Electronic File Location. CCMS ref: Version History

Transcription

1

2 Electronic File Location CCMS ref: Version History Issue Date Comments /03/16 First Issue /08/16 Update for SRSG /08/16 Update from SRSG /09/16 Update for SRSG /09/16 Explanation of Generic product added and release for ESB / OSG review /02/17 Update from ESB / OSG comments and Technical Author review note some comments remain to be addressed. DOORS update version /03/17 Final comments close-out /03/17 Formal issue Disclaimer Network Rail has used its best endeavours to ensure that the content, layout and text of this document are accurate, complete and suitable for its stated purpose. It makes no warranties, expressed or implied, that compliance with the contents of this document shall be sufficient to ensure safe systems of work or operation. Network Rail will not be liable to pay compensation in respect of the content or subsequent use of this document for any purpose other than its stated purpose or for any purpose other than that for which it was prepared except where it can be shown to have acted in bad faith or there has been wilful default. NETWORK RAIL Page 2 of 96

3 Contents 1 INTRODUCTION Purpose of this Document Scope Context Abbreviations Requirements: Form, Applicability and Identification Requirement Functionality Basic Requirement Form Safety Requirement Provisional Requirements Unique ETCS Trackside Requirement-Identifier (ETrckSS-Identifier) Normative / Application-Specific / Preferred / Generic Product status Topics Requirements Assurance Requirements Change Areas for Development REQUIREMENTS Scheme Design Requirements Movement Authority, Modes & Levels Appropriate Supervision Level Movement Authorities Full Supervision Movement Authorities Start of Mission Degraded Starts Routing Information Speed Restrictions Possessions Shunting Occupied Sections Level Crossings NETWORK RAIL Page 3 of 96

4 2.3 Degraded and Emergency Signs and Indicators Other Systems Class B Systems Traction Switching Onboard Data Safety Security Workload/People/Training Driver Interface Whole Life Management Life Cycle Management Reliability, Availability & Maintainability (RAM) Maintenance Diagnostics Implementation Requirements Transitions Implementation and Migration Future Enhancements Design Rules Requirements for the Control Layer APPENDIX A: ABBREVIATIONS APPENDIX B: LIST OF REFERENCES APPENDIX C: TOPICS LOOKUP TABLE APPENDIX D: AREAS FOR DEVELOPMENT NETWORK RAIL Page 4 of 96

5 1 INTRODUCTION 1.1 Purpose of this Document This document provides a specification that is intended to promote effective implementation of the ETCS. It is applicable to both retrofit and new-build installations and provides requirements that are optimised for operation on the GB rail network. As stated in the industry-agreed and issued National ETCS Requirements Management Strategy [RD1] and Plan [RD2], the document provides the requirements which have been developed as part of a suite of ETCS requirements covering all elements required to optimise performance and operation of an ETCS railway. The document can be utilised as a standalone specification for the Trackside aspect of the ETCS; further details of the parent requirements that drive the development of this specification are included within the System Requirements Specification [RD3] and the other Sub-system Requirements (Telecoms, Onboard (Retrofit and New Trains), and Operations [RD4], [RD5], [RD6] & [RD7]). This Specification for the ETCS Trackside sub-system has been written to complement the Command, Control and Signalling Technical Specification for Interoperability (CCS TSI) and European Union Agency for Railways (known as The Agency ) specifications for Baseline 3 ETCS 1 [RD8] & [RD9]. Every effort has been made to avoid conflict with the CCS TSI and Baseline 3 specification but, in case of conflict, the CCS TSI (including the UK specific cases) and Baseline 3 specification take precedence. Nothing in this document obviates any legal requirement to which any of the parties must comply. The document is set out in the form of standard requirements with the ETCS Trackside Requirement (ETrckSS) identifier, followed by rationale and guidance notes, where appropriate. 1.2 Scope This document consists of requirements which describe the functionality and application of the ETCS Trackside sub-system optimised for application on the GB rail network at all required levels of operation. These requirements are not expected to prevent the ETCS operating in conjunction with an Automatic Train Operation (ATO) system. Requirements will be added at a later date once the European specification for adding ATO to an ETCS sub-system has been finalised. Projects are encouraged to seek advice from the ERTMS Systems Body (ESB) if there is a wish to facilitate early introduction of ATO. These requirements are not expected to prevent the ETCS operating in conjunction with a Traffic Management (TM) system. No specific TM requirements have been identified for inclusion to date. Specific requirements and domain knowledge for a particular application are not included within this document and will need to be defined by the Contracting Entity or their appointed Agent. Nothing in this document obviates any legal requirement with which any of the parties must comply. Furthermore, it does not preclude operation of a TSI-compliant vehicle on the GB rail 1 Note: This suite of requirements has been written to meet Baseline 3 Release 2, although the ETCS DOORS requirements database has the capability of producing a suite of requirements to meet Baseline 3 Maintenance Release 1. Should a suite of Baseline 3 Maintenance Release 1 requirements be needed, or if any background information be required to any specific requirement then an with specifics should be sent to: nationalertmsrequirements@networkrail.co.uk NETWORK RAIL Page 5 of 96

6 network, or a vehicle compliant to this specification operating on TSI-compliant infrastructure outside the GB rail network. 1.3 Context This document has been developed from a number of sources. Input from the ETCS programme, ETCS suppliers, and the wider rail industry has been used to develop the requirements. A series of workshops and industry consultations have identified new requirements. Guidance has been added to justify changes. Requirements amended and deleted through this development process have been captured within the requirements database, along with justification for their amendment or removal. 1.4 Abbreviations Abbreviations are explained in full where used in Requirements. A fuller explanation of Terms and Abbreviations can be found in Appendix A: and the ERTMS Glossary [RD10]. 1.5 Requirements: Form, Applicability and Identification Requirement Functionality Requirements may be functional or non-functional: Functional Requirements - Technical details that define what a system needs to accomplish, i.e. how the suppliers equipment will be applied, what it needs to do, and what processes, procedures and rules need to be in place to achieve it. Non-Functional Requirements - Constraints on the design or implementation, such as performance, security, competence, training, and reliability requirements. Functional requirements have largely been derived through the Reference Design generation process [RD11], whereas non-functional requirements have mostly been derived from the Cambrian Requirements suite and supplemented by workshop input [RD12] Basic Requirement Form All requirements are in the following form: Safety Requirement text. Unique ETrckSS-Identifier Status: Normative/Application-Specific/Preferred/Generic. (See Section below). Rationale: Shows applicability of the requirement. Guidance: Supplementary information to support Requirement interpretation and satisfaction. Topics: Reference Design Topics (if applicable). (See Section below) Safety Requirement Where a requirement has been associated with a Safety Measure, this is identified Provisional Requirements A requirement that has been derived from a Reference Design Topic that has not been issued as a Release Version or where there is still Industry discussion required, this is identified. NETWORK RAIL Page 6 of 96

7 1.5.5 Unique ETCS Trackside Requirement-Identifier (ETrckSS-Identifier) Each requirement has been identified uniquely. The requirement numbers have been generated automatically within the DOORS database, which means that the requirement numbering may be neither sequential nor gap-free Normative / Application-Specific / Preferred / Generic Product status Each requirement within this document is identified as one of: normative, preferred, or application-specific. These are defined as follows: Normative o Necessary to achieve compatibility or optimisation of the system in relation to the GB rail network, or o A system feature that is deemed to be cost-effective and universally beneficial. Satisfaction of normative requirements in compliance with this document is expected to be a requirement of individual delivery contracts. Application-Specific o A requirement which may not be relevant or applicable to every implementation of the ETCS. It is expected that, where a requirement is applicable, it will be applied. Satisfaction of application-specific requirements in compliance with this document is expected to be a requirement of individual delivery contracts, as appropriate to the implementation being considered. Preferred o A requirement of lower importance which, whilst not essential, the industry would prefer were satisfied. It is expected that, where a requirement is applicable, it will be applied. Satisfaction of preferred requirements in compliance with this document is not expected to be a requirement of individual delivery contracts unless explicitly specified within the relevant contract. Generic Product o o A feature required to enable all the Reference Design topics to be satisfied, Necessary to minimise future development of the product for other projects Topics Satisfaction of preferred requirements in compliance with this document is not expected to be a requirement of individual delivery contracts unless explicitly specified within the relevant contract. Where applicable, the Reference Design Topic has been identified, as detailed in the Topics Lookup Table in Appendix C:. The Topic has been broken down, where applicable, into Options and Variants e.g. Topic N1-2 refers to Topic N, Option 1, Variant 2. Where the Reference Design Topic has not yet achieved Release Version status, the requirements are marked (Provisional). NETWORK RAIL Page 7 of 96

8 1.6 Requirements Assurance Requirements assurance has been explained in the ETCS Requirements Assurance Statement [RD13]. 1.7 Requirements Change The ETCS Requirements Change Control Process [RD14] will be used to raise Change Requests (CRs) to amend existing requirements or add new requirements. 1.8 Areas for Development Noting that this document represents the best understanding of the needs of GB s rail network at the time of publishing, it is recognised that there are a number of areas where the document may be deficient. New deficiencies may be identified as understanding of the ETCS develops, as well as areas being closed out through further work being undertaken. The current known areas of deficiency are listed in Appendix D: 2 REQUIREMENTS 2.1 Scheme Design Requirements This section contains specific requirements relating to the scheme design for individual routes. Safety ETCS National Values transmitted by the Trackside shall be in accordance with the published ERTMS/ETCS National Values document [RD15] unless a specific risk assessment has been undertaken in accordance with GE/RT8408 [RD16]. ETrckSS-915 Rationale: The Reference Design and underpinning safety analysis and arguments are based on the published NV. Any changes to those values will require a full safety impact analysis. Safety requirements for hazards A4-H005, A4-H006, A4-H007a, A4-H007b, A4-H008, A4-H010, A4-H011, A4-H013a, A4-H013a, A4-H013b, A4- H014a, A4-H014b, A4-H015a, A4-H015b, A4-H017a, A4-H017b, AA-H010, AA- H011, B-H009, B-H014, B-H015, E-H014, G1.3-H011, G1.3-H044, H-012b, H- H017, I1-H012, I1-H013, I1-H015, J2-H009, J2-H010, J2-H014, J2-H015, J3- H018, J3-H019a, J3-H019b, L1-H011, L2-H019, LL-H003, N-H001, N-H012a, N- H034, N-H049, N-H052a, O1-H025b, O1-H025a, P-H003, P-H004, P-H005, P- H006, P-H007, P-H009, S5-H001, S5-H003, T-H037, T-H038, Z2-H008 and Z2- H009b. Guidance: The version of the ERTMS/ETCS National Values document to be used, or details of the document defining an alternative set of National Values, will be specified in the contract. Topics: A4, B, E1, G2, G3-1, G4-1, G4-2, G4-3, H1, I, J2, J3, K1, K2, L1, L2, N1-1, N1-2, N2-1, N2-2, O1, P1, R3, S5-1, T1, Z2, KK, LL The RBC-RBC handover border shall be situated as close as possible to the Interlocking- Interlocking border, or at the same location as the Interlocking-Interlocking border. ETrckSS-352 Status: Application-Specific Rationale: To simplify the data exchange between adjacent interlockings. Guidance: In areas where a single Interlocking sub-system can be used by both RBCs, then the RBC-RBC border will be independent of any Interlocking (IXL)-IXL border. Siting the RBC-RBC handover border in close proximity to, or at, the IXL border is NETWORK RAIL Page 8 of 96

9 Topics: then applicable in every situation. Topic R does not permit the border to be situated within the limits of a station. R1 The release of a route by the interlocking shall only be permitted once the RBC has confirmed that no Movement Authority into the route is held by a train. ETrckSS-237 Rationale: This prevents any unsafe movement and is an additional safeguard to current sectional route locking. Guidance: A method for releasing the route in degraded modes must also be provided. Topics: L1, L2 The location where a driver must manually select Level NTC to exit from a Level 2 operated line shall be situated at a lineside signal. ETrckSS-322 Rationale: The driver will be manually changing to Level NTC at the exit point signal; the authority to proceed onto the Level NTC line after the level change must, therefore, normally be provided by a lineside signal aspect. Topics: O1 Safety The signal authorising movements over the transition border to a Level 2-only area shall only clear when receipt of the Movement Authority (MA) has been acknowledged by an approaching train. ETrckSS-292 Rationale: To minimise the risk of a train being signalled into the Level 2-only area without an MA. Safety requirement for hazards N-H028, N-H033, N-H034, N-H047a, N- H047b Guidance: Conditions for clearing include: a) the appropriate route into the Level 2-only area being set; b) conventional interlocking (IXL) conditions for the relevant signal to clear being met; c) the approaching train being in communication with the RBC; and d) being driven by a driver authorised to operate in Level 2. Topics: N2-1 A train in Level NTC SH shall be authorised to enter an ETCS area by an appropriate signal aspect and route indication. ETrckSS-282 Rationale: The driver requires the information on the movement to be provided since this is not available on the Driver Machine Interface (DMI). See System Requirements Open Point 4 regarding Level NTC SH. Topics: B, N1-2 NETWORK RAIL Page 9 of 96

10 A balise group containing a Conditional Level Transition Order shall be provided at, or as soon as possible beyond, the signal at the exit point from a Level 2 operated line onto a Level NTC operated line where a manual transition to Level NTC is required. ETrckSS-326 Rationale: To update the level information on trains that have exited in Sleeping (SL), Shunting (SH) or Non Leading (NL) modes, and to force transition to Level NTC on trains that incorrectly enter the Level NTC area in Staff Responsible (SR). Guidance: The Conditional Level Transition Order (CLTO) should include Level NTC, NID_NTC=20 (Level TPWS) and, where required, Level NTC, NID_NTC=21 (Level TPWS FIXED). Where Level NTC, NID_NTC=21 is included, Level NTC, NID_NTC=20 must have the higher priority to avoid trains in Level 2 being forced to transition to Level NTC, NID_NTC=21. Topics: O1 Where a TPWS Train Speed Sensor (TSS) loop is required at a signal located at the boundary from a Level 2 area into a Level NTC area and manual transition is required, a balise group containing a 'Stop if in SR' packet shall be provided at the signal. ETrckSS-325 Rationale: To provide a similar level of protection to the TPWS TSS loop for trains that pass the signal at danger in Staff Responsible. Guidance: The requirements for TPWS TSS loops are defined in conventional signalling application design rules. Topics: O1 The Movement Authority authorising a move up to a buffer stop shall define the End of Authority to be the buffer stop location. Rationale: This defines the desired stopping location for display to the driver. Topics: E1 ETrckSS-69 Where a train is operationally required to approach within 40m of an EOA, a release speed shall be provided. Status: Application-Specific Rationale: To draw the train up closely to the EOA where the supervision curves may become restrictive. Guidance: In certain circumstances the distance may need to be greater. Topics: E3 ETrckSS-77 A Danger Point with associated release speed not exceeding 15km/h shall be defined at the buffer stop. ETrckSS-67 Rationale: Trains need to approach the buffer stop to reach the required stopping position with a release speed appropriate to the location and retardation capabilities of the buffer stop. A speed of 15km/h is consistent with current TPWS design rules. Guidance: Subset 026 allows the distance to the Danger Point from the EOA to be 0m and, hence, the Supervised Location to be at the buffer stop. Subset-026 also allows a NETWORK RAIL Page 10 of 96

11 Topics: trackside defined release speed to be associated with the Danger Point. E1 A balise group containing the valid levels for movements outside the ETCS area shall be placed at the transition border. Rationale: Subset 026 requires transitions to be marked by balise. Guidance: A number of levels (e.g. TPWS/AWS, NT-TPWS and Level 0) may be valid outside the ETCS area. Topics: O2-1, O2-2, O3 ETrckSS-339 Where there is a requirement for running in both directions across an RBC-RBC handover border, one Border Balise Group shall be used for both directions. ETrckSS-351 Rationale: To reduce the whole life cost by using only a single balise group that acts as the border balise group for trains travelling in either direction on the line in question, rather than providing separate border balise groups for each direction of travel. Topics: R1 Balise groups necessary for network registration and establishing a communication session with the RBC shall be positioned on the approach to the level transition such that a train can normally transition without braking. ETrckSS-287 Rationale: To minimise the impact on performance. Guidance: The position should take into account the time required for network registration and communication session establishment, as well as the time required for the entry signal to be cleared and to display the appropriate proceed aspect. All this must be achievable before the driver of the approaching train sights, and begins reacting to, the first restrictive aspect associated with the signal authorising movements over the transition border at danger, assuming there are no other trains in the transition area. Topics: N2-1, N2-2 The balise group including the Conditional Level Transition Order shall be located such that the on-board AWS and TPWS are unsuppressed prior to the first location on the Level NTC line at which their use may be required. ETrckSS-716 Rationale: To ensure that, where a transition to Level NTC has been forced on trains that incorrectly enter the Level NTC area in Staff Responsible (SR), the on-board AWS/TPWS are operational when required. Guidance: The Conditional Level Transition Order should include Level NTC, NID_NTC=20 (Level TPWS) and, where required, Level NTC, NID_NTC=21 (Level TPWS FIXED). Where Level NTC, NID_NTC=21 is included, Level NTC, NID_NTC=20 must have the higher priority to avoid trains in Level 2 being forced to transition to Level NTC, NID_NTC=21. Topics: O1, O2-1, O2-2, O3 NETWORK RAIL Page 11 of 96

12 If Packet 44 functionality is required in an ETCS area, it shall be included in balises required for ETCS functions, where practicable. ETrckSS-52 Status: Application-Specific Rationale: To reduce whole life costs by minimising the deployment of balises. Guidance: Where it is not possible to utilise existing balises without impacting on Packet 44 functionality, this should be highlighted. Topics: CC1 Where a balise with a 'Stop if in SR' message is provided associated with an ETCS Stop Marker, it shall be positioned no more than 5m beyond the marker. ETrckSS-25 Rationale: The override effectiveness distance (National Value) assumes that the driver will operate the control within 50m of the marker and allows a 10m margin. Additionally, the effectiveness of the balise message to stop an errant train in ETCS would be reduced. Topics: U6, AA1 All permanent balise groups shall be marked as linked. Rationale: This is the GB national policy to enable balises to be used to correct the confidence interval. Guidance: This includes balise groups containing Packet 44. Topics: II The Trackside sub-system shall be programmed with linking reaction 'No reaction'. ETrckSS-172 ETrckSS-173 Rationale: GB policy is to use 'No Reaction' for Level 2 application in order to maintain the level of performance of the rail network. Guidance: The Trackside sub-system will normally be the RBC, but could be the balise group for Level 1 launch. Subset-026 Section requires the Trackside to select a suitable linking reaction for its application: No Reaction, Service Brake, or Trip. Topics: II The distance between consecutive balise groups shall be optimised for performance and confidence interval correction. ETrckSS-175 Status: Application-Specific Rationale: To provide an appropriate confidence level and increase performance levels consistent with the demands of the application. Guidance: On low capacity lines, where level of performance is lower than on high capacity lines, this requirement can be altered to suit the application. Topics: II NETWORK RAIL Page 12 of 96

13 Where it is possible that a train that is not going to enter the Level 2 only area may pass over balise groups provided to establish a communication session with the RBC, further balises shall be positioned to order termination of a session for that train. Status: Application-Specific Rationale: To avoid unnecessary use of RBC capacity. Guidance: This covers divergent routes. Topics: N2-1, N2-2 Safety ETrckSS-288 In an overlay area, the Trackside sub-system design shall ensure that the start event for the display of a routing text message is no later than when the driver would become aware of the route set if they were observing the lineside signals. ETrckSS-406 Status: Application-Specific Rationale: To avoid confusion between the information provided on the DMI and what the driver may observe by looking at the lineside signals. Safety requirement addressing hazards V-H041 and V-H044. Topics: V2 The Trackside sub-system design shall enable routing text messages to be displayed when the train is within the site-specific approach area and the relevant route has been set. ETrckSS-405 Rationale: This is to avoid messages being displayed too early and causing confusion or being forgotten, whilst providing the driver, in ideal circumstances, with sufficient time to recover the situation if an incorrect route has been set. Guidance: The start event should be selected so as to enable the train to be brought to a stand before the route setting point protecting the critical divergence if the driver considers that an inappropriate route has been set. Unless the supplier can demonstrate a robust alternative methodology, this will be achieved by the use of the braking data in GK/RT0075 [RD17]. This approach is proposed because all trains which are either TSI compliant or a legacy GB train will stop within the distance. (Note: GK/RT0075 stopping distances include a margin over the required performance of trains detailed in GM/RT2045 [RD19], which are equivalent to the required distances in the Rolling Stock TSI (RST TSI) [RD20]). Each potential approach to the critical divergence should be assessed and specified separately. Topics: V1, V2 The transition announcement shall be displayed when a route is set out of the ETCS area and the train is within a site-specific distance of the border. ETrckSS-340 Rationale: Advance notice of the transition allows a driver time to prepare for the transition. Guidance: The location at which the announcement is displayed (dependent on when the Level Transition Announcement message is received) must provide sufficient time for the driver to prepare mentally to apply the rules applicable to the Level NTC area but should not be so early as to distract the driver from the needs of the driving task within the ETCS area (for example, dealing with infrastructure features such as neutral sections or locally-monitored crossings). NETWORK RAIL Page 13 of 96

14 Topics: O2-1, O2-2 The ETCS Trackside shall be configured to send the track condition 'change of traction system' packet on the approach to traction changeover locations. ETrckSS-251 Rationale: To allow for the display of the traction changeover location on the ETCS DMI. Topics: M2 Safety Track condition information 'powerless section with main power switch to be switched off' shall be transmitted to a train a minimum distance of 'x' seconds driving time at the maximum applicable Static Speed Profile from the start of a neutral section. ETrckSS-244 Status: Application-Specific Rationale: To ensure that indications on the ETCS DMI are available at a suitable distance before the neutral section is reached. Safety requirement for hazard M1-H001. Guidance: This requirement is applicable to Level 1 and Level 2 implementations where track condition information is to be provided via balise and RBC, respectively. The time 'x' is the greater of the maximum time required, for any train that can operate on the line, for traction demand to be cut and the vehicle in-feed circuit breaker/s to be opened, and 11 seconds. The minimum value of 11s ensures compliance with the rule in Subset 040, section Topics: M1 (Provisional) When entering an area where a speed unit override command is required or no longer applies, the Trackside sub-system shall send the relevant Packet 44 message at the boundary. ETrckSS-429 Rationale: The displayed units must match the requirements of the location. Guidance: This may be achieved using balises containing a Packet 44 message regarding the units to be displayed that are placed where trains enter the area and at the exit to maintenance depots. Topics: Z1-2 The Trackside shall send National Values (NVs) where the X component of the ETCS System Version changes. ETrckSS-228 Rationale: To cope with potential unavailability of the correct NV and allow the Onboard in SL to store the correct NV. Guidance: System Versions will be identified as X.Y in accordance with Subset 026. For example, the list of available National Values is different between Baseline 2.3.0d and Baseline 3. Topics: KK The length of the acknowledgement window in the Full Supervision (FS) to On Sight (OS) mode profile shall be specified on a site-by-site basis. Status: Generic Product ETrckSS-157 NETWORK RAIL Page 14 of 96

15 Rationale: To avoid distracting the driver during a critical time in the permissive working manoeuvre. Guidance: The process for determining the length of the acknowledgement window needs to take into account the need for the driver to have sufficient time to observe and react to the presence of an obstruction on the line ahead, and control the train to a stand clear of the obstruction, after acknowledging the transition. Topics: H1, H2, I, U2, JJ5 Track condition parameters shall define the start and end location of the neutral section as the position of the Automatic Power Control (APC) magnets for opening and closing vehicle infeed circuit breakers (ICBs). ETrckSS-245 Status: Application-Specific Rationale: The driver needs to be aware of the location of the APC magnets as that is the actual location at which the trackside influences the train. Topics: M1 The scheme design shall enable the required train performance taking into account the interaction between GSM-R boundaries and RBC-RBC boundaries. ETrckSS-350 Rationale: The RBC-RBC handover border should not coincide with GSM-R cell boundaries. Train performance should be optimised taking into account both handovers. Guidance: To avoid undesirable GSM-R behaviour that can impact on train to track communication during RBC-RBC handover. Topics: R1 At high density traffic stations, there shall be no RBC-RBC handover boundary within the station limits. ETrckSS-797 Rationale: To avoid excessive usage of radio capacity due to the higher number of radio sessions in stations. Guidance: A high density traffic station is one at which trains routinely start and end their journeys or where platforms are regularly occupied by more than one train simultaneously. Such stations would typically have in excess of four platforms. Topics: R1 Where a traction changeover location is beyond the divergent junction, the ETCS shall be configured to announce the changeover based on the set route. ETrckSS-256 Rationale: In close proximity to junctions, there may be a change in traction for one or more routes. The system needs to be configured so that the changeover is initiated appropriately to the actual route. Topics: M2 NETWORK RAIL Page 15 of 96

16 The scheme design shall consider the risk of vehicles occupying the line of route between the point at which the train receives a starting Movement Authority (MA), and the route entrance ahead. ETrckSS-136 Rationale: To determine the appropriate mode profile for the initial MA to be issued to the train as it is possible that, on starting, a vehicle could be standing between the train and the route entrance. Guidance: It is possible that a train will have stopped in a location within track detection section that could be occupied by another vehicle before the preceding End of Mission. Topics: G1-1, G1-2 A risk assessment shall be undertaken to determine where 'Stop if in SR' (SiiSR) packets are to be transmitted. Status: Application-Specific Rationale: To protect critical assets and mitigate collision risks from unauthorised SR movements. Topics: G3-1, U6 An assessment shall be undertaken to determine when Packet 145 must be used. ETrckSS-720 ETrckSS-174 Status: Application-Specific Rationale: To avoid application of the service brake when the train moves. Guidance: Packet 145 can be used to inhibit the detection of consistency errors in balise messages. A number of scenarios describing instances where Packet 145 may be required are included in Topic II design guidance. Topics: II A risk assessment shall be undertaken to determine where 'Danger for Shunting Information' packets are to be transmitted. ETrckSS-368 Status: Application-Specific Rationale: Shunt moves must be limited to prevent impact on critical assets or conflicting train movements. Guidance: This is particularly relevant in frequently used shunting areas. A balance needs to be struck between preventing trains from travelling too far and the operational flexibility required for shunting movements. Topics: G4-1 The scheme design shall take account of track topography and risks from environmental conditions when determining the location of all End of Authority (EOAs). Rationale: To support driveability. Guidance: Topography includes: gradients, tunnels, etc. Risks from environmental conditions include low adhesion as a result of leaf fall or ice, for example. Topics: E2 ETrckSS-74 NETWORK RAIL Page 16 of 96

17 For a running transition from Level 2 to Level NTC, the ETCS Trackside shall be configured such that the transition acknowledgement request is only presented to the driver if the train is both authorised to cross the border and at a site-specific distance from the border. ETrckSS-341 Rationale: To avoid asking the driver to undertake a task when they might be distracted. Guidance: The acknowledgement window needs to be designed to take account of other driving tasks and distractions. The site-specific distance will be decided on a siteby-site basis. Topics: O2-1, O2-2 The scheme design shall align to professional driving policies. ETrckSS-848 Rationale: To ensure that the scheme design is operationally effective. Guidance: Professional driving policies may vary from one Train Operating Company to another. Topics: None Wherever possible, ground frames shall be eliminated from application scheme design. ETrckSS-1013 Status: Preferred Rationale: To realise the safety benefit of a fully interlocked route. There is a performance and safety benefit from not needing ground frame operators. This adheres to the business requirement to avoid perpetuation of historic constraints. Topics: None Scheme Design shall make provision for the analysis and assessment required to position "Stop if in SR" balises. Rationale: To control movements made in SR. Topics: G3-1, U6, AA1 ETrckSS Movement Authority, Modes & Levels This section contains specific requirements relating to the GB operational basis for mode and level selection. (Provisional) The Trackside design shall provide overrun protection at the boundaries of depots operating in ETCS L-NTC. ETrckSS-344 Status: Application-Specific Rationale: To prevent trains operating in levels or modes for which Danger in SH may not be effective reaching the running lines. This requirement perpetuates current practices. Topics: P1, P2 NETWORK RAIL Page 17 of 96

18 Safety The system shall require automatic crossings capable of reporting their status to be able to operate correctly prior to the issue of a Full Supervision (FS) Movement Authority. ETrckSS-917 Rationale: To prevent trains travelling over a failed level crossing in FS. Safety requirement for hazard JJ-H022. Topics: JJ2, JJ6 (Provisional) The Trackside design shall allow automatic mode transitions requested by the driver when the RBC is able to relate the train s current position report to the Level 2 depot area. ETrckSS-348 Rationale: To minimise the workload of the signaller. Guidance In depot areas there may be multiple train movements taking place and cabs being opened and closed frequently. If the signaller were required, personally, to authorise all mode transitions resulting from this activity, it would become a distraction from managing train movements on the running line which have a higher criticality. Topics: P3 When authorised by the signaller, the ETCS Trackside sub-system shall be able to issue a Movement Authority with an OS mode profile for a single movement where other controls prevent the issue of the FS Movement Authority in degraded situations or where the route is marked as obstructed. ETrckSS-1025 Rationale: To enable a train to be maintained in the highest available level of supervision during infrastructure failures or when the route has been marked as obstructed by the signaller (for example, to protect a tunnel, viaduct or level crossing). Guidance: This is a requirement on the ETCS system that emanates from the need for the signaller's control system to be able to make the request. Topics: G2, U2, JJ Appropriate Supervision Level The Trackside equipment shall be able to send a Movement Authority to the Onboard so that the operating mode can step up from SR to either OS or FS. Rationale: To allow train movements under the highest level of supervision available. Guidance: The step up should occur as soon as the reasons for preventing the higher supervision state have been resolved. Topics: A2-1, A2-2 ETrckSS-20 The Trackside design shall avoid the need for the use of SR to depart sidings and depots. ETrckSS-898 Rationale: To ensure that facilities for movements to depart depots, sidings and yards under the highest level of supervision are considered within scheme design and that SR NETWORK RAIL Page 18 of 96

19 is a degraded mode option. Topics: N1-1 The RBC shall issue a mode profile including a transition from FS to OS at any pre-defined location, as required. ETrckSS-156 Rationale: To reduce the length of route that the train is required to travel in OS. Guidance: This would normally be on the approach to the first occupied section for permissive working. It is not desirable for an acknowledgement to be requested of the driver when they also need to be looking out of the window. Topics: H1, H2, I The RBC shall be able to send a Track Ahead Free (TAF) request including the request window when the requirements for an FS Movement Authority for the forward route have been satisfied. ETrckSS-137 Rationale: To allow TAF to be offered if the RBC cannot be certain that there is no obstruction before the route entrance. Guidance: It is appropriate to provide this functionality when the train is within a specified distance/range of distances from the route origin determined on a site-by-site basis. Topics: A2-2, G1-2 The RBC shall be able to update the Movement Authority from On Sight (OS) to Full Supervision (FS) when the driver has acknowledged the Track Ahead Free (TAF) request. ETrckSS-21 Rationale: This allows the train to pass a train detection boundary and the associated Stop marker. Topics: A2-2, G2 When a Track Ahead Free (TAF) acknowledgement is received from a train, a Full Supervision (FS) Movement Authority (MA) shall be issued (subject to other FS MA conditions being satisfied). Rationale: To facilitate prompt entry into FS. Topics: A2-2, G1-2 ETrckSS-718 The extent of the area over which the use of OS is imposed shall be reduced to the minimum technically practicable. ETrckSS-1015 Rationale: OS imposes a ceiling speed and has, therefore, a performance impact that must be reduced where possible. Guidance: This applies in situations such as bridge bash, level crossing, etc. Topics: A1-2, G2, U2 NETWORK RAIL Page 19 of 96

20 2.2.2 Movement Authorities A Movement Authority (MA) shall require the route to be set and locked exclusively from the front of the train to the end of the MA or the boundary of the controlled infrastructure. ETrckSS-382 Rationale: The driver is not required to check that the route is set. Guidance: An MA represents the distance that a train is authorised to move (to the End of Authority EOA). It may include a section beyond the EOA up to a Danger Point (DP) and / or an Overlap. Topics: A1-1, A1-2, S5-2, S5-3, U1 The issue of an On Sight (OS) Movement Authority shall require the wheeled path to be set, locked and proven from the front of the train to the End of Authority. Rationale: The driver is not required to check the status of movable infrastructure. Guidance: The driver still has to check the line ahead is clear and not obstructed. Topics: A1-2, S5-2, S5-3, U2 ETrckSS-390 The issue of a Reversing (RV) Movement Authority shall require the wheeled path to be set, locked and detected from the active cab for a distance in excess of the authorised reversing distance. ETrckSS-398 Rationale: The potential extent of the Reversing (RV) movement, allowing for any train position confidence, must be kept clear. Guidance: RV authorisation includes a maximum distance that the train may travel. The reserved area should reflect this distance, plus the length of the train, and allow for a potential overrun. Topics: U4 Where the Movement Authority (MA) includes an overlap with alternative positions, the MA shall not change when the overlap is swung. ETrckSS-385 Rationale: A change to the MA can affect ETCS supervision, leading to interventions. Guidance: The length of the MA (extent of overlap) should be set to the shortest physical overlap available. The gradient within the overlap should be set to the worst case of the physical overlap's maximum falling or minimum rising. The speed within the overlap should be set to no higher than the most restrictive speeds of the physical overlaps available. Topics: A1-1, A1-2, U1 The length of a Movement Authority (MA) transmitted to the train shall not extend over more block sections than required. ETrckSS-6 Rationale: The MA should not be so excessive that it locks up infrastructure unnecessarily. Guidance: There is a risk that, if the MA is too short, the driver will brake unnecessarily in anticipation of an EOA, so a balance needs to be struck. The MA may need to be NETWORK RAIL Page 20 of 96

21 longer if there is a need for the MA update request from the train to trigger a level crossing, etc. Topics: A1-1, A2-1, A2-2 In overlay areas, approach release controls for a lineside signal shall not apply where a Movement Authority has been issued to an EOA at the signal. ETrckSS-160 Rationale: Approach release functionality is replaced by speed supervision on trains operating in Level 2. Guidance: This applies to a signal with approach release controls. Consideration needs to be given to requiring the Onboard to acknowledge Movement Authorities. Topics: H1, H2, I The RBC shall send updated Movement Authorities before the driver anticipates the need to brake or cut the traction power, subject to the route(s) being set and proved. Rationale: To avoid the train slowing unnecessarily. Topics: A1-1 ETrckSS-710 The RBC shall send appropriate Movement Authority (MA) request parameters, based on the End of Authority, with all MAs. ETrckSS-711 Rationale: The MA request is used to provide the train with sufficient movement authority to avoid the driver reducing speed; it may also be used to trigger a level crossing or other sub-system. The parameters need to reflect the EOA and need to be reset after being extended for a level crossing or suchlike. Guidance: The time offset must allow for: the system reaction time (typically, 5 seconds, but supplier dependent); any activities that the system will undertake on receiving the update request (e.g. triggering non ETCS systems such as level crossings or route setting); and an updated MA to be received before the driver considers it necessary to start reacting to the approaching EOA. The train needs to be instructed when to request an MA update on approach to the EOA. The time offset will be dependent on the EOA (since the request may trigger other actions) and the route to that EOA. Appropriate parameters relate to the values of T_MAR, T_TIMEOUTRQST, T_CYCRQST. Topics: A1-1, A1-2, JJ1 If an updated Movement Authority (MA) becomes available after an Onboard request, the updated MA shall be sent by the RBC to the train within 15 seconds. ETrckSS-712 Rationale: To avoid the train slowing unnecessarily. Guidance: This can be achieved either by using a proper TCYCRQST or storing the request and sending the MA as soon as it becomes available. The shortest system response time available, and the maximum to minimise the likelihood of the driver receiving a pre-indication, is 15 seconds. Topics: A1-1, A1-2 NETWORK RAIL Page 21 of 96

22 The ETCS Trackside sub-system shall hold Movement Authorities (MAs) available until they are used or until the route they relate to is given up. ETrckSS-717 Rationale: To ensure that an MA is continuously available, and a train can accept an MA on completing the Start process. Topics: G1-1, G1-2, G2 The ETCS Trackside sub-system shall provide the function to update or shorten a Movement Authority (MA). ETrckSS-844 Rationale: To provide to the signaller with control over the length of an ETCS MA. Guidance: The signaller may wish to shorten a route set for the train in order to change the lie of the points in the section of line released by the shortening. Topics: J4 The ETCS Trackside sub-system shall inform the control layer of the sending, receipt and successful application (or otherwise) of a cooperative shortening request. ETrckSS-1031 Rationale: So that the signaller knows whether a co-operative shortening request has been correctly requested by the workstation. Topics: J5 Where there is a safety justification, the ETCS RBC shall be able to revoke a Movement Authority (MA) and send an emergency stop message to trains approaching a route setting point. ETrckSS-1032 Rationale: Where hazards are detected in the route, then all reasonable measures should be taken to stop trains entering the route. Once in the route, the opportunity to reduce the consequences is small. Guidance: The loss of the following items, traditionally found in the aspect level interlocking controls, will cause the MA to be revoked from the route setting point: Slot from another control point; Point detection in the route; Ground frame proving in the route; Train detection in the route; Foul train detection; Level crossing barrier integrity; Movable infrastructure in route or overlap; Signaller's control device. Topics: U1, U Full Supervision Movement Authorities The issue of Full Supervision shall require the wheeled path to be proved clear from the front of the train to the end of the Movement Authority (MA). ETrckSS-386 Rationale: The driver is not required to check the route for obstructions. Guidance: An MA represents the distance that a train is authorised to move (to the End of Authority EOA). It may include a section beyond the EOA up to a Danger Point (DP) and / or an Overlap. Topics: A1-1, U1 NETWORK RAIL Page 22 of 96

23 Where it is possible for the route to be obstructed by a vehicle not on the wheeled path, then the issue of a Movement Authority shall be dependent on a check that there is no obstruction. ETrckSS-383 Rationale: The driver is not required to check for obstructions to the passage of the train. Guidance: Foul tracks should be proved clear as far as the EOA/LOA, where a vehicle could, legitimately, be partially obstructing the route and the control is not operationally restrictive (e.g. phantom overlaps). Topics: A1-1, U1, U2 On routes where the SR ceiling speed can be raised above the NV, the system shall be able to manage the transition from SR to FS at an unmarked EOA without the need to reduce the train speed back to the NV. ETrckSS-18 Rationale: To make sure that stepping up from SR to FS is achieved without imposing speed restrictions unknown to the driver. Topics: A Start of Mission National Values shall be sent by a balise group in locations where trains regularly start missions. ETrckSS-231 Rationale: To cope with situations where a train has been moved in No Power (NP) and starts up in a completely different area. Guidance: The stored National Values (i.e. wrong NV) will be used until the first balise group is read, at which point, if the correct set is not received, the default NV may be used. One SoM scenario is the situation in which a train starts in Level 2 SR with an invalid or unknown position. Topics: KK National Values shall be sent by the RBC during Start of Mission in Level 2. ETrckSS-230 Rationale: To cope with situations where the Onboard starts with default NV but requires correct NV for the current National area. Topics: KK Degraded Starts A text message shall be sent from the RBC, prior to the 'disconnection and deletion of Onboard position' data packet, to inform the driver of an 'invalid position' where the train's position cannot be confirmed. ETrckSS-127 Rationale: To facilitate prompt entry into the Override to SR Driver/Signaller interaction. Guidance: The text message wording is to be agreed but should contain the words 'invalid position'. (See Open Point 5). Topics: G3-1, U6 NETWORK RAIL Page 23 of 96

24 A text message shall be sent from the RBC, prior to the 'disconnection and deletion of Onboard position' data packet, to inform the driver of an 'invalid RBC' where the incorrect RBC identifier is used. ETrckSS-128 Rationale: To initiate manual RBC identifier entry and allow registration with the correct RBC. Guidance: The text message wording is to be agreed but should contain the words 'invalid RBC'. (See Open Point 5). Topics: G3-1, U Routing Information Safety Where an electric train could, if misrouted, become stranded beyond the limits of a compatible electrification system after a divergence, the application design shall consider whether to configure the route concerned as an announced route. ETrckSS-829 Status: Application-Specific Rationale: Hazard analysis has identified that this situation needs to be assessed on a sitespecific basis to determine whether the divergence is a critical divergence. Safety requirement addressing hazards V-H102 and V-H106. Topics: V1, V2 Safety Where a more restrictive structure gauge applies to a route beyond a divergence, such that a misrouted train could not be stopped before encountering a restricted structure, the application design shall configure the route containing the restriction to be an announced route. Status: Application-Specific Rationale: Hazard analysis has identified this situation as a critical divergence. Safety requirement addressing hazards V-H108 and V-H110. Topics: V1, V2 Safety ETrckSS-827 Where a more restrictive axle load limit applies to a structure on a route beyond a divergence, such that a misrouted train could not be stopped before encountering a restricted structure, the application design shall consider whether to configure the route containing the restriction as an announced route. ETrckSS-828 Status: Application-Specific Rationale: Hazard analysis has identified that this situation needs to be assessed on a sitespecific basis to determine whether the divergence is a critical divergence. Safety requirement addressing hazards V-H112 and V-H114. Topics: V1, V2 The application design shall consider whether there are site-specific hazards that require divergences to be identified as critical in addition to those covered by ETrckSS-827, ETrckSS- 828 and ETrckSS-829. ETrckSS-982 NETWORK RAIL Page 24 of 96