Electronic Version CCMS Reference: 65646660 Version History Issue Date Comments 1.0 31/03/16 First Issue 1.1 18/08/16 Update for SRSG 1.2 28/08/16 Update from SRSG 1.3 22/09/16 Update for SRSG 1.4 30/09/16 Release for ESB / OSG review 1.5 27/01/17 Update from Industry and Technical Author review 2.0 31/03/17 Formal issue Disclaimer Network Rail has used its best endeavours to ensure that the content, layout and text of this document are accurate, complete and suitable for its stated purpose. It makes no warranties, expressed or implied, that compliance with the contents of this document shall be sufficient to ensure safe systems of work or operation. Network Rail will not be liable to pay compensation in respect of the content or subsequent use of this document for any purpose other than its stated purpose or for any purpose other than that for which it was prepared except where it can be shown to have acted in bad faith or there has been wilful default. NETWORK RAIL Page 2 of 61
Contents 1 INTRODUCTION... 5 1.1 Purpose of this Document... 5 1.2 Scope... 5 1.3 Context... 6 1.4 Abbreviations... 6 1.5 Requirements: Form, Applicability and Identification... 6 1.5.1 Requirement Functionality... 6 1.5.2 Basic Requirement Form... 6 1.5.3 Safety Requirement... 6 1.5.4 Provisional Requirements... 6 1.5.6 Normative / Application-Specific / Preferred status... 7 1.5.7 Topics... 7 1.6 Requirements Assurance... 7 1.7 Requirements Change... 7 1.8 Areas for Development... 7 2 OPERATIONS SUB-SYSTEM REQUIREMENTS... 8 2.1 Scheme-Specific... 8 2.2 Movement Authority, Modes & Levels... 8 2.2.1 Start of Mission... 8 2.3 Degraded and Emergency... 9 2.4 Data... 10 2.5 Security... 12 2.6 People Issues... 12 2.6.1 Workload/People/Training... 12 2.7 Whole Life Management... 13 2.7.1 Maintenance... 13 2.7.2 Diagnostics... 13 2.8 Implementation Requirements... 14 2.8.1 Transitions... 14 2.8.2 Design Rules... 14 NETWORK RAIL Page 3 of 61
3 REQUIREMENTS FOR THE CONTROL LAYER... 15 4 REQUIREMENTS FOR OPERATIONAL RULES... 16 5 REQUIREMENTS FOR TRAINING... 32 APPENDIX A: ABBREVIATIONS... 57 APPENDIX B: REFERENCES... 59 APPENDIX C: TOPICS LOOKUP TABLE... 60 APPENDIX D: AREAS FOR DEVELOPMENT (OPEN POINTS)... 61 NETWORK RAIL Page 4 of 61
1 INTRODUCTION 1.1 Purpose of this Document This document provides a specification that is intended to promote effective implementation of the ETCS. It is applicable to ETCS installations, and provides requirements that are optimised for operation on the GB rail network. As stated in the industry-agreed and issued National ETCS Requirements Management Strategy [RD1] and Plan [RD2], the document provides the requirements which have been developed as part of a suite of ETCS requirements covering all elements required to optimise performance and operation of an ETCS railway. The document can be utilised as a standalone specification for the Operational aspect of the ETCS; further details of the parent requirements that drive the development of this specification are included within the System Requirements Specification [RD3] and the other Sub-system Requirements (Trackside, Onboard (Retrofit and New Trains), and Telecoms [RD4], [RD5] & [RD6]). This Specification for the ETCS Trackside sub-system has been written to complement the Command, Control and Signalling Technical Specification for Interoperability (CCS TSI) and European Union Agency for Railways (known as The Agency ) specifications for Baseline 3 ETCS 1 [RD7] & [RD8]. Every effort has been made to avoid conflict with the CCS TSI and Baseline 3 specification but, in case of conflict, the CCS TSI (including the UK specific cases) and Baseline 3 specification take precedence. Nothing in this document obviates any legal requirement to which any of the parties must comply. The document is set out in the form of standard requirements with the ETCS Operations Requirement (EOPSS) identifier, followed by rationale and guidance notes where appropriate. 1.2 Scope This document consists of requirements which describe the functionality and application of the ETCS Operational sub-system optimised for application on the GB rail network at all required levels of operation. These requirements are not expected to prevent the ETCS operating in conjunction with an Automatic Train Operation (ATO) system. Requirements will be added at a later date once the European specification for adding ATO to an ETCS sub-system has been finalised. Projects are encouraged to seek advice from the ERTMS Systems Body (ESB) if there is a wish to facilitate early introduction of ATO. These requirements are not expected to prevent the ETCS operating in conjunction with a Traffic Management (TM) system. No specific TM requirements have been identified for inclusion to date. Specific requirements and domain knowledge for a particular application are not included within this document, and will need to be defined by the Contracting Entity or their appointed Agent. Nothing in this document obviates any legal requirement with which any of the parties must comply. Furthermore, it does not preclude operation of a TSI-compliant vehicle on the GB rail network, or a vehicle compliant to this specification operating on TSI-compliant infrastructure outside the GB rail network. 1 Note: This suite of requirements has been written to meet Baseline 3 Release 2, although the ETCS DOORS requirements database has the capability of producing a suite of requirements to meet Baseline 3 Maintenance Release 1. Should a suite of Baseline 3 Maintenance Release 1 requirements be needed, or if any background information be required for any specific requirement, then an e-mail with specifics should be sent to: nationalertmsrequirements@networkrail.co.uk NETWORK RAIL Page 5 of 61
1.3 Context This document has been developed from a number of sources. Input from the ETCS programme, ETCS suppliers, and the wider rail industry has been used to develop the requirements. A series of workshops and industry consultations have identified new requirements. Guidance has been added to justify changes. Requirements amended and deleted through this development process have been captured within the requirements database, along with justification for their amendment or removal. 1.4 Abbreviations Abbreviations are explained in full where used in Requirements. A fuller explanation of Terms and Abbreviations can be found in Appendix A: and the ERTMS Glossary [RD9]. 1.5 Requirements: Form, Applicability and Identification 1.5.1 Requirement Functionality Requirements may be functional or non-functional: Functional Requirements - Technical details that define what a system needs to accomplish, i.e. how suppliers equipment will be applied, what it needs to do, and what processes, procedures and rules need to be in place to achieve that. Non-Functional Requirements - Constraints on the design or implementation, such as performance, security, competence, training, and reliability requirements. Functional requirements have been derived through the Reference Design generation process [RD10], whereas non-functional requirements have been derived from the Cambrian Requirements suite and supplemented by workshop input [RD11]. 1.5.2 Basic Requirement Form All requirements are in the following form: Safety Requirement text. Unique EOPSS-Identifier Status: Normative/Application-Specific/Preferred. (See Section 1.5.4 below). Rationale: Shows applicability of the requirement. Guidance: Supplementary information to support Requirement interpretation and satisfaction. Topics: 1.5.3 Safety Requirement Reference Design Topics (if applicable). (See Section 1.5.7 below). Where a requirement has been associated with a Safety Measure, this is identified. 1.5.4 Provisional Requirements A requirement that has been derived from a Reference Design Topic that has not been issued as a Release Version or where there is still Industry discussion required, this is identified. 1.5.5 Unique ETCS Trackside Requirement-Identifier (EOPSS-Identifier) Each requirement has been identified uniquely. The requirement numbers have been generated automatically within the DOORS database, which means that the requirement numbering may be neither sequential nor gap-free. NETWORK RAIL Page 6 of 61
1.5.6 Normative / Application-Specific / Preferred status Each requirement within this document is identified as one of: normative, preferred, or application-specific. These are defined as follows: Normative o Necessary to achieve compatibility or optimisation of the system in relation to the GB rail network, or o A system feature that is deemed to be cost-effective and universally beneficial. Satisfaction of normative requirements in compliance with this document is expected to be a requirement of individual delivery contracts. Application-Specific o A requirement which may not be relevant or applicable to every implementation of the ETCS. It is expected that, where a requirement is applicable, it will be applied. Satisfaction of application-specific requirements in compliance with this document is expected to be a requirement of individual delivery contracts, as appropriate to the implementation being considered. Preferred o A requirement of lower importance which, whilst not essential, the industry would prefer were satisfied. It is expected that, where a requirement is applicable, it will be applied. 1.5.7 Topics Satisfaction of preferred requirements in compliance with this document is not expected to be a requirement of individual delivery contracts unless explicitly specified within the relevant contract. Where applicable, the Reference Design Topic has been identified, as detailed in the Topics Lookup Table in Appendix C:. The Topic has been broken down, where applicable, into Options and Variants e.g. Topic N1-2 refers to Topic N, Option 1, Variant 2. Where the Reference Design Topic has not yet achieved Release Version status, the requirements are marked (Provisional). 1.6 Requirements Assurance Requirements assurance has been explained in the ETCS Requirements Assurance Statement [RD12]. 1.7 Requirements Change The ETCS Requirements Change Management Process [RD13] will be used to raise Change Requests (CRs) to amend existing requirements or add new requirements. 1.8 Areas for Development Noting that this document represents the best understanding of the needs of GB s rail network at the time of publishing, it is recognised that there are a number of areas where the document may be deficient. New deficiencies may be identified as understanding of the ETCS develops, as well as areas being closed out through further work being undertaken. The current known areas of deficiency are listed in Appendix D: NETWORK RAIL Page 7 of 61
2 OPERATIONS SUB-SYSTEM REQUIREMENTS 2.1 Scheme-Specific This section contains specific requirements relating to the scheme design for individual routes. Locations where the driver is authorised to apply different speeds or distances to the National Values shall be documented. EOPSS-773 Rationale: To ensure that drivers understand where different speeds or distances to the National Values (NV) are applicable. Guidance: Documentation may include Sectional Appendix, local advice notices, or electronic notification. Topics: A4 Safety Locations where the driver is normally required to select Level 2 manually shall be clearly documented and communicated to the relevant users. EOPSS-781 Rationale: This is to raise users' awareness of where a manual switchover to Level 2 is likely to occur. Safety requirement for hazard N-H052a Topics: N3 The speed units in use at each location shall be published. EOPSS-785 Rationale: Drivers, signallers and maintainers need access to this information. Guidance: This addresses the need to identify locations where speed units change as there may be a need on some journeys to change to and from km/h or mph. Speed units could be published in the Sectional Appendix. Topics: Z2 2.2 Movement Authority, Modes & Levels This section contains specific requirements relating to the GB operational basis for mode and level selection. 2.2.1 Start of Mission Where it is deemed necessary, Infrastructure Managers and Railway Undertakings shall document, by agreement, any location-specific processes and instructions for an ETCS Start of Mission (SoM). EOPSS-125 Rationale: There is a need for some location-specific processes and instructions concerning a driver entering a cab and performing Start of Mission, including the actions of the driver, where SoM is affected by unexpected or abnormal conditions. This will ensure that operations are not constrained by lengthy Start of Mission processes during normal and degraded working. Guidance: For example, commencing SoM before it is necessary to do so might, at some NETWORK RAIL Page 8 of 61
locations, prevent legitimate and more immediate connections to the RBC from taking place due to capacity constraints. Also, where there is a temporary reduction in Radio Block Centre (RBC) connection capacity, there needs to be a process whereby this is managed between the Railway Undertaking (RU) and Infrastructure Manager (IM). Note: The term Railway Undertaking is used within the Operational Sub-System to indicate any Train Operating Company (TOC) / Freight Operating Company (FOC) which operates over the route where the ETCS has been deployed. Topics: G1-1, G1-2, G2, G3-1, G3-2, G3-3, G4-1, G4-3, G5 2.3 Degraded and Emergency This section contains requirements specific to degraded and emergency working. Railway Undertakings shall detail arrangements, considerations and instructions for defective, traction-specific on-board equipment, including brakes. EOPSS-61 Rationale: To ensure that there are instructions and guidance for drivers and fleet engineers concerning the arrangements for dealing with defective on-board equipment. Guidance: Information could be published within the RU s Defective On-Train Equipment (DOTE) documentation. Railway Undertakings shall document the operating procedures concerning a driver operating a train where not authorised or competent to do so. EOPSS-62 Rationale: To ensure that, in the event of a driver being in control of a train that is operating in a mode / level in which the driver is not authorised to operate, procedures are in place to rectify the situation. Topics: T1, T2 Railway Undertakings shall specify, within the Defective On-Train Equipment (DOTE) instructions, the operating procedures following partial or full failures of a Driver Machine Interface (DMI). EOPSS-63 Rationale: To ensure that each Railway Undertaking analyses and documents tractionspecific instructions concerning the decisions and processes for managing a train with full or partial DMI failure. Guidance: The DOTE instructions operating procedures will need to include failures where a DMI shows incorrect speed units e.g. mph instead of km/h. Railway Undertakings shall define, within company operating procedures, the process for recovery from Isolation (IS). EOPSS-66 Rationale: To ensure that, where Operational Rules, Instructions and Procedures detail the use of IS, there are suitably competent and qualified persons available, acting NETWORK RAIL Page 9 of 61
with appropriate authority to recover from IS. Guidance: There is an operating procedure to recover from IS. 2.4 Data Within the Defective On-Train Equipment instructions, Railway Undertakings shall detail traction-specific instructions concerning Isolation (IS) in an overlay environment and its interface with Class B systems. Rationale: To ensure that instructions exist for drivers concerning the use of IS. Railway Undertakings shall define and detail traction-specific procedures for level/mode selection following an ETCS reset. Rationale: To ensure that there are clear processes that permit recovery from an ETCS reset. EOPSS-71 EOPSS-155 Railway Undertakings shall specify, within Driver User Procedures and Defective On Train Equipment instructions, considerations and instructions concerning what actions to take when on-board equipment is identified as defective. Rationale: To ensure that instructions and guidance existfor drivers and fleet engineers concerning the arrangements for dealing with on-board equipment defects. Railway Undertakings shall review their policies for the operation of trains with defects. EOPSS-156 EOPSS-784 Rationale: The maximum speed of movements for various defects and safety system faults needs to be defined in both mph and km/h. Safety requirement from hazard Z2- H010. Topics: Z1-2 This section contains requirements specific to data. Pre-set and manual data entry for use by operators shall be validated as far as technically practicable. EOPSS-54 Rationale: To ensure that consideration is given to data validation and the point of entry. Topics: Z1-1, Z1-2 The processes and procedures for train data entry shall be subject to formal ergonomics and human factors assessment. EOPSS-55 NETWORK RAIL Page 10 of 61
Rationale: To ensure that the processes and procedures for train data entry take into account ergonomic and human factors, and also that suitable mitigatory controls are employed. Topics: Z1-1, Z1-2 Railway Undertakings shall provide drivers with short dial numbers for each RBC. Rationale: To ensure that numbers are available for dialling the RBC manually, where required. Topics: R1 EOPSS-58 Railway Undertakings shall make one pre-set brake value available on the Driver Machine Interface (DMI) for use in shunting movements. EOPSS-60 Rationale: A pre-set value is required to allow shunting movements within yards and sidings. Railway Undertakings shall provide one pre-set value on the Driver Machine Interface (DMI) that represents the maximum number of isolated brakes, as specified within the Defective On- Train Equipment contingency plans. EOPSS-68 Rationale: To ensure that the braking curve is sufficient for the worst-case scenario for the train. Driver workload and error rate is reduced when compared to flexible data entry. It is the fastest method of data entry. Topics: Z1-1 Downloads from ETCS equipment shall be available in an easily readable and usable format. EOPSS-39 Rationale: To ensure that all data downloads that become available as a result of an ETCS application are in a common format, humanly readable, and standardised across the user base. Guidance: Consideration should be given to achieving compatibility with other data recorders generally used for operational purposes. Topics: HH The distances published in the Route Book shall match those displayed on the location signs. EOPSS-1297 Rationale: It is important that the information provided within the Route Book follows the original information provided at the trackside. Guidance: The Route Book may be the Sectional Appendix or other documentation introduced by the industry. Topics: AA5 NETWORK RAIL Page 11 of 61
2.5 Security This section contains requirements specific to security. Operational procedures shall be developed to enable efficient and secure key management by the Key Management Centre (KMC) operators and Onboard and RBC maintainers. Rationale: To allow the relevant operators and maintainers to carry out their duties efficiently. Topics: EE1, EE2 2.6 People Issues 2.6.1 Workload/People/Training This section contains requirements specific to people. EOPSS-923 Additional guidance may be obtained from the National ETCS Ergonomics Strategy [RD16]. A signaller's workload and ergonomic assessment shall be undertaken during development and deployment of each workstation. EOPSS-4 Rationale: Human factors implications of a TM/ETCS workstation need to be considered and appropriate controls employed to mitigate any issues. Railway Undertakings shall align their professional driving policies to the scheme design layout to which they apply. EOPSS-994 Rationale: To ensure that the professional driving policies for ETCS areas are consistent with the supervision provided by the ETCS and do not retain material that is only relevant to conventionally-signalled areas. Guidance: Areas of Professional Driving Policy to review include the stand back distance from marked Ends of Authority. Topics: A1-1 Competence management strategies and frameworks shall recognise ETCS skill fade and make provision for managing infrequent application. EOPSS-167 Rationale: To ensure that competence management processes recognise the potential and impact of skill fade and that the competence framework employs suitable controls. Railway Undertakings shall establish guidance for their drivers on when the driver should toggle on the extra information in On Sight (OS). Rationale: To provide the information only when it is relevant and safe to do so. EOPSS-772 NETWORK RAIL Page 12 of 61
Guidance: It may not be relevant or safe to toggle the Driver Machine Interface (DMI) display at certain points during Start of Mission or Permissive moves. Topics: A1-2, H1, H2, I, U2 Railway Undertakings shall define when it is permissible to change the Driver ID or Train Running Number (TRN) whilst the train is in motion. Rationale: To allow Railway Undertakings to accommodate this process within their operating procedures. EOPSS-843 Railway Undertakings shall specify within Professional Driving Policy the driving style to be adopted when leaving an ETCS area and entering a non cab-signalled area. Rationale: The change from cab-signalling to driving to external signals in a non cabsignalled area requires the driver to be alert to hazards. Guidance: Non cab-signalled areas include depots and sidings. Topics: O3 EOPSS-873 Railway Undertakings shall define within operating procedures when it is acceptable to leave a cab unattended with an open driving desk. EOPSS-919 Rationale: To ensure that a train is maintained in the highest level of security. Guidance: The driving desk will normally be closed at the end of the train s journey, causing the ETCS Onboard European Vital Computer (EVC) to report the End of Mission (EoM), thus initiating the termination of the communication session with the RBC. Topics: C 2.7 Whole Life Management 2.7.1 Maintenance This section contains requirements specific to maintenance. Information from all elements of the ETCS shall be made available to support operational and maintenance activities. EOPSS-82 Rationale: The capability to download data remotely should be provided, as necessary, to enable signallers and maintainers to understand the status of the ETCS. 2.7.2 Diagnostics This section contains requirements specific to diagnostic facilities. Signallers shall be informed of any faults or failures that affect train running. Status: Normative EOPSS-59 NETWORK RAIL Page 13 of 61
Rationale: To ensure that, where a technician becomes aware of a failure that is affecting train running, they contact the appropriate Railway Operating Centre (ROC) and inform the signaller in order that an appropriate method of degraded working can be safely and promptly implemented. 2.8 Implementation Requirements 2.8.1 Transitions Local Instructions for the signaller shall make provision for the scenario where a train needs to be routed out of an ETCS area where no running transition facilities are provided. EOPSS-56 Rationale: There will be scenarios where routes out of ETCS areas will not be used by trains operating in ETCS Level 2 on a regular basis. These routes may not justify the provision of running transition facilities but will still be available for abnormal working. Instructions will be required to ensure clear and consistent operating practices. Guidance: The scenario addressed by this requirement is that in which a train needs to be routed out of an ETCS area, with the movement controlled by a signal and where no running transition is provided. If application of this scenario becomes common practice, then a formal national rule would need to be considered. Topics: N1-1, N2-1, N2-2, O1, O2-1, O2-2, O3 Speed restrictions shall be published in metric and imperial units on an overlay ETCS implementation. Rationale: To ensure that the speed restriction information is published in speed units appropriate to both ETCS-fitted and ETCS-unfitted vehicles. Topics: F2 EOPSS-69 Operational Rules and Instructions shall make provision for reverting to Level NTC and the return to Level 2. EOPSS-83 Rationale: To enable movements in areas where Level 2 is not available or where drivers are not trained to drive in Level 2. Topics: G3-4, N3, O2-2 2.8.2 Design Rules This section contains the requirements specific to the design guidance. The train dispatch risk assessment shall be reviewed for ETCS operation. EOPSS-1003 Rationale: The risks associated with train dispatch may be affected by the removal of lineside signals. Guidance: The processes described in RIS-3703-TOM Issue 2 - Rail Industry Standard for Passenger Train Dispatch and Platform Safety Measures [RD19] should be followed with the initial premise that there will be no lineside indicators. NETWORK RAIL Page 14 of 61
Topics: D1, D3 Site-specific operating rules shall be developed for the management of train movements into an unsignalled area (e.g. a depot). EOPSS-1004 Rationale: To clarify the actions to be undertaken by a signaller before setting a route into a depot or other unsignalled infrastructure. Guidance: A signaller's authority for a train to enter the site can be verbal or shunter s acceptance; the ongoing movement can be controlled under either shunter s authority or driver checks. Topics: O3 For each section of line where it is proposed that drivers will be authorised to enter a higher Staff Responsible (SR) ceiling speed, then a risk assessment for the higher speed shall be undertaken. EOPSS-1007 Rationale: The default trackside design allows for an overrun at an ETCS Stop Marker at the GB National Value Ceiling Speed for SR (V_NVSTFF). An increase in speed could require alteration to the trackside design or operational rules. Topics: U6 3 REQUIREMENTS FOR THE CONTROL LAYER Speed restriction planner training shall make provision for the relationship of restrictions to ceiling speeds imposed by bespoke and National Values. EOPSS-227 Rationale: Planner training to cover dealing with speed restrictions between National Value for Staff Responsible (SR) ceiling speed and proposed bespoke SR ceiling speed for planned degraded working. Topics: F1, F2 Tools shall be provided to aid personnel placing speed restriction boards in achieving consistency with ETCS speed restrictions details. EOPSS-774 Rationale: To provide consistent information for both Level 2 and Level NTC operated trains. Guidance: Due to trackside conditions, the location of the speed boards and the position of an ETCS speed restriction may not be contiguous. Topics: F2 Temporary Speed Restriction (TSR) data from the TSR system shall be available to all roles that require TSR information on the railway under their responsibility. Rationale: To provide access to TSR information for those who need it (i.e. signaller, planner, and maintainer). Topics: F1, F2 EOPSS-786 NETWORK RAIL Page 15 of 61
Operating rules shall support the application of a Temporary Speed Restriction (TSR) in a straightforward and timely manner. Rationale: To allow the speed of trains to be reduced when required. Topics: F1, F2 EOPSS-925 Where a Temporary Speed Restriction applies within an unfitted site, the speed restriction shall also be applied within the ETCS area for a minimum of 50m on approach to the transition boundary. EOPSS-997 Rationale: The train needs to be controlled to an appropriate speed to enter the unfitted area, and changes of speed should be avoided in situations where the driver is required to observe potential hazards ahead. Guidance: Typical unfitted areas would be stabling facilities, train depots and yards. Sitespecific procedures should be produced. Topics: F1, F2 4 REQUIREMENTS FOR OPERATIONAL RULES The Written Order authorisation from the signaller shall end at an End Of Authority (EOA) marked with an ETCS Stop Marker or lineside stop signal. EOPSS-1005 Rationale: The extent of a movement under the authorisation of a Written Order must be clearly visible to the driver. Guidance: Before providing authority to proceed, Signallers must ensure that the route up to the next ETCS Stop Marker is secured for the train movement. Topics: S5-1 Operational Rules and Instructions shall make provision for immediate and subsequent actions by signallers and persons in charge of movements where a vehicle or train is proceeding without authority on an ETCS railway. EOPSS-109 Rationale: To ensure that a process and instructions exist that guide the action of drivers and signaller concerning a vehicle proceeding without authority, in order to make the railway safe and ensure a swift recovery, recognising the capabilities and functionality of the ETCS. Operational Rules and Instructions shall make provision for the scenario where a train has stopped short of the End of Authority (EOA) due to odometry over-reading. EOPSS-110 Rationale: In this scenario, Operational Rules and Instructions are required to guide drivers and signallers in recovering from the situation. Topics: E2 NETWORK RAIL Page 16 of 61
Operational Rules and Instructions shall make provision for system recovery should ETCSfitted trains develop faults prior to, or during, a journey. EOPSS-111 Rationale: To ensure that there is a process and instructions to guide train preparers and drivers concerning the discovery of faults and failures of the train and its associated systems (including the ETCS). Operational Rules and Instructions shall make provision for managing isolated Automatic Warning System (AWS) / Train Protection and Warning System (TPWS) failures on overlay and Level 2 ETCS implementations. EOPSS-112 Rationale: To ensure that the safeguards provided by the ETCS are reflected within the instructions for running with defective or isolated AWS / TPWS, and that due regard is given to the supervision and protection in an exclusively Level 2 ETCS area and on an overlay application. Topics: O2-1, O2-2 Operational Rules and Instructions shall make provision for running with, and actions on, Driver's Safety Device failures. EOPSS-113 Rationale: To ensure that a process and instructions define the conditions, responsibilities of train preparers and drivers, and safeguards when operating with Driver s Safety Device failures, and that the capabilities and functionality of the ETCS are reflected accordingly. Operational Rules and Instructions shall make provision for driver reaction where conflicting speed and distance information is presented to the driver. EOPSS-114 Rationale: To ensure that, where a driver is presented with conflicting speed or distance information, a process and instructions exist to manage the scenario safely and permit suitable recovery. Operational Rules and Instructions shall make provision for failures that affect transition. EOPSS-115 Rationale: To ensure that, where a fault or failure of the infrastructure or on-board equipment prevents the intended transition process, clear instructions are provided to inform the signaller and driver concerning immediate and subsequent actions. Topics: N1-1, N2-1, N2-2, O1, O2-1, O2-2, O3 NETWORK RAIL Page 17 of 61
Operational Rules and Instructions shall make provision for degraded Movement Authority on an Overlay ETCS Level 2 route where Proceed on Sight Authority (PoSA) functionality is not provided. EOPSS-117 Rationale: To ensure that the operational considerations concerning the issue of a degraded Movement Authority are documented and a process and instructions exist regarding its use, authority, and the responsibility of the driver on receipt. Topics: G3-1 Operational Rules and Instructions shall make provision for the passing of multiple ETCS Stop Markers on the authority of a single Written Order. EOPSS-118 Rationale: To ensure that there are published instructions that define the authority required, the process to follow, and the records that must be maintained when passing multiple Stop Markers on the authority of a single Written Order. Topics: A4, U5 Operational Rules and Instructions shall make provision for reversion to Level NTC where a Movement Authority cannot be issued on an Overlay implementation. EOPSS-119 Rationale: To ensure that there is a process and instructions defining when it is appropriate to revert to Level NTC, and how this is achieved, and detailing the safeguards that the signaller and driver must employ to ensure that the subsequent movement is safe. Topics: G3-4, O1, O2-2, O3 Operational Rules and Instructions shall make provision for the driver selecting a new ETCS Level. EOPSS-120 Rationale: This includes the process that specifies how a train that had previously reverted to Level NTC returns to Level 2. This enables movement in areas where Level 2 is not available or where drivers are not trained to drive in Level 2. It ensures that there is a process and instructions defining when it is appropriate to change to Level NTC and how this is achieved, and detailing the safeguards that the signaller and driver must employ to ensure that the subsequent movement is safe. Guidance: An example would be where a Movement Authority cannot be issued to a train in an overlay area. Topics: N3, O2-2 Operational Rules and Instructions shall make provision for the actions to be taken by drivers following a loss of Global System for Mobile Communications Railway (GSM-R) data on an ETCS Level 2 Overlay application. EOPSS-121 Rationale: To ensure that clear instructions exist detailing the driver action required and their subsequent responsibilities where a loss of GSM-R data has occurred. NETWORK RAIL Page 18 of 61
Topics: G5 Operational Rules and Instructions shall make provision for operations where failures have occurred to multiple block sections on an ETCS Level 2 and Level 2 Overlay application. EOPSS-122 Rationale: To ensure that a process and instructions exist defining how trains are to be operated over an area affected by a signalling equipment failure that prevents Movement Authorities from being issued. Guidance: The current equivalent would be covered by Temporary Block Working. Operational Rules and Instructions shall make provision for driver and signaller actions and interactions when becoming aware of a failure of lineside ETCS equipment. EOPSS-123 Rationale: To ensure that faults and failures on the trackside are reported, protected and appropriate, and that safe methods of work are implemented to deal with the failure. Guidance: Lineside ETCS equipment includes signage, signalling and balises. Driver training shall include propelling movements and movements where the vehicle is driven from an on-board location other than from the leading cab on an ETCS railway. EOPSS-124 Rationale: To ensure that drivers are aware that current Operational Rules and Instructions apply to these movements on an ETCS railway. Topics: U7 Operational Rules and Instructions shall make provision for wrong direction movements on an ETCS railway. EOPSS-126 Rationale: To ensure that there is a process and instructions specifying the authority required, and the safeguards before and during the movement, taking into account the functionality and capability of the ETCS on a Level 2 and Overlay application. Guidance: These Operational Rules and Instructions would be National but would not need to be applied where bidirectional operation (Bi/Di) is not implemented. Operational Rules and Instructions shall make provision for the use and management of Isolation(IS). EOPSS-127 Rationale: To ensure that IS is authorised, selected appropriately, and managed safely. NETWORK RAIL Page 19 of 61
Operational Rules and Instructions shall make provision for the driver and signaller actions and interactions where signals received at the line side conflict with information and indications displayed on the Driver Machine Interface (DMI) in an ETCS Overlay area. EOPSS-128 Rationale: Where there is a conflict between lineside signals and the DMI, it is important that Operational Rules provide a process and instructions for the initial and subsequent actions of the signaller and driver. Topics: G3-4 Operational Rules and Instructions shall make provision for operating in areas on an ETCS railway affected by low adhesion. EOPSS-129 Rationale: To ensure that there is a process and instructions specifying how trains are signalled on an ETCS railway affected by low adhesion, and that any specific ETCS considerations are defined. Operational Rules and Instructions shall make provision for the transmission of information to a driver using a GSM-R berth triggered broadcast. EOPSS-130 Rationale: To ensure that, with suitable consideration and controls, Operational Rules and Instructions define a process whereby signallers can instruct the drivers of trains to proceed at caution via a berth triggered broadcast, which minimises two-way voice communications and realises performance benefits. Operational Rules and Instructions shall make provision for conditions that must be met before allowing a train to approach defective or missing ETCS equipment or signage. EOPSS-131 Rationale: To ensure that an area affected by any missing, damaged or defective ETCS lineside equipment is protected and that the instructions define conditions that must be met before allowing an ETCS-fitted train to approach. Operational Rules and Instructions shall make provision for the issue of a Full Supervision (FS) Movement Authority with an On Sight (OS) profile. Rationale: To ensure that the occasions when it is safe and appropriate to issue an FS Movement Authority with an OS profile are detailed within Operational Instructions and, additionally, signallers and drivers responsibilities in this respect are detailed. Topics: A2-2, H1, H2, I, JJ5 Operational Rules and Instructions shall make provision regarding the award of Shunting (SH). EOPSS-132 EOPSS-134 NETWORK RAIL Page 20 of 61
Rationale: To ensure that clear instructions concerning the awarding and receiving of an SH Movement Authority give clear guidance to signallers and drivers, so that it is used appropriately and safely, and its supervision limitations are fully understood and taken into account; additionally, the need for signaller / driver communications regarding the award are defined. Topics: G4-1, G4-3, U5 Operational Rules and Instructions shall make provision for dealing with telephone failures at level crossings on an ETCS railway. EOPSS-135 Rationale: To ensure that there are Rules and Instructions concerning normal and degraded mode working over level crossings that take into account ETCS railway operation. Topics: JJ7, JJ8 Operational Rules and Instructions shall make provision for movements made over defective level crossings. EOPSS-136 Rationale: To ensure that appropriate levels and modes are authorised over a defective level crossing, taking into account the nature of level crossing failure, the protection afforded by the ETCS, and the additional responsibilities of signallers and drivers when preparing for and making the movement. Topics: JJ8 Operational Rules and Instructions shall make provision for using a train to check that the line is clear on an ETCS railway. EOPSS-137 Rationale: To ensure that a process and instructions exist that make provision for line examinations on an ETCS railway using the most appropriate level and mode to provide the highest level of supervision available. Topics: U2 Operational Rules and Instructions shall make provision for the imposition of blanket speed restrictions on an ETCS railway. EOPSS-138 Rationale: To ensure that the rules, regulations and instructions make provision for the imposition of blanket speed restrictions, and that these restrictions, in particular, can be notified to drivers by GSM-R broadcast, in order to meet performance targets and achieve safety benefits. Topics: F1, F2 Operational Rules and Instructions shall make provision for movable speed restrictions on an ETCS railway. EOPSS-140 Rationale: To ensure that moving engineering work protected by movable or 'dagger' speed restrictions is safe and that the capabilities and functionally of the ETCS are NETWORK RAIL Page 21 of 61
Topics: taken into account. F1, F2 Operational Rules and Instructions shall make provision for rail grinding and milling outside of possessions on an ETCS railway. EOPSS-141 Rationale: To ensure that the rail grinding and milling outside of possessions can take place on an ETCS railway. Operational Rules and Instructions shall make provision for the protection of obstructions on an ETCS railway. EOPSS-142 Rationale: To ensure that there are published instructions detailing the immediate and subsequent actions required of signallers when becoming aware an obstruction of a running line of and protecting that obstruction. Topics: J3 Operational Rules and Instructions shall make provision for immediate and subsequent actions following an ETCS trip. EOPSS-144 Rationale: To ensure that there is a procedure to be followed immediately after a train has tripped, and that the actions and responsibilities of drivers and signallers post-trip are specified so that the railway is made safe and any subsequent movements are authorised and made, safely and appropriately. Topics: G5, J3, J4 Operational Rules and Instructions shall make provision concerning the necessity to appoint a responsible person during degraded mode working. EOPSS-145 Rationale: To ensure that there is a process to assess the need for the appointment of a responsible person during degraded mode working. Operational Rules and Instructions shall make provision for train movements where a Movement Authority cannot be issued on non-overlay applications. EOPSS-146 Rationale: To ensure that, where a Movement Authority cannot be issued on non-overlay applications, subsequent movements are authorised and made in the highest mode of supervision possible. Topics: A4, G3-1, U6 Operational Rules and Instructions shall make provision for operation in areas known to be affected by RBC connection failures. EOPSS-147 NETWORK RAIL Page 22 of 61
Rationale: To control and manage trains through the affected section. Guidance: Consider restricting the issue of Movement Authorities into these areas. Topics: R1 Operational Rules and Instructions shall make provision for actions following the loss of Global System for Mobile Communications Railway (GSM-R) data. EOPSS-148 Rationale: To ensure that, following GSM-R data loss, there are instructions and a process for drivers and signallers to follow that permit a train to continue on its journey with the highest level of supervision available. Topics: G3-1, G3-4 Operational Rules and Instructions shall make provision for the need for, and meaning of, lineside signage used to denote speed restrictions. EOPSS-149 Rationale: Operational Rules and Instructions are required to ensure that drivers are aware of the speed at which trains are required to pass through the restriction. Guidance: There are certain modes where drivers will not receive Temporary Speed Restriction (TSR) information. Topics: F1, F2, AA3 Operational Rules and Instructions shall make provision for degraded mode working on an ETCS railway. EOPSS-150 Rationale: To support movements where local conditions do not allow for ETCS operation at the highest level of supervision. Topics: G2, G3-1, G3-4, U6, AA1 Operational Rules and Instructions shall make provision for the duties and responsibilities of any responsible person appointed in connection with degraded mode working. EOPSS-151 Rationale: To ensure that, where a responsible person is appointed in connection with degraded mode working, the responsibilities and authority of this person are clearly defined. Operational Rules and Instructions shall make provision for the signaller to use RBC data to establish the location of a train. EOPSS-152 Rationale: To ensure that signallers take account of the location of trains in carrying out their duties. Guidance: To assist signallers in understanding that the position given by the RBC, whilst being the best information available, may not always be up to date. Topics: II, JJ3 NETWORK RAIL Page 23 of 61
Operational Rules and Instructions shall make provision for a driver manually amending a ceiling speed in Staff Responsible (SR). EOPSS-154 Rationale: To ensure that a process exists for authorising and amending SR ceiling speeds. Topics: A4 The process for the generation of an RT3973 form shall be reviewed with the introduction of the ETCS. EOPSS-777 Rationale: To avoid ceiling speed interventions on transition to ETCS operation. Guidance: For example, in a non-etcs area, the RT3973 form requires 50mph (80km/h), but in an ETCS area, the axle load speed profiles require trains heavier than a certain value to be restricted to 25km/h (15 mph). The RT3973 form would need to advise of the need to decrease to 15mph on the approach to the transition border. Topics: N2-1, N2-2 Each Railway Undertaking s Professional Driving Policy shall be updated to take driver anticipation into account. EOPSS-898 Rationale: To minimise the likelihood of drivers anticipating the need to brake / cut traction power. Topics: A1-1 Journeys made in Staff responsible (SR) shall take place when authorised by the signaller. Rationale: To ensure safe and consistent train movement. Topics: A2-1, A4, G3-1 EOPSS-899 Operational Rules shall define the signaller / driver procedure for movements in Override. EOPSS-901 Rationale: To ensure that signallers and drivers follow clear and consistent communication protocols. Topics: A4, G3-1, U6 Operational Rules shall define the actions to be taken by the signaller before authorising Override. Rationale: To ensure safe train movement. Guidance: Such actions include, for example, setting routes. Topics: A4, G3-1, U6 EOPSS-902 NETWORK RAIL Page 24 of 61
Operational Rules and Instructions concerning possessions shall apply consistently to both ETCS Level 2 with, and without, signals. EOPSS-903 Rationale: During the Reference Design activity there was agreement for possession rules to be applied to ETCS Level 2 with, and without, signals as this allows operational consistency. Topics: B Note: EOPSS-904 has been removed as it is now considered that the Rule Book contains adequate provision for possessions on an ETCS railway. Operational Rules and Instructions shall specify that trains approaching, entering or exiting a possession will be compatible with, and supervised by, the ETCS or Class B systems. EOPSS-905 Rationale: This is to ensure that trains approaching or departing from possessions are supervised to or from the limits of the possession. Guidance: For ETCS Level 2 with lineside signals, both fitted and unfitted trains can approach, enter, or exit a possession. For ETCS Level 2 without lineside signals, any unfitted trains will need to be hauled in by an ETCS-fitted locomotive. Topics: B Safety Driver training shall include entering, working within, and exiting a possession of the line on an ETCS railway. EOPSS-909 Rationale: Shunting (SH) allows trains to move forwards and backwards from the leading cab. ETCS Level 0 inhibits the train from being brought to a stand by Stop if in SR and Stop if in SH messages. Also, exiting SH requires the driver to enter / revalidate train data, which is important as train data is likely to require update. Before proceeding past an entry Possession Limit Board (PLB) (on fitted or unfitted infrastructure), the driver of a fitted train will select Level 0 SH. Safety requirement for hazards B-H007a, B-H007b, B-H012 and B-H013. Guidance: It is an assumption that possession limit boards will not remain a standard feature of possession. Further, this requirement is aimed at drivers who will be driving trains in connection with possessions only. When a fitted train is to exit the possession to fitted infrastructure, the driver will manually exit SH via the Driver machine Interface (DMI) to enter Standby (SB). The driver will then select ETCS Level 2 at the exiting PLB or at the ETCS Stop Marker / ETCS Location Marker / signal if the possession is given up around the train; they will then press Start. Topics: B Safety When a possession is taken around a train, the driver of an ETCS-fitted train shall select Level 0 Shunting (SH) or working mode prior to making any movements within the possession. EOPSS-910 Rationale: SH allows trains to move forwards and backwards from the leading cab. ETCS Level 0 prevents the train from being tripped by Class B systems, Stop if in SR NETWORK RAIL Page 25 of 61
and Stop if in SH balises. Also, it does not respond to transition orders. Furthermore, exiting SH requires the driver to enter / revalidate train data, which is important as train data is likely to require updating. Safety requirement for hazard B-H007b. NB Working mode is a mode that is used for some engineering trains to undertake their engineering work. Guidance: Working mode is only permitted in worksites. Topics: B Operational Rules and Instructions shall make provision for movements within possession worksites being made in Level 0 Shunting (SH), except when working mode is appropriate. EOPSS-911 Rationale: SH allows trains to move forwards and backwards from the leading cab. Level 0 prevents the train from being tripped by Class B systems, Stop if in SR and Stop if in SH balises. Also, it does not respond to transition orders. Additionally, exiting SH requires the driver to enter / revalidate train data, which is important as train data is likely to require updating. NB Working mode is a mode that is used for some engineering trains to undertake their engineering work. Topics: B Operational Rules and Instructions shall make provision for movements between worksites always being made in Level 0 Shunting (SH). EOPSS-912 Rationale: This requirement is to prevent an engineering train from operating in working mode when moving between worksites as this is not a permitted operation. NB Working mode is a mode that is used for some engineering trains to undertake their engineering work. Topics: B Safety Driver training shall include movements when entering and exiting a possession. EOPSS-914 Rationale: To ensure that drivers can control a train safely when driving into and out of an engineering possession. Safety requirement for hazard B-H013. Guidance: When a fitted train is to exit a possession to unfitted infrastructure, the driver will exit Shunting (SH) mode manually via the DMI to enter Standby (SB). The driver will then select Level NTC at the exiting Possession Limit Board (PLB) or at the ETCS Stop Marker / ETCS Location Marker / signal if the possession is given up around the train. The process for manually selecting Level 2 through the Start of Mission process is described in Topic N3. The process for data entry and then pressing start is described in Topic G. Topics: B, N3 NETWORK RAIL Page 26 of 61