Rail Safety and Standards Board

Transcription

1 Rail Safety and Standards Board Certificate of Derogation from a Railway Group Standard (under 8.3 of the Railway Group Standards Code) Derogation Number: Applicant: Subject Matter of Derogation: RGS Number: RGS Issue Number: Managing Director, Heathrow Express, 30 Eastbourne terrace, Paddington, London W2 6LE Provision of Overlaps, Flank Protection and Trapping: Trap points. GK/RT0064 One RGS Issue Date: December 2000 RGS Title: RGS Clause: RGS Clause Requirements: Provision of Overlaps, Flank Protection and Trapping (a) Trap points shall be provided in the following circumstances: a) For the protection of passenger lines against sidings and any other non running lines (unless other suitable points exist which can be used for this purpose). b) n/a c) n/a. In addition to derogation with GK/RT0064, a letter of non-objection will separately be sought from HMRI in relation to non-compliance with HMRI Railway Safety Principles and Guidance part 2 section A Guidance on the Infrastructure, paragraph 23 Trap points. This states where sidings or freight only lines converge on passenger lines, and any overrun from such lines might foul a passenger line, trap points should be provided to derail vehicles. Trap points should be located and means provided to guide and arrest derailed vehicles away from the passenger lines, structures and any other hazards. HMRI have advised the appropriate order of events should be: (a) Derogation Application for GK/RT0064 to be prepared and supported by Infrastructure Owner (HEx) and Infrastructure Controller (NR) (b) Derogation Application to be considered by RSSB (c) Submission to be made to HMRI supported by Certificate of Derogation issued by RSSB. The proposed change will therefore not be implemented without both RSSB and HMRI approval. Standards Committee Name: CCS

2 Standards Committee Date: Standards Committee Min Ref: Uncontrolled When Printed 01/09/ /CCS/09/225 Scope of Derogation: Retractable Restraining Device (RRD) at Heathrow Branchline headshunt (8223 points). Description of the Heathrow Headshunt: The headshunt was constructed at the same time as the Heathrow Branchline tunnels in 1997, as a spur to the proposed T5 extension. At that time, it was equipped with all necessary infrastructure (track, OHLE, signalling etc), to enable the headshunt to be used to berth/turn trains. The headshunt has seen very little use, until the recent introduction of the Connect service. Currently, only 4-car CL332s or 4-car CL360/2s can be accommodated within the headshunt although, towards the end of 2005, it will be extended slightly to enable accommodation of 5-car CL360/2s (the 4-car limit for CL332s will remain). The headshunt is fully equipped with ATP, as are the CL332s & CL360/2 trains that will use it. The headshunt will only be used by ECS trains. As shown on the attached sketch (Ref T16986/002), there is a limited distance beyond the exit signal (SN342) protecting the conflict at the junction ahead. Technical description of the RRD: The RRD was included during the original construction of the headshunt. The RRD effectively acts as a set of trap points, but instead of derailing a runaway train, it stops it with a hydraulic buffer. Use of a traditional set of trap points in this scenario was rejected during the original Branchline design/construction stage, in view of the difficulties associated with recovering a derailed train within the subject tunnel environment. The RRD will absorb the impact of a 4-car CL332 or a 4-car CL360/2 train rolling away from the extreme end of the headshunt, but not a train taking power against it. When the headshunt is extended, calculations have confirmed that the RRD will stop a 5-car 360/2 rolling away from the extreme end of the extended head shunt, but it will no longer stop a 4-car 360/2. (The factors that could result in a train rolling away or in a SAS-SPAD are discussed in further detail in following sections together with mitigating measures.) The RRD is presented on the IECC workstation as a wide-to-gauge set of trap points and for train signalling and interlocking purpose, it is called, detected and locked in exactly the same way as a set of points. It has a normal position (raised) and reverse (lowered). The only difference is in the physical realisation of the device. Given the mass of the unit, the energy required to operate it up or down is considerably larger than for a set of points. Nature and Degree of Derogation: Operation of the railway between Heathrow CTA and T4 stations, without protection from the headshunt by trap points (or equivalent). Complete non-compliance with (a). Safety risk is train collision, following run away or SPAD (Cat A or Cat D) of SN342.

3 Reference has been made to RSSB document How Safe is Safe Enough? Edition 1a, February 2005 in the preparation of this Application. Particular attention is drawn to the guidance given on Removing a Safety Measure (page 20), which states An established control measure may be withdrawn if: - Withdrawal has no material detrimental impact on overall safety, for example where control of the risk is provided by another means or the activity or asset giving rise to the risk is no longer used - It conflicts with legislation - It is not reasonably practicable, for example because the risk has fallen or because new information demonstrates that an original decision was flawed. This Application seeks to demonstrate that these conditions are met in this instance. Alternative Measures Controlling Risk: a) The train braking system configurations/ characteristics limit the risk of a roll away occurring. b) The effectiveness of ATP in bringing a train to halt before the point of conflict reduces the likelihood of a SAS SPAD resulting in a train reaching a fouling point c) Provision of Drivers Reminder Appliance on the CL360/2 units reduces the likelihood of a SAS SPAD. d) The requirement for drivers to leave the cab to operate the TRTS at SN342 reduces the likelihood of a SAS SPAD. e) When the headshunt is extended, for a limited period, both 4 & 5 car CL360/2s will be in service. Drivers will be reminded of the number of vehicles on their train by means of colour-coded unit keys, and a reminder card on each driving desk. f) The requirement for a driver to advise the signaller of an ATP failure before entering service reduces the likelihood of a SAS-SPAD. Further commentary on points a) & b) is included in the Risk Assessment section below. Safety Justification: The situation at the subject location is unusual due to: - The limited train types using the headshunt (CL332 & CL360/2 only), - The fact that ATP is fitted to the protecting signal (SN342), and all train types that use the headshunt, - The location in question is a restricted access single bore tunnel, which does not lend itself to recovery of derailed trains. This situation is unlikely to be replicated elsewhere within the British railway network. In addition, it should be noted that the headshunt/rrd will cease to exist in 2007, when the extension to T5 is completed. Heathrow Express have compiled this application in conjunction with a number of bodies, including: - [name removed] Interfleet Technology, - [name removed] Lloyds Register - [name removed] Network Rail. This application has been reviewed, and is supported and sponsored by [name removed], GW Territory Signalling Engineer, Network Rail. An independent review of this derogation application has also been carried out by [name removed], Principal Consultant - Lloyds Register

4 Rail. [name removed] is a Chartered Engineer, with over 40 years broad-based experience in railway signalling, with particular emphasis on the operational aspects, project specification, development of systems, and preparation of safety cases. Maintenance and reliability issues: The impetus to undertake this review and to apply for this derogation followed an initial period of operational experience with the RRD, where a number of unforeseen failure modes were identified which have the potential to cause significant impact to the reliability of train operations. A number of small improvements have been made to the RRD following technical investigations undertaken in conjunction with the OEM (Rawie). Heathrow Express has also made significant efforts in conjunction with the RRD manufacturer and its technical advisers to improve the reliability of the RRD. However, no reasonably practicable solutions have been identified to improve the long term reliability of the RRD, and it continues to operate on the limit of its capability, remaining susceptible to failure and imparting of operational delays. In addition, the RRD is a non-standard piece of equipment which is difficult to maintain and repair due to its location within the running tunnels and its unique nature. Furthermore, attendance by specialist engineers is required in the event of the hydraulic system failing or if the pressure vessel fails/ requires repressurisation. Risk Mitigation measures not considered fully in original justification A detailed review of the original requirements for the RRD has been undertaken by completing the following activities: - An over run risk assessment has been carried out in accordance with GI/RT7006 on SN324. This process was not established at the time of the original risk assessment (1997). - Re-evaluation of the train braking systems, which were not accurately considered by the original risk assessment. - A detailed review of the mitigation provided by ATP against SAS SPADs on exiting the headshunt, which was not considered by the original risk assessment. These activities showed that the original risk assessment was flawed in the following respects: (a) did not fully consider the option of not providing a trap points (or equivalent) (b) did not accurately consider the performance of the train braking systems (c) did not adequately consider the mitigation provided by ATP. These matters are outlined in more detail as follows: Over run risk assessment: An overrun risk assessment, in accordance with GI/RT7006 was carried out on 22nd June The following information was used in the SAT assessment, a copy of which is attached: 1) SPAD route SN342 to SN336 or SN334 Distance to conflict: 15m Trains: 24 in 12 hours Speed: 5mph Train Type: 4-car Mk3

5 Train Loading: 0% (ECS) 2) Set Routes (conflict) a) SN340 to SN336 (converging conflict) Trains: 48 in 12 hours Speed: 25mph Train type: 9-car Mk3Train loading: 25% b) SN335 to SN345 (head on conflict) Trains: 48 in 12 hours Speed: 25mph Train type: 9-car Mk3 Train loading: 25% ATP was entered at 95% effective for the SAT assessment, however information contained below demonstrates this to actually be 100%. SAT Risk Score: 5 This is a level where ALARP is demonstrable. Evaluation of the train braking systems: This was not accurately considered during the original risk assessment, which assumed that roll away might occur as a result of: - Drivers failing to apply the brakes, or - Failure of the trains brakes. The CL332s are fitted with standard Westcode brake assemblies, which by their nature provide robust, anti-roll away protection. CL360/2s provide enhanced functionality in this respect, through a combination of hard and soft-wired brake circuits. When changing ends, with the master switch in the OFF position, both the CL332 and CL360/2 default to an emergency brake application. With the Master switch in Neutral28/07/2005: - The CL332 defaults to an emergency brake application, - The CL360/2 defaults to a full service brake application. If the master switch were to be left in either forward or reverse when the train had drawn to a stop, a loud audible alarm would sound, followed by an automatic emergency brake application after 6 seconds. In order to remove such applications, the master switch will need to be set into either FORWARD or REVERSE, and the DSD pedal depressed. For the CL360/2, a brake application is held on, until such time as the driver takes power, and sufficient torque to move the train is detected in the traction motors. The parking brakes are held-off against springs by air pressure. Should this air pressure be removed, deliberately or otherwise, the parking brakes automatically and instantly apply. Work undertaken by Interfleet (see attached Cavanagh dated 21 June 2005) has shown that: - For a CL360/2, a train could be held in the headshunt even if 5 of the 6 parking brakes had failed. - For a CL332, a train could be held in the headshunt even if 14 of the 16 parking brakes had failed. There is no single point failure of the parking brake system. Reliability of the CL332 parking brakes (which are similar to the CL360/2 system) is high, with only 4 brakes replaced in over 6 years

6 operation of the 14-train CL332 fleet. It should be noted that the driver remains with the train at all times whilst it is in the headshunt, other than momentarily when activating the TRTS. Even if some obscure failure mode arose whilst the driver was walking through the train to change ends, he would have access to Pass Com devices throughout the train in order to initiate an emergency brake application. It is not proposed to berth unattended trains in the headshunt. ATP also has a roll away protection feature which applies the train brakes to prevent train movements occurring against the direction selected on the master controller. Thus, if a driver drove a train into the head shunt and left the cab open (either in forward or neutral), ATP would demand a brake if the train rolled backwards out of the head shunt after about 3 metres of movement. Interfleet (Martin, ref HeadFTA001, 22 June 2005) have reviewed the fault tree analysis contained within the original risk assessment, taking account of the above-noted train braking characteristics. It has been shown that the prevailing risk of roll away occurring without RRD protection is actually an order of magnitude less than the conclusion that the original assessment reached with RRD protection. Mitigation provided by ATP: The mitigation provide by ATP against SAS SPADs on exiting the headshunt was not adequately considered by the 1997 risk assessment. Work undertaken by Interfleet (see attached Cavanagh dated 21 June 2005) has shown that ATP would bring CL332 or CL360/2 trains subject to SAS SPAD to a halt prior to reaching the point of conflict (please refer to attached sketch ref T16986/002). This assumes that upon entering the headshunt, the trains draw to a halt at the appropriate stop boards. The risk of over-running the stop boards upon entry to the headshunt is considered low since: - HEX employ a strict defensive driving policy. - HEX drivers are accustomed to accurately drawing up to stop boards at other locations along the route. - Headshunt approach speeds are low (10mph). - The headshunt is a dry tunnel environment, with negligible risk of low-adhesion conditions arising. - The drivers will be keen to stop accurately adjacent to the stop boards, in order to align the city-end cab with the tunnel-wall mounted TRTS controls (ready for the headshunt exit movement). - There is limited scope for driver confusion over train length. The RRD is not designed to prevent incidents where the train is deliberately driven out of the headshunt under power. The mitigation for this has always been the ATP system. There is a scenario where, if a CL360/2 stops 14m or further the CL360/2 stop board and then experiences a SAS-SPAD, ATP would not stop the train from fouling the running line. However, as the RRD is not designed to mitigate this event, the disconnection/ removal of the RRD has a minimal effect on this risk. All trains scheduled to operate in the headshunt are fitted with ATP. Procedures are in place, which minimise to the lowest reasonably practicable level the risk that trains with faulty ATP equipment will enter the headshunt. This is achieved by removing trains which have known ATP faults from service. If the ATP fails while the train is in the headshunt, the driver is required to inform the signaller. Where the headshunt ATP Beacon fails while the RRD is failed, the

7 headshunt will be closed to train operations until such time as a repair has been affected. The driver has the ability to over-ride ATP by isolation, use of the over-ride or shunt functions. However, the risks of this occurring inappropriately are no different than elsewhere on the route. The RRD is not designed to restrain a train under power, therefore the RRD can only be considered a secondary measure and its removal has no effect in such circumstances. Additional marginal benefits have also been identified as follows: Automatic Route setting: Based on certain technical restraints and operational regimes associated with continued operation of the RRD, there is a potential increase in workload on the Slough IECC signallers as result of the requirement to operate the Hayes & Heathrow areas on workstation 2 without the assistance of Automatic Route setting. Maintenance: The RRD is a non-standard piece of equipment, which recent experience has shown to be prone to reliability problems. It is considered that removal of the RRD provides the lowest overall risk option, when taking into account the requirement for ongoing maintenance, inspection and faulting activities which must be undertaken by personnel working on or near the line. Removal of the RRD reduces the overall exposure of workers to the associated risks, in accordance with Section 3 of the RSSB Railway Strategic Safety Plan In addition to the above, it has been found that the device is operationally unreliable, introducing more risks than it controls. Additional Action/Observations: Upon receipt, the applicant is required to identify affected, interfacing parties and copy this certificate, together with supporting information, to those parties. Attachments: - SAT Assessment of SN342, dated 22 June Cavanagh (Interfleet) dated 21 June 2005), inclusive of sketch ref T16986/002. Signed by Jeff Allan on 21/09/2005 Authorised by: Jeff Allan Head of Control Command and Signalling, and Energy Delivery Unit Derogation Issue Date: 21/09/2005