GSM-R Failures Safety Risk Model

Transcription

1 GSM-R Failures Safety Risk Model Contents Executive summary Introduction Types of failure Risk model overview Immediate risk Protecting an obstructed line Contacting the signaller when a line is not obstructed Knock-on risk Risk calculations Baseline risk Single cab radio failure Operational responses Results Continue at line speed Taking a train out of service Collecting a portable radio Reducing the train s speed Sensitivity analysis Network failures Operational responses Results Continue at line speed Stopping trains Using the GSM-P network Reduce the speed of all trains Sensitivity analysis Other GSM-R failures Conclusions Appendix A: Acronyms and abbreviations Appendix B: GSM-R FWG members

2 Appendix C: Workshop attendance Appendix D: Emergency protection event tree Appendix E: Calculation of knock-on risk Appendix F: Default input values for the safety risk model Issue Record Issue Date Comments September 2015 Draft for comment January 2016 Updated draft with principles for cab-mobile and network failures added February 2016 For approval by the GSM-R FWG 2

3 Executive summary A risk model has been produced which calculates the safety risk associated with different GSM-R system failures. This model may be used to assess the risk associated with different operational responses to these failures and determine how they may be best managed. This work has been carried out in collaboration with the GSM-R Failures Working Group (GSM-R FWG) in order to determine a consistent method by which GSM-R system failures should be managed across the GB network. There have been a number of related risk assessments undertaken in the past and this model represents a consolidation of the key assumptions and methodology used in these previous assessments. Whilst the previous risk assessments have considered both safety and performance costs associated with different operational responses, this model uses only safety to determine the best operational response, although other criteria should be considered qualitatively. Two types of safety risk are calculated: The immediate risk from not being unable to use GSM-R during a system failure. This is primarily the risk from not being able to protect an obstructed line but other uses of GSM-R are also considered. The knock-on risk resulting from the impact different operational responses will have on train performance. This includes personal accident risk resulting from extra boarding, alighting, and crowding at stations, as well as train accident risk caused by miscommunication and extra red signal approaches. The risk model may be used to determine the operational response which results in the lowest total risk for a given GSM-R system failure. The risk is assessed using a series of input parameters, such as line speed and train detection method, which define the conditions under which the train is operating. The risk has been calculated for a DOO (Passenger) train operating in an axle counter area, with the other parameters set to average values for the GB network. These results have been used to assess the best operational responses on average across the network. The introduction of a guard or operating in a track circuit block area will reduce the immediate risk but the operational response found to provide the lowest total risk generally remains unchanged. For single cab mobile failures, the best calculated operational response is to collect a GSM-R Transportable or Operational Hand-Portable. If a portable radio is not immediately available then sensitivity analysis shows that the train may travel a maximum of 75 miles before the affected cab is taken out of service or a portable radio is collected. For network failures, the best calculated operational response is to impose a speed restriction after a planning period has elapsed. In areas where the GSM-R network is not available, drivers should be able to contact the signaller in emergency situations through the GSM-P network. This may either be achieved through issuing drivers with GSM-P handsets or by allowing the cab radio to roam onto the GSM-P network. The roaming cab mobile solution is found to result in the lowest overall risk during a network failure. For all other failures, the increase in risk is found to be very small and the best operational response is for the train to continue at line speed. 3

4 1 Introduction The GSM-R Failures Working Group (GSM-R FWG) has been established as a sub-group of the Traffic Operation and Management Standards Committee (TOM SC). The group is remitted to consider the concerns that have emerged in relation to the management of GSM-R failures, but more importantly to work collaboratively as a representative group of industry to ensure failures of the GSM-R system are managed in an effective, efficient and consistent manner across the GB network. The members of this group are given in Appendix B. Early on in its work, the GSM-R FWG realised that there were a number of risk assessments that had been undertaken in the past, in order to answer different but related questions regarding operational communication. These were: Axle Counter Concept Safety Case (WS Atkins, 2002). GSM-R Safety Risk Assessment (RiskTec, 2003). Risk Assessment of Failure of the Interim Voice Radio System (IVRS) (RSSB, 2006). Independent Critical Review and Risk Assessment of IVRS System Failure and Responses (RailSafe, 2010). GSM-R Emergency Call Risk Assessment (RSSB, 2010). Assessing the risk from the loss of the NRN frequency spectrum in 2012 (RSSB, 2012). Risk assessment of GSM-R failures (RSSB, 2012). Following a review of these risk assessments, it was found that they were not always consistent in the assumptions that they made, did not all use up-to-date data, and all focussed on specific aspects only, rather than taking a whole system approach. GSM-R FWG asked RSSB to develop a consolidated risk model based on the previous work. Where possible, the new model developed builds upon the previous risk assessments by extracting the key assumptions, reconciling any inconsistencies, using the most up-to-date data available and consolidating this all into one single risk model. Whilst previous risk assessments have considered both the performance cost and safety benefit of each operational response, this risk model only considers changes in safety risk. The risk model has been developed through a series of workshops, the details of who was present at these meetings are given in Appendix C. 2 Types of failure The safety risk model has been developed to understand the risk associated with certain types of GSM-R failure which will either affect single trains or sections of a route with potentially a large number of trains affected. The failures considered by the risk model were: Single cab radio failures. Single unregistered cab radios (temporary). Single unregistered cab radios (permanent). Network failures. Multiple uncorrelated cab radios. 4

5 Signaller fixed terminal failures. DSD/PA link unavailability. The total risk for each of these scenarios is calculated for a series of operational responses and compared to the base case scenario, where no GSM-R failure has occurred. The use of legacy radio systems such as CSR, IVRS or NRN is not considered in this risk model since it is intended to focus on GSM-R functionality. The model covers both passenger and freight trains (including those carrying hazardous goods), different line types and train detection methods e.g. axle counters, lineside telephone fitment schemes. 3 Risk model overview The risk calculated by the model is divided into two main sections: the immediate risk to a train travelling around the network with a specific GSM-R failure; and the knock-on risk caused by the delay minutes and cancellations resulting from the chosen operational response to the failure. 3.1 Immediate risk The immediate risk to the train is calculated in two parts: hazards where a GSM-R REC is required to protect an obstructed line; and the risk due to needing to contact the signaller in situations where a line is not obstructed, such as requesting permission to pass a signal at danger. This risk is calculated for a train travelling under certain conditions: GSM-R working (this is the base case). Cab radio failure. Network failure. Unregistered radio. These risks are all calculated per train km and, depending on the failure scenario and chosen operational response, the distance the train travels in a particular failed state is calculated and used to calculate a train s total immediate risk Protecting an obstructed line The hazards considered in this part of the risk model are those where a REC might be required to protect an obstructed line. These hazards are: Derailments (secondary collisions). Train collisions (secondary collisions). Collisions with objects. Train fires (uncontrolled evacuations). Trespass. Emergency evacuations. The risks associated with these hazards will primarily depend upon the average time it takes for the obstructed line to be protected. This is calculated using an event tree which takes into account a large number of factors, such as driver incapacitation, the role of the guard, placement of TCOCs, 5

6 lineside phones, flags and detonators, use of GSM-P etc. Full details of the event tree used in the risk model are given in Appendix D and a simplified version is given in Figure 1. Simplified event tree to illustrate the method used to calculate emergency protection times for the emergency risk model. Hazardous Event Driver initiates pre-emptive action? Driver available? All rulebook tasks correctly followed? All trains stopped by REC? Yes Yes Yes GSM-R status No Yes Yes (REC only) Yes No Yes No No No No This event tree is for a DOO (passenger) train and the basic assumption is that if a driver is available then they will first use a REC, if possible, and then carry out all the tasks in the Rule Book exactly as they are currently written. This gives an average protection time which can then be compared with the next oncoming train s braking distance and average headway to determine a probability that the oncoming train will be able to stop before a collision occurs. The probability that a train may be able to stop on sight is also included and an overall probability of a collision occurring is calculated. This probability may subsequently be converted into a risk value using consequences derived from the Safety Risk Model (SRM) Contacting the signaller when a line is not obstructed This includes the risk associated with situations where there is no obstructed line needing emergency protection but communication between the driver and signaller is required. The risks included in the model are: Passing a signal at danger (possible miscommunication). Driver injuries when using a lineside telephone (slips, trips & falls, struck by train and electric shocks). DSD alarm availability. These risks are calculated using assumptions extracted from previous risk assessments, in particular the Fixed Lineside Telephony Analysis Tool (FLAT). In addition to these risks, the delay minutes associated with communicating with the signaller through methods other than a registered GSM-R radio are also calculated. 3.2 Knock-on risk Analysis of data shows that there is a strong correlation between certain types of hazardous events, such as slips, trips & falls at stations, passenger assaults etc., and train performance. This relationship can be used to determine the level of risk associated with train delay minutes and cancellations. The three main types of risk identified as being strongly affected by performance are: Train accidents an increase in train collision and derailment risk as miscommunication and the number of red signal approaches increases. 6

7 Crowding slips, trips & falls and assaults increase as stations and trains become more crowded. Boarding and alighting incidents if trains are cancelled mid journey this risk would increase because of the increased boarding and alighting required. Delay minutes and the number of cancelled trains are calculated for each possible operational response. These delay minutes and cancellations will primarily depend on the chosen operational response. The factors considered when calculating these minutes are: Any delays (both reactionary and primary) from running at reduced speed. If a train needs to be stopped and cautioned. Delays accrued from part or full cancellation of trains. Any delays when picking up a portable radio. In addition to the delay minutes accrued due to the chosen operational response, the delay from not being able to use GSM-R in order to contact the signaller in non-emergency situations is also calculated. These values may subsequently be converted into a risk value using relationships derived from analysis of performance data as well as assumptions from previous risk assessments. If the delay minutes are caused by the introduction of a speed reduction, then the effect of delay minutes is reduced significantly if the speed reductions are introduced after a delay to allow for planning. This is because it is thought that graceful degradation will reduce the risk of overcrowding at stations by resulting in reduced re-platforming and better use of staff and information to passengers. In addition, this planning period will allow a properly planned emergency timetable to be implemented, which should reduce signaller workload and errors significantly, and the possible use of ARS both of which will reduce the knock-on risk associated with train accidents. Further details of the knock-on risk calculations are given in Appendix E. 4 Risk calculations The calculation of the results requires a number of values specifying the conditions under which the train is operating. The results presented in this section will be based on the default input values given in the table in Appendix F. Generally, all risk values presented in this section are for a DOO (passenger) train operating in an axle counter area. All values specifying the exact properties of the line, such as line speed or headway, have been set to values thought to be representative of a network average. This is the default case and the risk will be lower if a guard is available or the train is in a track circuit block area. The sensitivity of the results to varying these default parameters has also been investigated. All risk values are calculated as fatalities and weighted injuries (FWI) per train. The model calculates the risk for each train from the point of failure (assumed to be halfway through the day), to the end of the day (when the failure is assumed to be fixed). The same risk units are used for GSM-R network failures but, as the network failure may only affect a proportion of the train s journey, the increase in risk is smaller (although a large number of trains may be affected by the failure). The base case is the risk from running from the middle of the day till the end of the day with GSM-R working. Since these risks are very small they have been multiplied by a factor of 1 million so that the numbers are 7

8 easier to read. The units are therefore fatalities and weighted injuries per million trains, which has been abbreviated to FWI/mt. All risk values are calculated by assuming that all trains are travelling at line speed at the moment of an accident. In reality, this is often not the case as there will be a distribution of train speeds, with many trains stopped at red signals or stations. The calculated values are therefore intended to be worst-case risk estimates. All risk values presented by the model are not intended to be absolute measures of risk as they only consider a subset of hazards for which GSM-R has been considered to be important. The risk of different operational responses for the same failure mode should be compared to each other and the baseline risk (where GSM-R is working). It is the relative changes between these values which should be considered when deciding on the correct operational response. It should be noted that risk values for failures affecting multiple trains should be multiplied by the number of trains affected before directly comparing them with values calculated for single train failures. 5 Baseline risk The base case, for which all GSM-R failure types should be compared, is when no failure has occurred. It represents the baseline risk, as calculated by the risk model, of a train operating under the specified conditions with GSM-R fully functional, from halfway through the day until the end of the day. With the default values inputted into the risk model, the risk is calculated to be 4.6 FWI/mt and the majority of the calculated emergency communication risk (68%) is due to the need to protect an obstructed line following a derailment to prevent a secondary collision. The distribution of the calculated emergency communication risk is illustrated in Figure 2. The distribution of calculated emergency communication risk when GSM-R is working. Collision with object Train fire Trespass Emergency evacuation Train collision Derailment The values calculated by the risk model when GSM-R is working may be compared to the SRM to check for consistency. For example, the SRM (v8.1) value for passenger train derailment risk is 1.6 FWI per year. Approximately 22% of this risk may be attributed to secondary collisions giving a national average risk secondary collisions following a derailment of 0.7 FWI per billion train km. The baseline risk of derailment secondary collisions calculated by the GSM-R safety risk model is 8

9 1.1 FWI per billion train km. Given that these two values have been calculated using different methodologies, they are very similar and demonstrates that the magnitude of risk calculated by this risk model is correct. When GSM-R is working, the non-emergency communication and knock-on risks are taken to be zero. 6 Single cab radio failure 6.1 Operational responses For a single cab mobile failure, the operational responses considered are: Taking the affected cab out of service this can happen either after it completes its current journey or mid journey. If the cab is taken out of service mid journey, then it is assumed that all subsequent journeys made by that train are cancelled. If the cab is taken out of service at the end of its journey then it is assumed that at the end of the journey, either: 1. The train is taken out of service and is replaced by one with a working cab radio for the rest of the day. 2. The affected cab is boxed in so that it is not required to be used for the rest of the day. 3. If the rear cab has a working radio, then the train enters service driven from the working rear cab, and at the end of this subsequent journey, either 1 or 2 above occur. Collecting a portable radio this is either a GSM-R Transportable or Operational Hand-Portable (OPH), which is configured to send and receive Railway Emergency Group Calls. Reducing the train s speed this is either until the end of the day or until the end of its current journey. In all cases it is assumed that the train s radio will be fixed at the end of the day. 6.2 Results The resulting risk values for a single cab mobile failure are summarised in Figure 3. The immediate risk per train km increases, primarily due to the inability of a driver to use a REC to prevent a secondary collision following a derailment, whilst the knock-on risk increases as the chosen operational response results in more delay minutes and trains cancelled mid journey. The operational response resulting in the lowest total risk is to collect a hand-portable radio. 9

10 Risk values in FWI/mt for a single cab radio failure of a DOO (passenger) train in an axle counter area compared to the base case Continue at line speed This operational response is calculated assuming the train continues to run at line speed from the moment of the cab radio failure until the end of the day when it is fixed. In this case, the train travels the same distance as the base case and there is a 50% increase in immediate risk over the base case. This is primarily due to the inability of a train to use a REC to protect an obstructed line during this time Taking a train out of service There are two options for taking a train of service: in the middle of a journey and at the end of the journey. If taken out of service in the middle of a journey, the distance the train travels with a broken radio is assumed to be the distance to the nearest available station to unload passengers plus the distance to the nearest location to be taken out of service with no passengers. If the train is taken out of service at the end of the journey then it simply travels the remaining distance of the journey with a broken radio (assumed to be halfway through the journey). In both cases it is assumed the train is replaced by one with a working radio for the remainder of its scheduled journeys for that day. This results in a reduced immediate risk in both cases compared to continuing at line speed due to the reduced distance the train travels with a broken radio. Taking a train out of service mid journey results in a large knock-on risk. This is mainly due to the risk of off-loading passengers mid journey at unscheduled stations, resulting in increased boarding/alighting injuries. Nationally, the risk from these two hazardous events is high (38 FWI/year) although only a fraction of this risk is as a result of delays and cancellations. From 10

11 analysis it has been estimated that approximately 3.5 FWI/year, result from delays and cancellations. Given that there are over 212,000 cancelled trains per year, the risk from a single cancelled train is 3.5/212,000 = 17 FWI/mt. Taking a train out of service at the end of its journey has a much smaller knock-on risk as passengers are off-loaded at their intended stations. The knock-on risk in this case being the extra crowding caused by the small delays resulting from the planned replacement of the train s subsequent journeys Collecting a portable radio Two types of portable radio are considered: GSM-R Transportables and Operational Hand-Portables (OPH). It is assumed that both these types of portable radios are configured to send and receive a REC, with a slightly reduced effectiveness to the fully working GSM-R cab radio. In both cases the risk is calculated by assuming that the train travels a distance with a broken radio in order to collect the portable radio and then travels for the rest of the day with the portable radio. They both therefore have similar immediate risks to the situation when GSM-R is working, with the slight increase primarily due to the small distances they must travel with the broken radio. The slight risk from the lack of a fully functional DSD/PA link when using a portable radio is also included. Hand-portables are found to have the lowest risk since the distance a train will need to travel to collect one is thought to be lower than a transportable. Both options have small knock-on risks. This is due to the increased train accident and crowding risk resulting from the small delay in order to collect a radio. Hand-portables are assumed to take less time to collect and therefore have the lowest knock-on risk Reducing the train s speed The average network line speed is calculated to be approximately 67 mph and this value is used as default, whilst the default reduction in train speed as an operational response is chosen to be to a maximum speed of 40 mph. Two options for implementing a speed reduction are considered: reducing a train s speed for the rest of the journey after which it is taken out of service, and reducing the train s speed for the rest of the day. Reducing the train s speed reduces the train s immediate risk from travelling with a broken radio by approximately 30% per km travelled, primarily due to the reduction in probabilities that the train will obstruct an adjacent line and that the driver will be incapacitated during the initiating accident. In fact, the immediate risk is reduced to a value even lower than when GSM-R is working since reducing speed both mitigates the risk due to not having a working cab radio and other accidents for which GSM-R is not a mitigation. Reducing the speed results in a large knock-on risk due to a large number of delay minutes resulting from this operational response. The knock-on train accident risk is especially large if the speed of just one train is reduced since the trains affected by the delay minutes are ones which are still travelling at the original line speed. 6.3 Sensitivity analysis For single cab mobile failures, the operational response found to have the lowest total risk is to collect a GSM-R hand-portable. This is found to be the case for any combination of input parameters. If portable radios aren t available, then the option with the next lowest total risk is found to depend on the exact values of the parameters inputted and is either: for the train to continue with the 11

12 failure for the rest of the day; to take the cab out of service at the end of the train s current journey; or to take the cab out of service immediately mid journey. The three main input parameters to which the results are found to be most sensitive are: the headway, line speed, and journey length. The sensitivity of the results to these input parameters is illustrated in Figure 4. As the journey length which the train is required to travel with a broken radio increases, the operational response which results in lowest total risk changes from taking the cab out of service at the end of the journey to taking it out of service immediately. This change in the lowest calculated risk occurs as the immediate risk of the train completing its journey with a broken radio starts to outweigh the knockon risk due to off-loading passengers mid journey. As the line speed increases and headway shortens, this change occurs for shorter journey lengths since the immediate risk per mile travelled with a cab radio failure increases. As can be seen in Figure 4, the maximum journey length for which taking a train out of service mid journey is not found to be the lowest risk operational response for any combination of line speed or headway is 150 miles. Given that the model assumes that the failure occurs halfway through the train s journey, the sensitivity analysis suggests that the maximum distance a train should travel with a cab radio failure in the absence of a portable radio is 75 miles. Operational response with the lowest calculated risk (assuming portable radios are unavailable) for a range of possible input parameters. 12

13 7 Network failures Within the safety risk model, a network failure is a geographical region in which the GSM-R network is unavailable to both the driver of a train and the signaller. The network failure may affect an entire route or just a small section of track. Three sizes of network failure have been explicitly calculated, corresponding to different parts of the GSM-R infrastructure which have the potential to fail: Small failure a single Base Transceiver Station (BTS) outage (1% of route affected). Medium failure a single Base Station Controller (BSC) outage (10% of route affected). Large failure complete network outage (100% of route affected). 7.1 Operational responses For a network failure, the operational responses considered are: Continue at line speed, relying on lineside telephones and emergency protection. No movement of trains through the affected area. Using GSM-P when the GSM-R network is unavailable. Reducing the speed of all trains within the affected area. For the speed reduction operational response, this may be implemented either immediately or after a delay to allow for the speed restriction to be properly planned. 7.2 Results As mentioned previously, the calculated risk values are presented in units of FWI/mt per affected train. Clearly many trains would be affected by a network failure so, whilst the individual values may appear to be similar to single cab radio failures, it should be noted that in reality they are much higher. To obtain absolute risk values, all numbers should be multiplied by the number of affected trains. This would be a constant multiplied to all values so the relative changes between GSM-R working and the different operational responses would not change whether or not this factor is applied Continue at line speed This operational response is calculated assuming the train continues to run at line speed from the moment of the cab radio failure until the end of the day when it is fixed. In this case, the train travels the same distance as the base case and there is a 50% increase in immediate risk over the base case. This is primarily due to the inability of a train to use a REC to protect an obstructed line during this time. The difference in the percentage of collisions which may be prevented by using a GSM-R REC and by relying on lineside telephones and emergency protection during a network failure is illustrated in Figure 5 for a range of headways and a network average line speed of 67 mph. 13

14 The percentage of collisions which may be prevented with GSM-R working and by continuing at line speed during a network failure Stopping trains For this operational response there is no movement of trains through the affected area. It is assumed that trains not already in this area will be stopped before entry and trains already in the area will travel to the nearest available location to off-load passengers. When the network outage reaches 100% this operational response corresponds to stopping all trains on a particular route. The risk calculated for this operational response for the three different sizes of failure are illustrated in Figure 6. For all sizes of failure, the immediate risk is greatly reduced compared to the baseline, since trains will only have to travel short distances. The knock-on risk, however, is very high. If trains aren t allowed through an affected area then there is a significant contribution to train accident risk caused by stopping trains before they enter an affected area. In addition, there is a large risk from offloading passengers at unscheduled stations. It is assumed that passengers will use rail replacement buses for the extent of the failure and this extra risk due to modal transfer is also included in the calculated knock-on risk. This increases as the percentage of the route affected increases and is it at a maximum if all trains are stopped. 14

15 The risk associated with stopping trains for different sizes of network failure, compared to continuing through the affected area and the baseline risk. It should be noted that, especially for the stop all trains operational response, the knock-on risk calculated here is an underestimate. Simply extrapolating the risk from a single cancellation will give increasingly less accurate results as the number of cancelled trains increases. Clearly, the large amount of disruption caused if all trains on the network were stopped at once will be significantly underestimated through this approach. However, even as an underestimate, the risk of stopping trains from entering an affected area is still found to be significantly larger than continuing at line speed. Whilst it is possible to further increase the knock-on risk to account for these factors, it is not considered necessary since this is already shown to be clearly a poor choice of operational response Using the GSM-P network In an area where the GSM-R network is unavailable, the immediate risk increases as the driver s ability to protect an obstructed line during an accident is reduced, primarily due to the lack of ability to perform a REC. Instead of just relying on lineside phones, flags and detonators to protect the obstructed line, one further operational response is to make use of the GSM-P network. One way in which this network may be utilised is to issue drivers with mobile phones which operate on the GSM-P network. These mobile phones will be switched off and stored inside the driver s bag at all times. In order to use the mobile phone if there is a need to protect an obstructed line during a network failure, the driver will need to get the phone out of the bag, exit the cab and turn the phone on. The driver will then contact the signaller, who will set the signals to danger. The other option considered by the risk model is to allow the cab radio to roam onto the GSM-P network in areas where GSM-R has become unavailable. The level of effectiveness of GSM-P in this situation could be enhanced over a mobile phone, as the on-board assembly is an 8W radio interfaced with an external roof mounted antenna and is therefore thought to have a much higher level of performance / reliability / availability than a GSM-P handheld. In addition, GSM-P provided through the cab radio 15

16 would be able to be used without the driver needing to exit the cab, which would enable to the driver to contact the signaller in a shorter amount of time than with a mobile phone. The percentage of collisions prevented by allowing drivers to use the GSM-P network of contacting the signaller during a network failure for a line speed of 67 mph are illustrated in Figure 7. The percentage of collisions which may be prevented with GSM-R working, by continuing at line speed during a network failure with GSM-P, and without GSM-P. The provision of GSM-P handsets becomes an increasingly effective method for protecting an obstructed line as the headway increases, since the time for the driver to get out of their cab and turn the phone on becomes less significant. Allowing the cab mobile to roam onto the GSM-P network does provide a significant benefit over a handset, especially for short headways where the time for a driver to exit the cab and turn on the mobile is too long for any potential collisions to be prevented. A cab radio roaming onto the GSM-P network is, however, still not as effective as GSM-R at preventing collisions since the driver will still be unable to use the REC functionality and will still need to talk to a signaller in order to get signals set to danger. For average line properties, the provision of GSM-P handsets reduces the increase in immediate risk over the base case from continuing at line speed during a network failure by approximately 50%, whilst a roaming cab mobile provides a 70% reduction in this immediate risk. This is illustrated in Figure 8. 16

17 Comparing the risk of continuing at line speed during a network failure when the GSM-P network is available to be used and when it isn t Reduce the speed of all trains The default reduction in speed is from the average line speed of 67 mph to 40 mph and results in a large decrease in immediate risk. Reducing the speed of all trains is a very effective mitigation since both the initial train is less likely to foul an adjacent line and oncoming trains are much more likely to stop before an obstruction. In fact, the immediate risk with a speed reduction is significantly lower than with GSM-R working since the risk of hazards not mitigated by the use of REC are also significantly lower. There is, however, knock-on risk resulting from the significant delay minutes caused by all trains running at the reduced speed. The majority of this risk is train accident risk from miscommunication and extra red signal approaches. The magnitude of the knock-on train accident risk for reducing the speed of all trains is, however, much lower per train than reducing the speed of a single train since the trains being affected are running at a reduced speed instead of at line speed. The possibility of allowing a time period before a speed restriction is implemented is also considered. The default value for this is in the risk model is 4 hours, which is what was proposed in the previous IVRS risk assessment. If there is a delay before the speed reduction is implemented, there is an increase in immediate risk over the situation where the speed restriction is implemented immediately. This is because trains will travel through the area without GSM-R at the original line speed for this period of time. The knock-on risk is, however, significantly lower than if it was implemented immediately. There are two reasons for this. Firstly, the train will travel longer at line speed and will therefore result in less delay minutes from running at a reduced speed. Secondly, the introduction of a time delay before the speed reduction is introduced allows for this to be properly planned for. Signallers will be working to a properly planned emergency timetable so errors should be minimised. Overcrowding at stations will be less of a problem since passengers can be properly informed of the delays, there will be reduced re-platforming and staff can be deployed to where 17

18 they are most needed. The risk values calculated for these operational responses are illustrated in Figure 9. Risk values for the speed reduction operational responses when GSM-P hasn t been issued to the driver. If the driver has been issued with a GSM-P handset, then the immediate risk to the driver will be reduced, as was discussed in the previous section. The resulting risk values are illustrated in Figure 10. It can be seen that provision of GSM-P handsets provides a safety benefit in all cases but provides the most benefit when the train is running at line speed through the network failure and for the planning period before the speed reduction is implemented for the operational response of reducing speed after a delay. GSM-P handsets only provide a very slight safety benefit if speed reductions are implemented immediately. Allowing the cab radio to roam onto the GSM-P network will have an enhanced safety benefit over GSM-P handsets, especially for the period where the train continues at line speed. The additional benefits of allowing the cab radio to roam onto the GSM-P network are illustrated in Figure

19 Risk values for the speed reduction operational responses when GSM-P handsets have been issued to the driver. Risk values for the speed reduction operational responses when the cab radio is allowed to roam onto the GSM-P network. 7.3 Sensitivity analysis The risk associated with each operational response is found to be sensitive to two main parameters: headway and line speed. Firstly the effectiveness of GSM-P provision was analysed by varying these parameters. The results of this sensitivity analysis are shown in Figure 12. The benefit of using GSM-P generally increases as both line speed and headway increase. For very long headways, the 19

20 benefit of GSM-P starts to reduce as there is sufficient time for the driver to walk to a lineside telephone or the next oncoming train s braking distance. The percentage of collisions which may be prevented for the base case and during a network failure with and without GSM-P handsets issued to drivers. The only operational response which has been found to reduce the risk during a network failure back to the baseline is to impose a speed restriction for the geographical region affected by the failure. The speed restriction displayed previously was from the network average line speed of 67 mph to 40 mph. The speed reduction imposed should be that which reduces the predicted frequency of secondary collisions to a value less than or equal to that with GSM-R working. The exact speed reduction required to achieve this will depend on the original line speed, the headway, whether a GSM-P handset has been issued to the driver or whether the cab mobile is able to roam onto the GSM-P network. The speed reductions required in the absence of the GSM-P network are illustrated in Figure 13, whilst those utilising the GSM-P network are illustrated in Figure 14. Comparing predicted collision frequencies for line speeds in areas where GSM-R is working and where there has been a network failure. 20

21 Comparing predicted collision frequencies for line speeds in areas where GSM- R is working and where there has been a network failure if the GSM-P network is utilised. It can be seen that if GSM-P handsets have not been issued then a speed reduction of approximately one third is sufficient to reduce the predicted collision frequency during a network failure back to that which is calculated for when GSM-R is working correctly. As discussed previously, the provision of GSM-P handsets does not have a significant safety benefit for short headways so the same speed reductions are required. For longer headways, a lower speed reduction is sufficient to reduce the collision frequency back to the base case if GSM-P handsets have been issued to drivers. Whilst the provision of a roaming cab radio was found to provide a safety benefit over GSM-P handsets in the last section, it can be seen in Figure 14 that it doesn t significantly alter the speed reductions required to reduce the risk during a network failure back to the baseline. 21

22 As illustrated in Figures 9-11, the operational response found to reduce the risk during a network failure back to the baseline, for network average values, was to introduce a speed reduction after a planning period. Whether the reduction in knock-on risk achieved by waiting before implementing the speed restriction outweighs the immediate risk from trains running at line speed through the network failure will primarily depend on: the line speed, the headway, and whether or not the GSM- P network is available to be used by drivers. Figure 15 illustrates which is the lowest-risk operational response for different values of these parameters. It can be seen that, if drivers are able to use the GSM-P network, then the lowest risk operational response for a network failure is to implement a speed reduction after a period of 4 hours to allow for planning. If GSM-P is not available, then for the high speed lines with a short headway the analysis indicates that the speed reduction should be implemented sooner than waiting for the full 4 hour planning period. Sensitivity analysis indicating the optimum operational response for different combinations of line speed and headway. 8 Other GSM-R failures For the other GSM-R failures considered by the risk model, GSM-R REC functionality was still available and any increase in immediate risk is due to the hazards described in Section 3.1.2, where a driver needs to contact the signaller but a REC is not required. The risk associated with passing a signal at danger and driver injuries from using line side telephones is found to be much smaller than for protecting an obstructed line. For all of the GSM-R failures where trains are uncorrelated but REC is still available, the knock-on risk associated with any operational response is found to outweigh any potential increase in the immediate risk. The optimum operational response in these situations is therefore to allow trains to continue at line speed until the end of the day when the fault can be fixed. The model includes the safety benefit from the DSD/PA link if the driver were to become incapacitated. This is the benefit associated with providing an incapacitated driver with assistance quicker than if no DSD/PA link were provided. There have been 2 reported activations of the DSD/PA link due to driver ill health in 20 years, giving an annual frequency of 0.1. There would still be a 22

23 significant delay for help to arrive to the driver following a PA announcement and the chance of saving a driver s life following a heart attack after this delay is approximately The benefit from the DSD/PA link to DOO (Passenger) trains is therefore considered to be around FWI/year. This is clearly much smaller than the 0.35 FWI/year associated with derailment secondary collisions and for a DSD/PA link failure the optimum operational response is found to be to allow trains to continue at line speed until the end of the day when the fault can be fixed. 9 Conclusions The safety risk model results and associated sensitivity analysis have been used to determine a series of principles, defining the recommended operational responses for the different types of GSM-R failure. For a single cab mobile failure, the following operational principles have been concluded: A train shall not be permitted to enter service from a maintenance depot if the train radio is defective in any cab that is required to be used. A train shall be permitted to enter service from a location other than a maintenance depot with a defective train radio, provided that one of the following applies: 1. The defect is in a cab which is not required to be used for that journey. 2. A GSM-R Transportable or Operational Hand-Portable (OPH), configured to send and receive Railway Emergency Group Calls, is available. 3. The defect was not identified until immediately before the train was scheduled to enter service, and there has been insufficient time to mitigate the overall system risk associated with taking the train out of service. In this situation the train may enter service if either the affected train s total journey length will not exceed 75 miles or a GSM-R Transportable or Operational Hand-Portable (OPH) can be provided before reaching this distance. The provision of GSM-R Transportables and Operational Hand-Portables configured to send and receive Railway Emergency Group Calls should be considered within contingency plans, and the following considered: 1. The strategic location of such equipment to optimise access arrangements and the effectiveness as a means of mitigating the overall system risk associated with train radio failures. The safety analysis presented here does not justify making provision of OPHs on all train journeys, although there may be other factors that would support the development of a positive business case e.g. the safety and performance benefits realised by continuing to provide a mechanism that facilitates safety critical communications between signallers and drivers within their normal operating environment. 2. The maintenance and charging of such equipment to ensure it is operational when required. 3. Security of equipment and prevention of unauthorised access, thus mitigating the risk of accidental initiation of Railway Emergency Group Calls. 4. Tracking equipment once it has been deployed and ensuring it is returned to the point from which it was collected. 23

24 For network failures, the following operational principles have been concluded: The analysis has concluded that access to GSM-P as a secondary means of communication, is an effective control in the event of a GSM-R network failure. However, it is not as effective as GSM-R. Assuming GSM-P is available, the most effective operational response is to introduce a planned reduction in operating speed through the affected area. Reducing speed by one-third, is sufficient to reduce risk during network failures to the same level as running at line speed with GSM-R working. The level of effectiveness of GSM-P provision through both handsets and the cab radio roaming onto the GSM-P network has been investigated. A roaming cab radio has been found to provide a significant safety benefit over the provision of GSM-P handsets. It is therefore recommended that the industry explore the provision of a secondary communications system that is based upon access to a GSM-P network via the cab mobile. For all other failures the increase in risk is found to be very small and the best operational response is for trains to continue at line speed until the end of the day, when the failure may be fixed. 24

25 Appendix A: Acronyms and abbreviations ARS BTS DOO (passenger) DSD GSM-P GSM-R GSM-R OPH IVRS NRN PA PPM PTI REC RSSB SPAD SPT SRM STFs TCOCs TOC Automatic Route Setting Base Transceiver Station Passenger train with Driver Only Operation Driver s Safety Device Global System for Mobile communications Public Global System for Mobile communications Railways GSM-R Operational Hand-portable Interim Voice Radio System National Radio Network Public Address Public Performance Measure Platform Train Interface Railway Emergency Call Rail Safety & Standards Board Signal Passed At Danger Signal Post Telephone Safety Risk Model Slips, Trips & Falls Track Circuit Operating Clips Train Operating Company 25

26 Appendix B: GSM-R FWG members Anthony McBride Claudia Brogelli Daniel Mann Dave Calfe David Griffin Dean Johnson Gary Portsmouth Gerald Riley Graham Goswell Justin Willett Keith Shepherd Kevin Johnson Mark Steward Marz Colombini Neil Whisler Paul Clyndes Paul Cooper Peter Bowes Richard Carr Stephen O Brien Steve Wright RSSB RSSB ATOC ASLEF RSSB RSSB RSSB RSSB Network Rail South West Trains ORR Freightliner South West Trains ASLEF Amey RMT Network Rail Virgin Trains RSSB First Group GTR 26

27 Appendix C: Workshop attendance Name List of attendance at the workshops through which the risk model was developed. Company Workshop date 20 th April 5 th June 10 th June 7 th July 5 th August Alex Gilchrist RSSB Attended Attended Attended Attended Anthony Haines Brendan McClurg Network Rail South West Trains Attended Attended Attended Attended Attended Daniel Mann ATOC Attended Attended Attended Attended Attended Dave Calfe ASLEF Attended Attended Attended Attended Attended David Griffin RSSB Attended Attended Attended Attended Attended Gary Portsmouth RSSB Attended Attended Attended Gerald Riley RSSB Attended Attended Attended Attended Attended Graham Goswell Network Rail Ian Wiseman Amey Attended Justin Willett Keith Shepherd Mark Steward Martin Thomason Marz Colombini South West Trains Attended Attended Attended Attended Attended Attended ORR Attended Attended South West Trains Attended Attended Attended Attended Attended Virgin Trains Attended Attended ASLEF Attended Attended Attended Attended Attended Paul Cooper Network Rail Attended Peter Bowes Virgin Trains Attended Richard Carr RSSB Attended Attended Attended 27

28 Appendix D: Emergency protection event tree In the risk model, an event tree is used to calculate the average time it takes for an obstructed line to be protected. This event tree has been constructed by consolidating assumptions used in previous risk assessments, data from the SRM and expert judgment from workshops. The gates of this event tree represent the different situations which may occur once a line has been obstructed and how they influence the time before it is protected. The event tree is constructed assuming that a REC will first be attempted, if possible, then the actions written in the rule book will be undertaken in the order they are currently written. The different gates included within the event tree, in the order with which they are considered, are: Driver initiates pre-emptive REC before the accident. Whether or not the train has a guard on it. Whether the driver is incapacitated during the accident and not able to use the GSM-R radio. Whether the GSM-R network is available for the train attempting to make a REC. Whether the train s cab radio is broken during the accident. Whether the driver is injured during the accident so that they cannot leave the cab. Whether there is another cab with a working radio which other members of train staff may use. Whether the driver or guard may stop trains by placing TCOCs on the track. If the driver is incapacitated, whether the guard can use the cab radio to make a REC. Whether a lineside telephone may be used to contact the signaller. Whether company issued GSM-P may be used to contact the signaller. The time taken for a driver or guard to walk along the track to the braking distance of the next oncoming train to flag it down. Each of these gates will have a time and probability associated with them, with all the different possible combinations resulting in 67 possible outcomes. The times and probabilities of each gate will depend on the inputted parameters defining the line and train properties, the GSM-R status and the hazardous event which has caused the line to be obstructed. Each end point s time and probability are then combined to give an overall protection time for any given scenario. 28

29 Appendix E: Calculation of knock-on risk In order to calculate the knock-on risk, the amount of risk associated with train performance needs to be determined. This is achieved by estimating the percentage of annual risk, as calculated by the SRM, which is attributable to train delay minutes and cancellations. These percentages may be derived by investigating the correlation between event frequency and train performance data. Four main areas of risk were considered: SPADs. Staff assaults (both physical and verbal). PTI incidents. Passenger slips, trips & falls at stations. The daily frequency with which each of these events occur may be plotted against PPM data to determine the percentage of these events which are attributable to performance. These plots are shown in Figure 15. From these plots, the proportion of events which are attributable to performance can be determined. For example, it can be shown that each delayed train approximately results in an additional 1 in 10,000 chance of a SPAD and that 30% of current SPADs are related to train delays. The knock-on risk is subsequently determined by adding together all of the risk in the SRM associated with SPADs, calculating the fraction of the annual delay minutes accumulated during the failure and multiplying this by the portion of the risk identified as resulting from delays. This process was then repeated for each of the four main risk areas. In addition to the risk areas where the percentage associated with delays and cancellations have been determined through the analysis of current data, other risks have also been included in the knock-on risk calculations. These were identified in the previous IVRS risk assessment and were determined through expert judgment in workshops. The risk areas and associated percentages used to calculate the knock-on risk in the risk model are given in Table 4. If there is a 4 hour delay before a speed reduction is applied to all trains then it is thought that there will be a reduction in the knockon risk as these delays will be properly planned for. This reduction was determined through expert judgment for the IVRS risk assessment and is also given in Table 2. 29

30 Graphs illustrating the relationship between event frequency and PPM for the four main risk areas contributing to knock-on risk. SPADs Staff assaults Frequency per million train journeys PTI incidents Slips, trips & falls Other Escalator and stairs PPM 30