Guidance Note: Prevention and Mitigation of Overruns Risk Assessment

Transcription

1 Guidance Note: Prevention and Mitigation of Overruns Risk Assessment Synopsis This document provides guidance on meeting the requirements of Railway Group Standard GI/RT7006. Signatures removed from electronic version This Guidance Note has been produced by Marie Marks Standards Project Manager Authorised by Brian Alston Controller, Railway Group Standards This document is the property of Railtrack PLC. It shall not be reproduced in whole or in part without the written permission of the Controller, Railway Group Standards, Railtrack PLC. Published by: Safety & Standards Directorate Railtrack PLC Evergreen House 160 Euston Road London NW1 2DX Copyright 2000 Railtrack PLC

2 This page has been left blank intentionally

3 of Overruns - Risk Assessment Page 1 of 45 Contents Section Description Page Part A Issue Record 2 Technical Content 2 Application 2 Health and Safety Responsibilities 2 Supply 2 Part B 1 Purpose 3 2 Scope 3 3 Definitions 4 4 Assessment of Overrun Risk During Track Layout and Signalling Design 5 5 Operational Use of Infrastructure 15 6 Review of Overrun Risk in Existing Layouts 17 7 General Requirements for Overrun Risk Assessments and Reviews 19 Appendices A Overview of the Overrun Risk Assessment Process for Track and Signalling Design 23 B Good Practice for the Design of Track Layouts and the Positioning of Signals 24 C Application of the Low Risk Criteria 26 D Detailed Assessment of Overrun Risk 30 E Overrun Risk Reduction Measures 39 F Use of Layout Risk Method for Signal Overrun Assessment 44 References 45 RAILTRACK 1

4 Page 2 of 45 Uncontrolled When Printed of Overruns Risk Assessment Issue Record Part A This document will be updated when necessary by distribution of a complete replacement. Revisions in the reissued document will be marked by a vertical black line in the right hand margin adjacent to the revision. Issue Date Comments One December 2000 Original Document This supersedes GK/GN0678 and GK/RC0578 Technical Content Approved by: Francis How, Principal Signalling & Telecoms Engineer, Railtrack S&SD Enquiries to be directed to the Industry Safety Liaison Dept. Tel: Application s are non-mandatory documents providing helpful information relating to the control of hazards and often set out a suggested approach, which may be appropriate for Railway Group members to follow. Health and Safety Responsibilities In issuing this document, Railtrack PLC makes no warranties, express or implied, that compliance with all or any document published by the Safety & Standards Directorate is sufficient on its own to ensure safe systems of work or operation. Each user is reminded of its own responsibilities to ensure health and safety at work and its individual duties under health and safety legislation. Supply Controlled and uncontrolled copies of this document may be obtained from the Industry Safety Liaison Dept, Safety & Standards Directorate, Railtrack PLC, Evergreen House, 160 Euston Road, London, NW1 2DX. 2 RAILTRACK

5 of Overruns - Risk Assessment Page 3 of 45 1 Purpose Part B This document provides guidance on meeting the requirements of Railway Group Standard (RGS) GI/RT7006 prevention and mitigation of overruns risk assessment. GI/RT7006 defines the requirements for risk assessment of the design and operational use of track and signalling so as to control the risks associated with trains passing the end of their movement authority arising from driver disregard, misread or misjudgement. The mandatory requirements of GI/RT7006 are shown verbatim and boxed. 2 Scope 2.1 Subject Matter that Is Within the Scope of GI/RT The overall scope of RGSs is as specified in Appendix A of GA/RT6001. GI/RT7006 contains requirements which are applicable to the duty holders of the Infrastructure Controller category of Railway Safety Case Specifically GI/RT7006 contains requirements that are applicable to: a) the design of track layouts and fixed block signalling systems on Railtrack controlled infrastructure. b) the operational use of those layouts and signalling. Although the document refers to stop signals, this includes fixed block end of movement authorities issued to the driver via a cab signalling system (see definition of stop signal) The document requires the assessment of risk associated with the overrun of a stop signal at danger arising from: a) driver misread or disregard of signals. b) driver misjudgement of braking The accident scenarios arising from overruns that are within the scope of the document are: a) collisions with other trains (primarily those on conflicting paths, but also including rear end collisions). b) collisions with road users at level crossings. c) derailments on points and crossings. 2.2 Subject Matter that Is Not Within the Scope of GI/RT The scope of GI/RT7006 does not include: a) the control of buffer stop collision risk (see GC/RT5033). b) specific technical measures applied to the design of the infrastructure to control overrun risk (see section 4.6). c) requirements for investigation following an overrun (see GO/RT3252). RAILTRACK 3

6 Page 4 of 45 Uncontrolled When Printed of Overruns Risk Assessment d) overruns arising from low adhesion (see section 2.2.2). e) control of collision risk when a train is signalled onto an occupied line (see GK/RT0044). f) measures applicable to train operators for the control of overrun risk (eg driver training; use of driver reminder appliance; crashworthiness of rolling stock) The rationale for excluding overruns due to low adhesion (eg caused by leaf fall) from the scope of GI/RT7006 is as follows: a) It is difficult to predict whether the effects of low adhesion problems will be localised or widespread at any given site. When a train encounters a widespread area of low adhesion, as can be caused by leaf fall, a train may travel a considerable distance before coming to a stand (possibly passing more than one signal). It is not considered reasonable to expect the design of the track and signalling to cater for such eventualities. b) Low adhesion is an effect which is not necessarily present at any given site throughout the service life of the track and signalling. Indeed, in the case of leaf fall, it may well appear in the autumn of one year at a specific location, and disappear the next year. c) There are other measures (eg operational procedures see GO/RT3356 and GE/RT8040; sanding see GM/RT2461; lineside vegetation see GC/RT5202) for dealing with the problem of low adhesion, and these are considered to be the best mechanisms for coping with the problem. 3 Definitions Acceptably Low Risk Levels of risk that are: a) tolerable. b) As Low As Is Reasonably Practicable (ALARP). Area of Conflict A section of line ahead of a signal at danger on which a head-on, crossing or same direction converging collision with another legitimately positioned train (whether moving or stationary) could occur in the event of the signal being passed at danger. For the purposes of this document, the area of conflict commences where the two movements first become foul of each other (eg at points, a fixed crossing, a switch diamond crossing, or the commencement of interlaced tracks), and extends to the location where one of the following conditions is first met: a) The rear of the overrunning train is clear of the route of the authorised train movement. b) The leading end of the overrunning train reaches another stop signal that is applicable to its direction of movement. c) The leading end of the overrunning train is 100 metres beyond the Automatic Warning System (AWS) magnet of a stop signal that controls movements in the opposite direction to that of the overrunning movement. Although this definition specifically excludes a section of line on which the only possible collisions are rear end, such collisions are considered as part of the risk assessment process, and are within the overall scope of GI/RT RAILTRACK

7 of Overruns - Risk Assessment Page 5 of 45 End of Movement Authority The point at which a train is required to come to a stand on completion of a signalled movement (usually denoted by a signal at danger, stop board, buffer stop, or an in-cab instruction where cab signalling is in use). Full Overlap An overlap of at least 180 metres (or 400 metres in the case of a semaphore signal where the preceding caution signal is also a semaphore type), as defined in GK/RT0064. The definitions of reduced and restricted overlaps are set out in GK/RT0064. Operational Use The manner in which the track and signalling is used for the purposes of running trains, including factors such as: a) frequency, speed and type of train. b) direction of traffic flow. c) timetabling of trains. d) pathing of trains through the layout. e) regulation policy and rules (both those applied by signallers and those implemented via automatic route setting systems). f) platforming arrangements (eg platform allocations, stopping positions, method of authorising train departure from platforms, platform sharing). Overrun Passing the end of movement authority. On lines signalled with lineside signals, the conventional terminology for an overrun is a Signal Passed At Danger (SPAD). The definition includes both failure to come to a stand at a signal at danger, and starting from rest against a signal at danger. Stop Signal A signal which is capable of displaying a stop aspect to a train driver. For the purposes of this document, this includes not only conventional colour light and semaphore signals (main and shunt types), but also stop signs/boards, and incab end of movement authority instructions issued to the driver via a cab signalling system. Train Protection System A system that automatically applies the brakes on a train to control the risk of an overrun arising from driver error. Automatic Train Protection (ATP) systems, the Train Protection and Warning System (TPWS) and trainstops are all forms of train protection systems. The AWS does not constitute a train protection system for the purposes of this document. 4 Assessment of Overrun Risk During Track Layout and Signalling Design Traditionally UK main line signalling has catered for limited overruns as a result of braking misjudgement principally by providing overlaps beyond the stop signal. Historically these have proved sufficient to contain the majority of overruns safely. However, in a minority of cases (principally associated with driver disregard or misread), this has proved ineffective. GI/RT7006 addresses not only overrun due to misjudgement, but also the control of overrun risk in the event of disregard or misread, by the application of risk assessment techniques. Overrun risk assessment should be an integral part of the design process from conception onwards. It should not be confined to a single activity performed after RAILTRACK 5

8 Page 6 of 45 Uncontrolled When Printed of Overruns Risk Assessment the design of the track layout and signalling arrangements has been completed. It is a multi-disciplinary activity, not restricted to signal engineering issues alone. In the early phase of design, the assessment process should involve consideration of the layout as a whole and how it is to be used. As the design is developed and refined, the assessment will need to focus in greater detail on specific risks at individual signals. It may have to be performed in an iterative manner as options are evaluated and selected/discarded during the design process. One important reason for not designing the track layout and signalling and then evaluating the overrun risk afterwards is that such an approach cannot provide assurance that the solution is genuinely As Low As Reasonably Practicable (ALARP) in terms of risk. It is only by considering the relative merits of various options during the design process that the selected option can be demonstrated to present a level of risk that is ALARP. As well as including risk reduction measures that meet the ALARP criteria, consideration should also be given to the inclusion of other measures if they reduce overrun risk at a cost which is small compared with the total cost of the project, even though they would not be included if they were judged simply against the ALARP criteria. The processes by which options are identified, evaluated and selected should follow a structured, formal approach, involving representatives from the relevant engineering and operational disciplines applying their professional judgement to the work in a collaborative manner. The inclusion of design review meetings within the process may be appropriate. Where existing track and/or signalling is being modified, the requirement to assess overrun risk applies irrespective of how small the modification is. However, no assessment is required where the modifications do not have any impact on overrun risk (eg where a signalling remote control system is being altered, or track not in the vicinity of signals is being slued to improve alignment). Where the modifications are expected to reduce overrun risk, this does not obviate the need for risk assessment, since there remains the obligation to ensure that the residual risk is ALARP, not simply that it is lower than it was before. 4.1 Infrastructure Design: Overrun Risk Control Objectives New and modified track layouts and signalling shall be designed so as to: a) eliminate the potential for overrun collisions and derailments, wherever this is reasonably practicable. b) make use of risk reduction measures which mitigate overrun risk to levels that are as low as reasonably practicable, wherever the potential for collision has not been eliminated. Although the legal requirement for risk control in this context is to reduce risk in accordance with the ALARP principle, it is good practice (and usually consistent with the ALARP principle) to seek to eliminate risk in preference to reducing it. Appendix A shows the recommended sequence of activities for the assessment of overrun risk for new and modified track layouts. 6 RAILTRACK

9 of Overruns - Risk Assessment Page 7 of Track Layout Options for the Control of Overrun Risk During the identification, evaluation and selection of options for new and modified track layouts, consideration shall be given to the following design features so that, together with the signalling, the risk control objectives set out in section 4.1 are achieved: a) The extent to which areas of conflict can be eliminated completely by appropriate design of the layout. b) The opportunities provided by the track layout to divert overrunning movements away from areas of conflict (eg by flank point protection; trapping; automatic restoration of points). c) The opportunities provided by the track layout to use a train protection system to bring an overrunning train to a stand before it reaches an area of conflict (principally by the provision of a sufficient length of track between the signal and the area of conflict). d) The minimisation of the time window during which a collision could occur in an area of conflict (principally by reducing the length of the area of conflict). This requirement is aimed at projects where the track layout is being altered, or a new layout provided. It is not generally relevant to projects that involve only alterations to signalling. Guidance on the control of overrun risk by appropriate choices of track layout is provided in Appendix B. The requirement to identify and evaluate track layout options during the design process involves consideration of the technical feasibility of various options, and of the operational use to which the track and signalling is intended to be put (direction of traffic flow, segregation of traffic types etc). To do this in a meaningful manner, it is necessary to make some provisional decisions about where signals will be positioned for each layout option under consideration. However, it is the intent of this document that the evaluation of the track layout options takes place before the signalling scheme plan is fully developed. The processes for complying with this section should include identification of the areas of conflict on each proposed track layout, and of the type of conflict that could occur in each area (head-on collision; crossing collision; sideways converging collision). This will then facilitate consideration of the issues listed in this section of the document. It may be possible to limit the extent to which track layout options have to be explored for each specific project, by the adoption of standard layouts that have been demonstrated generically to provide the best means of controlling overrun risk. 4.3 Signalling Options for the Control of Overrun Risk During the development of designs for new and modified signalling, the overrun risk associated with each stop signal shall be assessed, in accordance with sections 4.4 and 4.5. This requirement applies to every stop signal whose overrun risk could be affected by the project, not just those signals being provided or altered. In conjunction with the assessment, signalling options shall be identified, evaluated and selected so that, together with the track layout, the risk control objectives set out in section 4.1 are achieved. Once a track layout has been selected and signals have been provisionally positioned, the next phase of the risk assessment is to consider the overrun risk associated with each stop signal. This phase of the assessment needs to be RAILTRACK 7

10 Page 8 of 45 Uncontrolled When Printed of Overruns Risk Assessment performed as an integral part of the signalling design production process (see GK/RT0207). The boundary of the risk assessment needs first to be determined. Signals within the physical scope of the project whose overrun risk could be affected will require assessment. Signals beyond the physical area of change may also have their level of overrun risk affected by the project (eg where the driver s approach to a signal is affected by the project although the signal itself is unaltered). These signals will also require assessment. Where the project is intended to meet the needs of changing traffic levels or patterns, the changes in operational use may embrace a much larger geographic area than that of the project itself. In these circumstances, a review of the whole area affected by the traffic changes is required, in accordance with section 5.2. This will be in addition to the risk assessment of those signals directly affected by the project itself. The document permits (but does not mandate) a filtering process to be applied to the risk assessment of individual signals. This involves a simple risk assessment to identify low risk signals (section 4.4 and Appendix C), followed by a more detailed risk assessment of the remaining signals (section 4.5 and Appendix D). The purpose of such a methodology is to enable effort to be focussed on those signals where the risks are greatest, rather than having to treat all signals in the same manner. In many cases the positions of signals are constrained by the track layout, other infrastructure features and the proposed operational use. However, where there are significantly different options for the placement of signals, those options should be evaluated in terms of their overrun risk, by application of the risk assessment processes set out in sections 4.4 and 4.5. Appendix E provides a list of possible risk reduction measures. In applying measures, care should be exercised to avoid situations where risk is reduced at one signal but inadvertently increased at another one as a consequence. 8 RAILTRACK

11 of Overruns - Risk Assessment Page 9 of Signals for which a Simple Risk Assessment is Sufficient Where a simple assessment of a stop signal demonstrates that the criteria for one of the categories [(a) and (b)] listed below are met, then no further risk assessment is required, and no additional risk reduction measures need be applied. The categories and associated criteria are: a) A stop signal on plain line with no points or crossings between the stop signal and the next stop signal ahead, meeting all the following criteria: i. The signal and the associated preceding caution signal(s), and the associated AWS equipment, are compliant with the requirements of the RGSs that are in force at the time of the risk assessment and which are relevant to the control of overrun risk. ii. There are no station platforms between the stop signal and the immediately preceding caution signal. iii. It is unlikely that a driver would misinterpret another nearby signal as being applicable to his train (this applies at both the stop signal and the preceding caution signal(s)). iv. A full overlap is provided beyond the signal, with no provision made for the use of reduced or restricted overlaps (see GK/RT0064). v. There is full signal spacing (in three aspect territory) or at least one third of the signal spacing (in four aspect territory) between the stop signal and the next stop signal ahead. See GK/RT0034. vi. There are no infrastructure features between the stop signal and the next stop signal ahead that could either increase the likelihood of a collision or could significantly worsen the consequences of a collision or derailment. b) A stop signal on a line fitted with a train protection system, meeting all the following criteria: i. The signal and associated preceding caution signal(s), and the associated AWS equipment, are compliant with the requirements of the RGSs that are in force at the time of the risk assessment and which are relevant to the control of overrun risk. ii. The action of the train protection system and, where applicable, the setting and interlocking of facing points ahead of the stop signal, is such that all trains overrunning the stop signal will be routed so as to avoid, or be brought to a stand short of, all areas of conflict and all infrastructure features that could either increase the likelihood of a collision or could significantly worsen the consequences of a collision or derailment. iii. The action of the train protection system is such that all trains overrunning the stop signal will be brought to a stand so as to avoid a rear end collision with a train standing at a stop signal ahead (this criteria has to be met in respect of all routes that the train might follow after overrunning the stop signal under consideration). iv. The action of the train protection system is such that all trains overrunning the stop signal will not derail on any points or crossings ahead (this criteria has to be met in respect of all routes that the train might follow after overrunning the stop signal under consideration). RAILTRACK 9

12 Page 10 of 45 Uncontrolled When Printed of Overruns Risk Assessment In some cases it is possible to categorise a signal as having a low overrun risk associated with it. This could be because of the position of the signal in relation to the track layout and other infrastructure, and/or it could be because of risk reduction measures that have already been applied as part of the design process (eg to comply with another RGS). This categorisation process is described in GI/RT7006 as a simple risk assessment, and for a signal that falls into one of the defined categories, there is no need to undertake a more detailed risk assessment. Furthermore, there is no need to consider the application of additional risk reduction measures as part of the assessment process. However, this does not obviate the need for a signal sighting committee to consider the position and visibility of the signal and to recommend the provision of additional measures where necessary (eg long hoods to cope with sunlight problems). See GK/RT0037. The categories of signals where this simple risk assessment process can be applied, and the associated criteria, are set out in this section (4.4). Guidance on the application and interpretation of the criteria is provided in Appendix C. When this phase of the risk assessment is being undertaken, the design may not be sufficiently far advanced to be certain that the low risk criteria will be met. In such cases it is acceptable that signals are provisionally categorised as low risk. where this is supported by the information available. Any assumptions made which enable this to be done must subsequently be verified as the design is developed. If an assumption is proved to be wrong, the overrun risk for the relevant signal(s) will need to be re-assessed, and the design modified as necessary. Where a signal does not fit into a low risk category because it failed against just one or two of the criteria, it may be possible to make use of that fact to reduce the amount of detailed risk assessment that would otherwise be required, as follows: a) It might be possible to change the infrastructure design and/or its proposed operational use such that the signal does meet the criteria; or b) It might be possible to focus the detailed risk assessment primarily on the criteria against which the signal failed, thus limiting the amount of work that needs to be done. 4.5 Signals Requiring a Detailed Risk Assessment For all signals other than those in the categories set out in section 4.4, a detailed risk assessment shall be conducted which includes consideration of the following elements: a) Likelihood of an overrun occurring (see section 4.5.1). b) Extent and path of an overrun (see section 4.5.2). c) Probability of an overrun resulting in a collision or derailment (see section 4.5.3). d) Consequences of a collision or derailment (see section 4.5.4). Where signals do not fall into the categories defined in section 4.4, a more detailed risk assessment is necessary, involving consideration of the factors set out in this section (and amplified in sections 4.5.1, 4.5.2, and 4.5.4). Factors for consideration when carrying out a detailed risk assessment are listed in Appendix D. An approach for carrying out a more detailed risk assessment is shown as part of the flowchart in Appendix A. This permits a qualitative analysis of the risks, and in many cases this may be sufficient. Further guidance on qualitative assessment techniques is provided in Appendix D. 10 RAILTRACK

13 of Overruns - Risk Assessment Page 11 of 45 In more complex cases, the flowchart in Appendix A indicates that quantitative analysis may be necessary in order to arrive at conclusions about the levels of risk. Further guidance on quantitative assessment is provided in Appendix D. It should be noted that the use of the word evaluated in sections 4.5.1, 4.5.2, and 4.5.4, in relation to probabilities and frequencies, does not necessarily imply that a numerate result is required. Depending upon the circumstances, it may be adequate to use a non- or semi-numerate approach which simply places signals into probability and frequency bands. The Engineering Safety Management Yellow Book gives guidance on this. In both qualitative and quantitative assessments, it may be beneficial to test the sensitivity of the decisions regarding risk reduction measures. In particular, where a decision not to apply a risk reduction measure would be overturned by relatively minor changes to (or uncertainties in) the probabilities and frequencies, the measure should be applied on the basis that the cost is not demonstrably grossly disproportionate to the benefit. The primary focus of the risk assessment is to consider the overrun risk for trains operating in accordance with the timetable. However some consideration should also be given to the sensitivity of the risk assessment to the following factors: a) Non-timetabled movements such as freight trains. b) Disruption of the timetabled service. c) Potential increases in traffic volumes during the service life of the track and signalling. Where the effect of any of these would lead to large numbers of signals being encountered at danger on a regular basis, the implementation of further risk reduction measures may be appropriate. Not only will this help to control risk during periods of disruption and non-timetabled working, but it will also make the process of reviewing overrun risk more straightforward when significant changes to operational use are proposed (see section 5.2) Likelihood of Overrun Occurring The frequency with which trains are likely to overrun each signal at danger shall be evaluated, taking into account all the following: a) The possible routes by which the train could approach the stop signal. b) Site-specific factors affecting the likelihood of a driver failing to stop at the signal. c) Site-specific factors affecting the likelihood of a driver starting from rest against the signal at danger. d) The frequency with which trains are routed past the signal. e) The probability of a driver encountering the signal at danger. All factors that could contribute to the likelihood of an overrun occurring, whether through disregard, misread or misjudgement, should be considered at this stage. A hazard identification process, or the use of checklists, may help. A nonexhaustive list is provided in Appendix D. RAILTRACK 11

14 Page 12 of 45 Uncontrolled When Printed of Overruns Risk Assessment Extent and Path of an Overrun For each stop signal, the extent and the path of all the possible overrun scenarios shall be identified in terms of: a) which points and line(s) the overrunning train might traverse; and b) where the train might eventually come to a stand (whether by driver action, activation of the train protection system, or by derailment). The relative probabilities of each overrun scenario occurring shall be evaluated, taking into account site-specific post overrun factors that could determine the route taken by the train or affect where it might eventually come to a stand. In order to comply with this requirement, it is necessary to identify systematically the possible outcomes of an overrun in terms of where the train might go, having passed the signal at danger, and the factors that are likely to affect how quickly the train is brought to a stand. A non-exhaustive list of factors for consideration is provided in Appendix D. Consideration should be given not only to cases of driver misjudgement (where the train will usually stop within the overlap), but also cases of disregard or misread. In extreme cases of disregard or misread, the train might proceed as far as the next stop signal, although for the purposes of risk assessment, it is not generally necessary to consider the possibility of it passing that signal at danger as well, particularly if the second signal has been subject to its own overrun risk assessment Probability of an Overrun Resulting in Collision or Derailment For all the credible overrun scenarios (as identified in section 4.4.2), the probability of a collision or derailment occurring shall be evaluated, taking into account relevant factors that could affect the probability. A non-exhaustive list of factors for consideration in evaluating the probability of a derailment is provided in Appendix D. Collisions at level crossings need to be considered, as well as collisions with other trains and derailments Consequences of Collision or Derailment For each collision and derailment scenario, the credible consequences shall be identified and evaluated, in terms of injuries and fatalities, taking into account relevant factors that could determine the severity of loss. A non-exhaustive list of factors for consideration in evaluating the consequences of a collision is provided in Appendix D. Collisions at level crossings need to be considered, as well as collisions with other trains and derailments. It is recognised that an assessment of numbers of casualties can be no more than a broad estimate. Nevertheless, it is necessary to make an estimate, in order that the test of reasonable practicability can be applied to the available risk reduction measures. It is not the intent of the document to require the implementation of risk reduction measures such as improving the crashworthiness of rolling stock as a result of the risk assessment process, although clearly these factors have a bearing on the consequences of a collision or derailment. These measures are implemented via other RGSs. 12 RAILTRACK

15 of Overruns - Risk Assessment Page 13 of Extent of Application of Other Overrun Risk Controls The detailed risk assessment shall take into account the extent of application of, and degree of risk control achieved by, relevant requirements mandated in other RGSs. Where those requirements permit a risk-based approach to the extent of application of a particular risk reduction measure (for example in GK/RT0064), the risk assessment mandated by that RGS shall form an integral part of the risk assessments required by this document. Other RGSs mandate specific overrun risk reduction measures that are relevant to the design of the infrastructure, and these may be applicable to the circumstances under consideration. Provided that they are applied, it is appropriate that the risk assessment takes account of the benefits provided by these measures. A list of relevant RGSs is provided in Appendix E. Risk reduction measures applicable to trains and drivers can also be taken into account (eg GK/RT0091 driver s reminder appliance). See also the guidance supporting section Some of these other RGSs (eg GK/RT0064) mandate risk assessment in relation to the application of specific overrun risk reduction measures. It is important that such risk assessment activities form an integrated part of the all-embracing assessment processes mandated by GI/RT7006. In situations where the infrastructure is not compliant with current RGSs, and the proposals for modification do not include incorporation of the overrun risk reduction measures mandated by them, the implications of not including those measures would need to be considered as part of the risk assessment. Such situations need to be formally authorised through the non-compliance processes set out in RGSs GA/RT6001, GA/RT6004 and GA/RT6006. The risk assessment would logically form the basis for the submission of such a non-compliance. 4.7 Iteration of Design and Risk Assessment Where the risk assessment of overrun risk at signals (as required by section 4.3) indicates, even after the application of risk reduction measures, that the risk is not acceptably low, then: a) changes to the operational use shall be reconsidered; and/or b) the options for the track layout shall be reconsidered (in accordance with section 4.2) to identify ways in which the risk can be further reduced. Having applied the risk assessment process described in sections 4.3, 4.4 and 4.5, it is possible that all reasonably practicable risk reduction measures have been included but the overrun risk is still not considered to be acceptably low. In these circumstances, a further appraisal of the layout and operational use has to be undertaken in order to find other ways of reducing the risk. One option is to constrain the operational use. This could mean that the specified operational requirements cannot be met, and although not desirable, there may be some circumstances where this is necessary. Alternatively, or additionally, it may be that a re-design of some elements of the track layout will enable risks to be reduced to an acceptably low level. A change to the track design and/or proposed operational use in order to reduce risk may in turn necessitate a further assessment of the signalling arrangements (as required by section 4.3). RAILTRACK 13

16 Page 14 of 45 Uncontrolled When Printed of Overruns Risk Assessment 4.8 Review and Approval The infrastructure controller shall review and approve the outputs from the risk assessments (as listed in section 7.6), so as to be satisfied that the proposed track layout, signalling arrangements and operational use reflect the conclusions of the risk assessment and will control overrun risk to an acceptably low level. The review and approval can be undertaken as part of the processes mandated by RGS GC/RT5101. In the case of the signalling design, see also GK/RT0207. It is not the intent of this section that the review takes the form of a full check of the assessment. The emphasis should be on: a) being assured that the risk assessment processes have been applied correctly. b) being satisfied that the proposed risk reduction measures are appropriate for the level of risk. Those persons involved in the review and approval should possess the appropriate knowledge and competency for their role. The review may be delegated to another party but the approval remains the responsibility of the infrastructure controller. Full independence of the infrastructure controller s reviewers from the persons who undertook the risk assessment is not required. However, if the infrastructure controller s representatives were heavily involved in planning the risk assessment process and considering the risks associated with individual signals, it is probably not appropriate that they also conduct the review. In such cases, an independent review should be carried out on the infrastructure controller s behalf. In conjunction with this part of the process, proposed overrun risk reduction measures should be collected centrally, so as to accumulate a toolkit of good practice for use on other projects throughout Railtrack controlled infrastructure The infrastructure controller shall seek and consider the views of train operators, regarding the adequacy of the proposed arrangements from a safety perspective, before giving final approval for implementation. Whilst the infrastructure controller has final accountability for the adequacy of the infrastructure risk reduction measures, it is important that the views of train operators are sought, as they may have relevant input or concerns. It may also be important to clarify and agree with the train operators the dependency upon train-based risk reduction measures that has been built into the risk assessment (eg the use of driver s reminder appliances; TPWS). As a matter of good practice, it may be beneficial to involve the train operator in the risk assessment activities described earlier in this document (see also section 7.3, which requires the involvement of persons with train driving experience in the risk assessment process). 4.9 Implementation The infrastructure controller shall ensure that the approved overrun risk reduction measures are incorporated into the design of the infrastructure and also, where applicable, into procedures, timetables and other arrangements for the operation of the railway. The technical risk reduction measures affecting the infrastructure will need to be captured as part of the track layout and signalling design process, and thereafter 14 RAILTRACK

17 of Overruns - Risk Assessment Page 15 of 45 implemented at the construction and commissioning phases of the project. The design, construction and commissioning processes should be adequate to ensure that any changes to the design undertaken after the risk assessment has been completed do not negate the risk reduction achieved by the measures. In some cases compliance with this section may necessitate implementation of procedures or rules relating to the operational use of the layout in order to control overrun risk. These should be documented, for instance in the form of signal box instructions or in the Sectional Appendix. It may be necessary in some circumstances to incorporate constraints on the operational use of the railway into systems such as automatic route setting systems Where the risk reduction measures are not all being implemented together, the infrastructure controller shall agree with the train operator(s) the prioritisation of implementation in order to gain optimal safety benefit. In most cases risk reduction measures will come into force together, but it is possible under some circumstances that phased implementation will take place (eg TPWS might not be operational on trains at the time the infrastructure is altered). Although the ordering and phasing of the controls is frequently determined, in part at least, by technical or other practical constraints, it is important that, where there is the opportunity, those measures which add the greatest safety benefit are implemented first. Consideration should be given to whether, during the period that only some of the overrun risk reduction measures are in place, other measures might need to be implemented in order to control the additional interim risk. A particular example of this is the fitment of TPWS. Any proposal to use TPWS as a risk reduction measure needs to take into account whether or not all trains and infrastructure will be fitted when the signalling is commissioned, and if not, how the risk gap will be managed until fitment is complete. 5 Operational Use of Infrastructure 5.1 Layout and Signalling to be Used in Accordance with Assumptions The infrastructure controller shall devise and implement documented procedures for track layouts and signalling to ensure that the operational use is not in breach of any constraints or assumptions that were incorporated into, or underpinned, the risk assessment. The application of this requirement is limited to track layouts and signalling that have been assessed in accordance with the requirements of this document. The validity of the risk assessments, and the consequential level of residual risk associated with the operational use of the layout, is likely to be dependent upon using the layout in a manner that is consistent with the constraints and assumptions built into the assessment. This is particularly so where a train protection system is not in use. The purpose of this section, therefore, is to ensure that the timetable alterations or other changes do not take the operational use outside the boundaries of the constraints and assumptions. It is for this reason that it is important to keep records of constraints and assumptions, and to make sure they are incorporated into the working of the railway via procedures and rules (see sections and 7.1). RAILTRACK 15

18 Page 16 of 45 Uncontrolled When Printed of Overruns Risk Assessment 5.2 Requirement for Re-Assessment The infrastructure controller shall ensure that overrun risk is reviewed in the event of a proposal for a significant change to: a) the operational use of the track and signalling; or b) elements of the infrastructure other than the track layout and signalling. A significant change, in this context, is one that is likely to invalidate the basis of any previous overrun risk assessment. Where no previous assessment exists, a significant change is one that is likely to breach relevant constraints or assumptions that were incorporated into the design of the track and signalling. The infrastructure controller shall seek and consider the views of train operators, regarding the results of the review. Where a modification to the track layout or signalling is proposed, the requirements of section 4 of this document apply. Circumstances that could be considered to constitute significant change include: a) increases in permissible speeds (see also GK/RT0007). Under some circumstances, a reduction in permissible speed may also require a review of overrun risk, for instance if the reduction results in excessive signal spacing. b) increases in the volume of traffic, where this is likely to result in trains encountering significantly more signals at danger (either during normal timetabled working, or because the increased use means that any disruption to timetabled working is likely to result in a disproportionately large increase in the numbers of signals at danger). c) timetable alterations which introduce near-conflicting movements across junctions (ie the time interval between two trains arriving at a junction becomes such that one of them is quite likely to encounter a signal at danger). d) changes to train regulation policy (if the policy change is of national significance, then a generic assessment of risk should be undertaken; if the policy change is at local level, then it may be more appropriate to consider its impact on the specific routes where it is to be applied)/; e) increases in the use of bi-directional or single lines. f) introduction of significantly longer trains (giving rise to increased collision opportunities across junctions). g) introduction of new/modified rolling stock where the new/modified operational characteristics (eg acceleration performance) could affect overrun risk. h) station re-building affecting the stopping/despatch arrangements for trains and/or the visibility of signals. i) electrification of a route. j) changes to arrangements for despatching trains from platforms (eg in connection with introduction of driver only operation). k) major changes to platforming arrangements at complex stations. l) major increase in level of use of platforms that were previously little used. The nature of the review and re-assessment will depend very much on the circumstances and extent of the changes. The rigour of the review should be determined by factors such as: a) whether any documented previous review or risk assessment exists, and if it does exist, what it says about the current levels of risk. Where one does not 16 RAILTRACK

19 of Overruns - Risk Assessment Page 17 of 45 exist, and the changes proposed are significant, then a more detailed reassessment should be considered. b) whether a train protection system is in operation, and the extent of its effectiveness. Where one is in operation, there is less concern about the effects of the types of changes listed above, since there is a high degree of protection against driver error. c) whether or not the constraints and assumptions relating to the use of the infrastructure are known or not (see section 5.1), and if they are known, how likely they are to be breached by the proposed changes. d) whether or not the proposed changes would lead to an increase in the numbers of signals that do not fall into the categories set out in section 4.4. It may be feasible in some circumstances to focus attention on key junctions and signals with a history of overruns. Section 4 of the document mandates re-assessment of overrun risk in the event of a proposed modification of the track layout or signalling. This section (5.2) mandates a review in the event of other proposed infrastructure changes that could affect overrun risk. Most examples of this relate to possible impairment of the visibility of signals (see GE/RT8034). However, other changes (such as platform lengthening) could also adversely affect the level of risk. 5.3 Risk Reduction Measures Where a review conducted in accordance with section 5.2 indicates that the level of risk is not acceptably low, options shall be identified, evaluated, and where necessary implemented to reduce the risk. Appendix D provides guidance on assessing the reasonable practicability of implementing risk reduction measures, and Appendix E provides a list of possible risk reduction measures in relation to the signalling system and the operational use of the layout. The options considered should include not making the proposed change at all, and modifying the change proposals to reduce the risk. 6 Review of Overrun Risk in Existing Layouts 6.1 Requirement for the Review of Overrun Risk on Existing Layouts A review of overrun risk at existing signals that protect junctions shall be conducted at least once by October Where a signal has been the subject of either a review in accordance with section 5.2, or risk assessment in accordance with section 4 of this document, a further review is not required. The infrastructure controller shall produce a prioritised programme of reviews. These reviews shall consider the adequacy of existing risk control measures, taking account of the operational use of the infrastructure. The cumulative effect of small changes to operational use can, over a number of years, lead to a situation where the track and signalling is being used in a manner which is significantly different from that originally planned. The document therefore mandates the undertaking of a one-off review of the existing levels of overrun risk on the network. Depending upon the outcome of this one-off review, the document may be revised at some stage in the future to mandate an ongoing review process. During the one-off review process, best endeavours should be used to capture existing constraints and assumptions associated with the operational use of the layout, and other site-specific information relevant to overrun risk, as this may be required for ongoing review purposes, or to facilitate compliance with section 5.2. RAILTRACK 17

20 Page 18 of 45 Uncontrolled When Printed of Overruns Risk Assessment The adequacy of existing control measures can be assessed by considering: a) the frequency and nature of overruns that have occurred, and any discernible trends. b) whether there are track layouts or signalling arrangements that could present an unacceptable level of overrun risk because they do not conform with current best practice and/or the requirements of RGSs in force at the time of the assessment. c) whether the nature and intensity of operational use is significantly different from that which applied when the infrastructure was first provided or was last subjected to a review of overrun risk. The document requires that the programme of reviews is prioritised. The prioritisation should take account of a number of factors, including: a) known areas of abnormally high numbers of overruns. b) routes and areas that are intensively used, and particularly those where the permissible speeds are high. c) locations where the junction layout is known not to accord with current best practice. d) areas where the signalling design does not comply with the requirements of GK/RT0064. A structured approach to the review process, which ensures consistency as well as an appropriate degree of rigour, is important if the review is to be meaningful. Reviews of existing layouts and their operational use are not generally expected to be very detailed, although where an initial review indicates that there may be overrun risk that is not adequately controlled, it is likely to be necessary to conduct a more detailed assessment. It may be possible in some situations to use the results of overrun reviews or assessments conducted before the publication of GI/RT7006 in order to meet the requirements of this section, thus avoiding unnecessary work. However, care should be exercised that such assessments are valid (ie not out of date) and sufficient in scope to ensure compliance with the section. 6.2 Review of Overrun in Other Circumstances In addition to the requirements of sections 5.2 and 6.1, if information comes to light which suggests that the existing level of overrun risk is not acceptably low, then a review of the risk shall be carried out. Circumstances where this section could be applicable include: a) complaints from drivers regarding visibility of signals. b) adverse trends in numbers of overruns occurring. GO/RT3252 sets out the requirements for the investigation of an overrun that has occurred. The nature of the review (and, where necessary, any detailed re-assessment of risks at particular signals) will depend very much on the circumstances. 6.3 Risk Reduction Measures Where a review conducted in accordance with section 6.1 or 6.2 indicates that the level of risk is not acceptably low, options shall be identified, evaluated and, where necessary, implemented to reduce the risk or reverse the trend. 18 RAILTRACK