Lineside Signalling Layout Driveability Assessment Requirements

Transcription

1 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, Lineside Signalling Layout Driveability Assessment Requirements Synopsis This document sets out requirements for assessing the driveability of lineside signalling systems, and guidance on the process of assessing changes to signalling layouts or signal aspect sequences. Copyright in the Railway Group documents is owned by Rail Safety and Standards Board Limited. All rights are hereby reserved. No Railway Group document (in whole or in part) may be reproduced, stored in a retrieval system, or transmitted, in any form or means, without the prior written permission of Rail Safety and Standards Board Limited, or as expressly permitted by law. RSSB members are granted copyright licence in accordance with the Constitution Agreement relating to Rail Safety and Standards Board Limited. In circumstances where Rail Safety and Standards Board Limited has granted a particular person or organisation permission to copy extracts from Railway Group documents, Rail Safety and Standards Board Limited accepts no responsibility for, nor any liability in connection with, the use of such extracts, or any claims arising therefrom. This disclaimer applies to all forms of media in which extracts from Railway Group documents may be reproduced. Published by RSSB Copyright 2018 Rail Safety and Standards Board Limited

2 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, Issue Record Issue Date Comments 1 03/03/2018 Original document. Requirements and guidance on driveability assessment is intended to inform decisions about safe integration of lineside signalling systems with train operations /03/2018 This document has been reissued to correct formatting only. There are no changes to the content. This document will be updated when necessary by distribution of a complete replacement. Superseded Documents The following Railway Group documents are superseded, either in whole or in part as indicated: Superseded documents Sections superseded Date when sections are superseded GKRT0075 issue four Lineside Signal Spacing and Speed Signage GKRT0045 issue five Lineside Signals, Indicators and Layout of Signals 2.1.3, 2.4.3, /03/ /03/2018 Supply The authoritative version of this document is available at Enquiries on this document can be submitted through the RSSB Customer Self-Service Portal Page 2 of 44 RSSB

3 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, Contents Section Description Page Part 1 Purpose and Introduction Purpose Introduction Application of this document Health and safety responsibilities Structure of this document Approval and Authorisation 11 Part 2 Requirements for Driveability Assessment Requirements for qualitative assessment of driveability Driveability assessment: shunting MA Driveability assessment: excessive signal spacing Driveability assessment: variation in signal spacing 18 Part 3 on the Driveability Assessment Process When is a driveability assessment needed? What does a driveability assessment look like? Planning a driveability assessment Who participates in the driveability assessment? Facilitating a driveability assessment Driveability assessment: acceptance criteria Driveability assessment records 30 Part 4 on the Driveability Assessment Hazard Precursors on assessment of lineside signalling systems Driveability hazard precursor A1: necessary MA information is not provided by the signalling system Driveability hazard precursor A2: information provided by the signalling system is not complete Driveability hazard precursor A3: some information provided by the signalling system is not current Driveability hazard precursor A4: provided information is not relevant to some trains Driveability hazard precursor A5: information provided by the signalling system cannot be relied upon Driveability hazard precursor B1: poor readability 36 RSSB Page 3 of 44

4 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, 4.8 Driveability hazard precursor B2: poor interpretability Driveability hazard precursor B3: poor accuracy of the information provided by the signalling system Driveability hazard precursor B4: inconsistent signal aspects and indications presented along the route Driveability hazard precursor C1: unusual or non-compliant asset position relative to corresponding infrastructure features Driveability hazard precursor C2: inconsistent infrastructure position of one or more signalling assets Driveability hazard precursor D1: insufficient time for the train driver to comply with the operating requirement Driveability hazard precursor D2: excessive time for the train driver to comply with the operating requirement Driveability hazard precursor D3: excessive variation in position of successive lineside signals Driveability hazard precursor D4: information is provided at inconsistent times 41 Definitions 42 References 44 Page 4 of 44 RSSB

5 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, List of Figures Figure 1: Example of MAs towards a passenger line using a main signal 17 Figure 2: Safety, reliability and technical compatibility 35 RSSB Page 5 of 44

6 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, List of Tables Table 1: Lineside signalling layout driveability hazard precursors 12 Table 2: Exemptions from the requirement to assess excessive signal spacing 17 Page 6 of 44 RSSB

7 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, Part 1 Purpose and Introduction 1.1 Purpose This document sets out requirements for the scope of a driveability assessment that can be used by a Proposer to confirm that planned changes to the lineside signalling system, or the train operations that use it, are capable of being safely integrated into the Great Britain (GB) mainline railway The purpose of a driveability assessment is to assess the lineside signalling system for the hazard of poor driveability, to inform decisions about controlling the risk arising This document includes guidance on planning and undertaking a driveability assessment This document is intended to be read in conjunction with the RSSB standards applicable to lineside signalling systems on the GB mainline railway and the guidance on the application of the Common Safety Method for Risk Evaluation and Assessment (CSM RA) published by the Office of Rail and Road (ORR) and RSSB The hazard precursors set out in Part 4 of this document are described in terms of the lineside signalling system, but they are also relevant to the driveability assessment of cab signalling systems. Additional hazard precursors might be present if the train driver is presented with Control, Command and Signalling (CCS) system transitions or multiple signalling systems are provided on the same line. 1.2 Introduction How to use the requirements in this document This document sets out requirements for assessing driveability, and guidance on how to carry out the assessments. The requirements and guidance are underpinned by an analysis of the signal engineering standards applicable to the GB mainline railway to understand how these assessments can help Proposers to control the factors that support and influence driveability The requirements in this document are available as codes of practice that can be applied to control the hazard of poor compatibility of the signalling system with train operations (poor driveability), and inform a decision that the signalling system is driveable Part 2 sets out the requirements for assessing driveability Part 3 provides guidance on the driveability assessment process Part 4 provides guidance on the factors that support and influence driveability (driveability hazard precursors) The requirements in this document are intended to be read in conjunction with the other Railway Group Standards (RGSs) and s (RISs) referenced in this document, that contain requirements that can be used to control the hazard of poor driveability. RSSB Page 7 of 44

8 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, Driveability assessment The contribution of the infrastructure manager (IM) (network) towards driveability is to provide, maintain and operate the lineside signalling system so that it is driveable. The contribution of the transport operators is to manage train operations in accordance with rules and procedures, ensuring that authorised users have sufficient and appropriate competence, experience and knowledge (including train drivers' route knowledge) It is good practice to consider how planned changes to the lineside signalling system or train operations might impact on driveability from the start of the project, using the operating requirements specification as the basis; continuing throughout the project life cycle, including option selection and single option development. Applying the principle of 'design for driveability' reduces the likelihood that a driveability assessment will recommend changes at a late stage of the project The driveability assessment is part of the overall framework of compatibility assessments and risk assessments that are applied by the Proposer before putting a change into use. It is used to confirm that train drivers will be able to reliably act upon the information presented by the lineside signalling system, throughout the range of operational and ambient conditions applicable on the route(s), within the operational context and while performing their required duties. It provides some of the information needed by the Proposer to complete the route compatibility assessment and signal overrun risk assessment processes. Further guidance on safe integration of changes affecting signalling systems is provided in GEGN The driveability assessment evaluates the likelihood of a train driving error due to: a) The layout of lineside signals, indicators and lineside operational signs. b) The displays presented by lineside signals, indicators and lineside operational signs. c) The relationship between train protection and warning system indications and the displays presented by lineside signals, indicators and lineside operational signs. d) The functionality of the lineside signalling system and the train protection and warning system in terms of the parameters of the information they present to drivers. e) The rolling stock types operated on the route. f) The train operations and station operations that use the lineside signalling system Driveability assessment involves representatives of affected transport operators because: a) The IM (network) is responsible for providing a lineside signalling system that is driveable and operating it in accordance with the relevant operating rules and procedures. b) Railway Undertakings (RUs) are responsible for train driving, which includes reading and interpreting lineside signal aspects and indications, and acting upon the information they convey in accordance with the relevant operating rules and procedures. Page 8 of 44 RSSB

9 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, c) IM (stations) are responsible for train dispatch processes, which includes reading and interpreting lineside signal aspects and indications, and acting upon the information they convey in accordance with the relevant operating rules and procedures. Driveability A well-designed signalling system supports good compatibility with train operations. This means that train drivers can obtain and use the information provided by lineside signals, indicators and signs to take good train driving decisions A signalling system that has poor compatibility with train operations is a hazard which, if uncontrolled, could result in unacceptable safety risk. This includes the collision risk or derailment risk that can arise when a train: a) Exceeds the limit of movement authority (MA). b) Exceeds the permissible speed. c) Uses a permissive MA incorrectly. d) Occupies a level crossing area when a road user is present. e) Uses locally monitored infrastructure that is not correctly set for the train movement. f) Starts to move before the 'right away' is given Compatibility of a lineside signalling system with train operations is described using the term 'driveability'. A definition of driveability is provided in Definitions Driveability has a range; it is influenced by the operational context on each route where the trains will be driven and therefore changes to a lineside signalling system are assessed. The contribution of a lineside signalling system to driveability is to be driveable. Other contributions to driveability include the signalling operations and train driving processes Train driving involves a continuous process, which includes: a) Monitoring the railway environment. b) Gathering and assimilating the information needed, including reading and interpreting information presented at the lineside, in the cab, from other people and using procedures. c) Taking decisions based on all the information available. d) Controlling the train to maintain the required speed, including starting, stopping, accelerating and braking The lineside signalling system provides the following types of information applicable to the train driving processes: a) MA. b) Routing. c) Locally monitored system status (for example, points correctly set ). d) Operating instruction (for example, close train doors ). e) Permissible speed change. RSSB Page 9 of 44

10 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, Other information relevant to train driving is provided by authorised personnel (for example, signallers and station staff), working timetables, rules and procedures The design of the lineside signalling system influences: a) What information is provided by the lineside signalling system. b) Which signal aspects, indications and signs provide the information. c) Where the information is positioned within the driver s field of vision. d) When the information is provided relative to the required train driving response Train drivers read and interpret signal aspects, indications and signs in order to understand: a) Whether or not an MA is provided to the train. b) The type and extent of MA that is provided. c) Which route is set at a diverging junction and, therefore, which applicable permissible speed applies. d) The operational status of locally monitored systems on the route. e) Relevant train operating instructions. f) The permissible speed limit Providing a signalling system that is driveable does not mean that the risk is reduced to an acceptable level. Risk assessment is used to confirm that sufficient risk controls are provided Further requirements and guidance on risk controls and risk assessment are provided in RISs and company standards published by the IM (network) Further requirements and guidance on operating the signalling system and train operations are provided in the National Operating Publications and transport undertaking safety management systems. 1.3 Application of this document Compliance requirements and dates have not been specified since these will be the subject of internal procedures or contract conditions The Standards Manual and the Railway Group Standards (RGS) Code do not currently provide a formal process for deviating from a (RIS). However, a member of RSSB, having adopted a RIS and wishing to deviate from its requirements, may request a Standards Committee to provide opinions and comments on their proposed alternative to the requirement in the RIS. Requests for opinions and comments should be submitted to RSSB by to proposals.deviation@rssb.co.uk. When formulating a request, consideration should be given to the advice set out in the to applicants and members of Standards Committee on deviation applications, available from RSSB s website. 1.4 Health and safety responsibilities Users of documents published by RSSB are reminded of the need to consider their own responsibilities to ensure health and safety at work and their own duties under health and safety legislation. RSSB does not warrant that compliance with all or any Page 10 of 44 RSSB

11 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, documents published by RSSB is sufficient in itself to ensure safe systems of work or operation or to satisfy such responsibilities or duties. 1.5 Structure of this document This document sets out as a series of requirements that are sequentially numbered. This document also sets out the rationale for the requirement, explaining why the requirement is needed and its purpose, and where relevant, guidance to support the requirement. The rationale and the guidance are prefixed by the letter G Some subjects do not have specific requirements but the subject is addressed through guidance only and where this is the case, it is distinguished under a heading of and is prefixed by the letter G. 1.6 Approval and Authorisation The content of this document will be approved by Control Command and Signalling Standards Committee on 18 January This document will be authorised by RSSB on 30 January RSSB Page 11 of 44

12 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, Part 2 Requirements for Driveability Assessment 2.1 Requirements for qualitative assessment of driveability The Proposer shall review the proposed change to identify if any of the hazard precursors set out in Table 1 could be introduced by that change. Driveability Hazard Precursor Parameter Identity Description Page 12 of 44 What information is provided to train drivers Which signalling displays are used to provide the information Where information is positioned within the train driver s field of vision A1 A2 A3 A4 A5 B1 B2 B3 B4 C1 C2 Necessary MA information is not provided by the signalling system Information provided by the signalling system is not complete Some information provided by the signalling system is not current Information provided by the signalling system is not relevant to some trains Information provided by the signalling system cannot be relied upon Poor readability Poor interpretability Poor accuracy of the information provided by the signalling system Inconsistent signal aspects and indications presented along the route Unusual or non-compliant signalling asset position relative to corresponding infrastructure features Inconsistent infrastructure position of one or more signalling assets RSSB

13 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, Driveability Hazard Precursor Parameter Identity Description When information is provided D1 D2 D3 D4 Insufficient time for the train driver to comply with the operating requirement Excessive time for the train driver to comply with the operating requirement Excessive variation in position of successive lineside signals Information is provided at inconsistent times Table 1: Lineside signalling layout driveability hazard precursors For each identified driveability hazard precursor, the Proposer shall confirm that the proposed mitigation is sufficient to control the associated risk to an acceptable level. G G G G Rationale The driveability hazard precursors can make the train driving task more difficult on lines where train drivers rely on the lineside signalling system to obtain information. Therefore, if one or more of these hazard precursors are identified to be present within a signalling layout, appropriate measures are needed to control the associated risk. A1 is assessed to confirm that: a) The lineside signalling system is compatible with all reasonably foreseen train operations that require a signalled MA. b) The signalling layout provides reasonable opportunities for train drivers to obtain the information needed to recover from an error. A2 is assessed to confirm that the lineside signalling system supports train drivers understanding of: a) Whether the train has an MA. b) The type of the MA that is available. c) At a diverging junction, the route to which the MA applies. d) The applicable permissible speed. e) The status of any locally monitored systems associated with the train movement. f) Relevant operating information. A3 is assessed to confirm that the information provided by the lineside signalling system supports train drivers' understanding of the actual status of the railway. RSSB Page 13 of 44

14 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, G G G G G G G G G A4 is assessed to confirm that the lineside signalling system is optimised to allow train drivers to assimilate all of the information needed to inform the train driving task, taking account of route knowledge and the operational context on that route. A5 is assessed to confirm that the reliability performance of the lineside signalling system, and its failure modes, are compatible with train drivers obtaining information that can be relied upon. B1 and B2 are assessed to confirm that the overall level of readability and interpretability on the route is consistent with the requirement of the train driver to read and interpret the relevant signal aspects, indications and signs. B3 is assessed to confirm that the signal aspects, indications and signs are an accurate portrayal of the state of the railway. B4 is assessed to confirm that any variation in the appearance of signal aspects and indications on the route can be managed by train drivers. C1 is assessed to confirm that the position of lineside signalling assets relative to other infrastructure features that are associated with a train driving task: a) Is consistent with developing and maintaining train drivers route knowledge. b) Will not mislead a train driver into making an error. c) Provides an opportunity, where appropriate, for a train driver to recover from an error before a hazard is reached. C2 is assessed to confirm that the position of lineside signalling assets will not mislead a train driver or cause a train driver to misread or misinterpret the information being conveyed. D1 and D2 are assessed to confirm that the lineside signalling system provides the information at a time that helps train drivers to act upon it when it is needed. D3 and D4 are assessed to confirm that the variation in the time that information is made available does not compromise the ability of the train driver to respond correctly. G Further guidance on the driveability hazards is provided in Part 4. G G G Conformity with this requirement can be achieved using a driveability assessment. Part 3 provides further guidance on the driveability assessment process. The hazard precursors set out in Table 1 can arise from a change to the signalling system or a change to a different part of the railway that interacts or interfaces with the signalling system. Three risk acceptance principles can be applied to control the driveability hazard precursors: a) Conformity with a code of practice and assessment. b) Comparison with a similar reference system and assessment. c) Explicit risk estimation and assessment. Page 14 of 44 RSSB

15 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, G G G G G G G G G G In many cases, providing a design that conforms with requirements in applicable RGSs and RISs is sufficient to control the hazard of poor driveability. The driveability assessment process is used to record the extent to which conformity with requirements in RGSs and RISs is sufficient to control the hazard precursors. This approach is consistent with applying the risk acceptance principle: conformity with code of practice and assessment. Conformity with applicable standards does not mean that all of the driveability hazard precursors arising from a planned change to a particular lineside signalling system will be controlled to an acceptable level of risk. The Proposer is responsible for deciding which standards are applicable and the extent to which conformity controls the risk. Some requirements in RGSs and RISs specify design parameters that are known to control certain hazards. For example, the requirement in RIS-0703-CCS for the first cautionary aspect to be at least signalling braking distance (SBD) from the associated main stop aspect can be applied to control hazard precursor D1; however, it does not control hazard precursor D2. Some requirements describe methods of assessment that may support a decision that a hazard is controlled to an acceptable level. For example, the codes of practice for the signal sighting assessment can be applied to identify the method of controlling hazard precursors B1 and B2. Conformity with applicable standards is beneficial because it means that the main focus of the driveability assessment work will be the parts of the system that are either non-conforming, or result in hazards that are not sufficiently controlled by conformity with standards, or are the most difficult parts of the layout to drive. Codes of practice applicable to controlling the driveability hazard precursors on the GB mainline railway include the content in GKRT0075, RIS-0703-CCS, RIS-0737-CCS, RIS-0744-CCS and RIS-0758-CCS, which include guidance on the driveability hazards they control and the applicability of the requirements. Additional hazard controls can be applied using the other two risk acceptance principles set out in b) and c). A Proposer can decide that a compliant design does not provide the optimum solution. For example, a limited change to an existing lineside signalling system could have an adverse impact on driveability if it introduces an inconsistency or variation in the presentation of information to train drivers. In this case, comparison with a similar reference system can be used. It is permissible to implement a bespoke design that does not conform with a code of practice or a similar reference system if the Proposer can confirm that the alternative solution controls the risk to an acceptable level. This is done by exception and, where it is applied, the driveability assessment confirms that the bespoke design does not itself constitute a hazard. If one or more driveability hazard precursors cannot be controlled to the extent that risk is acceptable, further risk evaluation and assessment is used to identify what additional safety measures are needed. This might include additional train protection system measures and operational controls. RSSB Page 15 of 44

16 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, 2.2 Driveability assessment: shunting MA The Proposer shall assess the acceptability of using an independent shunt signal to present an MA for train movements towards, or along, a passenger line This assessment shall consider all of the following: G G a) The rationale for not providing a main signal. b) The frequency of train movements using that signal. c) The frequency of train movements from that signal towards, or along, a passenger line. d) The frequency of train movements using that signal towards, or along, a passenger line when the signal section is occupied (permissive shunt). e) The readability of the signal(s) denoting the limit of MA on the passenger line. f) The distance to the signal(s) denoting the limit of MA on the passenger line. g) The signalling layout at other geographical locations where train drivers might experience similar train movements. h) The operating rules and procedures for using a shunt MA at that location. Rationale Using an independent shunting signal can increase the likelihood of signal overrun or a train-on-train collision because the shunt aspect does not provide the train driver with enough information to understand whether the next stop signal is displaying a stop aspect or a proceed aspect or whether the section is clear or occupied. Previous experience at this location and similar locations can influence train drivers' understanding of the required operation. The output of this assessment is the likelihood of: a) A train exceeding the limit of a shunt MA on a passenger line. b) A train-on-train collision when the shunt MA is towards an occupied line. G This requirement can be applied to control driveability hazard precursor A2: Information provided by the signalling system is not complete. G G The result of this assessment provides data to support the signal overrun risk assessment and permissive working risk assessment. RIS-0386-CCS sets out further requirements for signal overrun risk assessment. It is good practice to design signalling layouts so that shunt MAs for train movements towards, or along, a passenger line end at a main stop signal. Any independent shunt signals within the MA that are provided for other reasons (for example, for set back shunt moves) can be preset. Fig. 1 shows an example of this. Page 16 of 44 RSSB

17 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, G G G Figure 1: Example of MAs towards a passenger line using a main signal In the example shown in Fig. 1, it is permissible to provide independent shunting signal 1051, subject to driveability and risk assessment. The likelihood of signal overrun or train-on-train collision can be further managed if main signal 301 is provided. Signal 301 is capable of clearing to: a) A main proceed aspect when signal 107 is presenting a main proceed aspect. b) The single yellow caution aspect when signal 107 is displaying a main stop aspect. c) A subsidiary shunt aspect when the signal section on the passenger line is occupied and for train movements into the siding. The likelihood of a signal overrun at shunt signal 1053 is controlled if it is preset by routes from signal 301 to signal 107 or 1055 (LOS). 2.3 Driveability assessment: excessive signal spacing The Proposer shall assess the impact on driveability of signal aspect sequences where the distance from the first cautionary aspect to the associated stop aspect exceeds the minimum signalling braking distance requirement by 50% or more This requirement is not applicable where an exemption in Table 2 is applicable. Criteria Where parallel lines on a multi-tracked route are signalled in the same direction and have different permissible speeds Where lines at a converging junction have different permissible speeds Where signal spacing is optimised for a particular train braking performance Scope of exemption from assessment Signal spacing on the line with the lower permissible speed, if parallel positioning of signals provides a greater benefit The signal spacing between the last stop signal on the converging route and the first stop signal beyond the junction Trains with a braking performance superior to that to which the signalling layout is optimised RSSB Page 17 of 44

18 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, Criteria Where a lower differential permissible speed applies to trains with inferior braking performance The signal spacing beyond a stop signal protecting the exit from a siding, loop or converging platform line Scope of exemption from assessment Trains to which the lower differential permissible speed applies Trains that start from rest The signal spacing beyond stop signals where trains start from rest on a through line The signal spacing approaching a buffer stop at the end of a signalled line The cautionary aspect sequence associated with the buffer stop Table 2: Exemptions from the requirement to assess excessive signal spacing G G G G G G Rationale The aim of this assessment is to confirm that train drivers will be able to manage any MA information that is presented significantly before the time it is needed to make a train driving decision. The exemptions in Table 2 represent cases where repositioning signals to reduce signal spacing would not provide an overall benefit. The result of the assessment of excessive signal spacing can be used to inform a decision about the extent that driveability hazard precursor D2 is controlled. Train drivers use the first cautionary aspect to understand that the train is approaching the limit of MA and to inform their decision about when to apply the brakes. If this information is presented too early, the signal aspect is less helpful in denoting the optimum train braking point and the train driver might forget which aspect was displayed by the time the brakes need to be applied. Further requirements and guidance on determining minimum signalling braking distances are set out in GKRT0075. Further requirements and guidance on signal positioning and cautionary aspect sequences are set out in RIS-0703-CCS. 2.4 Driveability assessment: variation in signal spacing The Proposer shall assess the impact on driveability where excessive signal spacing at consecutive signals on the same line reduces by 34% or more. Page 18 of 44 RSSB

19 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, G G G Rationale The aim of the assessment is to confirm that the train driver can manage the variation in the time that cautionary MA information is presented relative to the time that the brakes need to be applied. Excessive variation increases the train driver workload and the likelihood of train driver error. The result of the assessment of excessive variation in signal spacing can be used to inform a decision about the extent that driveability hazard precursors D3 and D4 are controlled. Train drivers use the first cautionary aspect to understand that the train is approaching the limit of MA and inform their decision about when to apply the brakes. If this information is presented at varying times, the signal aspect is less helpful in denoting the train braking point and the train driver might forget when to apply the brake. RSSB Page 19 of 44

20 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, Part 3 on the Driveability Assessment Process 3.1 When is a driveability assessment needed? G G G G G Page 20 of 44 on when a driveability assessment is needed The Proposer can decide that a driveability assessment is needed to confirm that a planned change to a lineside signalling system, or the train operations that use it, can be safely integrated into the operational railway. This might be necessary if the planned change includes features that could adversely affect driveability. A change to the lineside signalling system has the potential to adversely affect driveability, and therefore increase risk, if it changes: a) What information is presented to users of the lineside signalling system. b) Which equipment or displays are used to present the information. c) Where the information is presented relative to the user's viewpoint of the railway and the operational context. d) When the information is made available to users relative to the train driving task requirement. Examples of signalling system changes that might require a driveability assessment include alteration to: a) The type of signalling system. b) The method of operation. c) The configuration, type or infrastructure position of lineside signalling assets (for example, changes to signal spacing). d) The MAs provided by the lineside signalling system (for example, additional signal routes, permissive MAs). e) The lines on which signalled MAs apply. f) The signal aspects, indications and signs presented at each signalling asset, including any changes to display appearance. g) The sequence(s) of signal aspects, indications and signs presented to train drivers, including any time delays designed into the system. h) Signal aspects or indications that can be presented in normal and failure conditions. Planned changes to other structural or operational systems can have an adverse effect on driveability if they introduce a hazard precursor or invalidate an assumption, dependency or caveat underpinning the results of a previous assessment. Examples of changes that might affect the train driving process, and therefore driveability, include: a) A modified network infrastructure. b) A change to train operations. c) A change to the type of rolling stock or the train consists operated on the route. Examples of network infrastructure alterations that might require a driveability assessment include changes to: a) Track layout. RSSB

21 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, G G G G G G G G b) Gradient profile. c) Permissible speed(s). d) Electrification system(s). e) Station platform(s), length or position. Changes to the operational context that might require a driveability assessment include changes to: a) The operating specification. b) The method of train operation during normal and degraded operations. c) Train consists. d) Rolling stock type or performance. e) Operations at infrastructure operated by train crew (for example, a ground frame, token instrument or locally monitored points). f) A train dispatch system. g) Train driving policy. h) Train stopping position at a station. on when to undertake the driveability assessment Considering driveability and involving train operators from the start of projects should result in signalling system designs that are driveable and capable of being safely integrated into the GB mainline railway. A well-managed project considers driveability throughout the project life cycle so that the driveability assessment is used to confirm that the design is fit for purpose without needing any further significant changes. Undertaking a driveability assessment at a late stage in a project might add cost to a project if factors are identified that result in a need to change the design. In this case the driveability assessment may be of little benefit; it may be too expensive to implement changes that would have improved driveability at less cost if they had been identified at an earlier project stage. The Proposer uses the output from driveability assessment to inform decisions about safe integration; therefore, the driveability assessment should be completed before a design option decision is taken. The Actors use the output to confirm their actions in implementing safety requirements. The output of the assessment can have implications on the project Sponsor, particularly if there are recommendations that imply significant changes may be needed. Some of the assessment recommendations might be relevant to decisions about reasonable opportunity to improve the signalling system that would otherwise be outside of the original project scope. The output of a driveability assessment may be an input to further assessments relating to safe integration of the change. The output may also inform the review by a Network Rail Major Schemes Review Panel (MSRP) prior to approval for construction. RSSB Page 21 of 44

22 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, 3.2 What does a driveability assessment look like? G G G G on the scope of a driveability assessment The driveability assessment considers the physical attributes of the railway and the operational context on the signalled lines where trains will be driven, including the impact on train driving of: a) Trackside CCS subsystem features, for example signal aspect sequences. b) Trainborne CCS subsystem features, for example Automatic Warning System (AWS) indications or cab signalling displays. c) Rolling stock features. d) Electrification subsystem features, for example neutral sections and conductor rail gaps. e) The track layout. f) Stations and structures, including station platforms. g) The operational task requirements on the route, including required stopping positions. h) People, including other railway personnel. i) The environment. on what is assessed The driveability assessment needs to be of a sufficient breadth and depth to reach a conclusion that enough has been done to find the hazard precursors that could adversely affect driveability. It is not necessary to assess every signalling asset and signal route. If the project has been well managed in considering driveability, the assessment can sample a representative selection of signal routes to confirm that the system is driveable. The driveability assessment provides the most benefit by looking for signal routes that make train driving more difficult. For example, this may include: a) Interfaces with the existing signalling system, including fringes. b) New or unusual train operations, for example propelling or running round. c) Signalling system and route transitions, including aspect sequences. d) Depot interfaces, including ground frame operations. e) Inconsistent signal spacing. f) Irregular permissible speed profiles, including inconsistencies with movement authorities. g) Junction aspect sequences, including approach controls. h) Complex / diverse routing. i) Unusual or non-compliant signal aspects, aspect sequences and indications. j) Train dispatch arrangements. k) Permissive working. l) Facilities that are provided to assist service recovery and which are therefore infrequently used. Page 22 of 44 RSSB

23 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, G G G The driveability assessment is a good opportunity for cross-route comparison (for example, consider how the impact of changing something can change the driveability of something else, perhaps untouched by the project). It is helpful to select a train movement and describe how the train will progress from start to destination, with an emphasis on the information needs of the driver. If a potential issue is identified, asking questions based on the driveability hazard precursors described in Part 4 of this document provides a focussed assessment of the issue. It is beneficial to avoid solutioneering. The Project is responsible for developing a design that is fit-for-purpose; therefore, the role of the driveability assessment is limited to reviewing the proposed design and making recommendations if it is appropriate to do so. 3.3 Planning a driveability assessment G G G G G G on planning a driveability assessment The driveability assessment plan forms part of the overall safe integration strategy for changes to lineside signalling systems and the train operations that use those systems. Further guidance on the framework of route compatibility assessments and risk assessments that form part of the safe integration of change is provided in GEGN8651. A driveability assessment can apply to any planned change to the lineside signalling system or the train operations that use it; however, it is not generally used to assess temporary changes to the railway, for example those associated with implementing a temporary speed restriction (TSR) or emergency speed restriction (ESR). The requirements for managing TSRs and ESRs are set out in RIS-0734-CCS. The driveability assessment plan is used to specify an assessment that is sufficiently rigorous to evaluate the applicability of the driveability hazard precursors and assess the options available to eliminate or control each one. The actual content of each driveability assessment plan will reflect the planned changes and be proportionate to the scope and complexity. The scope of each driveability assessment can be dependent on the extent to which the planned change conforms with the codes of practice applicable to controlling the driveability hazard precursors on the GB mainline railway. These are typically set out in GKRT0075, RIS-0703-CCS, RIS-0737-CCS, RIS-0744-CCS and RIS-0758-CCS, which include guidance on the driveability hazards they control and the applicability of the requirements. The IM (Network) manages the driveability assessment process and produces the driveability assessment plan. If the Proposer is an railway undertaking (RU) or an IM (stations), the project plan includes the arrangements with the IM (network) for managing the driveability assessment. Inviting representation from external stakeholders, including any transport operator(s) external to the mainline railway, is consistent with the legal obligation to cooperate in order to manage shared risk. Examples of when a transport operator external to the mainline railway should be invited include assessment of: RSSB Page 23 of 44

24 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, G G G G G G G a) A route used by mainline trains and a metro operator. b) A layout that interfaces with another IM, for example a depot or yard. Consultation on the driveability assessment plan can provide process efficiencies if stakeholders confirm that the assessment will be capable of addressing issues of concern and that the required resources and information will be available. A driveability assessment plan that is sufficiently complete and comprehensive provides stakeholders with a holistic view of the planned assessment. on the content of the driveability assessment plan The content of the driveability assessment plan helps each stakeholder to understand their expected contribution to the assessment and which other stakeholders have an interest. Stakeholders use the information in the driveability assessment plan to confirm that the assessment will be sufficiently robust to identify and evaluate the driveability hazard precursors relevant to their operations. The driveability assessment plan helps the affected parties to understand the following, before the assessment takes place: a) Why the driveability assessment is needed. b) What will be assessed and what will not be assessed. c) When the assessment will take place. d) Where the assessment will take place. e) Who will take part in the assessment. f) Which assessment method(s) will be used. g) How the assessment will be done. h) The assumptions, dependencies and caveats underpinning the assessment. The content of the assessment plan may develop and change over time. It is good practice to start planning the driveability assessment and consulting with stakeholders at an early stage, starting with a high-level description of how the assessment contributes to the implementation of the project safe integration strategy. The final version of the plan provides stakeholders with all of the relevant information they need to fulfil their roles in the assessment. Information relevant to why the assessment is needed includes the reason for the change and what is the expected outcome. The driveability assessment plan should reference the project scope, the safe integration strategy and make it clear what is included / excluded from the assessment. Information relevant to what will be assessed includes information about: a) Changes to the lineside signalling system, including signalled MAs, signalled routes, permissible speeds, locally monitored infrastructure, and operating indications. b) Changes to railway infrastructure, including track and electrification systems. c) Changes to the trains and types of rolling stock being operated. d) Changes to planned train operations, including train movements and methods of train dispatch. e) Parts of the existing railway that will not change. Page 24 of 44 RSSB

25 Document supersedes Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, G G G G G G f) Any deviations relevant to the assessment. Information relevant to when the assessment will take place includes the dates and times of each part of the assessment. Information relevant to where the assessment will take place includes assessment venues. Information relevant to who will perform the assessment includes: a) Facilitation of the assessment. b) Nominated stakeholder representatives, their role(s) and their affiliation. c) Arrangements for confirming representatives' identity and authorisation. Information relevant to which assessment method will be used includes the driveability assessment method. The assessment plan can specify a combination of assessment methods including: a) Structured professional judgement. b) Assessment using simulation of the train driving process. c) Formal assessment of hazards and risks. Information relevant to how the assessment will be done includes: a) The standard(s) against which the assessment will be carried out. Details should include any codes of practice being applied to the assessment that are additional to the requirements in this document, for example, requirements in RGSs, RISs and technical standards published by affected stakeholders and project specifications. b) Assessment using an interactive assessment workshop. c) Assessment using specialist tools and equipment. d) Assessment by correspondence. A driveability assessment based on information shared by correspondence is suitable only if the scope is limited to confirming changes that have already been agreed in principle by stakeholders or if the stakeholders confirm that using documentary evidence alone would be sufficient to complete the assessment without the need to convene an assessment workshop. Suitable evidence might include signalling design plans, aspect sequence charts and control tables. e) The overall approach being applied to hazard elimination and control. f) The method of recording the assessment result. Information relevant to the assumptions, dependencies and caveats underpinning the assessment includes the data being used by the Proposer to inform the proposed change. Examples include: a) The standard(s) against which the assessment will be carried out. Details should include: i) The codes of practice being applied to the assessment that are additional to the requirements in this document. ii) Use of similar reference systems. iii) Project specific requirements derived by explicit risk estimation. b) Train operating parameters, including timetables and traffic patterns, rail vehicle types and their restrictions, train lengths, the applicability of permissive or RSSB Page 25 of 44