Rail Industry Guidance Note for Safe Integration of CCS Systems with Train Operations

Transcription

1 for Safe Integration of CCS Systems with Train Synopsis This document provides guidance on assessment of changes that affect the interfaces between Control Command and Signalling (CCS) systems and train operations. Copyright in the Railway Group documents is owned by Rail Safety and Standards Board Limited. All rights are hereby reserved. No Railway Group document (in whole or in part) may be reproduced, stored in a retrieval system, or transmitted, in any form or means, without the prior written permission of Rail Safety and Standards Board Limited, or as expressly permitted by law. RSSB members are granted copyright licence in accordance with the Constitution Agreement relating to Rail Safety and Standards Board Limited. In circumstances where Rail Safety and Standards Board Limited has granted a particular person or organisation permission to copy extracts from Railway Group documents, Rail Safety and Standards Board Limited accepts no responsibility for, nor any liability in connection with, the use of such extracts, or any claims arising therefrom. This disclaimer applies to all forms of media in which extracts from Railway Group documents may be reproduced. Published by RSSB Copyright 2018 Rail Safety and Standards Board Limited

2 for Safe Issue Record Issue Date Comments One 03/03/2018 Original document. This guidance note is intended to inform decisions about safe integration of CCS systems with train operations This document will be updated when necessary by distribution of a complete replacement. Page 2 of 25 RSSB

3 for Safe Contents Section Description Page Part 1 Introduction 6 G1.1 Purpose 6 G1.2 Structure of this document 6 G1.3 Approval and Authorisation 6 Part 2 Guidance on Managing Assessments 7 G2.1 Introduction 7 G2.2 Meeting the essential requirements as a contribution to safe integration 9 G2.3 Compatibility and safe integration 10 G2.4 Risk assessment 14 G2.5 Framework of assessments 15 G2.6 Managing the assessment process 16 Part 3 Guidance on Assessment Types and Scope 19 G3.1 Signal sighting assessment 19 G3.2 Signalling layout driveability assessment 19 G3.3 Clearance point risk assessment 20 G3.4 Signal overrun risk assessment 20 G3.5 Permissive working risk assessment 21 Definitions 22 References 24 RSSB Page 3 of 25

4 for Safe List of Figures Figure 1: Compatibility has a range 10 Figure 2: Compatibility and safety 10 Figure 3: Example of a simple assessment framework 16 Page 4 of 25 RSSB

5 for Safe List of Tables Table 1: Types of functional compatibility 12 Table 2: Examples of standards relevant to integration with train operations 13 Table 3: Standards relevant to assessment of integration with train operations 14 Table 4: Requirements for risk assessment 15 RSSB Page 5 of 25

6 for Safe Part 1 Introduction G1.1 Purpose G1.1.1 G1.1.2 G1.1.3 G1.1.4 G1.1.5 G1.1.6 This document gives guidance on using conformity with standards and assessment to confirm safe integration of changes into the Great Britain (GB) mainline railway that have the potential to introduce risk at interfaces between the Control Command and Signalling (CCS) system and train operations. Although the guidance is expressed in terms of safe integration of CCS systems that incorporate a lineside signalling system, the risk acceptance principles and processes described in this document are also applicable to changes affecting cab signalling systems such as the European Rail Traffic Management System / European Train Control System (ERTMS/ETCS). Part 2 provides guidance on the role of assessments, and the standards relevant to these assessments. Part 3 provides guidance on some assessments that are commonly applied to projects that affect the interfaces between CCS systems and train operations. This is not a comprehensive list. The guidance in this document is intended to be read in conjunction with the guidance, published by the Office of Rail and Road (ORR) and RSSB, on the application of Regulation (EU) 402/2013 (the Regulation on a Common Safety Method for Risk Evaluation and Assessment (CSM RA)). This document does not set out requirements. G1.2 Structure of this document G1.2.1 Guidance is provided as a series of sequentially numbered clauses. G1.3 Approval and Authorisation G1.3.1 The content of this document was approved by Control Command and Signalling Standards Committee (CCS SC) on 18 January G1.3.2 This document was authorised by RSSB on 30 January Page 6 of 25 RSSB

7 for Safe Part 2 Guidance on Managing Assessments G2.1 Introduction G2.1.1 G2.1.2 G2.1.3 G2.1.4 G2.1.5 G2.1.6 G2.1.7 Scope of guidance This document sets out some good practices for assessing and controlling the hazards and risk that can arise at interfaces between the CCS system and train operations when planned changes are implemented into the GB mainline railway. These practices can be applied to inform the process of safe integration of a planned change. Planned changes can affect compatibility at technical interfaces and functional integration at subsystem interfaces, including interfaces wholly within a single transport undertaking, interfaces between different transport undertakings and interfaces between the railway system and other systems or the general public. The scope of guidance in this document is limited to the following, which can form a part of the safe integration of a much wider scope of change: a) The CCS trackside subsystem. b) CCS onboard subsystems. c) Rail vehicle interfaces with the CCS system. d) Train operations that interface with the CCS system. e) A combination of these. The ORR guidance on the application of the CSM RA defines safe integration to be 'The action to ensure that incorporating an element of a system into a bigger system does not create an unacceptable risk for the resulting system'. The guidance in this document is set out in the context of a Proposer applying the CSM RA risk acceptance principles to a planned change. Although the full CSM RA process is applicable only to projects that are assessed to be 'significant', the risk acceptance principles it describes are scaleable and can be applied to any change projects, including those that do not need to conform with the CSM RA. Further guidance on applying the CSM RA process is provided in the following: a) GEGN8646 Guidance on the Common Safety Method on Risk Evaluation and Assessment b) ORR guidance on the application of Commission Regulation (EU) 402/2013. Irrespective of whether the CSM RA process is followed, or which organisations are involved in developing and implementing a change project, the Railways and Other Guided Transport (Safety) Regulations (ROGS) give infrastructure managers (IMs) and railway undertakings (RUs) a specific duty to carry out a suitable and sufficient assessment of the safety risks involved in running the transport system and to cooperate in carrying out risk assessments and implementing measures to control risk. Applying the risk acceptance principles Three risk acceptance principles are available to control hazards and risk: a) Conformity with a code of practice and assessment. RSSB Page 7 of 25

8 for Safe G2.1.8 G2.1.9 G G G G G G b) Comparison with a similar reference system and assessment. c) Explicit risk evaluation and assessment. Applying these risk acceptance principles is used to support a decision that the safety risk arising from a planned change is reduced to an acceptable level. Effective application of the risk acceptance principles should result in a set of hazard mitigations and controls that are sufficient to reduce risk to an acceptable level without being unnecessarily excessive or costly to introduce; however, this does not confirm that the proposed change will be acceptable to all affected stakeholders in supporting their commercial or operational objectives. The following types of standards are managed under industry agreed governance arrangements that include oversight from the ORR, which means that they can be used to apply the 'code of practice' risk acceptance principle: a) Technical Specifications for Interoperability (TSIs). b) Railway Group Standards (RGSs). c) Rail Industry Standards (RISs). d) International, European and British Standards (ISOs, ENs and BSs). Other standards (for example, company standards) describe 'standard' designs that can be used to apply the 'reference system' risk acceptance principle. The Proposer decides which risk acceptance principles to apply, taking account of the extent that conformity with standards will control the hazards and risks. A Proposer can choose to implement a change that is non-compliant with a standard. In such cases the Proposer can use comparison with similar reference systems and / or explicit risk assessment to confirm that the alternative controls are sufficient to control the hazards and risks. The results of assessment are also used to support any necessary applications for deviation from standards. Assessment types and their aims Two distinct and complementary types of assessment are applied to confirm safe integration: a) Compatibility assessment. b) Risk assessment. The aim of compatibility assessment is to: a) Evaluate the proposed change to identify hazards at the IM and RU interfaces (compatibility hazards). b) Assess the likelihood that compatibility hazards will be present in the operational and environmental context applicable to the route(s) where the change will be put into use. c) Confirm that proposed controls will either eliminate or reduce the likelihood of the hazard being present. The aim of risk assessment is to: a) Evaluate the change for all hazards. b) Assess the risk. Page 8 of 25 RSSB

9 for Safe G G G G c) Confirm that the proposed controls and risk mitigation measures are capable of either eliminating the hazards or controlling the risk to an acceptable level. Developing a good understanding of how a planned change could impact on compatibility and risk at system interfaces can help inform project decisions about design option selection and work programmes. Compatibility assessment and risk assessment are iterative and complementary processes; starting planning for necessary assessments during the feasibility and option selection stages can help a project to select designs that control all of the hazards and risk. Starting assessment work at a late stage of the project can have significant cost implications and result in project delays and rework necessary to control unforeseen hazards and risks. Well-managed projects seek to involve stakeholders at an early stage of the project life cycle, with the aim of confirming that the proposed change will be acceptable to them and that the necessary risk assessments can be supported and resourced. Establishing contacts and consulting with stakeholders at corporate and local levels provide opportunities to identify and resolve any issues of concern in a controlled way. If this is not done well, unidentified and unresolved issues can become an obstacle at later project stages when stakeholders become more directly involved in the assessment processes. When undertaking assessments, it is helpful to remember that excessive provision of safety controls can result in unnecessary CCS system complexity, which might have an adverse impact on reliability and availability as well as having project cost implications. G2.2 Meeting the essential requirements as a contribution to safe integration G2.2.1 G2.2.2 G2.2.3 The Railways (Interoperability) Regulations 2011 (RIR 2011), as amended by the Railways (Interoperability) (Amendment) Regulations 2013, sets out the six essential requirements of the railway system: a) Safety. b) Reliability and Availability. c) Health. d) Environmental protection. e) Technical compatibility. f) Accessibility. Conformity with the TSIs and RGSs is used to confirm that new, upgraded or renewed subsystems meet these essential requirements when applied to the GB mainline railway. GEGN8611 provides further guidance on the application of the CCS TSI and RGSs and how this contributes to safe integration of change. Conformity with the CCS TSI and CCS relevant RGSs can contribute to controlling hazards arising due to: a) A CCS structural subsystem that does not meet specified safety targets. b) A CCS structural subsystem that does not meet specified reliability and availability targets. RSSB Page 9 of 25

10 for Safe G2.2.4 c) A CCS structural subsystem that results in a health hazard. d) A CCS structural subsystem that results in an environmental hazard. e) Technical incompatibility at one or more CCS structural subsystem interfaces. Conformity with the essential requirements does not control route specific hazards; therefore further assessment is needed to identify which additional controls are needed to achieve safe integration of the planned change. G2.3 Compatibility and safe integration G2.3.1 G2.3.2 'Compatibility' is defined as 'the ability of one thing to work with another'. This includes the ability of technical systems to work together, the ability of people to work with technical systems and of people to work with other people. Compatibility has a range; it is not a binary quantity and therefore might need to be assessed. This range can extend from never compatible in any circumstance to always compatible in every circumstance. This is shown in Fig. 1. Achievable or actual compatibility is usually positioned somewhere between these two limits. G2.3.3 G2.3.4 G2.3.5 Figure 1: Compatibility has a range 'Integration' is defined as 'the combining of one thing with another so that they form a whole'. The term 'whole' implies an integrated system that is capable of providing the required output. 'Safe integration' means that the integrated system is capable of providing the required output to the required level of safety. Figure 22 shows the relationship between achieving compatibility and achieving safe integration. A system that is not compatible at interfaces is unlikely to be capable of being integrated or safe, either because the system does not work or because it would be unreliable. G2.3.6 Figure 2: Compatibility and safety Compatibility and integration are both abstract terms that apply to systems and interfaces. Compatibility and integration of CCS systems and interfaces, includes: Page 10 of 25 RSSB

11 for Safe G2.3.7 G2.3.8 G2.3.9 a) Technical compatibility of CCS trackside with CCS onboard subsystems (for example, the Automatic Warning System / Train Protection and Warning System (AWS/TPWS) air gap). b) Technical compatibility of the CCS system with rail vehicles (for example, track circuits with wheelsets). c) Integration of the CCS trackside functions with train operating functions (for example, compatibility at the interfaces between the lineside signalling system and train driving processes). d) Integration of the CCS onboard functions with train driving processes. Some areas of compatibility and integration are well defined and are specified in standards, some are already established in existing reference systems, and others might need to be developed from first principles and assessed, for example when the change will introduce new technology or the application of existing technology in a different operational context that is not described in standards. CCS standards include: a) The TSIs, which specify the essential requirements for the structural subsystems that make up the target European interoperable railway system. b) RGSs, which specify further requirements for technical compatibility on the GB mainline railway. c) RISs, which set out further parameter and risk assessment requirements applicable to safe integration of the GB mainline railway network as a whole. Although conformity with these standards can provide a significant contribution to controlling hazards, it might be insufficient to achieve safe integration because risk is also influenced by the operational context on the route where the change will be implemented and the environment in which trains are operated. The impact of this can be different on each route, for different types of train operations and for different operating modes and system states. The CCS functions that might require further assessment to confirm safe integration include: a) Communication: the purpose of this function is to enable voice and data communication between the infrastructure and trains, and between trains. b) Train detection: the purpose of this function is to locate trains within the railway infrastructure. c) Signalling: the primary purpose of signalling is to maintain safe spacing between trains. The signalling system provides information that train operators need to manage train operations in accordance with the rules and procedures. The assessment of the interfaces between the signalling system function and train operations evaluates the ease and reliability that train operators will be able to perform their operations in accordance with rules and procedures, throughout the range of operational and ambient conditions applicable to each operation, within the operational context and while performing required duties. d) Train protection: the purpose of this function is to supervise train operations and intervene to control the risk arising when a train exceeds its movement authority (MA). The intervention can be active (for example, by applying the brakes), or passive (for example, by providing a safe overrun distance). RSSB Page 11 of 25

12 for Safe G Table 1 sets out the CCS functional interfaces with train operations. Interface function CCS system requirement Train operator requirement Example applicability Train detection Detect rail vehicle Operate trains that are detectable Train protection Apply train brakes Operate a train protection system Audibility Be audible Audibly detect, identify and distinguish an audible indication or speech as applicable to the train operation Visibility Be visible Visually detect and identify a visible display as applicable to the train operation Readability Be readable Distinguish which display is presented Interpretability Be interpretable Correctly interpret a presented indication Driveability Be driveable Assimilate interpreted information, understand and correctly perform the necessary train driving action Operability Be operable Correctly operate the CCS system interface Infrastructure based train detection systems AWS / TPWS Audible indications Voice communication system Lineside signs that are used as a marker Trackside and onboard signalling system displays Trackside and onboard indications The totality of the signalling system configuration CCS control and indication systems G Table 1: Types of functional compatibility The starting point for any assessment is usually the extent to which technical compatibility and integration can be achieved using conformity with standards. Table Page 12 of 25 RSSB

13 for Safe 2 sets out some standards that include requirements for integration of CCS systems with train operations on the GB mainline railway. Interface function Standard Scope of requirements Train detection GKRT0028 RIS-0728-CCS Train detection parameters Train protection GERT8075 RIS-0775-CCS AWS & TPWS requirements Audibility RIS-0775-CCS AWS and TPWS audible indication parameters Visibility Readability Interpretability GKRT0057 GIRT7033 RIS-0737-CCS RIS-0758-CCS Catalogue of lineside signs Lineside signalling product parameters and performance assessment Signalling asset configuration constraints Lineside signalling display appearance and meaning Driveability RIS-0703-CCS Lineside signalling system layout and signal aspect sequences Controllability RIS-0077-CCS Ground frames and shunters' releases Electromagnetic compatibility (EMC) RIS-0725-CCS Train detection infrastructure: interference limits G Table 2: Examples of standards relevant to integration with train operations The scope of assessment needed to confirm integration is informed by the extent to which conformity with applicable standards manages the hazards that arise in the operational context. For example, positioning signals so that each one provides the minimum readable distance (MRD), and cautionary aspect sequences that conform with minimum signalling braking distances (SBDs) provides enough time for train drivers to read and respond to the signal aspects and stop the train at the limit of MA. However, too much distance or time might make it too difficult for some train drivers to do this reliably. Maximum distances for signal readability and spacing are not specified in standards; therefore, the impact of these on driveability needs to be assessed before putting into use. RSSB Page 13 of 25

14 for Safe G More than one assessment might be needed; the necessary assessments are dependent on the scope of the planned change but can include those set out in Table 3. Interface function Standard Comments Visibility RIS-0737-CCS Signal sighting assessment process and scope Readability requirements Driveability (asset) Driveability (layout) RIS-0713-CCS Driveability assessment process and scope requirements Table 3: Standards relevant to assessment of integration with train operations G2.4 Risk assessment G2.4.1 G2.4.2 G2.4.3 Risk is the product of the likelihood of a hazard arising and the consequence when it does (likelihood x consequence). Further guidance on identifying hazards and risk assessment is given in GEGN8646 and Taking Safe Decisions (version two), which describes the principles that companies apply to protect people s safety, satisfy the law, respect the interests of stakeholders and meet commercial objectives. Hazards can arise from a change to the CCS subsystem or the train operations that use it. They can result from changes to features within a subsystem or the operating system that result in poor compatibility or an increase in the level of risk. This can arise due to a technical fault or human error. The potential consequences include a collision or a derailment due to: a) A train exceeding the safe overrun distance beyond a limit of MA. b) A train operation using infrastructure that is not correctly set. c) A train exceeding a maximum safe speed. d) Technical incompatibility of a rail vehicle with the infrastructure on the route. A signalling system that is poorly integrated with train operations can lead to an increase in operating incidents. A signalling system that is properly integrated with train operations contributes to risk control because it reduces the likelihood of an operating error. However, controlling the likelihood of an operating error is insufficient to eliminate the hazard or control the risk to an acceptable level; therefore additional risk controls are usually provided by the IMs and RUs. These can include: a) Maintaining a safe overrun distance beyond the limit of movement authority (signalling overlap and flank protection controls). b) Train protection system functionality, for example TPWS or trainstops. c) Trapping protection. d) Train operating procedures. Page 14 of 25 RSSB

15 for Safe G2.4.4 Conformity with relevant standards and the reuse of applicable reference systems is a good starting point for controlling risk. If this is insufficient to reduce the risk to an acceptable level, further risk evaluation and assessment is necessary to confirm that the alternative risk controls are suitable and sufficient. Table 4 sets out some standards that contain requirements for risk assessment relevant to safe integration of changes to CCS trackside systems. Type of risk assessment Clearance point risk assessment Signal overrun risk assessment Permissive working risk assessment Train dispatch risk assessment Standard RIS-0728-CCS RIS-0386-CCS RIS-0744-CCS RIS-3703-TOM G2.4.5 Table 4: Requirements for risk assessment Other relevant risk assessments might include: a) Overspeed risk assessment. b) Misrouting risk assessment. c) Transition risk assessment. d) Level crossing risk assessment. G2.5 Framework of assessments G2.5.1 G2.5.2 The CSM RA requires the Proposer to produce a system definition of the change. The system definition describes the overall change being managed by the project and helps the Proposer and affected stakeholders (Actors) to understand what hazards might be introduced and therefore which risks need to be managed. For projects with a CCS system element, the system definition typically includes: a) System objective. The reason(s) for the change(s), for example: to increase the capacity of a route; to support a different type of train operation on a route. b) System functions and elements. What change needs to be safely integrated into the rest of the railway? For example, an infrastructure project might include changes to the track layout, electrification system, signalling system, train protection and warning system and operating processes. c) System boundary, including other interacting systems. This includes geographical (physical) and functional boundaries between the parts of the railway that will change and those that will not. For example, a project to implement permissive working at a station would be bounded by the affected signals and signal routes, relevant train detections systems and train protections systems and the operating rules at the station. d) Physical and functional interfaces. Which interface and which types of compatibility are affected by the change, and where; for example, will the change affect driveability? Does the change impact on the technical compatibility of RSSB Page 15 of 25

16 for Safe G2.5.3 G2.5.4 infrastructure with rail vehicles or trains (for example, replacement of track circuits with axle counters)? e) System environment. What is the railway operational context associated with the change? Are there any environmental or technical constraints that could impact on safe integration (for example, electromagnetic interference, effect of sunlight on train driver eyesight)? f) Existing safety measures and, after iterations, definition of the safety requirements identified by the risk assessment process. What existing safety measures are available, what is being reused and what new safety measures are proposed? g) Assumptions which shall determine the limits of the risk assessment. This might include assumptions about other parts of the railway that are changing, those parts that are remaining the same (including infrastructure, trains, stations), and its operating environment (for example, user behaviour). A project might need to undertake a number of assessments to confirm that the proposed change is capable of being safely integrated into the rest of the railway. Efficiencies can be gained if the project team has a good understanding of the contribution of each assessment to confirming safe integration and how they interrelate. This understanding can be supported using an assessment framework. Fig. 3 shows how compatibility assessments and risk assessments are interrelated and complementary. In particular, it shows how the output of one assessment provides the information needed to inform a different assessment. G2.5.5 Figure 3: Example of a simple assessment framework A documented assessment strategy that includes the framework of assessments can help a project to plan each assessment so that the necessary information and appropriate resources are identified and available. G2.6 Managing the assessment process G2.6.1 G2.6.2 An assessment strategy that includes a framework of well-planned and joined-up assessments can help a project to reach fully informed decisions about managing risk that can be supported by stakeholders. It is good practice to start planning and consulting with stakeholders on the assessment strategy at an early stage in the project life cycle, starting with a high- Page 16 of 25 RSSB

17 for Safe G2.6.3 G2.6.4 G2.6.5 G2.6.6 G2.6.7 G2.6.8 G2.6.9 G level description of the approach to be applied to compatibility assessment and risk assessment. It is also good practice to start planning each assessment at an early stage. The aim of each assessment plan is to specify an assessment that is sufficiently rigorous to evaluate the relevant hazards and assess the impact of proposed risk mitigations. The assessment plan is a live document and can develop over time as the project evolves. The assessment plan makes information available to participants before the assessment takes place, to inform their understanding of the scope and method of assessment and their roles and responsibilities. The final version of the plan provides assessment participants with all of the information they need to fulfil their roles in the assessment. Consultation on each assessment plan can provide process efficiencies if relevant stakeholders confirm that each assessment will be capable of addressing issues of concern and that the required resources and information will be available. Some of the necessary information might only be available from stakeholders. A good assessment plan records the following information relevant to the assessment: a) Why the assessment is needed and how it fits in to the overall assessment framework to inform the decision about safe integration. b) What will be assessed (and what will not). c) When the assessment will take place. d) Where the assessment will take place. e) Who will participate in the assessment and their roles. f) Which assessment method(s) will be used. g) How the assessment will be managed and facilitated. h) The pass / fail criteria being applied. i) The assumptions, dependencies and caveats underpinning the assessment. Structured professional judgement is an acceptable method of reaching an assessment decision. The plan identifies the resources necessary to support this. The assessment participants are selected to provide sufficient competence, knowledge and experience to inform the assessment. The necessary assessment participants depend on the type and scope of the assessment, the required roles and the stakeholder organisations affected by the change. Consulting on a skills, knowledge and experience matrix before the assessment takes place can be useful in confirming that the attendance is suitable for the assessment. Some assessments are supported by a tool, which can provide and manage the data needed to support the assessment decision. Where this is the case the assessment tool is approved for the application in which it is being used and it is operated by an authorised person. The use of a tool does not absolve the assessment participants from their responsibility in reaching a decision. Planning for, and achieving, a quorate assessment is beneficial because the discussion between assessment participants can influence the pass / fail decision. RSSB Page 17 of 25

18 for Safe G G G Planning an assessment that relies on a separate meeting with some of the stakeholders after the assessment might not provide a fully informed discussion. It is good practice to maintain an attendance record throughout each assessment and, if any participants leave during the assessment, review the membership to confirm that the assessment still provides sufficient competence and knowledge to reach a fully informed assessment decision. Records of assessment participation demonstrate that the assessment decision was informed by an appropriate level of knowledge, experience and representation. Details of the assessment participants' considerations in reaching a decision, including the assumptions, dependencies and caveats, are formally recorded and circulated to all participants. Page 18 of 25 RSSB

19 for Safe Part 3 Guidance on Assessment Types and Scope G3.1 Signal sighting assessment G3.1.1 G3.1.2 G3.1.3 G3.1.4 G3.1.5 The signal sighting assessment process set out in RIS-0737-CCS is used to confirm that lineside signals, indicators and signs are fit for purpose and capable of being integrated with the train operations that use, or are potentially influenced by them. The hazard relevant to signal sighting assessment is 'poor compatibility of a lineside signalling asset with train operations'. The signal sighting assessment includes assessment of: a) Visibility. b) Readability. c) Interpretability. d) Driveability. The inputs to signal sighting assessment include information about: a) The performance capability of the signalling product(s) being used. b) The proposed asset configuration and layout. c) The railway infrastructure context. d) The railway operational context. e) The environment. The output from a signal sighting assessment is available as an input to signalling layout driveability assessment and any other necessary risk assessments. It includes the following information: a) A decision on compatibility with train operations. b) Confirmation of fitness for purpose in terms of the asset performance, configuration and layout. c) Hazards that require further risk assessment. d) Assumptions, dependencies and caveats underpinning the assessment decision. Network Rail applies the Signal Sighting Form Tool (SIFT) to support the industry in applying the signal sighting assessment process to change projects. G3.2 Signalling layout driveability assessment G3.2.1 G3.2.2 The purpose of a lineside signalling system is to provide train operators with the information they need to operate trains in accordance with the rules and procedures. The design of the lineside signalling system influences four variables relevant to compatibility with train operations: a) What information is provided by the signalling system to the train operator (for example, movement authority and routing). b) Which signalling display is used to present the information (for example, lineside signal aspect). c) Where the display is presented in the driver's field of vision (for example, on the left-hand side of the line). RSSB Page 19 of 25

20 for Safe G3.2.3 G3.2.4 G3.2.5 G3.2.6 d) When the information is presented relative to the operating task (for example, a period of time before the driver needs to apply the brakes). The signalling layout driveability assessment set out in RIS-0713-CCS is used to confirm that the signalling system is compatible with the train operations that will use it. The hazard relevant to signalling layout driveability assessment is 'poor driveability'. The driveability assessment scope includes: a) Readability. b) Interpretability. c) Driveability. The inputs to signalling layout compatibility assessment include: a) The outputs from the relevant signal sighting assessments. b) The proposed signalling layout and the presented signal aspect sequences and indications. c) The proposed infrastructure layout and parameters, including permissible speeds and gradients. d) The proposed train protection functionality. e) The railway operational context, including infrastructure, station and train operations. f) The environment. The output from a signalling layout driveability assessment is available as an input to other necessary risk assessments. It includes the following information: a) A decision on the driveability of the signalling system. b) Confirmation of the overall signalling compatibility performance, configuration and layout and an understanding of which parts of the layout are more difficult to drive. c) Hazards that require further risk assessment. d) Assumptions, dependencies and caveats underpinning the assessment decision. G3.3 Clearance point risk assessment G3.3.1 G3.3.2 A risk assessment of the adequacy of the safety margin between the fouling point and the clearance point is used to confirm that the distance is sufficient to control the hazard: 'loss of passing clearance between rail vehicles at a junction'. RIS-0728-CCS sets out the requirements for safety margins and guidance on the clearance point risk assessment process and managing the assessment to change projects. G3.4 Signal overrun risk assessment G3.4.1 The signal overrun risk assessment process set out in RIS-0386-CCS is used to confirm that the proposed signal overrun risk controls mitigate the hazards associated with a train exceeding the limit of its MA at a stop signal. Page 20 of 25 RSSB

21 for Safe G3.4.2 G3.4.3 G3.4.4 The inputs to signal overrun risk assessment include: a) The outputs from signal sighting assessment and driveability assessment. b) Historical data about signal overrun risk. c) The proposed signal overrun risk mitigations. d) The railway operational context. e) The environment. The output from a signal overrun risk assessment is available as an input to other risk assessments and can be used to revisit previous signal sighting assessments or driveability assessments. It includes the following information: a) The risk associated with a train exceeding the limit of MA at a stop signal. b) Recommendations on signal overrun risk control measures. c) The assumptions, dependencies and caveats underpinning the assessment decision. Network Rail applies the SORAT to support the industry in applying the signal sighting assessment process to change projects. G3.5 Permissive working risk assessment G3.5.1 G3.5.2 G3.5.3 The permissive working risk assessment set out in RIS-0744-CCS is used to confirm that the proposed controls are sufficient to control the risk associated with a train using a permissive MA, such as a train colliding with the train or rail vehicle that is already occupying the same signal section. The main hazard being assessed is 'two trains occupying the same signal section at the same time'. The inputs to permissive working risk assessment include: a) The outputs from signal sighting assessment and driveability signalling layout compatibility assessment. b) Historical data about permissive working risk. c) The proposed risk mitigations. d) The railway operational context. e) The environment. The output from a permissive working risk assessment includes the following information: a) The acceptability of permissive working at this location. b) Recommendations on risk control measures. c) The assumptions, dependencies and caveats underpinning the assessment decision. RSSB Page 21 of 25

22 for Safe Definitions CSM RA Driveability Electromagnetic Compatibility (EMC) Hazard precursor MA Proposer Risk Risk assessment Safety Page 22 of 25 Common Safety Method for Risk Evaluation and Assessment. COMMISSION REGULATION (EU) No 2015/1136 of 13 July 2015 amending Implementing Regulation (EU) No 402/2013 on the common safety method for risk evaluation and assessment. The ease and reliability that train drivers are able to perform train operations in accordance with rules and procedures, throughout the range of operational and ambient conditions applicable to each train, within the operational context and while performing typical required duties. The ability of equipment or a system to function satisfactorily in its electromagnetic environment without introducing intolerable electromagnetic disturbances to anything in that environment. A system failure, sub-system failure, component failure, human error or operational condition which could, individually or in combination with other precursors, result in the occurrence of a hazardous event. Movement authority. Proposer is defined in the common safety method on risk evaluation and assessment as one of the following: (a) a railway undertaking or an infrastructure manager which implements risk control measures in accordance with Article 4 of Directive 2004/49/EC; (b) an entity in charge of maintenance which implements measures in accordance with Article 14a(3) of Directive 2004/49/EC; (c) a contracting entity or a manufacturer which invites a notified body to apply the EC verification procedure in accordance with Article 18(1) of Directive 2008/57/EC or a designated body according to Article 17(3) of that Directive; (d) an applicant for an authorisation for the placing in service of structural sub-systems. Source: CSM RA The combination of the likelihood of occurrence of harm and the severity of that harm (specifically defined in CSM RA regulation as: the frequency of occurrence of accidents and incidents resulting in harm (caused by a hazard) and the degree of severity of that harm). The overall process comprising a risk analysis and a risk evaluation. Source: CSM RA The freedom from unacceptable risk to the outside from the functional and physical units considered. Source: IEV RSSB

23 for Safe System Train A set of sub-systems that interact according to a plan. Source: BS EN 50129:2003 A train is defined as (a) traction unit(s) with or without coupled railway vehicles, including light locomotive and self-propelled rail vehicle operating in rail mode, with train data available operating between two or more defined points. RSSB Page 23 of 25

24 for Safe References The Catalogue of Railway Group Standards gives the current issue number and status of documents published by RSSB. This information is also available from railway-group-standards.co.uk. RGSC 01 RGSC 02 Railway Group Standards Code Standards Manual Documents referenced in the text Railway Group Standards GERT8075 GERT8270 GIRT7033 GKRT0057 AWS and TPWS Interface Requirements Assessment of Route Compatibility of Vehicles and Infrastructure Lineside Signs Lineside Signal and Indicator Product Design and Assessment Requirements RSSB Documents Catalogue of Lineside Signs GEGN8611 GEGN8646 RIS-0077-CCS RIS-0386-CCS RIS-0703-CCS RIS-0713-CCS RIS-0725-CCS RIS-0728-CCS RIS-0737-CCS RIS-0744-CCS RIS-0758-CCS RIS-0775-CCS RIS-3703-TOM Guidance on the Application of the Control Command and Signalling TSI Guidance on the Common Safety Method for Risk Evaluation and Assessment Ground Frames and Shunters' Releases Rail Industry Standard on Signal Overrun Risk Evaluation and Assessment Signalling Layout and Signal Aspect Sequence Requirements Lineside Signalling Layout Driveability Assessment Requirements Electromagnetic Compatibility of Train Detection Infrastructure with Rail Vehicles Infrastructure Based Train Detection Systems Signal Sighting Assessment Requirements Permissive Working [to be published] Lineside Signal Aspects and Indications AWS and TPWS Application Requirements [to be published] Passenger Train Dispatch and Platform Safety Measures Page 24 of 25 RSSB

25 for Safe Other References The Railways and Other Guided Transport Systems (Safety) Regulations 2006 (ROGS) Common safety method on risk evaluation and assessment (CSM RA) Railways (Interoperability) Regulations 2011 (RIR 2011) Railways (Interoperability) (Amendment) Regulations 2013 Control Command and Signalling Technical Specification for Interoperatility (CCS TSI) RSSB Page 25 of 25