Signalling Control Centres

Transcription

1 Signalling Control Centres Synopsis This document defines the minimum requirements needed to ensure that a signaller can control and monitor the operation of the railway in a safe and effective manner. Signatures removed from electronic version Submitted by Laura Beales Standards Project Manager Authorised by Anne E Blakeney Acting Controller, s This document is the property of the Rail Safety and Standards Board Limited. It shall not be reproduced in whole or in part without the written permission of the Controller, s, Rail Safety and Standards Board. Published by: Rail Safety and Standards Board Evergreen House 160 Euston Road London NW1 2DX Copyright 2003 Rail Safety and Standards Board Limited

2 This page has been left blank intentionally

3 Page 1 of 24 Contents Section Description Page Part A A1 Issue record 2 A2 Implementation of this document 2 A3 Scope of s 2 A4 Responsibilities 2 A5 Health and safety responsibilities 3 A6 Technical content 3 A7 Supply 3 Part B B1 Purpose 5 B2 Application of this document 5 B3 Definitions 5 B4 Principles 7 B5 General 7 Part C C1 Provision of control centre equipment 8 C2 Control methods 10 C3 Signalling controls 13 C4 Signalling indications 15 C5 Ancilliary equipment 16 C6 Other information 17 C7 Symbols and text 18 C8 Functional requirements 19 C9 Performance requirements 20 C10 Degraded signalling 21 C11 Control of a disturbed railway 21 C12 Evacuation of signalling control centre 22 C13 Impact of multifunctional control rooms 23 References 24 RAIL SAFETY AND STANDARDS BOARD 1

4 Page 2 of 24 A1 Issue record Part A Issue Date Comments One September 1997 Original Document Replaced SSP25 Two October 2003 Replaces issue one and sections 1-6 of GK/RT0005 Revisions have not been marked by a vertical black line in this issue because the document has been revised throughout. This document will be updated when necessary by distribution of a complete replacement. A2 Implementation of this document The publication date of this document is 04 October This document comes into force on 06 December The dates by which compliance with the requirements of this document is to be achieved are set out in Part B2. Where those dates are later than the date on which this document comes into force, this is to give Railway Group members additional time to plan and commence implementation so as to achieve full compliance by the dates set out in Part B2. This document supersedes the following s, either in whole or in part as indicated: Railway Group Standard Issue No. Title RGS sections superseded by this document Date(s) as of which sections are superseded GK/RT Safety Related Colours for Signalling Applications 1 Signalling Control And Display Systems Sections Dec 2003 All 06 Dec 2003 GK/RT0005 section 7 will be superseded by GI/RT7033 with effect from 02 August GK/RT0005 will be withdrawn with effect from 02 August A3 Scope of Railway Group Standards A4 Responsibilities The overall scope of s is set out in Appendix A of GA/RT6001. The specific scope of this document is set out in Part B2. s are mandatory on all members of the Railway Group* and apply to all relevant activities that fall into the scope of each individual s Railway Safety Case. If any of those activities are performed by a contractor, the contractor s obligation in respect of s is determined by the terms of the contract between the respective parties. Where a contractor is a duty holder of a Railway Safety Case then s apply directly to the activities described in the Safety Case. 2 RAIL SAFETY AND STANDARDS BOARD

5 Page 3 of 24 * The Railway Group comprises Network Rail Infrastructure Limited, Rail Safety and Standards Board (RSSB), and the train and station operators who hold railway safety cases for operation on or related to infrastructure controlled by Network Rail Infrastructure Limited. Network Rail Infrastructure Limited is also known as Network Rail. Rail Safety and Standards Board Limited is also known as RSSB. A5 Health and safety responsibilities A6 Technical content In issuing this document, RSSB makes no warranties, express or implied, that compliance with all or any documents published by RSSB is sufficient on its own to ensure safe systems of work or operation. Each user is reminded of its own responsibilities to ensure health and safety at work and its individual duties under health and safety legislation. The technical content of this document has been approved by: Jeff Allan, Principal Signalling and Telecommunications Engineer. Enquiries should be directed to RSSB Tel: or enquiries@rssb.co.uk. A7 Supply Controlled and uncontrolled copies of this document may be obtained from the Industry Safety Liaison Dept, Rail Safety and Standards Board, Evergreen House, 160 Euston Road, London NW1 2DX or enquiries@rssb.co.uk. RAIL SAFETY AND STANDARDS BOARD 3

6 Page 4 of 24 This page has been left blank intentionally 4 RAIL SAFETY AND STANDARDS BOARD

7 Page 5 of 24 B1 Purpose B2 Application of this document Part B This document defines the minimum requirements needed to ensure that a signaller can control and monitor the operation of the railway in a safe and effective manner. B2.1 To whom the requirements apply This document contains requirements that are applicable to duty holders of the infrastructure controller category of Railway Safety Case. B2.2 Compliance requirements B2.2.1 Infrastructure The requirements of this document are mandatory for new Network Rail controlled infrastructure and for alterations to existing Network Rail controlled infrastructure for which Approval in Principle is given on or after 06 December When Approval in Principle is given before 06 December 2003, but the infrastructure has not yet been brought into service, the design shall be reviewed and, where reasonably practicable, brought into line with the requirements of this document. Action to bring existing installations into compliance with the requirements of this document is not required. B2.2.2 General compliance requirements Until the compliance date, or the date by which compliance is achieved (if earlier), the applicable requirements of the predecessor documents shall continue to be met (see Part A for details). After the compliance date, or after the date by which compliance is achieved (if earlier), Railway Group members shall not deviate from the requirements set out in this document. Where it is considered not reasonably practicable to comply with the requirements set out in this document, authorisation not to comply shall be sought in accordance with GA/RT6001, GA/RT6004 or GA/RT6006. B2.3 Exclusions from the application of this document Where an existing signalling control centre is to be modified, the requirements in sections C1 to C11 of this document shall apply only to those systems or subsystems that are introduced or modified, provided that the interface(s) between the existing and new are compatible with each other. An ergonomic assessment of the impact of the changes shall be undertaken for the control centre as a whole. B2.4 Supporting documents This document is supported by Railway Group Guidance Note GK/GN0525. Current practice for symbols used in diagrams in lever frames, control panel style signalling control centres and Integrated Electronic Control Centres (IECC) is included for reference purposes. B3 Definitions Automatic route setting sub-area A group of signals for which automatic route setting can be enabled or disabled by one operation. RAIL SAFETY AND STANDARDS BOARD 5

8 Page 6 of 24 Blockshelf A shelf provided, normally above the lever frame or panel, to hold equipment associated with control of the line, for example block instruments, indicators and other ancillary signalling equipment. Catastrophic failure A failure that prevents a signaller from exercising any control over the signalling system, and/or results in loss of all indications on a panel/workstation. Catch handle A handle of a latch that holds a lever in a specific position in the frame. Correspondence Correspondence occurs when the detected position of all point ends forming a set of points matches the normal or reverse position to which they have been instructed to move by an external command. Ergonomics The science of human performance at work, studying factors and developing tools to reduce error, increase productivity, improve safety and enhance comfort. It is largely synonymous with Human Factors. Interlocking A general term applied to the control of setting and releasing of signals and points to prevent unsafe conditions arising, and equipment that performs this function. Normal (lever) The position of a lever when it is lying fully back, away from the signaller, in the lever frame. Override A facility provided in respect of some remote interlockings for use during failure of the remote control equipment. It enables all signals to be replaced to danger or nominated routes to be set for automatic working. Limited diverse routing at junctions is sometimes provided. Overview A signalling diagram or display that shows the whole of an area being controlled. Reverse (lever) The position of a lever when it is pulled fully towards the signaller in the lever frame. Signal box diagram A diagram, readable by the signaller, showing the track layout and signalling arrangements for all or part of a signalling control centre. Depending on the technology used, this may take the form of a mounted paper diagram, a control/indication panel or display screen. Signalling function An item of signalling equipment that is operated, directly or indirectly, from a signalling control centre. Signalling control centre A collective title for rooms or centres where signallers or crossing keepers operate train control equipment. For the purposes of this standard it excludes ground frames. Situational awareness The perception of environmental features and events, the understanding of their meaning, and the prediction of their status in the near future. 6 RAIL SAFETY AND STANDARDS BOARD

9 Page 7 of 24 Task analysis A structured procedure that systematically specifies the jobs, duties, tasks and actions that a person performing that task will be doing. Visual Display Unit An electronic screen showing a graphical and/or text image generated by a computer, capable of being continuously updated. Other terms are as defined in GK/RT0002. B4 Principles This document supports HM Railway Inspectorate Safety Principle 20. The signalling system should provide for the safe routing, spacing and control of trains. It also supports HM Railway Inspectorate Safety Principle 21. The signalling system should continue to provide for safe passage of trains permitted to run under degraded conditions. B5 General The infrastructure controller shall ensure that the signaller has sufficient information and means of control to enable the movement of trains to be controlled safely to the benefit of Railway Group members as a whole. When a new signalling control centre is being planned, or a significant alteration is being made to an existing one, the infrastructure controller shall identify all equipment to be provided and determine its layout and position on the operating floor, so as to optimise the performance of personnel working therein. Where temporary control centres are established as part of migration strategies, to facilitate major works, or are fallback control centres, all functional requirements in this document shall apply to such temporary control centres, regardless of their intended life. RAIL SAFETY AND STANDARDS BOARD 7

10 Page 8 of 24 C1 Provision of control centre equipment Part C Design Requirements C1.1 General The infrastructure controller shall develop and maintain national standards for the operation and indication of signalling control equipment. For established control systems these standards shall be based on existing best practice, particularly where staff work in several control centres. See associated Guidance Note GK/GN0525. The signaller shall be provided with: a) a means of operating the signalling equipment being controlled, by means of a lever frame, control panel or workstation (as set out in section C2) b) a signal box diagram displaying the supervised track layout and the associated signalling in a clear, distinct, concise and consistent manner c) a means of carrying out voice communication with traincrew, lineside locations (for example level crossings) and other control centres d) other facilities, such as closed circuit television monitors, necessary to carry out their duties. The infrastructure controller shall carry out risk-based ergonomic assessments of signal control centres so as to demonstrate that the following factors are all designed to optimise the signaller s performance and thus minimise operator error: i) the signalling control and display equipment ii) the communications equipment, including facilities for emergency voice communication (see GE/RT8021) iii) ancillary systems and equipment, for example, hot axle box detectors and wheel impact load detectors iv) the signaller s workload v) the environment. C1.2 Information to be provided on the diagram A task analysis and specification of usability requirements shall be undertaken to identify all activities required to be carried out by the signaller. The information provided on the signal box diagram shall be determined as a result of these processes but as a minimum the following shall be displayed: a) All of the railway controlled, supervised or monitored, including level crossings equipped with control systems and/or telephones. Sections of the railway that are supervised from the signalling control centre only at certain periods (for example during closure of an adjacent signalling control centre) shall also be shown and be clearly identifiable. b) The track and signalling (for example signals, points, train detection sections) in the correct geographical relationship. It is not necessary to depict the railway to scale, but any distortion due to the representation of the layout not being to scale shall not be such as to cause confusion. c) The limits of each interlocking and ARS sub-area. 8 RAIL SAFETY AND STANDARDS BOARD

11 Page 9 of 24 d) The normal position and present state of each signalling function. e) Distances, where necessary to assist correct judgement. f) Significant geographical features affecting the safe operation of the railway (for example tunnels, station platforms). g) In electrified areas, traction neutral sections and substation/track paralleling hut gaps, station platforms. Equipment and track not under the control of the signaller but required to be shown on the signal box diagram for operational or other reasons shall be depicted in a different manner or colour (for example in outline). For workstations, it is permissible for information not regularly required by the signaller to be suppressed, with a facility for it to be called up as required. For example: i) signal, point and train detection nomenclature ii) iii) iv) the normal positions of points interlocking and ARS sub area boundaries (in electrified areas) traction neutral sections and substation gaps v) user worked level crossings with telephones. C1.3 Workload and assessment of working environment The workload of signallers shall be assessed to ensure that the signaller has the capacity to monitor and control the movement of trains safely and effectively both during normal and disrupted periods. The following factors shall form part of the assessment needed to determine the human resource requirements for the signalling control centre: a) the number of train movements controlled in a specified period, for example, in the busiest hour b) the time and effort needed to enable each train movement c) the degree of operational automation provided d) distractions through other duties or communications with other staff or public e) the situational awareness of the signaller f) the time and effort needed to deal with possible disruptions. Where the assessment indicates that during disruption the work needs to be shared, consideration shall be given to how the duties can be divided to minimise the risk of operator error. Workload assessments shall be conducted for all permitted combinations of signaller positioning. It is permissible for the number of signallers to be reduced at certain times, commensurate with lower traffic levels. The layout and disposition of workstation equipment and functions shall be designed to facilitate this. An assessment of the control room environment shall be undertaken so as to identify factors such as lighting that need to be controlled to enable the signaller to operate efficiently and safely. RAIL SAFETY AND STANDARDS BOARD 9

12 Page 10 of 24 C1.4 Layout of controls and indications Controls and indications provided to each signaller shall be determined using the analysis and assessments as set out in sections C1.2 and C1.3. Their physical appearance and layout shall be ergonomically designed. In particular, layout analysis, human machine interface assessment and a physical ergonomics assessment shall be undertaken to identify any weaknesses with the proposed layout. Display systems not associated with a particular signaller s interface shall be similarly designed. Where controls are duplicated, appropriate measures shall be taken to avoid risk of conflict or confusion. Where the external railway being controlled is visible from the normal operating position, the signal box diagram shall be laid out in the same orientation as the external railway. Train detection indications set out in GK/RT0011 shall be provided at locations where the signaller requires to determine the precise position of a train, (for example clear of points) unless it is clearly visible from the normal operating position. Indications and alarms not immediately affecting the operation of the railway shall generally be located away from the track layout area. Means shall be provided to facilitate the updating of controls and associated display information to reflect changes in the track layout or other operating parameters. C1.5 Response of controls and indications The equipment shall be designed to ensure that all system inputs made by the signaller generate feedback to confirm that the input has been registered. The response to a request made to the interlocking shall be made within three seconds of the control being operated. Response times of the interlocking are set out in GK/RT0060. A change of state of external equipment shall be indicated to the signaller within three seconds of it occurring. C1.6 Control area boundaries Boundaries between control areas of signalling control centres, signallers control areas, interlockings and ARS sub areas shall be designed to minimise their complexity and risk of confusion, particularly during the passage of trains during degraded or disturbed working conditions. C2 Control methods Control shall be exercised by the signaller by one of the following methods in accordance with the interlocking principles set out in GK/RT0060. C2.1 Lever frames Each lever shall have normal and reverse positions. It is permissible for intermediate positions to be designated if this is required for the operation of signalling equipment. A catch handle shall be provided to retain the lever in the required position. Further requirements for the design of lever frames are set out in GK/RT0039. Signals shall usually exhibit their most restrictive aspect with the lever in the normal position; reversing the lever shall enable the signal to show a proceed aspect. Exceptionally, it is permissible for levers that operate signals which are usually maintained in the OFF position to be normal when OFF. 10 RAIL SAFETY AND STANDARDS BOARD

13 Page 11 of 24 Points shall stand in a position so as to minimise conflicts (as set out in GI/RT7004) with the lever in the normal position. Where an electric lock is associated with the lever this shall be released only at the appropriate time and under the correct conditions (as set out in GK/RT0060), by the operation of the lever catch handle, a separate plunger on the block shelf or a similar economiser. Where the correct conditions are not obvious, it is permissible for a lever free indication to be provided. Information shall be provided on or adjacent to each working lever displaying: a) the identification number of the function operated by the lever b) a description of the function c) any levers required to be pulled in sequence before the lever. A block shelf shall be provided above the lever frame. The signal box diagram(s) shall be positioned above or supported on the block shelf. C2.2 Control panels Where control panels are employed, controls and indications shall be arranged either on a single display (combined controls and indications) or on separate displays for controls and indications, in line with existing control panel designs. Ergonomic assessments shall be used to determine which of these options is most suited for each control centre, giving particular regard to the number and roles of staff needing to work in the centre. Indications shall be clearly visible when operating the corresponding controls. Assessments of working environment shall consider the needs of all control room staff who may need to observe displayed information to ensure that displays are readable and free from glare. Where route setting is employed, operation shall be as follows: a) The action of a signaller pressing a button at the position of a signal shall cause the system to register the entrance to a route at that signal. A flashing light, in or adjacent to the position of the button, shall be provided to confirm registration. b) The sequential pressing of another button at the route exit shall cause the system to register an available destination, including any overlap. The flashing light shall change to steady. c) Where there are alternative paths to the destination, either a preferred route shall, if available, be selected automatically or additional selection devices shall be operated, for example point keys or alternative route buttons. d) The points required shall be automatically set to the required position and be locked. The line of route shall be indicated on the signal box diagram by a number of evenly spaced white lights along the route, including the overlap. e) Point correspondence shall be displayed both adjacent to the point key and in the line of route. Any points that are out of correspondence shall be indicated by a flashing light. RAIL SAFETY AND STANDARDS BOARD 11

14 Page 12 of 24 f) When the interlocking and selection requirements (see GK/RT0060) have been satisfied, the signal shall display a proceed aspect. Evidence of this proceed aspect shall be displayed on the signal box diagram/panel. g) Replacement to danger of a signal shall be possible at any time by pulling the entrance button. h) Subject to approach locking conditions being satisfied, pulling the button shall also cause the route to restore to normal. It is permissible for train operated route release (TORR) to be provided (see GK/RT0063). i) It is permissible to allow main signals to clear automatically for subsequent trains along prescribed routes or be controlled by ARS. An associated indication shall be provided. It is permissible for alternative methods of route setting to be employed: i) A switch instead of a route entrance button. Operation of the switch shall register the route entrance. ii) A switch for each route. iii) A switch for each set of points and for each signal, the points being set to the required position before the signal switch is operated. Restoration of the signal/route switch shall replace the signal to danger. A switch as a route entrance device shall not be used with TORR or ARS as it is incompatible. Where a signalling control centre is operated by more than one signaller at a time, the controls, indications and layout shall be arranged so that each signaller has the necessary information and access to controls without obstructing or interfering with the other signallers. It is permissible in this situation to duplicate some or all of the diagrams and indications. C2.3 Workstations Workstations based on processor technology offer a particularly wide range of input and display options. Ergonomic analysis techniques shall be used to establish the human/computer interfaces that optimise the signaller s performance during normal and degraded operations. Where workstations using VDUs are employed: a) The whole of the signaller s area shall be displayed continuously on an overview diagram that shows, as a minimum, the track layout, running signal aspects and positions of all trains. It is permissible for this display to be on more than one screen. b) Other displays, showing the detail for a specific area, shall be available to view on demand. It is permissible for the signaller to be able to call up and suppress signal, point and train detection nomenclature and associated text. c) A track layout diagram shall be provided for emergency use (see sections C10 and C11). This display shall be permanent and not affected by power or system failure. It shall be possible to attach labels (for example by magnets) to this diagram. It is permissible for the diagram to be provided in sections corresponding to signallers workstations. d) Provision shall be made for alerting the signaller to a failure of the display system, for instance, by use of a continually moving icon. It is permissible to provide workstations for control and detailed displays, combined with a fixed display diagram to give an overview display. 12 RAIL SAFETY AND STANDARDS BOARD

15 Page 13 of 24 Where route setting is employed, operation shall be as follows: i) The action of a signaller selecting an entrance signal icon shall cause the system to register the entrance to a route at that signal. A distinctive indication shall be provided to confirm registration. ii) The sequential selection of a route exit shall cause the system to register an available destination, including any overlap. The distinctive indication shall change to steady. iii) Where there are alternative paths to the destination, either a preferred route shall, if available, be selected automatically or additional selection devices shall be operated, for example point or alternative route icons. iv) The points required shall be automatically set to the required position and be locked. The line of route shall be indicated on the VDU by a white trace along the route, including the overlap. v) Point correspondence shall be displayed in the line of route. Any points that are out of correspondence shall be indicated by a flashing indication. vi) When the interlocking and selection requirements have been satisfied (see GK/RT0060), the signal shall display a proceed aspect. Evidence of this proceed aspect shall be displayed on the workstation. vii) Replacement to danger of a signal shall be possible at any time by selection of a control object associated with the entrance signal. viii) Subject to approach locking conditions being satisfied, the above operation shall also cause the route to restore to normal. It is permissible for TORR to be provided (see GK/RT0063). ix) It is permissible to allow main signals to clear automatically for subsequent trains along prescribed routes or be controlled by ARS. An associated indication shall be provided. It is permissible for route setting and cancellation and point operation to be by clicking on icons, keyboard operation or menu selection. At least two alternative methods shall be available. Displays using VDUs shall be designed and positioned to minimise reflections and glare. C2.4 Hybrid installations Where a signalling control centre contains a mix of control and/or indication systems, the requirements of this section C2, shall be complied with for the relevant parts. The requirements of section C1.4 shall be complied with for the equipment as a whole. In particular the relationship between the various parts shall be considered to ensure a logical arrangement. The mixing of control or indication systems within a signalling control centre which appear similar but operate differently or whose indications have different meanings shall be avoided. C3 Signalling controls C3.1 Control requirements The task analysis and specification of usability requirements (set out in section C1.2) shall be used to determine what control facilities are required on each workstation. As a minimum, the following controls shall be provided for: a) the operation of all signals, points, level crossings, and other movable infrastructure (for example swing bridges) requiring direct control RAIL SAFETY AND STANDARDS BOARD 13

16 Page 14 of 24 b) the release of movable infrastructure or other signalling functions for local control or operation (for example ground frames, remote token instruments) c) the operation of auxiliary functions (for example CCTV equipment, level crossing stopping/non-stopping controls) d) the operation and receipt of emergency alarms e) facilities supporting the normal signalling system during degraded or disturbed working (see sections C10 and C11) f) signalling lockout systems for staff protection (see GK/RT0030). C3.2 Control methodology Where controls are required to be operated in a specific sequence, the necessary information shall be provided (for example lever pull plates). There shall be no ambiguity as to the position of any control. Where a controlling device has two or more discrete positions it shall not be possible for the device to remain in any other intermediate position without this being obvious to the signaller. The normal position of similar types of control devices shall be consistent throughout any installation. Where it is permissible for control of areas of control to be transferred between operators: a) an area of control shall be under the control of one signaller at any one time, although the associated indications are permitted to be displayed to several signallers b) no area of control shall be left unassigned to a signaller c) communications and other ancillary facilities for each area of control shall be made available to the controlling signaller at the relevant workstation d) emergency signal controls ( all signals on and group replacement - see GK/RT0060) shall be made available to the controlling signaller at the relevant workstation. C3.3 Route selection Where route setting is by operation of entrance and exit devices: a) main class routes shall be selected by main route entrance and exit devices b) warning class routes (where provided) shall be selected by the operation of the main route entrance and a route exit device separate to that of the associated main class route c) calling-on class routes (where provided) shall be selected by track occupancy at the time of setting, together with the operation of the main route entrance and a route exit device separate to that of the associated main class route (see GK/RT0044) d) shunt routes from main signal entrances to main signal exits (provided only exceptionally) shall be selected by the operation of a separate route entrance together with the main route exit device e) proceed-on sight (PoSA) class routes (where provided) shall be selected by the operation of a route entrance device separate to that 14 RAIL SAFETY AND STANDARDS BOARD

17 Page 15 of 24 of the associated main class route together with the main route exit device. Where route setting is by keyboard operation or menu selection, different characters or graphics shall be used for each class of route. For guidance on the layout and colours of route setting devices see GK/GN0525. Lever frames and non-route setting panels shall employ a separate control device for each class of route. C4 Signalling indications C4.1 Indication requirements The task analysis and specification of usability requirements (set out in section C1.2) shall be used to determine what indications are required on each workstation. Indications shall generally be provided to: a) monitor the response of equipment to the operation of a control by indicating the present state of the equipment (for example signal on and displaying red, points detected normal) b) indicate the state of occupancy of the line with the position and, where necessary, direction of trains c) indicate the correct operation or failure of any equipment or system which would affect the normal running of the railway. It is permissible for duplicate indication facilities to be provided where required for operating personnel other than the signaller. C4.2 Indication methodology Steady indications shall be used to indicate the state of equipment/systems; in such instances absence of the indication generally indicates failure or reduction of protection. In cases where the above principle is not followed (that is the extinction of an indication in normal operation corresponds to a clear or unrestrictive condition, for example for track sections), multiple indications shall be provided to minimise the likelihood of a failed indication being mistaken for a clear condition. It is permissible for the size and intensity of the indication and any associated text to be used to indicate importance. However, variations in intensity shall not be so great as to detract from any indication. Indications shall usually be positioned as near as possible to any associated controlling device and be suitably labelled; the positions of labels relative to the indications shall be consistent. However, it is permissible for indications associated with levers to be provided on the diagram if this cannot cause confusion. Duplication of indications is permitted where necessary (for example provision of point detection indications on a control console and on a layout diagram). Flashing indications shall be used for: a) events requiring the immediate attention of the signaller b) operation of equipment in progress c) failure alarms or indications RAIL SAFETY AND STANDARDS BOARD 15

18 Page 16 of 24 d) repeating of flashing signal aspects (on systems where all signal aspects are repeated and the technology permits). It is permissible for indications for similar functions to be combined or grouped, subject to suitable labelling. Symbols in current use for signal box diagrams associated with lever frames and for control panels are set out in the associated Guidance Note GK/GN0525. The infrastructure controller shall ensure the adoption of consistency and good practice in the disposition of VDU displays, particularly where signallers are expected to work in a number of signalling control centres. C4.3 Alarms All alarms provided within the control centre shall be considered holistically to ensure that the operator is able to respond to them with the appropriate level of priority. Particular attention shall be given to audible alarms to ensure that the operator can distinguish them. Safety critical alarm facilities shall be clearly distinguishable from other alarms and monitoring facilities. Audible indications shall be used only for safety critical failures and/or failure rectification, or where necessary to alert the signaller to take some action. Where audible indications sound continuously to draw attention to the failure and/or rectification of equipment, an acknowledgement control shall be provided to silence the alarm. It shall be necessary for the signaller to acknowledge an alarm on each occasion. A more strident alarm shall indicate greater importance. It is permitted for a short audible alarm to be used to alert the signaller to situations not requiring an immediate response. Such alerts shall not require acknowledgement. Out of sequence track section occupation and clearance alarms shall be provided where the technology permits. Where a track section out of sequence occupancy denotes a signal passed at danger (SPAD), the alarm shall be of a distinctive nature and be both audible and visual. Where a fault or failure would not otherwise be apparent, and, if not attended to, could affect the safety or normal operation of the railway, a separate indication shall be provided (for example main power supply failed with standby in use). Related alarms shall be prioritised in order of importance, lower order alarms being suppressed until higher order alarms have been dealt with. It is permissible for failure indications that do not immediately affect the operation of the railway (for example main signal first filament failure) not to be indicated to the signaller. However measures shall be in place to ensure that the failure is rectified before railway safety is compromised. Alarms normally indicated at a technician s workstation shall be diverted to the operating floor during periods that the former is unattended. C5 Ancillary equipment C5.1 Voice communication Each signaller s workstation shall be provided with communication facilities that allow calls to and from the area controlled by the signaller. This shall include signal post telephones, train radio and level crossing telephones. Additional requirements are set out in GE/RT8021. Task analysis (set out in section C1.2) and workload assessments (set out in section C1.3) shall be used to determine the provision and positioning of communications equipment. Communication systems that are used to pass safety critical messages to train drivers shall be provided with a means of preventing the signaller s speech from 16 RAIL SAFETY AND STANDARDS BOARD

19 Page 17 of 24 being heard when a call is established but the signaller s conversation is not addressed to the caller. Communication equipment shall be positioned such that the appropriate portion of the panel/display is visible to the signaller when the equipment is being used. Clear indication of which circuit is in use shall be provided. Where technically possible, consideration shall be given to displaying the identity of the caller. Lineside and signal post telephones that are in a position of limited clearance shall be identified to the signaller, both on the signal box diagram and on the communication equipment. C5.2 Text communication systems It is permissible for text systems (for example facsimile) to be provided, where required for safety or operational communication. C5.3 Clocks Clocks shall be provided that are visible to each signaller. The clocks shall show the time corresponding to a recognised national time standard that is synchronised to GMT/BST within the following tolerances: a) within one second for time signals transmitted digitally and automatically updated b) within ten seconds where the time is manually updated. Where the technology permits, clocks and other time recording equipment incorporating a time display, including train control and communications equipment and data recording equipment within a signalling control centre, shall be synchronised to a common national time standard. During a failure of the signals from the national time standard, the signalling control centre equipment shall maintain the accuracy of the time standard for internal and external time dependent systems. Where technically available, the failure and restoration of the national time signal shall be logged, as shall the complete failure of the signalling control centre clock system. C5.4 Train describers Indications of the identity or description of each train shall be provided in the form of an alphanumeric code, usually displayed in line of route on the signal box diagram. Facilities shall be provided for the signaller to interpose, step or cancel train descriptions. Where train descriptions change, it is permissible for this to be accomplished automatically. It is permissible to provide alternative methods of indicating the identity or description of a train where only a small number of trains will be supervised by a signaller at a time. C5.5 Automatic route setting It is permissible for routes to be set automatically using a strategy based on train descriptions and/or other information (for example, the timetable). Controls shall be provided for enabling and disabling automatic route setting system sub-areas and for individual trains. The sub-areas and trains for which automatic route setting systems are enabled shall be indicated to the signaller. C5.6 Other equipment Where hot axle box detectors, automatic train reporting, and general information systems are provided, it is permissible for them to be integrated into the display system to assist the signaller in the operation of the railway. RAIL SAFETY AND STANDARDS BOARD 17

20 Page 18 of 24 C6 Other information It is permissible for information that needs to be referred to only occasionally to be provided in paper or other suitable form. This information shall be logical in format and when supplied in the form of a track layout diagram, shall be in the same orientation as that of the signalling control diagram. Information in this category includes lists or diagrams of the following: a) names and locations of all level crossings b) locations and reference numbers or names of bridges under and over the railway c) locations of foot and vehicle access points d) limits of staff safety systems e) electric traction limits and sections* f) traction isolation gaps* g) route lists h) locations of lineside telephones that communicate direct with the signaller i) gradient profile. *In third and fourth rail electrified areas this information is required to be shown on the signal box diagram. See GK/GN0525. The gradient profile shall show all the running lines supervised and shall also indicate the positions of key geographical features such as adjoining signalling control centres, stations, tunnels, viaducts and junctions. The National Grid References of the above features shall, where appropriate, be given and their locations expressed in appropriate units (for example kilometres/metres, miles/yards). C7 Symbols and text The method of display and colour of controls and indications shall be consistent throughout a signalling control centre. For adjacent signalling control centres that employ common staffing (for example relief personnel), consideration shall be given to the consistency of the indications. Where consistency is not achieved, the reasons shall be documented. The identity of each function shall be shown in a logical position adjacent to its control device or symbol in accordance with the conventions set out in GK/RT0032, GI/RT7004 and GK/RT0009. This requirement is waived for signalling overviews on VDU based systems, provided that detailed diagrams are provided to display this information. All supervised lines shall be labelled with their identifying names and normal direction of running movement. The naming of lines shall be consistent with Table A of the relevant Sectional Appendix. At each boundary of the signalling control centre control area the name of the adjacent signalling control centre shall be displayed in a logical position. Ergonomic principles shall be applied to the appearance of symbols and text on diagrams and displays. In particular displayed information shall be: 18 RAIL SAFETY AND STANDARDS BOARD

21 Page 19 of 24 a) of adequate size to provide clear information and readability from the normal operating position b) readable by a signaller meeting the eyesight requirements of GO/RT3259 (Competence and Fitness Requirements for Signallers and Crossing Keepers) in all normal ambient lighting conditions It is permissible to abbreviate displayed text - for example, for a telephone circuit from a group of level crossings (see GI/RT7012) - so long as the meaning remains clear and unambiguous. Where the full text contains details that are not apparent in the displayed version, the full details shall be provided in the manner prescribed in section C6 of this document. It is permissible for the safety implications of information to be indicated by variation of the size or colour of text (See BS EN ISO 9241). C8 Functional requirements C8.1 Signals Facilities shall be provided to operate each controlled stop signal, either individually or by route setting, and to replace each stop signal (including automatic signals) to danger. When the replacement control is used, the display system shall indicate that the replacement of the signal has been effective at the signal. As a minimum, colour light controlled signals and position light signals shall be indicated as being on or off. It is permissible for indication of banner and coacting signals to be incorporated with those for the associated main signal where they are not required to be separately indicated. For VDU displays, where appropriate, signal aspect indications shall be provided exactly as displayed to the driver (this shall include flashing aspect indications). Where lamp proving (which might include TPWS proving) is required in controls of a controlled signal, it shall be included in the signal indication, or otherwise displayed. Lamp proving of automatic signals equipped with a replacement device shall be indicated when the replacement device has been operated. The provision of additional control devices to enable groups of signals to be placed or maintained at danger in emergency or loss of control of the interlocking is addressed in GK/RT0060. The boundaries of these groups shall be indicated to the signaller. Semaphore signals not visible from a signalling control centre shall be provided with indication of the arm on or off and that the lamp is alight (see GK/RT0039). Where the aspect of a signal is dependent upon a slot or release from another signalling control centre, the current status of the slot or release shall be indicated. Where the clearance of a signal is delayed by the timing of a related function that is not apparent to the signaller (for example, an automatic level crossing or trackside warning system operating sequence), a signal timing indication shall be provided. (This requirement does not apply to timed clearance of signals to enforce a reduction of speed). C8.2 Points All points operated by the signaller, including multiple point ends controlled from the same device in accordance with GI/RT7004, shall be controllable to either normal or reverse position. Where route setting is provided, the control device shall have a further position or icon to transfer control of the lie of the points to the route setting operation. RAIL SAFETY AND STANDARDS BOARD 19

22 Page 20 of 24 Proof that the points are correctly detected and in correspondence with the interlocking shall be indicated, except where the method of detection makes this impractical (for example mechanical detection). It is permissible for points to be operated locally from a ground frame/switch panel released by the signaller. Where the release is electrical the ground frame/switch panel normal and locked indication at the signalling control centre shall include any point detection relevant to the signalled movements controlled by the signalling control centre. C8.3 Level crossings The requirements for controls, indications and other equipment, including CCTV and telecommunications facilities, for the different types of level crossings are set out in GI/RT7012. C8.4 Train detection All train detection that controls the operation of signalling shall be indicated so that the signaller can clearly observe the state of each track section and the movement of trains. Track sections where train detection is by means of axle counters shall be clearly identified on the signal box diagram. Where the signaller is required to observe the position of a train relative to fixed infrastructure (for example tunnel or level crossing), additional indications shall be provided. The extent of the overlap beyond a signal shall be indicated, for example, by the extent of the route set indication. C8.5 Block systems Block instruments, associated train description equipment and voice communication equipment shall be clearly identified and positioned in relation to the lines to which they refer. The requirements for controls and indications for block systems are set out in GK/RT0041, GK/RT0042 and GK/RT0051. C8.6 Other facilities Controls and indications for any other facilities identified in the task analysis and usability requirements specification (set out in section C1.2) shall be designed following ergonomic principles. Reminder appliances (for example lever collars, button and switch covers or their electronic equivalent) shall be provided for the signaller to use as a reminder that a control device is not to be used under certain circumstances (see sections C10 and C11). C9 Performance requirements C9.1 Reliability The reliability of the signalling control system, excluding the interlocking, shall be designed to be no worse than one catastrophic failure in 5x10 4 hours. C9.2 Safety integrity level The infrastructure controller shall determine the safety integrity level (SIL) of each installation. This shall be based on the extent to which the safety criticality of the interlocking is integrated with and dependant upon operation of the control system. The safety integrity level of systems controlling the operation of safety critical signalling equipment, excluding the interlocking, shall not be less than SIL1. C9.3 Maintainability Facilities shall be provided to enable routine maintenance on items of control equipment to be undertaken whilst the control system remains functional and with a minimum of disturbance to the signaller. 20 RAIL SAFETY AND STANDARDS BOARD

23 Page 21 of 24 C9.4 Resilience to human error The system shall be designed to minimise the effects of errors by the signaller in the operation of the control equipment. C10 Degraded signalling Task analysis (set out in section C1.2) and work load assessment (set out in section C1.3) shall be undertaken to identify failure scenarios when additional facilities are required to enable safe movement of traffic to be maintained during failure of signalling or communication equipment. According to the technology in use, it is permissible for such facilities to include (but not be limited to): a) provision of proceed on sight aspects (PoSA) on appropriate signals (see GE/RT8071) b) ability of the signaller to override track circuit locking to allow points to be moved or route locking to be released (see GE/RT8071) c) ability of the signaller to restore axle counter train detection sections to operation (see GK/RT0217) d) duplicated data transmission systems for remote interlockings e) override facilities to allow nominated routes to work automatically at remote interlockings (see SSP50) f) diverse and/or uninterruptible power supplies g) backup communication facilities h) provision of local control panels at remote interlockings i) use of printed layout diagrams and labels (see section C2.3). C11 Control of a disturbed railway Facilities shall be provided to enable traffic to be protected or its safe movement ensured during the time that operation of the railway is subject to disturbance. The circumstances that shall be catered for include, but are not limited to: a) defect in track or structures b) line possessions for engineering works or infrastructure maintenance c) train failure d) attendance by emergency services. Provision shall be made for the signaller to arrange: i) blockage of the line(s) ii) iii) electrical isolation of traction supply disconnection of signalling equipment iv) cautioning of trains v) imposition of emergency speed restriction(s) vi) examination of line. RAIL SAFETY AND STANDARDS BOARD 21