late that a moving train has stopped - unlike road vehicles, trains do not have brake lights. Topics: H1, I, U2 The ETCS shall permit more than one train to depart in opposite directions from a single section simultaneously. ESR-571 Rationale: This permits trains that have been detached in platforms to depart in opposite directions to meet timetable needs. It also provides flexibility where a recovered train that was unable to continue because of a failure in the unit at one end could, once pulled or pushed out, continue under its own power to the depot facility if driven from the unit at the other end. Topics: I Level Crossings The ETCS solution shall provide effective integration with level crossing controls. Status: Application-Specific Rationale: There will be locations on the GB Railway where conventional signalling interfaces with level crossings must be supplemented or replaced with ETCS functionality. Topics: JJ1, JJ2, JJ5, JJ6 ESR-606 When in On Sight (OS), the driver shall only be responsible for checking that the route is clear of obstructions and checking the status of locally-monitored level crossings. Rationale: The driver shall only be responsible for checking that the route is clear of obstructions and checking the status of locally-monitored level crossings with respect to the OS Movement Authority. Topics: A1-2, G2, U2, JJ5, JJ8 2.3 Degraded and Emergency This section contains requirements specific to degraded and emergency working. ESR-659 The ETCS shall support the driver in stopping the train in the correct location for an emergency evacuation of a train within a tunnel. ESR-153 Status: Application-Specific Rationale: To be able to respond to emergency situations within a tunnel. Guidance: Whilst the functionality has to be provided, this requirement can only be met in full where tunnels have been configured to support evacuation. Topics: J2 The ETCS shall support the safe movement of trains in abnormal, degraded and emergency operations. Status: Normative ESR-245 NETWORK RAIL Page 17 of 48

18 Rationale: The risk of human error in abnormal, degraded and emergency conditions must be reduced by the ETCS. Guidance: Human involvement in safety operation systems increases risk, which the ETCS should be used to mitigate so far as is reasonably practicable. Examples of mitigation methods are implementing speed supervision if this is still functional or demanding brake intervention where Movement Authorities are exceeded. Topics: G2, G3-1, G3-4, G5, U2, U6 The ETCS shall be able to support abnormal, degraded and emergency operations on approach to, across and beyond the RBC-RBC handover border. Rationale: To maintain the operation of trains when operating in degraded situations. Topics: R1 ESR-303 The driver and signaller shall be provided with information that supports the accurate and unambiguous identification of the train and of the location at which the train is stopped. ESR-368 Rationale: This requirement supports the safety-critical conversation between the driver and the signaller. If a Movement Authority cannot be issued because of degraded conditions, and the line ahead is clear, the signaller needs to be able to provide an authorisation to move under written instructions. Guidance: In situations where routes cannot be proved, the expectation is that trains will normally be stopped at an EOA. Where the ETCS stop markers or location markers are provided lineside to mark EOAs, these are required to have unique identity plates to support identification of the train position. Drivers of trains stopped at unmarked EOAs may have access to geographic position information, kilometre posts or mileposts, etc. Signallers should have access to the same information in a manner that supports the accurate and unambiguous determination of the train's position. Topics: A4, E2, JJ3 2.4 Signs and Indicators This section contains requirements specific to signs and indicators. Where a train dispatch risk assessment identifies the need for platform dispatch staff, tools shall be provided to advise staff that the train dispatch process may commence. ESR-547 Rationale: Under conventional signalling, if there is no line of sight between the train dispatcher and the signal aspect, OFF indicators are provided. Under ETCS signalling, there will be no signal aspect to inform train dispatchers that the train has a Movement Authority. Guidance: The provision of Train Ready To Start (TRTS), Close Doors (CD) and Right Away (RA) facilities is unchanged by the use of ETCS. The choice of the method of train dispatch is the responsibility of the Railway Undertaking and Station Infrastructure Manager. The risk assessment will be conducted in accordance with RIS-3703-TOM Issue 2 [RD16]. Topics: D1 NETWORK RAIL Page 18 of 48

19 Where a train dispatch risk assessment identifies the need for platform staff to inform the driver that safety checks are complete, tools operated by platform staff shall be provided. ESR-548 Rationale: Under conventional signalling, if there is no line of sight between the train dispatcher and the train driver, Right Away indicators are provided and, in many cases, these are interlocked with the signal aspect. Guidance: The RA indicators indicate that the dispatch process is complete and the train may proceed. The risk assessment will be conducted in accordance with RIS TOM Issue 2 [RD16]. Topics: D3 Lineside signage shall be provided or retained where essential. ESR-4 Rationale: There may be occasions when lineside signage is required to support operations. Topics: F2, AA1, AA2, AA3, AA4, AA5 2.5 Other Systems Class B Systems This section contains requirements specific to Class B systems. Non-ETCS train protection systems shall not impact on the train or driver when they are operating under ETCS supervision. ESR-280 Rationale: Non-ETCS train protection systems should only be active when driving in Level NTC. Guidance: The ETCS does not supervise the train in Level NTC (the Onboard simply stands ready to transition to a level under which it will supervise the train when commanded by the Trackside). In Level NTC SH, the Class B system may be suppressed. Topics: B, N1-1, N2-1, N2-2, T2 The system shall support Level NTC, NID_NTC=21, displayed as 'TPWS' on the ETCS Driver Machine interface (DMI), where required for competence and training purposes. Status: Application-Specific Rationale: The extra Level NTC allows the driver to select whether transitions to ETCS levels will take place on entering overlay areas. Guidance: See NSR-57 and NSR-101. Topics: T1 ESR-562 ETCS modes and levels shall be compatible with other active on-board train protection systems. Status: Application-Specific Rationale: The ETCS can operate in Level NTC with other Class B systems undertaking train protection functionality. It is also possible for the ETCS to be made unavailable when another Automatic Train Protection (ATP) system is active. ESR-563 NETWORK RAIL Page 19 of 48

20 Guidance: This requirement has been created with Great Western ATP in mind but may be relevant to other Class B systems. When ATP is selected, any on-board Automatic Warning System (AWS)/TPWS must also be enabled. Topics: T Traction Switching This section contains requirements specific to traction switching. The ETCS shall be capable of supporting traction changeover while the train is at a stand or moving at the required speed. ESR-140 Status: Application-Specific Rationale: There are locations where it is necessary to switch over at a stand because it is not feasible to do this on the move. Guidance: The ETCS does not control the traction changeover but has the ability to export commands to the on-board traction system based on trackside commands. Traction changeover covers all possible power sources. Topics: M1 The ETCS shall permit automated electrical control on trains with one or more electrical traction supply system(s). ESR-614 Status: Application-Specific Rationale: The ETCS must be integrated with the traction supply system on the train to raise and lower pantographs, open and close circuit breakers, and switch to and from shoe collection as required on the route. The implementation of the ETCS shall continue to support the automatic opening and closing of vehicle supply in-feed circuit breakers as a train passes through a neutral section, regardless of the ETCS operating level or mode. ESR-143 Status: Application-Specific Rationale: To maintain the current level of automation through neutral sections available on the GB railway. Guidance: The ETCS 'powerless section with main power switch to be opened' track condition functionality is only available in modes: Full Supervision (FS); Limited Supervision (LS); On Sight (OS); (Non Leading (NL); Post Trip (PT) and Trip (TR). In other operating modes, the automatic control of vehicle supply in-feed circuit breakers must still be supported. Topics: M1 The ETCS shall be designed so that the symbols for raising / lowering pantographs can be displayed at the correct trackside location. ESR-669 Rationale: A stalled vehicle in a dead section with its pantographs lowered could cause long delays to service. The display of traction information at the correct geographical location is essential to avoid damage to train or infrastructure. NETWORK RAIL Page 20 of 48

21 2.5.3 Onboard Data This section contains requirements specific to Onboard capability. The ETCS shall release radio channels promptly when they are no longer required. ESR-18 Rationale: The Global System for Mobile Communications Railway (GSM-R) has a limited number of channels available. The concern is that trains coming out of service that keep channels open may prevent trains entering service from setting up a session with the Radio Block Centre (RBC). Topics: C, I, O2-1, O2-2 Where ETCS controls other on-board systems, the timing of controlled events shall be optimised by design. Rationale: Timing of events could affect performance. Guidance: As an example, timely management of traction controls results in the best performance. This section contains requirements specific to data. ESR-318 The values of configurable data shall be determined to provide optimum service performance whilst providing mitigation of hazards as far as is reasonably practicable. ESR-6 Rationale: Subject to safety and capacity constraints, parameters must be configured for maximum system performance. Guidance: These optimum values could be determined through experience, or possibly through bench-marking against other railways. Analysis is required to ensure that required capacity and system capability are optimised whilst hazards are mitigated as far as is reasonably practicable. Information and interface requirements shall be defined to clarify the data that the ETCS must exchange with external systems. ESR-198 Rationale: To exchange data for planning and passenger information, etc. Guidance: Train performance information is extremely useful for businesses and passengers (particularly in times of perturbations and degraded working). This information should be made available in accordance with a defined set of requirements. Topics: JJ1, JJ2, JJ3, JJ4 Suitably rigorous validation methods shall be applied to data upon which the safe operation of the ETCS is dependent. Status: Normative ESR-274 NETWORK RAIL Page 21 of 48

22 Rationale: The data required by the ETCS sub-systems is, at a minimum, safety-related and frequently safety-critical. Guidance: Methods of validation (static and dynamic) are to be determined as part of detailed operational safety and human factors analysis. Data within the scope of this principle includes: (a) Train data (for Onboard data entry and system configuration); (b) Infrastructure data (Temporary Speed Restriction (TSR) & Emergency Speed Restriction (ESR) data, RBC configuration data, and balise telegrams); (c) Security data (Cryptographic keys); and (d) Onboard and Trackside event recorder information. Topics: F1, F2, Y1, Y2, Y3, Z1-1, Z1-2 The system shall minimise the risk of incorrect train data entry. ESR-561 Rationale: The data affects the brake model and hence the safety of the ETCS supervision system. Errors in preparation or entry of data can lead to safety hazards. Topics: Z1-1, Z Safety This section contains requirements specific to safety. Existing safety measures shall be retained if any risks mitigated by them are not adequately mitigated by the ETCS. Rationale: The ETCS should not degrade safety over that provided by other systems. ESR-275 Measures shall be taken to mitigate the risk of trains failing to stop when or where required to do so. ESR-286 Rationale: To prevent, or mitigate the risk of, a train collision or derailment. Guidance: This will be achieved through layout design, odometry correction when needed, and operational rules. Topics: U5, U6 2.7 Security This section contains requirements specific to security. The ETCS solution shall be sufficiently robust to withstand intentional or unintentional threats that may result in damage or corruption. ESR-629 Rationale: Physical and cybersecurity measures are required to ensure that intentional damage or corruption can be avoided. Additionally, the design needs to be such that unintended damage or corruption can be avoided by mitigating human errors and considering risks to installations. NETWORK RAIL Page 22 of 48

23 Guidance: Damage includes physical damage to system components and interfaces, and corruption includes any software-based threats, such as incorrect data or network flooding with messages. The NR Security Assurance Framework [RD18] uses a standardised risk management methodology to assess GB operational rail system risk through a rail safety and systems engineering approach. Topics: II The risk of malicious or accidental intervention leading to an unsafe state shall be reduced to an acceptable level. ESR-236 Rationale: The ETCS is a safety-related system with safety-critical elements and its performance levels, with respect to safety and service delivery, must be maintained throughout its life. Guidance: System security applies to system data and operational information, as well as equipment, and includes the definition and implementation of a national key management strategy. Targets should be developed as part of any threat analysis undertaken to derive detailed security requirements. Details of security requirements will need to be captured in a security policy. The NR Security Assurance Framework [RD18] uses a standardised risk management methodology to assess GB operational rail system risk through a rail safety and systems engineering approach. Physical system interfaces shall be protected to avoid unauthorised access to equipment functionality and stored data. Rationale: For system safety and to protect system availability. Guidance: Access to systems must be controlled to avoid unauthorised access (either unintentional or deliberate). Topics: R1, II ESR-293 The ETCS maintenance system shall be secured with sufficient physical, procedural and technical controls to minimise security risks. ESR-389 Rationale: As the ETCS is software-based and uses open systems interconnection protocols it could be a target for attack. Guidance: The NR Security Assurance Framework [RD18] uses a standardised risk management methodology to assess GB operational rail system risk through a rail safety and systems engineering approach. The ETCS shall be designed, built and implemented using Secure Software Development Lifecycle (SSDL) methodologies to mitigate security risks appropriately. Rationale: As the ETCS is software-based and uses open systems interconnection protocols, it could be a target for attacks. ESR-388 NETWORK RAIL Page 23 of 48

24 Guidance: SSDL processes include Microsoft SDL, Atsec and SafeCODE. End-to-end ETCS security testing shall be conducted by an independent assessor that is a National Cyber Security Centre (NCSC) approved or certified service provider. ESR-387 Rationale: Using an independent assessor should provide a realistic view of the security resilience of the ETCS. Guidance: For increased assurance, more than one assessment could be undertaken from different, independent NCSC-approved or certified service providers but there will be an associated cost implication with that. Protection shall be afforded against vandalism and accidental damage. ESR-291 Rationale: Physical security is required to prevent damage. Guidance: The railway is frequently targeted by vandals and thieves. Consideration should also be given to the following: protection against accidental spillage of fluids (e.g. coffee and tea), or the design of buttons and other operating devices to avoid them being wedged in position by using paper or some other material. Topics: II 2.8 People Issues Workload/People/Training This section contains requirements specific to people. Processes shall be in place to assess staff competence and maintain it at the level required for staff to carry out their roles and responsibilities in operating and maintaining the ETCS. ESR-301 Rationale: A process of continuous monitoring of staff competence is necessary to enable the system to be operated and maintained safely. Guidance: The correct level of staff competency will keep the system in its design performance levels throughout its service life. Processes shall be in place to assess staff workload and maintain it at the level required for staff to carry out their roles and responsibilities in operating and maintaining the ETCS. ESR-968 Rationale: A process of continuous monitoring of staff workload is necessary to enable the system to be operated and maintained safely. Guidance: The correct level of staff workload will keep the system in its design performance levels throughout its service life. NETWORK RAIL Page 24 of 48

25 The ETCS shall neither lead nor predispose the operational user to make an error. ESR-220 Rationale: The first recourse to mitigate potential for human error is in the design. This requirement generalises mitigation of the referenced hazards into a design principle. Guidance: The complete operation of the ETCS will need to be considered from sourcing information, through data entry to operator actions. This requirement will be updated with a cross-reference to the relevant entry in the national ETCS hazard log in a future version of this document. Necessary and sufficient training support facilities shall be provided to carry out staff training. Rationale: Evidence of successful training will be required before staff can work on the equipment. Guidance: Successful training will require course modules to be developed and accompanied by notes that can be used as a reference in future by delegates Driver Interface This section contains requirements specific to the driver's interface. The information displayed to the driver shall support safe and efficient driving. ESR-179 ESR-14 Rationale: It must be possible for the driver to maintain consistent control over the train movement without unwanted brake intervention as a result of the data provided to the train. Guidance: This includes speed and gradient profile data transmitted to the train, the Onboard characteristics, and the brake model. Topics: A1-1, A1-2, V1, V2, Y1 The ETCS shall limit the demands on the attention of the driver during critical driving phases where the driver is required to be particularly alert to events outside the cab. ESR-228 Rationale: Derived requirement from Cambrian hazard cause analysis (HL-3915, HL-3928 and HL-3930) concerned with driver error relating to level crossings. This requirement generalises this into a design principle. Guidance: This requirement will be updated with a cross-reference to the relevant entry in the national ETCS hazard log in a future version of this document. This requirement captures the principle of avoiding competing visual tasks at critical phases of the driving task as a requirement. Topics: H1, H2, I, O2-1, O2-2, V1, V2 The train shall display on the Driver Machine interface (DMI) the units of speed appropriate to the location and train operation. ESR-107 NETWORK RAIL Page 25 of 48