Lineside Signalling Layout Driveability Assessment ... Iss 1.1.pdf · lineside signalling system, but they are also relevant to the driveability assessment of cab signalling systems.

Rail Industry StandardRIS-0713-CCSIssue: 1.1Date: March 2018

Lineside SignallingLayout DriveabilityAssessmentRequirements

Synopsis

This document sets out requirementsfor assessing the driveability of linesidesignalling systems, and guidance onthe process of assessing changes tosignalling layouts or signal aspectsequences.

Copyright in the Railway Group documents is owned by RailSafety and Standards Board Limited. All rights are herebyreserved. No Railway Group document (in whole or in part)may be reproduced, stored in a retrieval system, ortransmitted, in any form or means, without the prior writtenpermission of Rail Safety and Standards Board Limited, or asexpressly permitted by law.

RSSB members are granted copyright licence in accordancewith the Constitution Agreement relating to Rail Safety andStandards Board Limited.

In circumstances where Rail Safety and Standards BoardLimited has granted a particular person or organisationpermission to copy extracts from Railway Group documents,Rail Safety and Standards Board Limited accepts noresponsibility for, nor any liability in connection with, the useof such extracts, or any claims arising therefrom. Thisdisclaimer applies to all forms of media in which extractsfrom Railway Group documents may be reproduced.

Published by RSSB

© Copyright 2018Rail Safety and Standards Board Limited

Uncontrolled when printed Document supersedes RIS-0713-CCS Iss 1 (to correct formatting) and supersedes in part GERT8071 Iss 2, GEGN8571 Iss 2 and in part GKRT0045 Iss 5 and GKGN0645 Iss 5; and GKRT0075 Iss 4 (clauses 2.1.3 a, b and c) with effect from 03/03/2018

Issue Record

Issue Date Comments

1 03/03/2018 Original document. Requirements and guidance ondriveability assessment is intended to informdecisions about safe integration of linesidesignalling systems with train operations.

1.1 13/03/2018 This document has been reissued to correctformatting only. There are no changes to thecontent.

This document will be updated when necessary by distribution of a completereplacement.

Superseded Documents

The following Railway Group documents are superseded, either in whole or in part asindicated:

Superseded documents Sections superseded Date whensections aresuperseded

GKRT0075 issue four LinesideSignal Spacing and SpeedSignage

2.1.3, 2.4.3, 2.5 03/03/2018

GKRT0045 issue five LinesideSignals, Indicators and Layoutof Signals

3.1.2.4 03/03/2018

Supply

The authoritative version of this document is available at www.rssb.co.uk/railway-group-standards. Enquiries on this document can be submitted through the RSSBCustomer Self-Service Portal https://customer-portal.rssb.co.uk/


Lineside Signalling Layout DriveabilityAssessment Requirements

Page 2 of 44 RSSB


http://www.rssb.co.uk/railway-group-standards


https://customer-portal.rssb.co.uk/

Contents

Section Description Page

Part 1 Purpose and Introduction 71.1 Purpose 71.2 Introduction 71.3 Application of this document 101.4 Health and safety responsibilities 101.5 Structure of this document 111.6 Approval and Authorisation 11

Part 2 Requirements for Driveability Assessment 122.1 Requirements for qualitative assessment of driveability 122.2 Driveability assessment: shunting MA 162.3 Driveability assessment: excessive signal spacing 172.4 Driveability assessment: variation in signal spacing 18

Part 3 Guidance on the Driveability Assessment Process 203.1 When is a driveability assessment needed? 203.2 What does a driveability assessment look like? 223.3 Planning a driveability assessment 233.4 Who participates in the driveability assessment? 263.5 Facilitating a driveability assessment 283.6 Driveability assessment: acceptance criteria 303.7 Driveability assessment records 30

Part 4 Guidance on the Driveability Assessment Hazard Precursors 324.1 Guidance on assessment of lineside signalling systems 324.2 Driveability hazard precursor A1: necessary MA information is not

provided by the signalling system 324.3 Driveability hazard precursor A2: information provided by the

signalling system is not complete 334.4 Driveability hazard precursor A3: some information provided by the

signalling system is not current 344.5 Driveability hazard precursor A4: provided information is not

relevant to some trains 344.6 Driveability hazard precursor A5: information provided by the

signalling system cannot be relied upon 354.7 Driveability hazard precursor B1: poor readability 36



RSSB Page 3 of 44


4.8 Driveability hazard precursor B2: poor interpretability 364.9 Driveability hazard precursor B3: poor accuracy of the information

provided by the signalling system 374.10 Driveability hazard precursor B4: inconsistent signal aspects and

indications presented along the route 384.11 Driveability hazard precursor C1: unusual or non-compliant asset

position relative to corresponding infrastructure features 384.12 Driveability hazard precursor C2: inconsistent infrastructure

position of one or more signalling assets 394.13 Driveability hazard precursor D1: insufficient time for the train

driver to comply with the operating requirement 404.14 Driveability hazard precursor D2: excessive time for the train driver

to comply with the operating requirement 404.15 Driveability hazard precursor D3: excessive variation in position of

successive lineside signals 404.16 Driveability hazard precursor D4: information is provided at

inconsistent times 41

Definitions 42

References 44



Page 4 of 44 RSSB


List of Figures

Figure 1: Example of MAs towards a passenger line using a main signal 17

Figure 2: Safety, reliability and technical compatibility 35



RSSB Page 5 of 44


List of Tables

Table 1: Lineside signalling layout driveability hazard precursors 12

Table 2: Exemptions from the requirement to assess excessive signal spacing 17



Page 6 of 44 RSSB


Part 1 Purpose and Introduction

1.1 Purpose

1.1.1 This document sets out requirements for the scope of a driveability assessment thatcan be used by a Proposer to confirm that planned changes to the lineside signallingsystem, or the train operations that use it, are capable of being safely integrated intothe Great Britain (GB) mainline railway.

1.1.2 The purpose of a driveability assessment is to assess the lineside signalling system forthe hazard of poor driveability, to inform decisions about controlling the risk arising.

1.1.3 This document includes guidance on planning and undertaking a driveabilityassessment.

1.1.4 This document is intended to be read in conjunction with the RSSB standardsapplicable to lineside signalling systems on the GB mainline railway and the guidanceon the application of the Common Safety Method for Risk Evaluation andAssessment (CSM RA) published by the Office of Rail and Road (ORR) and RSSB.

1.1.5 The hazard precursors set out in Part 4 of this document are described in terms of thelineside signalling system, but they are also relevant to the driveability assessment ofcab signalling systems. Additional hazard precursors might be present if the traindriver is presented with Control, Command and Signalling (CCS) system transitions ormultiple signalling systems are provided on the same line.

1.2 Introduction

How to use the requirements in this document

1.2.1 This document sets out requirements for assessing driveability, and guidance on howto carry out the assessments. The requirements and guidance are underpinned by ananalysis of the signal engineering standards applicable to the GB mainline railway tounderstand how these assessments can help Proposers to control the factors thatsupport and influence driveability.

1.2.2 The requirements in this document are available as codes of practice that can beapplied to control the hazard of poor compatibility of the signalling system with trainoperations (poor driveability), and inform a decision that the signalling system isdriveable.

1.2.3 Part 2 sets out the requirements for assessing driveability.

1.2.4 Part 3 provides guidance on the driveability assessment process.

1.2.5 Part 4 provides guidance on the factors that support and influence driveability(driveability hazard precursors).

1.2.6 The requirements in this document are intended to be read in conjunction with theother Railway Group Standards (RGSs) and Rail Industry Standards (RISs) referencedin this document, that contain requirements that can be used to control the hazard ofpoor driveability.



RSSB Page 7 of 44


Driveability assessment

1.2.7 The contribution of the infrastructure manager (IM) (network) towards driveability isto provide, maintain and operate the lineside signalling system so that it is‘driveable’. The contribution of the transport operators is to manage train operationsin accordance with rules and procedures, ensuring that authorised users havesufficient and appropriate competence, experience and knowledge (including traindrivers' route knowledge).

1.2.8 It is good practice to consider how planned changes to the lineside signalling systemor train operations might impact on driveability from the start of the project, usingthe operating requirements specification as the basis; continuing throughout theproject life cycle, including option selection and single option development. Applyingthe principle of 'design for driveability' reduces the likelihood that a driveabilityassessment will recommend changes at a late stage of the project.

1.2.9 The driveability assessment is part of the overall framework of compatibilityassessments and risk assessments that are applied by the Proposer before putting achange into use. It is used to confirm that train drivers will be able to reliably act uponthe information presented by the lineside signalling system, throughout the range ofoperational and ambient conditions applicable on the route(s), within the operationalcontext and while performing their required duties. It provides some of theinformation needed by the Proposer to complete the route compatibility assessmentand signal overrun risk assessment processes. Further guidance on safe integration ofchanges affecting signalling systems is provided in GEGN8651.

1.2.10 The driveability assessment evaluates the likelihood of a train driving error due to:

a) The layout of lineside signals, indicators and lineside operational signs.b) The displays presented by lineside signals, indicators and lineside operational

signs.c) The relationship between train protection and warning system indications and the

displays presented by lineside signals, indicators and lineside operational signs.d) The functionality of the lineside signalling system and the train protection and

warning system in terms of the parameters of the information they present todrivers.

e) The rolling stock types operated on the route.f) The train operations and station operations that use the lineside signalling

system.

1.2.11 Driveability assessment involves representatives of affected transport operatorsbecause:

a) The IM (network) is responsible for providing a lineside signalling system that isdriveable and operating it in accordance with the relevant operating rules andprocedures.

b) Railway Undertakings (RUs) are responsible for train driving, which includesreading and interpreting lineside signal aspects and indications, and acting uponthe information they convey in accordance with the relevant operating rules andprocedures.



Page 8 of 44 RSSB


c) IM (stations) are responsible for train dispatch processes, which includes readingand interpreting lineside signal aspects and indications, and acting upon theinformation they convey in accordance with the relevant operating rules andprocedures.

Driveability

1.2.12 A well-designed signalling system supports good compatibility with train operations.This means that train drivers can obtain and use the information provided by linesidesignals, indicators and signs to take good train driving decisions.

1.2.13 A signalling system that has poor compatibility with train operations is a hazardwhich, if uncontrolled, could result in unacceptable safety risk. This includes thecollision risk or derailment risk that can arise when a train:

a) Exceeds the limit of movement authority (MA).b) Exceeds the permissible speed.c) Uses a permissive MA incorrectly.d) Occupies a level crossing area when a road user is present.e) Uses locally monitored infrastructure that is not correctly set for the train

movement.f) Starts to move before the 'right away' is given.

1.2.14 Compatibility of a lineside signalling system with train operations is described usingthe term 'driveability'. A definition of driveability is provided in Definitions.

1.2.15 Driveability has a range; it is influenced by the operational context on each routewhere the trains will be driven and therefore changes to a lineside signalling systemare assessed. The contribution of a lineside signalling system to driveability is to ‘bedriveable’. Other contributions to driveability include the signalling operations andtrain driving processes.

1.2.16 Train driving involves a continuous process, which includes:

a) Monitoring the railway environment.b) Gathering and assimilating the information needed, including reading and

interpreting information presented at the lineside, in the cab, from other peopleand using procedures.

c) Taking decisions based on all the information available.d) Controlling the train to maintain the required speed, including starting, stopping,

accelerating and braking.

1.2.17 The lineside signalling system provides the following types of information applicableto the train driving processes:

a) MA.b) Routing.c) Locally monitored system status (for example, ‘points correctly set’).d) Operating instruction (for example, ‘close train doors’).e) Permissible speed change.



RSSB Page 9 of 44


1.2.18 Other information relevant to train driving is provided by authorised personnel (forexample, signallers and station staff), working timetables, rules and procedures.

1.2.19 The design of the lineside signalling system influences:

a) What information is provided by the lineside signalling system.b) Which signal aspects, indications and signs provide the information.c) Where the information is positioned within the driver’s field of vision.d) When the information is provided relative to the required train driving response.

1.2.20 Train drivers read and interpret signal aspects, indications and signs in order tounderstand:

a) Whether or not an MA is provided to the train.b) The type and extent of MA that is provided.c) Which route is set at a diverging junction and, therefore, which applicable

permissible speed applies.d) The operational status of locally monitored systems on the route.e) Relevant train operating instructions.f) The permissible speed limit.

1.2.21 Providing a signalling system that is driveable does not mean that the risk is reducedto an acceptable level. Risk assessment is used to confirm that sufficient risk controlsare provided.

1.2.22 Further requirements and guidance on risk controls and risk assessment are providedin RISs and company standards published by the IM (network).

1.2.23 Further requirements and guidance on operating the signalling system and trainoperations are provided in the National Operating Publications and transportundertaking safety management systems.

1.3 Application of this document

1.3.1 Compliance requirements and dates have not been specified since these will be thesubject of internal procedures or contract conditions.

1.3.2 The Standards Manual and the Railway Group Standards (RGS) Code do not currentlyprovide a formal process for deviating from a Rail Industry Standard (RIS). However, amember of RSSB, having adopted a RIS and wishing to deviate from its requirements,may request a Standards Committee to provide opinions and comments on theirproposed alternative to the requirement in the RIS. Requests for opinions andcomments should be submitted to RSSB by e-mail to [email protected] formulating a request, consideration should be given to the advice set out inthe ‘Guidance to applicants and members of Standards Committee on deviationapplications’, available from RSSB’s website.

1.4 Health and safety responsibilities

1.4.1 Users of documents published by RSSB are reminded of the need to consider theirown responsibilities to ensure health and safety at work and their own duties underhealth and safety legislation. RSSB does not warrant that compliance with all or any



Page 10 of 44 RSSB


documents published by RSSB is sufficient in itself to ensure safe systems of work oroperation or to satisfy such responsibilities or duties.

1.5 Structure of this document

1.5.1 This document sets out as a series of requirements that are sequentially numbered. This document also sets out the rationale for the requirement, explaining why therequirement is needed and its purpose, and where relevant, guidance to support therequirement. The rationale and the guidance are prefixed by the letter ‘G’.

1.5.2 Some subjects do not have specific requirements but the subject is addressed throughguidance only and where this is the case, it is distinguished under a heading of‘Guidance’ and is prefixed by the letter ‘G’.

1.6 Approval and Authorisation

1.6.1 The content of this document will be approved by Control Command and SignallingStandards Committee on 18 January 2018.

1.6.2 This document will be authorised by RSSB on 30 January 2018.



RSSB Page 11 of 44


Part 2 Requirements for Driveability Assessment

2.1 Requirements for qualitative assessment of driveability

2.1.1 The Proposer shall review the proposed change to identify if any of the hazardprecursors set out in Table 1 could be introduced by that change.

Driveability Hazard Precursor

Parameter Identity Description

What information isprovided to train drivers

A1 Necessary MA informationis not provided by thesignalling system

A2 Information provided bythe signalling system is notcomplete

A3 Some informationprovided by the signallingsystem is not current

A4 Information provided bythe signalling system is notrelevant to some trains

A5 Information provided bythe signalling systemcannot be relied upon

Which signalling displaysare used to provide theinformation

B1 Poor readability

B2 Poor interpretability

B3 Poor accuracy of theinformation provided bythe signalling system

B4 Inconsistent signal aspectsand indications presentedalong the route

Where information ispositioned within the traindriver’s field of vision

C1 Unusual or non-compliantsignalling asset positionrelative to correspondinginfrastructure features

C2 Inconsistent infrastructureposition of one or moresignalling assets



Page 12 of 44 RSSB


Driveability Hazard Precursor

Parameter Identity Description

When information isprovided

D1 Insufficient time for thetrain driver to comply withthe operating requirement

D2 Excessive time for the traindriver to comply with theoperating requirement

D3 Excessive variation inposition of successivelineside signals

D4 Information is provided atinconsistent times

Table 1: Lineside signalling layout driveability hazard precursors

2.1.2 For each identified driveability hazard precursor, the Proposer shall confirm that theproposed mitigation is sufficient to control the associated risk to an acceptable level.

Rationale

G 2.1.3 The driveability hazard precursors can make the train driving task more difficult onlines where train drivers rely on the lineside signalling system to obtain information.Therefore, if one or more of these hazard precursors are identified to be presentwithin a signalling layout, appropriate measures are needed to control the associatedrisk.

G 2.1.4 A1 is assessed to confirm that:

a) The lineside signalling system is compatible with all reasonably foreseen trainoperations that require a signalled MA.

b) The signalling layout provides reasonable opportunities for train drivers to obtainthe information needed to recover from an error.

G 2.1.5 A2 is assessed to confirm that the lineside signalling system supports train drivers’understanding of:

a) Whether the train has an MA.b) The type of the MA that is available.c) At a diverging junction, the route to which the MA applies.d) The applicable permissible speed.e) The status of any locally monitored systems associated with the train movement.f) Relevant operating information.

G 2.1.6 A3 is assessed to confirm that the information provided by the lineside signallingsystem supports train drivers' understanding of the actual status of the railway.



RSSB Page 13 of 44


G 2.1.7 A4 is assessed to confirm that the lineside signalling system is optimised to allowtrain drivers to assimilate all of the information needed to inform the train drivingtask, taking account of route knowledge and the operational context on that route.

G 2.1.8 A5 is assessed to confirm that the reliability performance of the lineside signallingsystem, and its failure modes, are compatible with train drivers obtaining informationthat can be relied upon.

G 2.1.9 B1 and B2 are assessed to confirm that the overall level of readability andinterpretability on the route is consistent with the requirement of the train driver toread and interpret the relevant signal aspects, indications and signs.

G 2.1.10 B3 is assessed to confirm that the signal aspects, indications and signs are anaccurate portrayal of the state of the railway.

G 2.1.11 B4 is assessed to confirm that any variation in the appearance of signal aspects andindications on the route can be managed by train drivers.

G 2.1.12 C1 is assessed to confirm that the position of lineside signalling assets relative toother infrastructure features that are associated with a train driving task:

a) Is consistent with developing and maintaining train drivers’ route knowledge.b) Will not mislead a train driver into making an error.c) Provides an opportunity, where appropriate, for a train driver to recover from an

error before a hazard is reached.

G 2.1.13 C2 is assessed to confirm that the position of lineside signalling assets will notmislead a train driver or cause a train driver to misread or misinterpret theinformation being conveyed.

G 2.1.14 D1 and D2 are assessed to confirm that the lineside signalling system provides theinformation at a time that helps train drivers to act upon it when it is needed.

G 2.1.15 D3 and D4 are assessed to confirm that the variation in the time that information ismade available does not compromise the ability of the train driver to respondcorrectly.

G 2.1.16 Further guidance on the driveability hazards is provided in Part 4.

Guidance

G 2.1.17 Conformity with this requirement can be achieved using a driveability assessment.Part 3 provides further guidance on the driveability assessment process.

G 2.1.18 The hazard precursors set out in Table 1 can arise from a change to the signallingsystem or a change to a different part of the railway that interacts or interfaces withthe signalling system.

G 2.1.19 Three risk acceptance principles can be applied to control the driveability hazardprecursors:

a) Conformity with a code of practice and assessment.b) Comparison with a similar reference system and assessment.c) Explicit risk estimation and assessment.



Page 14 of 44 RSSB


G 2.1.20 In many cases, providing a design that conforms with requirements in applicableRGSs and RISs is sufficient to control the hazard of poor driveability. The driveabilityassessment process is used to record the extent to which conformity withrequirements in RGSs and RISs is sufficient to control the hazard precursors. Thisapproach is consistent with applying the risk acceptance principle: conformity withcode of practice and assessment.

G 2.1.21 Conformity with applicable standards does not mean that all of the driveabilityhazard precursors arising from a planned change to a particular lineside signallingsystem will be controlled to an acceptable level of risk. The Proposer is responsible fordeciding which standards are applicable and the extent to which conformity controlsthe risk.

G 2.1.22 Some requirements in RGSs and RISs specify design parameters that are known tocontrol certain hazards. For example, the requirement in RIS-0703-CCS for the firstcautionary aspect to be at least signalling braking distance (SBD) from the associatedmain stop aspect can be applied to control hazard precursor D1; however, it does notcontrol hazard precursor D2.

G 2.1.23 Some requirements describe methods of assessment that may support a decision thata hazard is controlled to an acceptable level. For example, the codes of practice forthe signal sighting assessment can be applied to identify the method of controllinghazard precursors B1 and B2.

G 2.1.24 Conformity with applicable standards is beneficial because it means that the mainfocus of the driveability assessment work will be the parts of the system that areeither non-conforming, or result in hazards that are not sufficiently controlled byconformity with standards, or are the most difficult parts of the layout to drive.

G 2.1.25 Codes of practice applicable to controlling the driveability hazard precursors on theGB mainline railway include the content in GKRT0075, RIS-0703-CCS, RIS-0737-CCS,RIS-0744-CCS and RIS-0758-CCS, which include guidance on the driveability hazardsthey control and the applicability of the requirements.

G 2.1.26 Additional hazard controls can be applied using the other two risk acceptanceprinciples set out in b) and c).

G 2.1.27 A Proposer can decide that a compliant design does not provide the optimumsolution. For example, a limited change to an existing lineside signalling system couldhave an adverse impact on driveability if it introduces an inconsistency or variation inthe presentation of information to train drivers. In this case, comparison with asimilar reference system can be used.

G 2.1.28 It is permissible to implement a bespoke design that does not conform with a code ofpractice or a similar reference system if the Proposer can confirm that the alternativesolution controls the risk to an acceptable level. This is done by exception and, whereit is applied, the driveability assessment confirms that the bespoke design does notitself constitute a hazard.

G 2.1.29 If one or more driveability hazard precursors cannot be controlled to the extent thatrisk is acceptable, further risk evaluation and assessment is used to identify whatadditional safety measures are needed. This might include additional train protectionsystem measures and operational controls.



RSSB Page 15 of 44


2.2 Driveability assessment: shunting MA

2.2.1 The Proposer shall assess the acceptability of using an independent shunt signal topresent an MA for train movements towards, or along, a passenger line.

2.2.2 This assessment shall consider all of the following:

a) The rationale for not providing a main signal.b) The frequency of train movements using that signal.c) The frequency of train movements from that signal towards, or along, a passenger

line.d) The frequency of train movements using that signal towards, or along, a

passenger line when the signal section is occupied (permissive shunt).e) The readability of the signal(s) denoting the limit of MA on the passenger line.f) The distance to the signal(s) denoting the limit of MA on the passenger line.g) The signalling layout at other geographical locations where train drivers might

experience similar train movements.h) The operating rules and procedures for using a shunt MA at that location.

Rationale

G 2.2.3 Using an independent shunting signal can increase the likelihood of signal overrun ora train-on-train collision because the shunt aspect does not provide the train driverwith enough information to understand whether the next stop signal is displaying astop aspect or a proceed aspect or whether the section is clear or occupied. Previousexperience at this location and similar locations can influence train drivers'understanding of the required operation.

G 2.2.4 The output of this assessment is the likelihood of:

a) A train exceeding the limit of a shunt MA on a passenger line.b) A train-on-train collision when the shunt MA is towards an occupied line.

G 2.2.5 This requirement can be applied to control driveability hazard precursor A2:Information provided by the signalling system is not complete.

Guidance

G 2.2.6 The result of this assessment provides data to support the signal overrun riskassessment and permissive working risk assessment. RIS-0386-CCS sets out furtherrequirements for signal overrun risk assessment.

G 2.2.7 It is good practice to design signalling layouts so that shunt MAs for train movementstowards, or along, a passenger line end at a main stop signal. Any independent shuntsignals within the MA that are provided for other reasons (for example, for set backshunt moves) can be preset. Fig. 1 shows an example of this.



Page 16 of 44 RSSB


Figure 1: Example of MAs towards a passenger line using a main signal

G 2.2.8 In the example shown in Fig. 1, it is permissible to provide independent shuntingsignal 1051, subject to driveability and risk assessment.

G 2.2.9 The likelihood of signal overrun or train-on-train collision can be further managed ifmain signal 301 is provided. Signal 301 is capable of clearing to:

a) A main proceed aspect when signal 107 is presenting a main proceed aspect.b) The single yellow caution aspect when signal 107 is displaying a main stop aspect.c) A subsidiary shunt aspect when the signal section on the passenger line is

occupied and for train movements into the siding.

G 2.2.10 The likelihood of a signal overrun at shunt signal 1053 is controlled if it is preset byroutes from signal 301 to signal 107 or 1055 (LOS).

2.3 Driveability assessment: excessive signal spacing

2.3.1 The Proposer shall assess the impact on driveability of signal aspect sequences wherethe distance from the first cautionary aspect to the associated stop aspect exceedsthe minimum signalling braking distance requirement by 50% or more.

2.3.2 This requirement is not applicable where an exemption in Table 2 is applicable.

Criteria Scope of exemption from assessment

Where parallel lines on a multi-trackedroute are signalled in the same directionand have different permissible speeds

Signal spacing on the line with the lowerpermissible speed, if parallel positioningof signals provides a greater benefit

Where lines at a converging junctionhave different permissible speeds

The signal spacing between the last stopsignal on the converging route and thefirst stop signal beyond the junction

Where signal spacing is optimised for aparticular train braking performance

Trains with a braking performancesuperior to that to which the signallinglayout is optimised



RSSB Page 17 of 44


Criteria Scope of exemption from assessment

Where a lower differential permissiblespeed applies to trains with inferiorbraking performance

Trains to which the lower differentialpermissible speed applies

The signal spacing beyond a stop signalprotecting the exit from a siding, loop orconverging platform line

Trains that start from rest

The signal spacing beyond stop signalswhere trains start from rest on a throughline

The signal spacing approaching a bufferstop at the end of a signalled line

The cautionary aspect sequenceassociated with the buffer stop

Table 2: Exemptions from the requirement to assess excessive signal spacing

Rationale

G 2.3.3 The aim of this assessment is to confirm that train drivers will be able to manage anyMA information that is presented significantly before the time it is needed to make atrain driving decision.

G 2.3.4 The exemptions in Table 2 represent cases where repositioning signals to reducesignal spacing would not provide an overall benefit.

G 2.3.5 The result of the assessment of excessive signal spacing can be used to inform adecision about the extent that driveability hazard precursor D2 is controlled.

Guidance

G 2.3.6 Train drivers use the first cautionary aspect to understand that the train isapproaching the limit of MA and to inform their decision about when to apply thebrakes. If this information is presented too early, the signal aspect is less helpful indenoting the optimum train braking point and the train driver might forget whichaspect was displayed by the time the brakes need to be applied.

G 2.3.7 Further requirements and guidance on determining minimum signalling brakingdistances are set out in GKRT0075.

G 2.3.8 Further requirements and guidance on signal positioning and cautionary aspectsequences are set out in RIS-0703-CCS.

2.4 Driveability assessment: variation in signal spacing

2.4.1 The Proposer shall assess the impact on driveability where excessive signal spacing atconsecutive signals on the same line reduces by 34% or more.



Page 18 of 44 RSSB


Rationale

G 2.4.2 The aim of the assessment is to confirm that the train driver can manage thevariation in the time that cautionary MA information is presented relative to the timethat the brakes need to be applied. Excessive variation increases the train driverworkload and the likelihood of train driver error.

G 2.4.3 The result of the assessment of excessive variation in signal spacing can be used toinform a decision about the extent that driveability hazard precursors D3 and D4 arecontrolled.

Guidance

G 2.4.4 Train drivers use the first cautionary aspect to understand that the train isapproaching the limit of MA and inform their decision about when to apply thebrakes. If this information is presented at varying times, the signal aspect is lesshelpful in denoting the train braking point and the train driver might forget when toapply the brake.



RSSB Page 19 of 44


Part 3 Guidance on the Driveability Assessment Process

3.1 When is a driveability assessment needed?

Guidance on when a driveability assessment is needed

G 3.1.1 The Proposer can decide that a driveability assessment is needed to confirm that aplanned change to a lineside signalling system, or the train operations that use it, canbe safely integrated into the operational railway. This might be necessary if theplanned change includes features that could adversely affect driveability.

G 3.1.2 A change to the lineside signalling system has the potential to adversely affectdriveability, and therefore increase risk, if it changes:

a) What information is presented to users of the lineside signalling system.b) Which equipment or displays are used to present the information.c) Where the information is presented relative to the user's viewpoint of the railway

and the operational context.d) When the information is made available to users relative to the train driving task

requirement.

G 3.1.3 Examples of signalling system changes that might require a driveability assessmentinclude alteration to:

a) The type of signalling system.b) The method of operation.c) The configuration, type or infrastructure position of lineside signalling assets (for

example, changes to signal spacing).d) The MAs provided by the lineside signalling system (for example, additional signal

routes, permissive MAs).e) The lines on which signalled MAs apply.f) The signal aspects, indications and signs presented at each signalling asset,

including any changes to display appearance.g) The sequence(s) of signal aspects, indications and signs presented to train drivers,

including any time delays designed into the system.h) Signal aspects or indications that can be presented in normal and failure

conditions.

G 3.1.4 Planned changes to other structural or operational systems can have an adverseeffect on driveability if they introduce a hazard precursor or invalidate an assumption,dependency or caveat underpinning the results of a previous assessment. Examples ofchanges that might affect the train driving process, and therefore driveability,include:

a) A modified network infrastructure.b) A change to train operations.c) A change to the type of rolling stock or the train consists operated on the route.

G 3.1.5 Examples of network infrastructure alterations that might require a driveabilityassessment include changes to:

a) Track layout.



Page 20 of 44 RSSB


b) Gradient profile.c) Permissible speed(s).d) Electrification system(s).e) Station platform(s), length or position.

G 3.1.6 Changes to the operational context that might require a driveability assessmentinclude changes to:

a) The operating specification.b) The method of train operation during normal and degraded operations.c) Train consists.d) Rolling stock type or performance.e) Operations at infrastructure operated by train crew (for example, a ground frame,

token instrument or locally monitored points).f) A train dispatch system.g) Train driving policy.h) Train stopping position at a station.

Guidance on when to undertake the driveability assessment

G 3.1.7 Considering driveability and involving train operators from the start of projects shouldresult in signalling system designs that are driveable and capable of being safelyintegrated into the GB mainline railway. A well-managed project considers driveabilitythroughout the project life cycle so that the driveability assessment is used to confirmthat the design is fit for purpose without needing any further significant changes.

G 3.1.8 Undertaking a driveability assessment at a late stage in a project might add cost to aproject if factors are identified that result in a need to change the design. In this casethe driveability assessment may be of little benefit; it may be too expensive toimplement changes that would have improved driveability at less cost if they hadbeen identified at an earlier project stage.

G 3.1.9 The Proposer uses the output from driveability assessment to inform decisions aboutsafe integration; therefore, the driveability assessment should be completed before adesign option decision is taken.

G 3.1.10 The Actors use the output to confirm their actions in implementing safetyrequirements.

G 3.1.11 The output of the assessment can have implications on the project Sponsor,particularly if there are recommendations that imply significant changes may beneeded.

G 3.1.12 Some of the assessment recommendations might be relevant to decisions about‘reasonable opportunity’ to improve the signalling system that would otherwise beoutside of the original project scope.

G 3.1.13 The output of a driveability assessment may be an input to further assessmentsrelating to safe integration of the change. The output may also inform the review bya Network Rail Major Schemes Review Panel (MSRP) prior to approval forconstruction.



RSSB Page 21 of 44


3.2 What does a driveability assessment look like?

Guidance on the scope of a driveability assessment

G 3.2.1 The driveability assessment considers the physical attributes of the railway and theoperational context on the signalled lines where trains will be driven, including theimpact on train driving of:

a) Trackside CCS subsystem features, for example signal aspect sequences.b) Trainborne CCS subsystem features, for example Automatic Warning System

(AWS) indications or cab signalling displays.c) Rolling stock features.d) Electrification subsystem features, for example neutral sections and conductor rail

gaps.e) The track layout.f) Stations and structures, including station platforms.g) The operational task requirements on the route, including required stopping

positions.h) People, including other railway personnel.i) The environment.

Guidance on what is assessed

G 3.2.2 The driveability assessment needs to be of a sufficient breadth and depth to reach aconclusion that enough has been done to find the hazard precursors that couldadversely affect driveability.

G 3.2.3 It is not necessary to assess every signalling asset and signal route. If the project hasbeen well managed in considering driveability, the assessment can sample arepresentative selection of signal routes to confirm that the system is driveable.

G 3.2.4 The driveability assessment provides the most benefit by looking for signal routesthat make train driving more difficult. For example, this may include:

a) Interfaces with the existing signalling system, including fringes.b) New or unusual train operations, for example propelling or running round.c) Signalling system and route transitions, including aspect sequences.d) Depot interfaces, including ground frame operations.e) Inconsistent signal spacing.f) Irregular permissible speed profiles, including inconsistencies with movement

authorities.g) Junction aspect sequences, including approach controls.h) Complex / diverse routing.i) Unusual or non-compliant signal aspects, aspect sequences and indications.j) Train dispatch arrangements.k) Permissive working.l) Facilities that are provided to assist service recovery and which are therefore

infrequently used.



Page 22 of 44 RSSB


G 3.2.5 The driveability assessment is a good opportunity for ‘cross-route’ comparison (forexample, consider how the impact of changing something can change the driveabilityof something else, perhaps untouched by the project).

G 3.2.6 It is helpful to select a train movement and describe how the train will progress fromstart to destination, with an emphasis on the information needs of the driver. If apotential issue is identified, asking questions based on the driveability hazardprecursors described in Part 4 of this document provides a focussed assessment of theissue.

G 3.2.7 It is beneficial to avoid ‘solutioneering’. The Project is responsible for developing adesign that is fit-for-purpose; therefore, the role of the driveability assessment islimited to reviewing the proposed design and making recommendations if it isappropriate to do so.

3.3 Planning a driveability assessment

Guidance on planning a driveability assessment

G 3.3.1 The driveability assessment plan forms part of the overall safe integration strategyfor changes to lineside signalling systems and the train operations that use thosesystems. Further guidance on the framework of route compatibility assessments andrisk assessments that form part of the safe integration of change is provided inGEGN8651.

G 3.3.2 A driveability assessment can apply to any planned change to the lineside signallingsystem or the train operations that use it; however, it is not generally used to assesstemporary changes to the railway, for example those associated with implementing atemporary speed restriction (TSR) or emergency speed restriction (ESR). Therequirements for managing TSRs and ESRs are set out in RIS-0734-CCS.

G 3.3.3 The driveability assessment plan is used to specify an assessment that is sufficientlyrigorous to evaluate the applicability of the driveability hazard precursors and assessthe options available to eliminate or control each one. The actual content of eachdriveability assessment plan will reflect the planned changes and be proportionate tothe scope and complexity.

G 3.3.4 The scope of each driveability assessment can be dependent on the extent to whichthe planned change conforms with the codes of practice applicable to controlling thedriveability hazard precursors on the GB mainline railway. These are typically set outin GKRT0075, RIS-0703-CCS, RIS-0737-CCS, RIS-0744-CCS and RIS-0758-CCS, whichinclude guidance on the driveability hazards they control and the applicability of therequirements.

G 3.3.5 The IM (Network) manages the driveability assessment process and produces thedriveability assessment plan. If the Proposer is an railway undertaking (RU) or an IM(stations), the project plan includes the arrangements with the IM (network) formanaging the driveability assessment.

G 3.3.6 Inviting representation from external stakeholders, including any transportoperator(s) external to the mainline railway, is consistent with the legal obligation tocooperate in order to manage shared risk. Examples of when a transport operatorexternal to the mainline railway should be invited include assessment of:



RSSB Page 23 of 44


a) A route used by mainline trains and a metro operator.b) A layout that interfaces with another IM, for example a depot or yard.

G 3.3.7 Consultation on the driveability assessment plan can provide process efficiencies ifstakeholders confirm that the assessment will be capable of addressing issues ofconcern and that the required resources and information will be available.

G 3.3.8 A driveability assessment plan that is sufficiently complete and comprehensiveprovides stakeholders with a holistic view of the planned assessment.

Guidance on the content of the driveability assessment plan

G 3.3.9 The content of the driveability assessment plan helps each stakeholder to understandtheir expected contribution to the assessment and which other stakeholders have aninterest. Stakeholders use the information in the driveability assessment plan toconfirm that the assessment will be sufficiently robust to identify and evaluate thedriveability hazard precursors relevant to their operations.

G 3.3.10 The driveability assessment plan helps the affected parties to understand thefollowing, before the assessment takes place:

a) Why the driveability assessment is needed.b) What will be assessed and what will not be assessed.c) When the assessment will take place.d) Where the assessment will take place.e) Who will take part in the assessment.f) Which assessment method(s) will be used.g) How the assessment will be done.h) The assumptions, dependencies and caveats underpinning the assessment.

G 3.3.11 The content of the assessment plan may develop and change over time. It is goodpractice to start planning the driveability assessment and consulting withstakeholders at an early stage, starting with a high-level description of how theassessment contributes to the implementation of the project safe integrationstrategy. The final version of the plan provides stakeholders with all of the relevantinformation they need to fulfil their roles in the assessment.

G 3.3.12 Information relevant to ‘why the assessment is needed’ includes the reason for thechange and what is the expected outcome. The driveability assessment plan shouldreference the project scope, the safe integration strategy and make it clear what isincluded / excluded from the assessment.

G 3.3.13 Information relevant to ‘what will be assessed’ includes information about:

a) Changes to the lineside signalling system, including signalled MAs, signalledroutes, permissible speeds, locally monitored infrastructure, and operatingindications.

b) Changes to railway infrastructure, including track and electrification systems.c) Changes to the trains and types of rolling stock being operated.d) Changes to planned train operations, including train movements and methods of

train dispatch.e) Parts of the existing railway that will not change.



Page 24 of 44 RSSB


f) Any deviations relevant to the assessment.

G 3.3.14 Information relevant to ‘when the assessment will take place’ includes the dates andtimes of each part of the assessment.

G 3.3.15 Information relevant to ‘where the assessment will take place’ includes assessmentvenues.

G 3.3.16 Information relevant to ‘who will perform the assessment’ includes:

a) Facilitation of the assessment.b) Nominated stakeholder representatives, their role(s) and their affiliation.c) Arrangements for confirming representatives' identity and authorisation.

G 3.3.17 Information relevant to ‘which assessment method will be used’ includes thedriveability assessment method. The assessment plan can specify a combination ofassessment methods including:

a) Structured professional judgement.b) Assessment using simulation of the train driving process.c) Formal assessment of hazards and risks.

G 3.3.18 Information relevant to ‘how the assessment will be done’ includes:

a) The standard(s) against which the assessment will be carried out. Details shouldinclude any codes of practice being applied to the assessment that are additionalto the requirements in this document, for example, requirements in RGSs, RISs andtechnical standards published by affected stakeholders and project specifications.

b) Assessment using an interactive assessment workshop.c) Assessment using specialist tools and equipment.d) Assessment by correspondence. A driveability assessment based on information

shared by correspondence is suitable only if the scope is limited to confirmingchanges that have already been agreed in principle by stakeholders or if thestakeholders confirm that using documentary evidence alone would be sufficientto complete the assessment without the need to convene an assessmentworkshop. Suitable evidence might include signalling design plans, aspectsequence charts and control tables.

e) The overall approach being applied to hazard elimination and control.f) The method of recording the assessment result.

G 3.3.19 Information relevant to ‘the assumptions, dependencies and caveats underpinningthe assessment’ includes the data being used by the Proposer to inform the proposedchange. Examples include:

a) The standard(s) against which the assessment will be carried out. Details shouldinclude:

i) The codes of practice being applied to the assessment that are additional tothe requirements in this document.

ii) Use of similar reference systems.iii) Project specific requirements derived by explicit risk estimation.

b) Train operating parameters, including timetables and traffic patterns, rail vehicletypes and their restrictions, train lengths, the applicability of permissive or



RSSB Page 25 of 44


propelling moves and the contribution of route knowledge. This may take accountof existing and future train operations that are relevant to the scope of thechange project that the assessment is supporting. Sharing this informationprovides an opportunity for the IM to capture information about foreseeablelonger-term aspirations held by other IMs and RUs and incorporate these into theassessment if there is a cost benefit in doing so.

c) The technical information and data used to inform the assessment, for examplemaximum and attainable train speed, acceleration and deceleration performance.

d) The output from other assessments, for example, signal sighting assessment.e) The input to other risk assessments, for example, permissive working risk

assessment and signal overrun risk assessment.f) Records of previous assessments. This information might be relevant if it would

help to inform the assessment in reaching a decision. For example, records ofassessment of similar layouts in similar operational contexts could be used as abaseline to inform consistent decision making by the assessment representatives.

g) The date(s) when the change(s) is planned to be implemented, including anystagework.

3.4 Who participates in the driveability assessment?

Guidance

G 3.4.1 The driveability assessment is informed by stakeholder representatives who provideinformation necessary to reach a decision on driveability. The representatives include:

a) IM (network) operator.b) RU operator.c) IM (stations) operator, if relevant to the assessment.

G 3.4.2 A small group of assessors supported by independent facilitation can reach areasoned and balanced conclusion; however, this is dependent on there beingsufficient knowledge, experience, and representation to make sure that the changeand the operational context are sufficiently well understood and considered. Thefacilitator is competent in the process and with no personal stake in the project.

G 3.4.3 Train operator representation is sufficiently wide-ranging to cover the scope ofpassenger and freight train operations that will use the signalling system, with anemphasis on train driving experience. It is good practice to agree to sharerepresentation at the assessment.

G 3.4.4 Network operator representation provides information about the existing operationalcontext and the future planned operations.

G 3.4.5 Consistency in representation can be a benefit in running an efficient assessment,particularly where previous assessments have taken place, for example signal sightingassessment. Some variation in participation can help to avoid ‘group think’.

G 3.4.6 Other participants that might add value include:

a) Yard or depot operators that interface with the mainline railway.b) Metro operators where they operate on or interface with the mainline.c) Station operators where train dispatch operations are a significant factor.



Page 26 of 44 RSSB


G 3.4.7 The facilitator is responsible for:

a) Convening the assessment.b) Collating the information needed to reach an informed decision.c) Making the information available to assessment representatives prior to the

assessment.d) Managing quoracy.e) Facilitating the assessment.f) Making sure that the assessment findings and recommendations are recorded.g) Preparing an assessment report, where necessary, and making it available to

stakeholders.h) Co-ordinating any follow-up actions with stakeholders.

G 3.4.8 The IM (network) operator contribution to driveability assessment is the relevantinfrastructure operating competence, signalling knowledge and train operatingexperience. This helps to confirm the applicability of the following assumptions,dependencies and caveats to the driveability assessment:

a) IM (network) operating processes.b) Existing and planned timetables, traffic patterns and train lengths.c) Movement authorities and routing; type and frequency of use.d) Existing and potential operational risk.e) Hazard elimination and mitigation available to IM (network) operators.f) Records of operating incidents relevant to the lineside signalling system being

assessed (for example, a multi-SPAD signal).

G 3.4.9 The RU operator contribution to driveability assessment is the relevant train drivingcompetence and traction knowledge and train operating experience. The informationprovided helps to confirm the applicability of the following assumptions,dependencies and caveats to the driveability assessment:

a) The train driving task relevant to the layout being assessed.b) RU train driving policy and procedures.c) Relevant train operating parameters such as train speeds, braking and

acceleration performance.d) Traction and vehicle types.e) In-cab train protection systems.f) Existing and potential train driving risks.g) Existing and potential train dispatch risks.h) Hazard elimination and mitigation available to RUs.

G 3.4.10 The IM (stations) contribution to driveability assessment is the relevant stationoperation's competence, knowledge and train operating experience. The informationprovided helps to confirm the applicability of the following assumptions,dependencies and caveats to the driveability assessment:

a) IM (stations) operating processes.b) Existing and planned station operations, including train dispatch equipment

location and operations.c) Existing and planned station infrastructure.



RSSB Page 27 of 44


d) Existing and potential station operation's risks.e) Hazard elimination and mitigation available to IM (stations).

G 3.4.11 Stakeholders can share representation if the nominated person(s) has sufficientcompetence, knowledge and experience to provide the necessary information.

G 3.4.12 The driveability assessment is also supported by a signal engineer, who has sufficientcompetence, knowledge and experience to confirm the applicability of the followingassumptions, dependencies and caveats to the driveability assessment:

a) Signal sighting assessment results.b) Signalling layout, signalling braking distances and signal aspect sequences,

including design assumptions about train performance (for example, assessedattainable speeds).

c) Signalling system functionality (for example, approach release of signal aspects).d) Train protection and warning system configuration and functionality.e) Communications system configuration and functionality.f) Infrastructure data relevant to the assessment, including permissible speeds,

gradients, signalling braking distances and electrification system interfaces.g) Stage work, which may be associated with a reduction in signalling facilities.h) The driveability hazards identified by the project and the options available to

control the hazards.

3.5 Facilitating a driveability assessment

Guidance on quoracy

G 3.5.1 The driveability assessment is quorate if all IM and RU stakeholders who haveexpressed an interest are present or are represented. A quorate assessment isbeneficial because the discussion during the assessment influences the pass / faildecision. Planning a driveability assessment that relies on separate meetings withsome stakeholder representatives before or after the assessment does not support afully informed discussion.

G 3.5.2 It is good practice to maintain an attendance record throughout the assessment and,if any participants leave during the assessment, review the membership to confirmthat the attendance still provides sufficient competence and knowledge to reach afully informed assessment decision.

G 3.5.3 If the facilitator considers that the attendance does not provide all of the requiredcompetence and knowledge, continuing the assessment might conclude with only apreliminary assessment decision. Further assessment might be needed when theadditional competence and information become available.

G 3.5.4 If the facilitator considers that the membership provides sufficient competence andknowledge but not all of the invited IM and RU representatives attend, the Proposercan consult on the assessment decision with the absent representative(s) beforetaking the recommendations forward for design approval.

G 3.5.5 The driveability assessment facilitator confirms that:



Page 28 of 44 RSSB


a) The context of the assessment is sufficiently realistic to replicate the effects ofcomplex interactions and their impact on train driving.

b) The fidelity of any simulation is sufficient to facilitate a reasonably accurateassessment of the effects of each driveability hazard on train driving.

Guidance on methods of assessment

G 3.5.6 Acceptable methods of assessing driveability include:

a) Structured professional judgement using previous knowledge and experience oftrain operations in a similar operational context.

b) Simulation of the train driving task.

G 3.5.7 For many planned changes, assessment using structured professional judgement issufficient. For major or complex changes, or projects where there is insufficientknowledge and experience of train operations in a similar operational context tosupport a robust decision, driveability assessment using simulation tools can providethe most effective and efficient method.

G 3.5.8 Simulation tools are approved by the IM (network) as suitable for driveabilityassessment. Approved simulation tools:

a) Provide a high-definition visual representation of the driver’s view of the layout(s)being assessed and its operational context.

b) Use video and / or virtual reality technology.c) Incorporate facilities to superimpose images onto the railway environment.d) Present images that have a level of granularity that equals or exceeds that which

would be achieved by a site assessment.

Guidance on necessary information

G 3.5.9 The driveability assessment is sufficient to support a fully informed decision only ifthe available information (including simulation data) is an accurate representation ofthe real operational context and up to date. It is good practice for the driveabilityassessment plan to include the arrangements for confirming the completeness andaccuracy of the information.

G 3.5.10 The following information helps to inform the assessment of driveability:

a) Operating requirements specification – this is the basis of the signalling systemdesign and the basis for the assessment scope.

b) Signalling layout (scheme) plan showing the planned changes and the interfaceswith the parts of the railway that are not changing.

c) Aspect sequence charts.d) Route tables (and control tables if available).e) Signal sighting assessment records.f) Video imaging or simulation of the routes to be driven.



RSSB Page 29 of 44


3.6 Driveability assessment: acceptance criteria

Guidance

G 3.6.1 The assessment considers driveability from the point of view of all authorised users ofthe lineside signalling system and those impacted by it, and therefore the decisiontakes account of all stakeholder representatives.

G 3.6.2 Driveability is acceptable when the IM (network), IM (stations) and RUrepresentatives nominated to the assessment confirm that the signalling layout is fitfor purpose for train driving, taking account of:

a) The operational context, including the train driving and train dispatch processes.b) Train drivers' route knowledge.c) The railway infrastructure configuration, including the signalling, infrastructure

and electrification subsystems.d) The applicability of the driveability hazard precursors set out in this document.e) The application of the risk acceptance principles to eliminate or control the

driveability hazard precursors.f) The responsibilities of the Proposer and other duty holders to implement hazard

controls.

G 3.6.3 The assessment decision can be qualified with a recommendation that further riskassessment is needed to pay particular attention to a specific hazard precursor or risk.In such cases, details of each hazard precursor and the relevant risk are provided tothe Proposer.

G 3.6.4 A failure to reach an agreed assessment conclusion means that further managementaction might be necessary to reach a decision on the acceptability of the change.

G 3.6.5 If the assessment fails to agree:

a) The facilitator should record the reason for the disagreement and provide this tothe Proposer.

b) Representatives' members should escalate the relevant issues in accordance withtheir company procedures.

G 3.6.6 The Proposer can consult with affected Actors to develop and implement a resolutionplan. It might be necessary to convene a panel of independent experts to review theissue(s) being escalated, the objections and rationale, and undertake discussions withthe affected parties.

3.7 Driveability assessment records

Guidance

G 3.7.1 The driveability assessment record is additional to the signalling asset record, whichincludes the signal layout plan, aspect sequence charts and control tables.

G 3.7.2 A formal record of the driveability assessment is created so that it can be referred toin connection with future assessments or investigations.

G 3.7.3 The driveability assessment record includes:



Page 30 of 44 RSSB


a) The driveability assessment plan.b) The driveability assessment participants and representation.c) The signal routes and train operations that were assessed.d) The conclusions arising from each assessed route, including any hazard precursors

identified as being present to the extent that they affect driveability.e) The results of any quantitative assessment.f) Any recommendations for eliminating or controlling the risk arising.g) Any assumptions, dependencies and caveats relevant to the assessment findings

and recommendations.

G 3.7.4 Using a templated proforma can help to structure the assessment so that everythingin the assessment plan is covered and clearly recorded. The key findings andrecommendations from the driveability assessment can be summarised in a report.



RSSB Page 31 of 44


Part 4 Guidance on the Driveability Assessment Hazard Precursors

4.1 Guidance on assessment of lineside signalling systems

Guidance

G 4.1.1 The guidance in Part 4 of this document is written in the context of an assessment ofdriveability of a lineside signalling system.

G 4.1.2 The driveability assessment process and the driveability hazard precursors in Table 1can also be applied to an assessment of a cab signalling system, with or withoutlineside signals. The guidance in Part 4 does not cover this application. Additionaldriveability hazard precursors might arise from such applications, which also need tobe assessed, for example:

a) Multiple information sources on dual fitted lines.b) Transitions between different signalling systems or train protection systems.

4.2 Driveability hazard precursor A1: necessary MA information is not providedby the signalling system

Guidance

G 4.2.1 All trains need an MA before starting to move. If a train driver cannot obtain MAinformation using the lineside signalling system, the information would need to beobtained from an alternative source (for example, a written or verbal authority fromthe signaller).

G 4.2.2 Driveability hazard precursor A1 concerns the totality of the MA information that isprovided to trains from the lineside signalling system. The hazard precursor is presentwithin the signalling layout if some MA information needed for train operations is notprovided. Hazard precursor A1 is controlled if the signalling system is configured toprovide the MA for every train movement and the drivers are able to obtain it.

G 4.2.3 The driveability assessment includes all train movements:

a) On signalled lines.b) From un-signalled lines towards signalled lines.c) From signalled lines towards un-signalled lines.

G 4.2.4 It is not necessary to provide a signalled MA for every foreseen train movement. Theoperating rules provide an alternative method of authorising unsignalled trainmovements. Two examples of where this is used are the procedures for:

a) Authorising train movements at a ground frame where signals are not provided.b) Coupling and uncoupling operations within a signal section.

G 4.2.5 The driveability assessment can consider reasonably foreseen train movements thatare not set out in the operating specification. Examples include:

a) Unscheduled wrong direction movements on a line that is not fitted withbidirectional signalling.

b) Unplanned shunting movements, for example, to detach a vehicle into a siding.



Page 32 of 44 RSSB


c) Permissive train movements when normal operations are disrupted.

G 4.2.6 Conformity with the codes of practice in RIS-0703-CCS can be used as the startingpoint for controlling hazard precursor A1.

4.3 Driveability hazard precursor A2: information provided by the signallingsystem is not complete

Guidance

G 4.3.1 If the information provided by the lineside signalling system is incomplete, the traindriver would need to use alternative sources to complete the information.

G 4.3.2 Driveability hazard precursor A2 concerns the extent to which the informationprovided by the signalling system is complete in terms of the train driving task.Hazard precursor A2 is present within the signalling layout if the information providedby the lineside signalling system does not include all of the signalling informationneeded by the train driver to understand any of the following relevant to an MA:

a) The limit of MA.b) The type of MA available.c) The route that the MA applies to.d) The permissible speed.e) The status of any locally monitored infrastructure associated with the MA.f) An operating instruction.

G 4.3.3 Hazard precursor A2 is controlled if the lineside signalling system provides sufficientinformation so that the driver is able to take the correct train driving decisions usingthat information in combination with other available information, route knowledgeand prior experience.

G 4.3.4 Examples of signals and indicators that might provide incomplete informationinclude:

a) An independent shunting signal. In this case, the shunt aspect does not provideinformation that confirms whether the line is occupied or is clear as far as the nextstop signal ahead. Further guidance on this is provided in 2.2.

b) A signal that displays the same indication for alternative routes towards acommon destination.

c) Indications and instructions at a stop board protecting more than one type oflocally monitored infrastructure (for example, facing points and a level crossing).In this case the train driver can distinguish when the infrastructure is set but mightnot be able to differentiate which asset has failed to operate correctly.

G 4.3.5 Conformity with the codes of practice in RIS-0703-CCS can be used as the startingpoint for controlling hazard precursor A2.



RSSB Page 33 of 44


4.4 Driveability hazard precursor A3: some information provided by thesignalling system is not current

Guidance

G 4.4.1 If the information provided by the lineside signalling system is not up to date, thetrain driver might be misled as to what action is required.

G 4.4.2 Driveability hazard precursor A3 concerns how up to date the information presentedby the signalling system is. It is present if:

a) Signal aspects or indications do not truly reflect the actual status of the railway atthe time they are read.

b) The information does not update quickly enough and becomes out of date.

G 4.4.3 Driveability hazard precursor A3 is controlled if signal aspects and indications arealways updated in real time to reflect real changes in the state of the railway, withminimal perceivable delay.

4.5 Driveability hazard precursor A4: provided information is not relevant tosome trains

Guidance

G 4.5.1 Any information presented by the lineside signalling system that is not needed adds‘clutter’ to the signalling layout and increases the workload associated with traindriving.

G 4.5.2 The signalling system cannot always determine what information will be relevant toindividual trains. Where the operational context on the route includes a variety oftrain types and differential speeds, some required signalling assets and displaysmight be relevant only to specific train operations (for example, permissible speedinformation). This means that some presented information is not relevant to sometrains.

G 4.5.3 Driveability hazard precursor A4 concerns the extent to which all the informationprovided by the signalling system is relevant to the driving task. It is present withinthe signalling layout if information provided by the signalling system is not relevantto the train driving task. This includes:

a) Information applicable to the line being used but which is not relevant to thatparticular train.

b) Information applicable to trains on other lines.

G 4.5.4 Driveability hazard precursor A4 is controlled if it is confirmed that train drivers will beable to recognise any non-relevant information as not applicable to their train. Routeknowledge and train driving experience helps train drivers understand which signalaspects, indications and lineside operational signs are relevant to the train beingoperated and which can be ignored.

G 4.5.5 The driveability assessment considers what can reasonably be done to minimise theimpact on train drivers, for example, by providing a clear visual differentiationbetween information intended for different types of train.



Page 34 of 44 RSSB


G 4.5.6 Some lineside signalling displays can be extinguished and made readable only whenthe information they present is needed, for example:

a) Preliminary route indications.b) Loading / unloading indications.c) Approach lit signal aspects.

4.6 Driveability hazard precursor A5: information provided by the signallingsystem cannot be relied upon

Guidance

G 4.6.1 Train driving is a safety-critical task, which is dependent on the reliability of theinformation provided by the signalling system.

G 4.6.2 Signalling system failures that present incorrect, misleading, or no information, canincrease the likelihood of an operating incident. Driveability hazard precursor A5concerns the extent to which the information can be trusted as a basis on which tomake train driving decisions. It is present within the signalling layout if making traindriving actions according to the information presented by the lineside signallingsystem might result in an unsafe outcome.

G 4.6.3 Driveability hazard precursor A5 is controlled if the reliability performance of thelineside signalling system means that train drivers can use the information to informtrain driving decisions to achieve a safe outcome.

G 4.6.4 Signalling system reliability performance is influenced by technical design andcompatibility at the CCS subsystem interfaces with the infrastructure, electrificationand rolling stock subsystems. Figure 1 shows how CCS subsystem technicalcompatibility, safety and reliability are interrelated. In particular, reliabilityperformance is influenced by technical compatibility. For example, poor rail-wheelinterfaces can adversely affect train detection, which might result in an unreliablesignalling system.

Figure 2: Safety, reliability and technical compatibility



RSSB Page 35 of 44


G 4.6.5 Driveability assessment considers the impact of presenting proceed signal aspectsand indications to authorise train movements when normal signalling functions arenot available due to a failure. Examples include:

a) Presenting a cautionary aspect when the train protection system is detected to befailed.

b) Presenting a PoSA aspect when the train detection system has failed.

G 4.6.6 Technical systems that are used to evaluate and generate the information presentedby the lineside signalling system should meet a safety integrity level (SIL) that isappropriate to their application. IEC 61508 Functional Safety of Electrical/ Electronic/Programmable Electronic Safety-related Systems and BS EN 50128:2011 Railwayapplications - Communication, signalling and processing systems - Software forrailway control and protection systems, set out further requirements relevant todeveloping signalling systems and SILs.

G 4.6.7 CCS systems are usually designed to ‘fail-safe’, which means that poor reliabilityperformance can result in excessive reliance on degraded methods of working. BS EN50126-1:1999 Railway applications: The specification and demonstration ofreliability, availability, maintainability and safety (RAMS), sets out furtherrequirements relevant to reliability performance.

4.7 Driveability hazard precursor B1: poor readability

Guidance

G 4.7.1 Train drivers need enough time to read the information provided by signalling systemdisplays.

G 4.7.2 Driveability hazard precursor B1 concerns the ease with which signalling systemdisplays can be read by train drivers, throughout the range of operational andambient conditions applicable to the asset, within the operational context and whileperforming typical required duties. Hazard precursor B1 is present within thesignalling layout if the train driver is unable to do this at one or more signals,indications or signs.

G 4.7.3 The compatibility of each lineside signalling asset is assessed by a signal sightingcommittee using the process set out in RIS-0737-CCS. The driveability assessmentuses the output from the signal sighting assessment to consider the overall level ofreadability in terms of what the train driver will actually experience during thejourney.

G 4.7.4 Hazard precursor B1 is controlled if all lineside signalling assets support the requiredreadable distance (RRD) and train drivers will be able to manage any variability inreadable distance at successive assets on the route.

4.8 Driveability hazard precursor B2: poor interpretability

Guidance

G 4.8.1 Train drivers have to be able to correctly interpret the signal aspects and indicationsto understand what train driving action is required.



Page 36 of 44 RSSB


G 4.8.2 Driveability hazard precursor B2 concerns the ease and reliability with which signalaspects and indications can be interpreted by a train driver throughout the range ofoperational and ambient conditions applicable to that asset, within the operationalcontext and while performing typical required duties. It is present within thesignalling layout if the meaning of a lineside signalling system display is ambiguousor unfamiliar to a train driver.

G 4.8.3 The signal sighting assessment process set out in RIS-0737-CCS includesconsideration of the interpretability of individual lineside signalling assets. Thedriveability assessment considers the overall level of interpretability that train driverswill experience during the journey.

G 4.8.4 Hazard precursor B2 is controlled if all presented signal aspects and indications havea clear, unambiguous meaning that is always the same and is familiar to train drivers.It is controlled if train drivers are able to manage any variability in displayappearance and meaning using their route knowledge and experience.

G 4.8.5 Examples of where hazard precursor B2 can arise include:

a) A signal aspect or indication that is unfamiliar to the train drivers who are requiredto interpret it (for example, the shunting conditional stop aspect).

b) A signal aspect sequence that is unfamiliar to the train drivers who are required tointerpret it.

c) A signal aspect or indication that conveys ambiguous information (for example, 4-aspect sequences that incorporate consecutive YY aspects). RSSB research projectT998 provides further information relevant to the interpretability of these signalaspects.

G 4.8.6 Conformity with the codes of practice in RIS-0758-CCS and the catalogue of linesidesigns can be used as the starting point for controlling hazard precursor B2. A decisionto use a signalling display that does not conform with these standards can besupported by one of the following:

a) Confirmation that the non-compliant display(s) is a similar reference system,which is consistent with existing displays on the route.

b) The non-compliance is for a trial of a new asset type or display.

4.9 Driveability hazard precursor B3: poor accuracy of the informationprovided by the signalling system

Guidance

G 4.9.1 An inaccurate signalling display can lead to a response based on train driverexpectation of the state of the railway, which is different to the actual state of therailway.

G 4.9.2 Driveability hazard precursor B3 concerns the extent to which the informationprovided by the signalling system is an accurate representation of the true systemstatus. Hazard precursor B3 is present within the signalling layout if the informationprovided is an inaccurate or distorted portrayal of the system status. For example, if atrain driver perceives that a cautionary aspect is presented for ‘false’ reasons (forexample, as part of a junction aspect sequence), and assumes that the line beyond



RSSB Page 37 of 44


the junction is in fact clear, this can lead to an expectation that the signal will clear toa proceed aspect.

G 4.9.3 Hazard precursor B3 is controlled if:

a) Signalling displays accurately reflect the system status.b) Train drivers respond to signal aspects and indications in accordance with the

train driving rules, including those that display restrictive aspects as a means ofinforming drivers to reduce the train speed, even though the MA extends furtherthan the cautionary aspect implies.

G 4.9.4 Examples of signal aspects that do not accurately represent the true state of therailway include approach controlled signal aspects, such as those presented inconnection with junction aspect sequences: MAR, MAY-YY, MAY-FA3 and MAY-FA4.

4.10 Driveability hazard precursor B4: inconsistent signal aspects andindications presented along the route

Guidance

G 4.10.1 Research suggests that train drivers tend to search for the displays that they expectto see based on previous experience. Driveability hazard precursor B4 concerns theappearance, behaviour and required response, along the line of route and within thetrain driver’s wider experience on other routes. Hazard precursor B4 is present withinthe signalling layout if:

a) Different products or displays are used to present the same type of information indifferent contexts.

b) The lineside signalling system behaves differently in the same circumstances indifferent contexts.

c) The response required differs even though the information looks the same.

G 4.10.2 Driveability hazard precursor B4 is controlled if:

a) The same type of signalling asset and display is used to present the sameinformation in all contexts.

b) The signalling system always behaves the same way and the required response toa given display is always the same.

c) Train drivers' route knowledge and experience of any variability supports therequired response.

G 4.10.3 RIS-0036-CCS sets out further requirements for the design and driveabilityassessment of signalling system transitions.

4.11 Driveability hazard precursor C1: unusual or non-compliant asset positionrelative to corresponding infrastructure features

Guidance

G 4.11.1 Train drivers use route knowledge when deciding what action is required and where itneeds to be applied.



Page 38 of 44 RSSB


G 4.11.2 Driveability hazard precursor C1 concerns how learnable the signalling layout will beand the extent to which the infrastructure positions of the displayed informationfacilitate route learning and the application of route knowledge. It is present if:

a) A signalling asset is positioned away from the range of specified or normallyexpected positions.

b) Information is presented at unexpected or indistinct locations.c) There is insufficient distance between the hazard and the last point where

information is delivered to allow recovery of an error before the hazard is reached.

G 4.11.3 A driveability assessment can provide some of the evidence needed to support anauthorisation to deviate from a compliant asset position. If the asset position is notspecified in a standard, the driveability assessment confirms that the proposed assetposition is driveable.

G 4.11.4 Hazard precursor C1 is controlled if information is displayed at expected anddistinctive locations, for example, the position of a stop signal at or beyond thedeparture end of a station platform.

G 4.11.5 If a signalling asset is positioned so that the information is displayed at anunexpected or unusual position, alternative options to control the hazard of poordriveability include:

a) Making the asset more readableb) Providing additional signage to remind train drivers of the position of the

signalling asset aheadc) Train driver briefing.

4.12 Driveability hazard precursor C2: inconsistent infrastructure position of oneor more signalling assets

Guidance

G 4.12.1 An unusual asset position might lead to a response based on train driver expectationrather than the actual position.

G 4.12.2 Driveability hazard precursor C2 concerns the extent to which the position of thedisplayed information in relation to other infrastructure features is consistent. Forexample, signals that are positioned on the right-hand side of the line. It is present ifsome signalling assets are positioned away from the range of specified or normallyexpected infrastructure positions, or information is displayed in an inconsistent orunexpected position.

G 4.12.3 Hazard precursor C2 is controlled if all information is presented in a similarinfrastructure position. Consistency is closely associated with driveability hazardprecursors B1, B2 and C1 but takes an overall view of the train driving experience onthe route. The assessment identifies any assets that are sited in an unusual position(for example, on the right-hand side of the line) and establishes what measures, ifany, would control the hazard (for example, train driver briefing).



RSSB Page 39 of 44


4.13 Driveability hazard precursor D1: insufficient time for the train driver tocomply with the operating requirement

Guidance

G 4.13.1 This hazard precursor is principally concerned with cautionary aspect sequences andreductions in permissible speeds. Signals and warning boards are positioned so thattrain drivers will have enough time to reduce the speed of the train from thepermissible speed to comply with the limit of MA or permissible speed reduction.

G 4.13.2 Driveability hazard precursor D1 is present within a signalling layout if information isprovided too late to be useful. Insufficient time would mean that the requiredoutcome might not be achieved, even if the driver immediately responds with therequired action.

G 4.13.3 Driveability hazard precursor D1 can be controlled by meeting the signal positioningrequirements set out in RIS-0703-CCS and the minimum signalling braking distancesset out in GKRT0075. This results in a lineside signalling system that is capable ofproviding train drivers with enough time to comply with operating procedures. Thesestandards include only those requirements which specify the minimum parameters(for example, signalling braking distance) and include design options to support arange of infrastructure layouts and operational contexts (for example, there are sixjunction signalling methods).

4.14 Driveability hazard precursor D2: excessive time for the train driver tocomply with the operating requirement

Guidance

G 4.14.1 Too much time before a required response is needed might result in a driverbecoming distracted or forgetting the presented information before taking therequired action.

G 4.14.2 Driveability hazard precursor D2 is present within the signalling layout if informationis provided significantly before the time it is needed, so that there is an excessivereliance on train drivers’ memory to be able to use the information at the relevanttime.

G 4.14.3 Driveability hazard precursor D2 is controlled if information is presented close to thetime when it is needed. 2.3 provides further guidance on assessment of excess signalspacing, the output of which is used to determine if anything needs to be done toreduce the risk to an acceptable level.

4.15 Driveability hazard precursor D3: excessive variation in position ofsuccessive lineside signals

Guidance

G 4.15.1 Signal spacing acts in combination with train speed to influence the regularity thatsignal aspects and indications are presented to train drivers. Variation in thefrequency that train drivers are able to obtain MA information would make the



Page 40 of 44 RSSB


driver’s task of interpreting it and understanding operational requirements moredifficult.

G 4.15.2 Excessive variation would place too much reliance on train drivers’ route knowledgeand experience to take the required action at the correct time.

G 4.15.3 Driveability hazard precursor D3 concerns the extent to which updated MAinformation is presented at consistent time intervals. It is present if MA information ispresented at irregular or infrequent intervals.

G 4.15.4 Hazard precursor D3 is controlled if MA information is presented at consistent timeintervals. 2.4 provides further guidance on the assessment of variation in excessivesignal spacing, which is used to determine what, if anything, needs to be done toreduce the risk to an acceptable level.

G 4.15.5 Examples of situations where hazard precursor D3 arises include:

a) A route that is intermittently signalled (for example, a line operated in accordancewith the absolute block system where local clusters of signals are associated with asignal box area).

b) A line where minimum signalling facilities are provided to support wrong-directionoperation (for example, to allow closure of the adjacent line for engineering work).

c) A 4-aspect signalled line where signal spacing means that the 4-aspect singleyellow is less than 33% SBD from the main stop aspect. `

4.16 Driveability hazard precursor D4: information is provided at inconsistenttimes

Guidance

G 4.16.1 Train drivers develop an expectation regarding where and when information will beprovided in relation to particular infrastructure features. If this expectation is not met,then train drivers might act upon the expectation of when they will receive theinformation rather than when it is actually presented.

G 4.16.2 Driveability hazard precursor D4 concerns the extent to which the timing ofpresentation of information is consistent with the timing of similar information alongthe route and on other routes that the train driver is familiar with. It is present withinthe signalling layout if information relating to a particular type of hazard is presentedat an inconsistent time in relation to when the information is needed.

G 4.16.3 Hazard precursor D4 is controlled if:

a) Information relating to a particular feature is always presented roughly the sameamount of time before reaching the feature (for example, a diverging junction).

b) Train drivers' route knowledge and experience is sufficient to manage theinconsistency.



RSSB Page 41 of 44


Definitions

CCS Control, Command and Signalling.

CSM RA Common Safety Method for Risk Evaluation and Assessment.COMMISSION REGULATION (EU) No 2015/1136 of 13 July 2015amending Implementing Regulation (EU) No 402/2013 on thecommon safety method for risk evaluation and assessment.

Drive / Train driving The human tasks and processes necessary to control themovement of a train in accordance with operating rules andprocedures.

Driveability The ease and reliability that train drivers are able to perform trainoperations in accordance with rules and procedures, throughoutthe range of operational and ambient conditions applicable toeach train, within the operational context and while performingtypical required duties.

Driveable A capability requirement of the lineside signalling system toprovide train drivers with the information needed to support theirconformity with the train driving rules and procedures.

Independent shuntingsignal

A shunting signal that is capable of presenting a stop aspect;includes a signal denoting a limit of shunt.

Indication of route A lineside signalling system display that conveys information aboutthe route set at a diverging junction in the form of either:

a) A signal aspect and route indication combination.b) A combination of semaphore signal aspects.c) A flashing or splitting distant signal aspect.d) A preliminary junction indication.e) A splitting banner repeater indication.

Indicator A lineside signalling asset that is capable of displaying a signallingindication.

Infrastructure Manager(IM)

Any ‘body’ or undertaking that is responsible in particular forestablishing and maintaining railway infrastructure, or part thereof,as defined in article 3 of Directive 91/440/EEC, which may alsoinclude the management of infrastructure control and safetysystems. The functions of the infrastructure manager on a networkor part of a network may be allocated to different bodies orundertakings. Source: Article 3 (b) of Directive 2004/49/EC.

Movement authority (MA) The authority given by a signaller (or ground frame operator),issued via the signalling system to the driver, which is the authorityto move the train within defined limits.

Non-permissive MA Authority for a train to proceed into a signal section that is notoccupied by other rail vehicles.



Page 42 of 44 RSSB


Permissible Speed The authorised maximum speed over a section of line, either for alltrains or (where differential or enhanced permissible speeds areapplied) for specific types of trains, as set out in the SectionalAppendix.

Proceed aspect Any signal aspect that is used to authorise a train movement.

Proposer Proposer is defined in the common safety method on riskevaluation and assessment as one of the following:(a) a railway undertaking or an infrastructure manager whichimplements risk control measures in accordance with Article 4 ofDirective 2004/49/EC;(b) an entity in charge of maintenance which implementsmeasures in accordance with Article 14a(3) of Directive2004/49/EC;(c) a contracting entity or a manufacturer which invites a notifiedbody to apply the ‘EC’ verification procedure in accordance withArticle 18(1) of Directive 2008/57/EC or a designated bodyaccording to Article 17(3) of that Directive;(d) an applicant for an authorisation for the placing in service ofstructural sub-systems.Source: CSM RA

Railway Undertaking (RU) Any private or public undertaking the principal business of which isto provide rail transport services for goods and/or passengers, witha requirement that the undertaking must ensure traction; this alsoincludes undertakings which provide traction only. Source: Article 3(a) of Directive 2004/49/EC.

Record Register in writing a finding from examination, test, inspection orspecial checks in accordance with procedures. Source: RIS-2702-RST editedGMGN2497 edited.

Shunting MA Authority for a train to proceed for shunting operations.

Sign Any surface (usually in one plane) that presents a fixed image ortext, in order to convey specific information to the viewer.

Signal A lineside signalling asset that presents a signal aspect.



RSSB Page 43 of 44


References

The Catalogue of Railway Group Standards gives the current issue number and status ofdocuments published by RSSB. This information is also available from http://www.rssb.co.uk/railway-group-standards.

RGSC 01 Railway Group Standards Code

RGSC 02 Standards Manual

Documents referenced in the text

Railway Group Standards

GKRT0075 Lineside Signal Spacing and Speed Signage

RSSB documents

GEGN8651 Rail Industry Guidance Note for Safe Integration of CCS Systemswith Train Operations

GIGN7634 Index for Lineside Signs

RIS-0036-CCS Transitions Between Signalling Systems

RIS-0386-CCS Rail Industry Standard on Signal Overrun Risk Evaluation andAssessment

RIS-0703-CCS Signalling Layout and Signal Aspect Sequence Requirements

RIS-0734-CCS Signing of Permissible Speeds and Signing of Temporary andEmergency Speed Restrictions [to be published]

RIS-0737-CCS Signal Sighting Assessment Requirements

RIS-0744-CCS Permissive Working [to be published]

RIS-0758-CCS Lineside Signal Aspects and Indications

Other references

IEC 61508 Functional Safety of Electrical/ Electronic/ ProgrammableElectronic Safety-related Systems

EN 50126-1:1999 Railway applications. The specification and demonstration ofreliability, availability, maintainability and safety (RAMS). Basicrequirements and generic process

BS EN 50128:2011 Railway applications - Communication, signalling and processingsystems - Software for railway control and protection systems



Page 44 of 44 RSSB


