Lineside Signalling Layout Driveability Assessment ... Iss 1.pdf · Part 3 Guidance on the Driveability Assessment Process 18 ... Lineside signalling layout driveability hazard ...

Rail Industry StandardRIS-0713-CCSIssue: OneDate: March 2018

Lineside SignallingLayout DriveabilityAssessmentRequirements

Synopsis

This document sets out requirements forassessing the driveability of linesidesignalling systems, and guidance on theprocess of assessing changes to signallinglayouts or signal aspect sequences.

Copyright in the Railway Group documents is owned by RailSafety and Standards Board Limited. All rights are herebyreserved. No Railway Group document (in whole or in part)may be reproduced, stored in a retrieval system, ortransmitted, in any form or means, without the prior writtenpermission of Rail Safety and Standards Board Limited, or asexpressly permitted by law.

RSSB members are granted copyright licence in accordancewith the Constitution Agreement relating to Rail Safety andStandards Board Limited.

In circumstances where Rail Safety and Standards BoardLimited has granted a particular person or organisationpermission to copy extracts from Railway Group documents,Rail Safety and Standards Board Limited accepts noresponsibility for, nor any liability in connection with, the useof such extracts, or any claims arising therefrom. Thisdisclaimer applies to all forms of media in which extractsfrom Railway Group documents may be reproduced.

Published by RSSB

© Copyright 2018Rail Safety and Standards Board Limited

Uncontrolled when printed Document supersedes in part GERT8071 Iss 2, GEGN8571 Iss 2 and in part GKRT0045 Iss 5 and GKGN0645 Iss 5; and GKRT0075 Iss 4 (clauses 2.1.3 a, b and c) with effect from 03/03/2018 Superseded by RIS-0713-CCS Iss 1.1 (to correct formatting)

Issue Record

Issue Date Comments

One 03/03/2018 Original document. Requirements and guidance on driveabilityassessment is intended to inform decisions about safeintegration of lineside signalling systems with train operations.

This document will be updated when necessary by distribution of a complete replacement.

Superseded Documents

The following Railway Group documents are superseded, either in whole or in part as indicated:

Superseded documents Sections superseded Date whensections aresuperseded

GKRT0075 issue four Lineside SignalSpacing and Speed Signage

2.1.3, 2.4.3, 2.5 03/03/2018

GKRT0045 issue five Lineside Signals,Indicators and Layout of Signals

3.1.2.4 03/03/2018

Supply

The authoritative version of this document is available at www.rssb.co.uk/railway-group-standards. Enquirieson this document can be submitted through the RSSB Customer Self-Service Portal https://customer-portal.rssb.co.uk/


Lineside Signalling Layout DriveabilityAssessment Requirements

Page 2 of 39 RSSB


http://www.rssb.co.uk/railway-group-standards

https://customer-portal.rssb.co.uk/

https://customer-portal.rssb.co.uk/

Contents

Part 1 Purpose and Introduction 7

1.1 Purpose 71.2 Introduction 71.3 Application of this document 91.4 Health and safety responsibilities 101.5 Structure of this document 101.6 Approval and Authorisation 10

Part 2 Requirements for Driveability Assessment 11

2.1 Requirements for qualitative assessment of driveability 112.2 Driveability assessment: shunting MA 142.3 Driveability assessment: excessive signal spacing 152.4 Driveability assessment: variation in signal spacing 17

Part 3 Guidance on the Driveability Assessment Process 18

3.1 When is a driveability assessment needed? 183.2 What does a driveability assessment look like? 193.3 Planning a driveability assessment 203.4 Who participates in the driveability assessment? 233.5 Facilitating a driveability assessment 253.6 Driveability assessment: acceptance criteria 263.7 Driveability assessment records 27

Part 4 Guidance on the Driveability Assessment Hazard Precursors 28

4.1 Guidance on assessment of lineside signalling systems 284.2 Driveability hazard precursor A1: necessary MA information is not provided by the

signalling system 284.3 Driveability hazard precursor A2: information provided by the signalling system is not

complete 294.4 Driveability hazard precursor A3: some information provided by the signalling system is not

current 294.5 Driveability hazard precursor A4: provided information is not relevant to some trains 304.6 Driveability hazard precursor A5: information provided by the signalling system cannot be

relied upon 304.7 Driveability hazard precursor B1: poor readability 314.8 Driveability hazard precursor B2: poor interpretability 324.9 Driveability hazard precursor B3: poor accuracy of the information provided by the

signalling system 334.10 Driveability hazard precursor B4: inconsistent signal aspects and indications presented

along the route 334.11 Driveability hazard precursor C1: unusual or non-compliant asset position relative to

corresponding infrastructure features 34



RSSB Page 3 of 39


4.12 Driveability hazard precursor C2: inconsistent infrastructure position of one or moresignalling assets 34

4.13 Driveability hazard precursor D1: insufficient time for the train driver to comply with theoperating requirement 35

4.14 Driveability hazard precursor D2: excessive time for the train driver to comply with theoperating requirement 35

4.15 Driveability hazard precursor D3: excessive variation in position of successive linesidesignals 35

4.16 Driveability hazard precursor D4: information is provided at inconsistent times 36Definitions 37References 39



Page 4 of 39 RSSB


List of Figures

Figure 1: Example of MAs towards a passenger line using a main signal 15

Figure 2: Safety, reliability and technical compatibility 31



RSSB Page 5 of 39


List of Tables

Table 1: Lineside signalling layout driveability hazard precursors 11

Table 2: Exemptions from the requirement to assess excessive signal spacing 16



Page 6 of 39 RSSB


Part 1 Purpose and Introduction

1.1 Purpose

1.1.1 This document sets out requirements for the scope of a driveability assessment that can be used by aProposer to confirm that planned changes to the lineside signalling system, or the train operations that useit, are capable of being safely integrated into the Great Britain (GB) mainline railway.

1.1.2 The purpose of a driveability assessment is to assess the lineside signalling system for the hazard ofpoor driveability, to inform decisions about controlling the risk arising.

1.1.3 This document includes guidance on planning and undertaking a driveability assessment.

1.1.4 This document is intended to be read in conjunction with the RSSB standards applicable to linesidesignalling systems on the GB mainline railway and the guidance on the application of the Common SafetyMethod for Risk Evaluation and Assessment (CSM RA) published by the Office of Rail and Road (ORR) andRSSB.

1.1.5 The hazard precursors set out in Part 4 of this document are described in terms of the linesidesignalling system, but they are also relevant to the driveability assessment of cab signalling systems.Additional hazard precursors might be present if the train driver is presented with Control, Command andSignalling (CCS) system transitions or multiple signalling systems are provided on the same line.

1.2 Introduction

How to use the requirements in this document

1.2.1 This document sets out requirements for assessing driveability, and guidance on how to carry out theassessments. The requirements and guidance are underpinned by an analysis of the signal engineeringstandards applicable to the GB mainline railway to understand how these assessments can help Proposersto control the factors that support and influence driveability.

1.2.2 The requirements in this document are available as codes of practice that can be applied to controlthe hazard of poor compatibility of the signalling system with train operations (poor driveability), andinform a decision that the signalling system is driveable.

1.2.3 Part 2 sets out the requirements for assessing driveability.

1.2.4 Part 3 provides guidance on the driveability assessment process.

1.2.5 Part 4 provides guidance on the factors that support and influence driveability (driveability hazardprecursors).

1.2.6 The requirements in this document are intended to be read in conjunction with the other RailwayGroup Standards (RGSs) and Rail Industry Standards (RISs) referenced in this document, that containrequirements that can be used to control the hazard of poor driveability.

Driveability assessment

1.2.7 The contribution of the infrastructure manager (IM) (network) towards driveability is to provide,maintain and operate the lineside signalling system so that it is ‘driveable’. The contribution of thetransport operators is to manage train operations in accordance with rules and procedures, ensuring thatauthorised users have sufficient and appropriate competence, experience and knowledge (including traindrivers' route knowledge).



RSSB Page 7 of 39


1.2.8 It is good practice to consider how planned changes to the lineside signalling system or trainoperations might impact on driveability from the start of the project, using the operating requirementsspecification as the basis; continuing throughout the project life cycle, including option selection and singleoption development. Applying the principle of 'design for driveability' reduces the likelihood that adriveability assessment will recommend changes at a late stage of the project.

1.2.9 The driveability assessment is part of the overall framework of compatibility assessments and riskassessments that are applied by the Proposer before putting a change into use. It is used to confirm thattrain drivers will be able to reliably act upon the information presented by the lineside signalling system,throughout the range of operational and ambient conditions applicable on the route(s), within theoperational context and while performing their required duties. It provides some of the information neededby the Proposer to complete the route compatibility assessment and signal overrun risk assessmentprocesses. Further guidance on safe integration of changes affecting signalling systems is provided inGEGN8651.

1.2.10 The driveability assessment evaluates the likelihood of a train driving error due to:

a) The layout of lineside signals, indicators and lineside operational signs.b) The displays presented by lineside signals, indicators and lineside operational signs.c) The relationship between train protection and warning system indications and the displays presented by

lineside signals, indicators and lineside operational signs.d) The functionality of the lineside signalling system and the train protection and warning system in terms

of the parameters of the information they present to drivers.e) The rolling stock types operated on the route.f) The train operations and station operations that use the lineside signalling system.

1.2.11 Driveability assessment involves representatives of affected transport operators because:

a) The IM (network) is responsible for providing a lineside signalling system that is driveable and operatingit in accordance with the relevant operating rules and procedures.

b) Railway Undertakings (RUs) are responsible for train driving, which includes reading and interpretinglineside signal aspects and indications, and acting upon the information they convey in accordance withthe relevant operating rules and procedures.

c) IM (stations) are responsible for train dispatch processes, which includes reading and interpretinglineside signal aspects and indications, and acting upon the information they convey in accordance withthe relevant operating rules and procedures.

Driveability

1.2.12 A well-designed signalling system supports good compatibility with train operations. This meansthat train drivers can obtain and use the information provided by lineside signals, indicators and signs totake good train driving decisions.

1.2.13 A signalling system that has poor compatibility with train operations is a hazard which, ifuncontrolled, could result in unacceptable safety risk. This includes the collision risk or derailment risk thatcan arise when a train:

a) Exceeds the limit of movement authority (MA).b) Exceeds the permissible speed.c) Uses a permissive MA incorrectly.d) Occupies a level crossing area when a road user is present.e) Uses locally monitored infrastructure that is not correctly set for the train movement.f) Starts to move before the 'right away' is given.

1.2.14 Compatibility of a lineside signalling system with train operations is described using the term'driveability'. A definition of driveability is provided in Definitions.



Page 8 of 39 RSSB


1.2.15 Driveability has a range; it is influenced by the operational context on each route where the trainswill be driven and therefore changes to a lineside signalling system are assessed. The contribution of alineside signalling system to driveability is to ‘be driveable’. Other contributions to driveability include thesignalling operations and train driving processes.

1.2.16 Train driving involves a continuous process, which includes:

a) Monitoring the railway environment.b) Gathering and assimilating the information needed, including reading and interpreting information

presented at the lineside, in the cab, from other people and using procedures.c) Taking decisions based on all the information available.d) Controlling the train to maintain the required speed, including starting, stopping, accelerating and

braking.

1.2.17 The lineside signalling system provides the following types of information applicable to the traindriving processes:

a) MA.b) Routing.c) Locally monitored system status (for example, ‘points correctly set’).d) Operating instruction (for example, ‘close train doors’).e) Permissible speed change.

1.2.18 Other information relevant to train driving is provided by authorised personnel (for example,signallers and station staff), working timetables, rules and procedures.

1.2.19 The design of the lineside signalling system influences:

a) What information is provided by the lineside signalling system.b) Which signal aspects, indications and signs provide the information.c) Where the information is positioned within the driver’s field of vision.d) When the information is provided relative to the required train driving response.

1.2.20 Train drivers read and interpret signal aspects, indications and signs in order to understand:

a) Whether or not an MA is provided to the train.b) The type and extent of MA that is provided.c) Which route is set at a diverging junction and, therefore, which applicable permissible speed applies.d) The operational status of locally monitored systems on the route.e) Relevant train operating instructions.f) The permissible speed limit.

1.2.21 Providing a signalling system that is driveable does not mean that the risk is reduced to anacceptable level. Risk assessment is used to confirm that sufficient risk controls are provided.

1.2.22 Further requirements and guidance on risk controls and risk assessment are provided in RISs andcompany standards published by the IM (network).

1.2.23 Further requirements and guidance on operating the signalling system and train operations areprovided in the National Operating Publications and transport undertaking safety management systems.

1.3 Application of this document

1.3.1 Compliance requirements and dates have not been specified since these will be the subject of internalprocedures or contract conditions.



RSSB Page 9 of 39


1.3.2 The Standards Manual and the Railway Group Standards (RGS) Code do not currently provide aformal process for deviating from a Rail Industry Standard (RIS). However, a member of RSSB, havingadopted a RIS and wishing to deviate from its requirements, may request a Standards Committee toprovide opinions and comments on their proposed alternative to the requirement in the RIS. Requests foropinions and comments should be submitted to RSSB by e-mail to [email protected]. Whenformulating a request, consideration should be given to the advice set out in the ‘Guidance to applicantsand members of Standards Committee on deviation applications’, available from RSSB’s website.

1.4 Health and safety responsibilities

1.4.1 Users of documents published by RSSB are reminded of the need to consider their own responsibilitiesto ensure health and safety at work and their own duties under health and safety legislation. RSSB does notwarrant that compliance with all or any documents published by RSSB is sufficient in itself to ensure safesystems of work or operation or to satisfy such responsibilities or duties.

1.5 Structure of this document

1.5.1 This document sets out a series of requirements that are sequentially numbered.

1.5.2 This document also sets out the rationale for the requirement. The rationale explains why therequirement is needed and its purpose. Rationale clauses are prefixed by the letter 'G'.

1.5.3 Where relevant, guidance supporting the requirement is also set out in this document by a series ofsequentially numbered clauses and is identified by the letter 'G'.

1.6 Approval and Authorisation

1.6.1 The content of this document will be approved by Control Command and Signalling StandardsCommittee on 18 January 2018.

1.6.2 This document will be authorised by RSSB on 30 January 2018.



Page 10 of 39 RSSB


Part 2 Requirements for Driveability Assessment

2.1 Requirements for qualitative assessment of driveability

2.1.1 The Proposer shall review the proposed change to identify if any of the hazard precursors set out inTable 1 Lineside signalling layout driveability hazard precursors on page 11 could be introduced by thatchange.

Driveability Hazard Precursor

Parameter Identity Description

What information is provided totrain drivers

A1 Necessary MA information is notprovided by the signalling system

A2 Information provided by thesignalling system is not complete

A3 Some information provided bythe signalling system is notcurrent

A4 Information provided by thesignalling system is not relevantto some trains

A5 Information provided by thesignalling system cannot be reliedupon

Which signalling displays are usedto provide the information

B1 Poor readability

B2 Poor interpretability

B3 Poor accuracy of the informationprovided by the signalling system

B4 Inconsistent signal aspects andindications presented along theroute

Where information is positionedwithin the train driver’s field ofvision

C1 Unusual or non-compliantsignalling asset position relativeto corresponding infrastructurefeatures

C2 Inconsistent infrastructureposition of one or more signallingassets

When information is provided



RSSB Page 11 of 39


Driveability Hazard Precursor

Parameter Identity Description

D1 Insufficient time for the traindriver to comply with theoperating requirement

D2 Excessive time for the train driverto comply with the operatingrequirement

D3 Excessive variation in position ofsuccessive lineside signals

D4 Information is provided atinconsistent times

Table 1: Lineside signalling layout driveability hazard precursors

2.1.2 For each identified driveability hazard precursor, the Proposer shall confirm that the proposedmitigation is sufficient to control the associated risk to an acceptable level.

Rationale

G 2.1.3 The driveability hazard precursors can make the train driving task more difficult on lines where traindrivers rely on the lineside signalling system to obtain information. Therefore, if one or more of these hazardprecursors are identified to be present within a signalling layout, appropriate measures are needed tocontrol the associated risk.

G 2.1.4 A1 is assessed to confirm that:

a) The lineside signalling system is compatible with all reasonably foreseen train operations that require asignalled MA.

b) The signalling layout provides reasonable opportunities for train drivers to obtain the informationneeded to recover from an error.

G 2.1.5 A2 is assessed to confirm that the lineside signalling system supports train drivers’ understandingof:

a) Whether the train has an MA.b) The type of the MA that is available.c) At a diverging junction, the route to which the MA applies.d) The applicable permissible speed.e) The status of any locally monitored systems associated with the train movement.f) Relevant operating information.

G 2.1.6 A3 is assessed to confirm that the information provided by the lineside signalling system supportstrain drivers' understanding of the actual status of the railway.

G 2.1.7 A4 is assessed to confirm that the lineside signalling system is optimised to allow train drivers toassimilate all of the information needed to inform the train driving task, taking account of route knowledgeand the operational context on that route.

G 2.1.8 A5 is assessed to confirm that the reliability performance of the lineside signalling system, and itsfailure modes, are compatible with train drivers obtaining information that can be relied upon.



Page 12 of 39 RSSB


G 2.1.9 B1 and B2 are assessed to confirm that the overall level of readability and interpretability on theroute is consistent with the requirement of the train driver to read and interpret the relevant signal aspects,indications and signs.

G 2.1.10 B3 is assessed to confirm that the signal aspects, indications and signs are an accurate portrayalof the state of the railway.

G 2.1.11 B4 is assessed to confirm that any variation in the appearance of signal aspects and indicationson the route can be managed by train drivers.

G 2.1.12 C1 is assessed to confirm that the position of lineside signalling assets relative to otherinfrastructure features that are associated with a train driving task:

a) Is consistent with developing and maintaining train drivers’ route knowledge.b) Will not mislead a train driver into making an error.c) Provides an opportunity, where appropriate, for a train driver to recover from an error before a hazard is

reached.

G 2.1.13 C2 is assessed to confirm that the position of lineside signalling assets will not mislead a traindriver or cause a train driver to misread or misinterpret the information being conveyed.

G 2.1.14 D1 and D2 are assessed to confirm that the lineside signalling system provides the information ata time that helps train drivers to act upon it when it is needed.

G 2.1.15 D3 and D4 are assessed to confirm that the variation in the time that information is madeavailable does not compromise the ability of the train driver to respond correctly.

G 2.1.16 Further guidance on the driveability hazards is provided in Part 4.

Guidance

G 2.1.17 Conformity with this requirement can be achieved using a driveability assessment. Part 3 providesfurther guidance on the driveability assessment process.

G 2.1.18 The hazard precursors set out in Table 1 Lineside signalling layout driveability hazard precursorson page 11 can arise from a change to the signalling system or a change to a different part of the railwaythat interacts or interfaces with the signalling system.

G 2.1.19 Three risk acceptance principles can be applied to control the driveability hazard precursors:

a) Conformity with a code of practice and assessment.b) Comparison with a similar reference system and assessment.c) Explicit risk estimation and assessment.

G 2.1.20 In many cases, providing a design that conforms with requirements in applicable RGSs and RISs issufficient to control the hazard of poor driveability. The driveability assessment process is used to record theextent to which conformity with requirements in RGSs and RISs is sufficient to control the hazard precursors.This approach is consistent with applying the risk acceptance principle: conformity with code of practiceand assessment.

G 2.1.21 Conformity with applicable standards does not mean that all of the driveability hazard precursorsarising from a planned change to a particular lineside signalling system will be controlled to an acceptablelevel of risk. The Proposer is responsible for deciding which standards are applicable and the extent to whichconformity controls the risk.

G 2.1.22 Some requirements in RGSs and RISs specify design parameters that are known to control certainhazards. For example, the requirement in RIS-0703-CCS for the first cautionary aspect to be at leastsignalling braking distance (SBD) from the associated main stop aspect can be applied to control hazardprecursor D1; however, it does not control hazard precursor D2.



RSSB Page 13 of 39


G 2.1.23 Some requirements describe methods of assessment that may support a decision that a hazard iscontrolled to an acceptable level. For example, the codes of practice for the signal sighting assessment canbe applied to identify the method of controlling hazard precursors B1 and B2.

G 2.1.24 Conformity with applicable standards is beneficial because it means that the main focus of thedriveability assessment work will be the parts of the system that are either non-conforming, or result inhazards that are not sufficiently controlled by conformity with standards, or are the most difficult parts ofthe layout to drive.

G 2.1.25 Codes of practice applicable to controlling the driveability hazard precursors on the GB mainlinerailway include the content in GKRT0075, RIS-0703-CCS, RIS-0737-CCS, RIS-0744-CCS and RIS-0758-CCS,which include guidance on the driveability hazards they control and the applicability of the requirements.

G 2.1.26 Additional hazard controls can be applied using the other two risk acceptance principles set out in b) on page 13 and c) on page 13.

G 2.1.27 A Proposer can decide that a compliant design does not provide the optimum solution. Forexample, a limited change to an existing lineside signalling system could have an adverse impact ondriveability if it introduces an inconsistency or variation in the presentation of information to train drivers.In this case, comparison with a similar reference system can be used.

G 2.1.28 It is permissible to implement a bespoke design that does not conform with a code of practice or asimilar reference system if the Proposer can confirm that the alternative solution controls the risk to anacceptable level. This is done by exception and, where it is applied, the driveability assessment confirms thatthe bespoke design does not itself constitute a hazard.

G 2.1.29 If one or more driveability hazard precursors cannot be controlled to the extent that risk isacceptable, further risk evaluation and assessment is used to identify what additional safety measures areneeded. This might include additional train protection system measures and operational controls.

2.2 Driveability assessment: shunting MA

2.2.1 The Proposer shall assess the acceptability of using an independent shunt signal to present an MA fortrain movements towards, or along, a passenger line.

2.2.2 This assessment shall consider all of the following:

a) The rationale for not providing a main signal.b) The frequency of train movements using that signal.c) The frequency of train movements from that signal towards, or along, a passenger line.d) The frequency of train movements using that signal towards, or along, a passenger line when the signal

section is occupied (permissive shunt).e) The readability of the signal(s) denoting the limit of MA on the passenger line.f) The distance to the signal(s) denoting the limit of MA on the passenger line.g) The signalling layout at other geographical locations where train drivers might experience similar train

movements.h) The operating rules and procedures for using a shunt MA at that location.

Rationale

G 2.2.3 Using an independent shunting signal can increase the likelihood of signal overrun or a train-on-train collision because the shunt aspect does not provide the train driver with enough information tounderstand whether the next stop signal is displaying a stop aspect or a proceed aspect or whether thesection is clear or occupied. Previous experience at this location and similar locations can influence traindrivers' understanding of the required operation.



Page 14 of 39 RSSB


G 2.2.4 The output of this assessment is the likelihood of:

a) A train exceeding the limit of a shunt MA on a passenger line.b) A train-on-train collision when the shunt MA is towards an occupied line.

G 2.2.5 This requirement can be applied to control driveability hazard precursor A2: Information providedby the signalling system is not complete.

Guidance

G 2.2.6 The result of this assessment provides data to support the signal overrun risk assessment andpermissive working risk assessment. RIS-0386-CCS sets out further requirements for signal overrun riskassessment.

G 2.2.7 It is good practice to design signalling layouts so that shunt MAs for train movements towards, oralong, a passenger line end at a main stop signal. Any independent shunt signals within the MA that areprovided for other reasons (for example, for set back shunt moves) can be preset. Fig. 1 Example of MAstowards a passenger line using a main signal on page 15 shows an example of this.

Figure 1: Example of MAs towards a passenger line using a main signal

G 2.2.8 In the example shown in Fig. 1, it is permissible to provide independent shunting signal 1051,subject to driveability and risk assessment.

G 2.2.9 The likelihood of signal overrun or train-on-train collision can be further managed if main signal301 is provided. Signal 301 is capable of clearing to:

a) A main proceed aspect when signal 107 is presenting a main proceed aspect.b) The single yellow caution aspect when signal 107 is displaying a main stop aspect.c) A subsidiary shunt aspect when the signal section on the passenger line is occupied and for train

movements into the siding.

G 2.2.10 The likelihood of a signal overrun at shunt signal 1053 is controlled if it is preset by routes fromsignal 301 to signal 107 or 1055 (LOS).

2.3 Driveability assessment: excessive signal spacing

2.3.1 The Proposer shall assess the impact on driveability of signal aspect sequences where the distancefrom the first cautionary aspect to the associated stop aspect exceeds the minimum signalling brakingdistance requirement by 50% or more.



RSSB Page 15 of 39


2.3.2 This requirement is not applicable where an exemption in Table 2 is applicable.

Criteria Scope of exemption from assessment

Where parallel lines on a multi-tracked route aresignalled in the same direction and have differentpermissible speeds

Signal spacing on the line with the lower permissiblespeed, if parallel positioning of signals provides agreater benefit

Where lines at a converging junction have differentpermissible speeds

The signal spacing between the last stop signal onthe converging route and the first stop signalbeyond the junction

Where signal spacing is optimised for a particulartrain braking performance

Trains with a braking performance superior to thatto which the signalling layout is optimised

Where a lower differential permissible speed appliesto trains with inferior braking performance

Trains to which the lower differential permissiblespeed applies

The signal spacing beyond a stop signal protectingthe exit from a siding, loop or converging platformline

Trains that start from rest

The signal spacing beyond stop signals where trainsstart from rest on a through line

The signal spacing approaching a buffer stop at theend of a signalled line

The cautionary aspect sequence associated with thebuffer stop

Table 2: Exemptions from the requirement to assess excessive signal spacing

Rationale

G 2.3.3 The aim of this assessment is to confirm that train drivers will be able to manage any MAinformation that is presented significantly before the time it is needed to make a train driving decision.

G 2.3.4 The exemptions in Table 2 represent cases where repositioning signals to reduce signal spacingwould not provide an overall benefit.

G 2.3.5 The result of the assessment of excessive signal spacing can be used to inform a decision about theextent that driveability hazard precursor D2 is controlled.

Guidance

G 2.3.6 Train drivers use the first cautionary aspect to understand that the train is approaching the limit ofMA and to inform their decision about when to apply the brakes. If this information is presented too early,the signal aspect is less helpful in denoting the optimum train braking point and the train driver mightforget which aspect was displayed by the time the brakes need to be applied.

G 2.3.7 Further requirements and guidance on determining minimum signalling braking distances are setout in GKRT0075.

G 2.3.8 Further requirements and guidance on signal positioning and cautionary aspect sequences are setout in RIS-0703-CCS.



Page 16 of 39 RSSB


2.4 Driveability assessment: variation in signal spacing

2.4.1 The Proposer shall assess the impact on driveability where excessive signal spacing at consecutivesignals on the same line reduces by 34% or more.

Rationale

G 2.4.2 The aim of the assessment is to confirm that the train driver can manage the variation in the timethat cautionary MA information is presented relative to the time that the brakes need to be applied.Excessive variation increases the train driver workload and the likelihood of train driver error.

G 2.4.3 The result of the assessment of excessive variation in signal spacing can be used to inform adecision about the extent that driveability hazard precursors D3 and D4 are controlled.

Guidance

G 2.4.4 Train drivers use the first cautionary aspect to understand that the train is approaching the limit ofMA and inform their decision about when to apply the brakes. If this information is presented at varyingtimes, the signal aspect is less helpful in denoting the train braking point and the train driver might forgetwhen to apply the brake.



RSSB Page 17 of 39


Part 3 Guidance on the Driveability Assessment Process

3.1 When is a driveability assessment needed?

Guidance on when a driveability assessment is needed

G 3.1.1 The Proposer can decide that a driveability assessment is needed to confirm that a plannedchange to a lineside signalling system, or the train operations that use it, can be safely integrated into theoperational railway. This might be necessary if the planned change includes features that could adverselyaffect driveability.

G 3.1.2 A change to the lineside signalling system has the potential to adversely affect driveability, andtherefore increase risk, if it changes:

a) What information is presented to users of the lineside signalling system.b) Which equipment or displays are used to present the information.c) Where the information is presented relative to the user's viewpoint of the railway and the operational

context.d) When the information is made available to users relative to the train driving task requirement.

G 3.1.3 Examples of signalling system changes that might require a driveability assessment includealteration to:

a) The type of signalling system.b) The method of operation.c) The configuration, type or infrastructure position of lineside signalling assets (for example, changes to

signal spacing).d) The MAs provided by the lineside signalling system (for example, additional signal routes, permissive

MAs).e) The lines on which signalled MAs apply.f) The signal aspects, indications and signs presented at each signalling asset, including any changes to

display appearance.g) The sequence(s) of signal aspects, indications and signs presented to train drivers, including any time

delays designed into the system.h) Signal aspects or indications that can be presented in normal and failure conditions.

G 3.1.4 Planned changes to other structural or operational systems can have an adverse effect ondriveability if they introduce a hazard precursor or invalidate an assumption, dependency or caveatunderpinning the results of a previous assessment. Examples of changes that might affect the train drivingprocess, and therefore driveability, include:

a) A modified network infrastructure.b) A change to train operations.c) A change to the type of rolling stock or the train consists operated on the route.

G 3.1.5 Examples of network infrastructure alterations that might require a driveability assessment includechanges to:

a) Track layout.b) Gradient profile.c) Permissible speed(s).d) Electrification system(s).e) Station platform(s), length or position.



Page 18 of 39 RSSB


G 3.1.6 Changes to the operational context that might require a driveability assessment include changesto:

a) The operating specification.b) The method of train operation during normal and degraded operations.c) Train consists.d) Rolling stock type or performance.e) Operations at infrastructure operated by train crew (for example, a ground frame, token instrument or

locally monitored points).f) A train dispatch system.g) Train driving policy.h) Train stopping position at a station.

Guidance on when to undertake the driveability assessment

G 3.1.7 Considering driveability and involving train operators from the start of projects should result insignalling system designs that are driveable and capable of being safely integrated into the GB mainlinerailway. A well-managed project considers driveability throughout the project life cycle so that thedriveability assessment is used to confirm that the design is fit for purpose without needing any furthersignificant changes.

G 3.1.8 Undertaking a driveability assessment at a late stage in a project might add cost to a project iffactors are identified that result in a need to change the design. In this case the driveability assessmentmay be of little benefit; it may be too expensive to implement changes that would have improveddriveability at less cost if they had been identified at an earlier project stage.

G 3.1.9 The Proposer uses the output from driveability assessment to inform decisions about safeintegration; therefore, the driveability assessment should be completed before a design option decision istaken.

G 3.1.10 The Actors use the output to confirm their actions in implementing safety requirements.

G 3.1.11 The output of the assessment can have implications on the project Sponsor, particularly if thereare recommendations that imply significant changes may be needed.

G 3.1.12 Some of the assessment recommendations might be relevant to decisions about ‘reasonableopportunity’ to improve the signalling system that would otherwise be outside of the original project scope.

G 3.1.13 The output of a driveability assessment may be an input to further assessments relating to safeintegration of the change. The output may also inform the review by a Network Rail Major Schemes ReviewPanel (MSRP) prior to approval for construction.

3.2 What does a driveability assessment look like?

Guidance on the scope of a driveability assessment

G 3.2.1 The driveability assessment considers the physical attributes of the railway and the operationalcontext on the signalled lines where trains will be driven, including the impact on train driving of:

a) Trackside CCS subsystem features, for example signal aspect sequences.b) Trainborne CCS subsystem features, for example Automatic Warning System (AWS) indications or cab

signalling displays.c) Rolling stock features.d) Electrification subsystem features, for example neutral sections and conductor rail gaps.e) The track layout.f) Stations and structures, including station platforms.



RSSB Page 19 of 39


g) The operational task requirements on the route, including required stopping positions.h) People, including other railway personnel.i) The environment.

Guidance on what is assessed

G 3.2.2 The driveability assessment needs to be of a sufficient breadth and depth to reach a conclusionthat enough has been done to find the hazard precursors that could adversely affect driveability.

G 3.2.3 It is not necessary to assess every signalling asset and signal route. If the project has been wellmanaged in considering driveability, the assessment can sample a representative selection of signal routesto confirm that the system is driveable.

G 3.2.4 The driveability assessment provides the most benefit by looking for signal routes that make traindriving more difficult. For example, this may include:

a) Interfaces with the existing signalling system, including fringes.b) New or unusual train operations, for example propelling or running round.c) Signalling system and route transitions, including aspect sequences.d) Depot interfaces, including ground frame operations.e) Inconsistent signal spacing.f) Irregular permissible speed profiles, including inconsistencies with movement authorities.g) Junction aspect sequences, including approach controls.h) Complex / diverse routing.i) Unusual or non-compliant signal aspects, aspect sequences and indications.j) Train dispatch arrangements.k) Permissive working.l) Facilities that are provided to assist service recovery and which are therefore infrequently used.

G 3.2.5 The driveability assessment is a good opportunity for ‘cross-route’ comparison (forexample, consider how the impact of changing something can change the driveability of something else,perhaps untouched by the project).

G 3.2.6 It is helpful to select a train movement and describe how the train will progress from start todestination, with an emphasis on the information needs of the driver. If a potential issue is identified,asking questions based on the driveability hazard precursors described in Part 4 of this document provides afocussed assessment of the issue.

G 3.2.7 It is beneficial to avoid ‘solutioneering’. The Project is responsible for developing a design that isfit-for-purpose; therefore, the role of the driveability assessment is limited to reviewing the proposed designand making recommendations if it is appropriate to do so.

3.3 Planning a driveability assessment

Guidance on planning a driveability assessment

G 3.3.1 The driveability assessment plan forms part of the overall safe integration strategy for changes tolineside signalling systems and the train operations that use those systems. Further guidance on theframework of route compatibility assessments and risk assessments that form part of the safe integrationof change is provided in GEGN8651.

G 3.3.2 A driveability assessment can apply to any planned change to the lineside signalling system or thetrain operations that use it; however, it is not generally used to assess temporary changes to the railway, forexample those associated with implementing a temporary speed restriction (TSR) or emergency speedrestriction (ESR). The requirements for managing TSRs and ESRs are set out in RIS-0734-CCS.



Page 20 of 39 RSSB


G 3.3.3 The driveability assessment plan is used to specify an assessment that is sufficiently rigorous toevaluate the applicability of the driveability hazard precursors and assess the options available to eliminateor control each one. The actual content of each driveability assessment plan will reflect the plannedchanges and be proportionate to the scope and complexity.

G 3.3.4 The scope of each driveability assessment can be dependent on the extent to which the plannedchange conforms with the codes of practice applicable to controlling the driveability hazard precursors onthe GB mainline railway. These are typically set out in GKRT0075, RIS-0703-CCS, RIS-0737-CCS, RIS-0744-CCS and RIS-0758-CCS, which include guidance on the driveability hazards they control and theapplicability of the requirements.

G 3.3.5 The IM (Network) manages the driveability assessment process and produces the driveabilityassessment plan. If the Proposer is an railway undertaking (RU) or an IM (stations), the project plan includesthe arrangements with the IM (network) for managing the driveability assessment.

G 3.3.6 Inviting representation from external stakeholders, including any transport operator(s) external tothe mainline railway, is consistent with the legal obligation to cooperate in order to manage shared risk.Examples of when a transport operator external to the mainline railway should be invited includeassessment of:

a) A route used by mainline trains and a metro operator.b) A layout that interfaces with another IM, for example a depot or yard.

G 3.3.7 Consultation on the driveability assessment plan can provide process efficiencies if stakeholdersconfirm that the assessment will be capable of addressing issues of concern and that the required resourcesand information will be available.

G 3.3.8 A driveability assessment plan that is sufficiently complete and comprehensive providesstakeholders with a holistic view of the planned assessment.

Guidance on the content of the driveability assessment plan

G 3.3.9 The content of the driveability assessment plan helps each stakeholder to understand theirexpected contribution to the assessment and which other stakeholders have an interest. Stakeholders usethe information in the driveability assessment plan to confirm that the assessment will be sufficiently robustto identify and evaluate the driveability hazard precursors relevant to their operations.

G 3.3.10 The driveability assessment plan helps the affected parties to understand the following, beforethe assessment takes place:

a) Why the driveability assessment is needed.b) What will be assessed and what will not be assessed.c) When the assessment will take place.d) Where the assessment will take place.e) Who will take part in the assessment.f) Which assessment method(s) will be used.g) How the assessment will be done.h) The assumptions, dependencies and caveats underpinning the assessment.

G 3.3.11 The content of the assessment plan may develop and change over time. It is good practice tostart planning the driveability assessment and consulting with stakeholders at an early stage, starting with ahigh-level description of how the assessment contributes to the implementation of the project safeintegration strategy. The final version of the plan provides stakeholders with all of the relevant informationthey need to fulfil their roles in the assessment.

G 3.3.12 Information relevant to ‘why the assessment is needed’ includes the reason for the change andwhat is the expected outcome. The driveability assessment plan should reference the project scope, the safeintegration strategy and make it clear what is included / excluded from the assessment.



RSSB Page 21 of 39


G 3.3.13 Information relevant to ‘what will be assessed’ includes information about:

a) Changes to the lineside signalling system, including signalled MAs, signalled routes, permissible speeds,locally monitored infrastructure, and operating indications.

b) Changes to railway infrastructure, including track and electrification systems.c) Changes to the trains and types of rolling stock being operated.d) Changes to planned train operations, including train movements and methods of train dispatch.e) Parts of the existing railway that will not change.f) Any deviations relevant to the assessment.

G 3.3.14 Information relevant to ‘when the assessment will take place’ includes the dates and times ofeach part of the assessment.

G 3.3.15 Information relevant to ‘where the assessment will take place’ includes assessment venues.

G 3.3.16 Information relevant to ‘who will perform the assessment’ includes:

a) Facilitation of the assessment.b) Nominated stakeholder representatives, their role(s) and their affiliation.c) Arrangements for confirming representatives' identity and authorisation.

G 3.3.17 Information relevant to ‘which assessment method will be used’ includes the driveabilityassessment method. The assessment plan can specify a combination of assessment methods including:

a) Structured professional judgement.b) Assessment using simulation of the train driving process.c) Formal assessment of hazards and risks.

G 3.3.18 Information relevant to ‘how the assessment will be done’ includes:

a) The standard(s) against which the assessment will be carried out. Details should include any codes ofpractice being applied to the assessment that are additional to the requirements in this document, forexample, requirements in RGSs, RISs and technical standards published by affected stakeholders andproject specifications.

b) Assessment using an interactive assessment workshop.c) Assessment using specialist tools and equipment.d) Assessment by correspondence. A driveability assessment based on information shared by

correspondence is suitable only if the scope is limited to confirming changes that have already beenagreed in principle by stakeholders or if the stakeholders confirm that using documentary evidencealone would be sufficient to complete the assessment without the need to convene an assessmentworkshop. Suitable evidence might include signalling design plans, aspect sequence charts and controltables.

e) The overall approach being applied to hazard elimination and control.f) The method of recording the assessment result.

G 3.3.19 Information relevant to ‘the assumptions, dependencies and caveats underpinning theassessment’ includes the data being used by the Proposer to inform the proposed change. Examplesinclude:

a) The standard(s) against which the assessment will be carried out. Details should include:

i) The codes of practice being applied to the assessment that are additional to the requirements inthis document.

ii) Use of similar reference systems.iii) Project specific requirements derived by explicit risk estimation.

b) Train operating parameters, including timetables and traffic patterns, rail vehicle types and theirrestrictions, train lengths, the applicability of permissive or propelling moves and the contribution of



Page 22 of 39 RSSB


route knowledge. This may take account of existing and future train operations that are relevant to thescope of the change project that the assessment is supporting. Sharing this information provides anopportunity for the IM to capture information about foreseeable longer-term aspirations held by otherIMs and RUs and incorporate these into the assessment if there is a cost benefit in doing so.

c) The technical information and data used to inform the assessment, for example maximum andattainable train speed, acceleration and deceleration performance.

d) The output from other assessments, for example, signal sighting assessment.e) The input to other risk assessments, for example, permissive working risk assessment and signal overrun

risk assessment.f) Records of previous assessments. This information might be relevant if it would help to inform the

assessment in reaching a decision. For example, records of assessment of similar layouts in similaroperational contexts could be used as a baseline to inform consistent decision making by theassessment representatives.

g) The date(s) when the change(s) is planned to be implemented, including any stagework.

3.4 Who participates in the driveability assessment?

Guidance

G 3.4.1 The driveability assessment is informed by stakeholder representatives who provide informationnecessary to reach a decision on driveability. The representatives include:

a) IM (network) operator.b) RU operator.c) IM (stations) operator, if relevant to the assessment.

G 3.4.2 A small group of assessors supported by independent facilitation can reach a reasoned andbalanced conclusion; however, this is dependent on there being sufficient knowledge, experience, andrepresentation to make sure that the change and the operational context are sufficiently well understoodand considered. The facilitator is competent in the process and with no personal stake in the project.

G 3.4.3 Train operator representation is sufficiently wide-ranging to cover the scope of passenger andfreight train operations that will use the signalling system, with an emphasis on train driving experience. Itis good practice to agree to share representation at the assessment.

G 3.4.4 Network operator representation provides information about the existing operational context andthe future planned operations.

G 3.4.5 Consistency in representation can be a benefit in running an efficient assessment, particularlywhere previous assessments have taken place, for example signal sighting assessment. Some variation inparticipation can help to avoid ‘group think’.

G 3.4.6 Other participants that might add value include:

a) Yard or depot operators that interface with the mainline railway.b) Metro operators where they operate on or interface with the mainline.c) Station operators where train dispatch operations are a significant factor.

G 3.4.7 The facilitator is responsible for:

a) Convening the assessment.b) Collating the information needed to reach an informed decision.c) Making the information available to assessment representatives prior to the assessment.d) Managing quoracy.e) Facilitating the assessment.f) Making sure that the assessment findings and recommendations are recorded.



RSSB Page 23 of 39


g) Preparing an assessment report, where necessary, and making it available to stakeholders.h) Co-ordinating any follow-up actions with stakeholders.

G 3.4.8 The IM (network) operator contribution to driveability assessment is the relevant infrastructureoperating competence, signalling knowledge and train operating experience. This helps to confirm theapplicability of the following assumptions, dependencies and caveats to the driveability assessment:

a) IM (network) operating processes.b) Existing and planned timetables, traffic patterns and train lengths.c) Movement authorities and routing; type and frequency of use.d) Existing and potential operational risk.e) Hazard elimination and mitigation available to IM (network) operators.f) Records of operating incidents relevant to the lineside signalling system being assessed (for example, a

multi-SPAD signal).

G 3.4.9 The RU operator contribution to driveability assessment is the relevant train driving competenceand traction knowledge and train operating experience. The information provided helps to confirm theapplicability of the following assumptions, dependencies and caveats to the driveability assessment:

a) The train driving task relevant to the layout being assessed.b) RU train driving policy and procedures.c) Relevant train operating parameters such as train speeds, braking and acceleration performance.d) Traction and vehicle types.e) In-cab train protection systems.f) Existing and potential train driving risks.g) Existing and potential train dispatch risks.h) Hazard elimination and mitigation available to RUs.

G 3.4.10 The IM (stations) contribution to driveability assessment is the relevant station operation'scompetence, knowledge and train operating experience. The information provided helps to confirm theapplicability of the following assumptions, dependencies and caveats to the driveability assessment:

a) IM (stations) operating processes.b) Existing and planned station operations, including train dispatch equipment location and operations.c) Existing and planned station infrastructure.d) Existing and potential station operation's risks.e) Hazard elimination and mitigation available to IM (stations).

G 3.4.11 Stakeholders can share representation if the nominated person(s) has sufficient competence,knowledge and experience to provide the necessary information.

G 3.4.12 The driveability assessment is also supported by a signal engineer, who has sufficient competence,knowledge and experience to confirm the applicability of the following assumptions, dependencies andcaveats to the driveability assessment:

a) Signal sighting assessment results.b) Signalling layout, signalling braking distances and signal aspect sequences, including design

assumptions about train performance (for example, assessed attainable speeds).c) Signalling system functionality (for example, approach release of signal aspects).d) Train protection and warning system configuration and functionality.e) Communications system configuration and functionality.f) Infrastructure data relevant to the assessment, including permissible speeds, gradients, signalling

braking distances and electrification system interfaces.g) Stage work, which may be associated with a reduction in signalling facilities.



Page 24 of 39 RSSB


h) The driveability hazards identified by the project and the options available to control the hazards.

3.5 Facilitating a driveability assessment

Guidance on quoracy

G 3.5.1 The driveability assessment is quorate if all IM and RU stakeholders who have expressed an interestare present or are represented. A quorate assessment is beneficial because the discussion during theassessment influences the pass / fail decision. Planning a driveability assessment that relies on separatemeetings with some stakeholder representatives before or after the assessment does not support a fullyinformed discussion.

G 3.5.2 It is good practice to maintain an attendance record throughout the assessment and, if anyparticipants leave during the assessment, review the membership to confirm that the attendance stillprovides sufficient competence and knowledge to reach a fully informed assessment decision.

G 3.5.3 If the facilitator considers that the attendance does not provide all of the required competence andknowledge, continuing the assessment might conclude with only a preliminary assessment decision. Furtherassessment might be needed when the additional competence and information become available.

G 3.5.4 If the facilitator considers that the membership provides sufficient competence and knowledge butnot all of the invited IM and RU representatives attend, the Proposer can consult on the assessmentdecision with the absent representative(s) before taking the recommendations forward for design approval.

G 3.5.5 The driveability assessment facilitator confirms that:

a) The context of the assessment is sufficiently realistic to replicate the effects of complex interactions andtheir impact on train driving.

b) The fidelity of any simulation is sufficient to facilitate a reasonably accurate assessment of the effectsof each driveability hazard on train driving.

Guidance on methods of assessment

G 3.5.6 Acceptable methods of assessing driveability include:

a) Structured professional judgement using previous knowledge and experience of train operations in asimilar operational context.

b) Simulation of the train driving task.

G 3.5.7 For many planned changes, assessment using structured professional judgement is sufficient. Formajor or complex changes, or projects where there is insufficient knowledge and experience of trainoperations in a similar operational context to support a robust decision, driveability assessment usingsimulation tools can provide the most effective and efficient method.

G 3.5.8 Simulation tools are approved by the IM (network) as suitable for driveability assessment.Approved simulation tools:

a) Provide a high-definition visual representation of the driver’s view of the layout(s) being assessed and itsoperational context.

b) Use video and / or virtual reality technology.c) Incorporate facilities to superimpose images onto the railway environment.d) Present images that have a level of granularity that equals or exceeds that which would be achieved by

a site assessment.



RSSB Page 25 of 39


Guidance on necessary information

G 3.5.9 The driveability assessment is sufficient to support a fully informed decision only if the availableinformation (including simulation data) is an accurate representation of the real operational context and upto date. It is good practice for the driveability assessment plan to include the arrangements for confirmingthe completeness and accuracy of the information.

G 3.5.10 The following information helps to inform the assessment of driveability:

a) Operating requirements specification – this is the basis of the signalling system design and the basis forthe assessment scope.

b) Signalling layout (scheme) plan showing the planned changes and the interfaces with the parts of therailway that are not changing.

c) Aspect sequence charts.d) Route tables (and control tables if available).e) Signal sighting assessment records.f) Video imaging or simulation of the routes to be driven.

3.6 Driveability assessment: acceptance criteria

Guidance

G 3.6.1 The assessment considers driveability from the point of view of all authorised users of the linesidesignalling system and those impacted by it, and therefore the decision takes account of all stakeholderrepresentatives.

G 3.6.2 Driveability is acceptable when the IM (network), IM (stations) and RU representatives nominatedto the assessment confirm that the signalling layout is fit for purpose for train driving, taking account of:

a) The operational context, including the train driving and train dispatch processes.b) Train drivers' route knowledge.c) The railway infrastructure configuration, including the signalling, infrastructure and electrification

subsystems.d) The applicability of the driveability hazard precursors set out in this document.e) The application of the risk acceptance principles to eliminate or control the driveability hazard

precursors.f) The responsibilities of the Proposer and other duty holders to implement hazard controls.

G 3.6.3 The assessment decision can be qualified with a recommendation that further risk assessment isneeded to pay particular attention to a specific hazard precursor or risk. In such cases, details of eachhazard precursor and the relevant risk are provided to the Proposer.

G 3.6.4 A failure to reach an agreed assessment conclusion means that further management action mightbe necessary to reach a decision on the acceptability of the change.

G 3.6.5 If the assessment fails to agree:

a) The facilitator should record the reason for the disagreement and provide this to the Proposer.b) Representatives' members should escalate the relevant issues in accordance with their company

procedures.

G 3.6.6 The Proposer can consult with affected Actors to develop and implement a resolution plan. It mightbe necessary to convene a panel of independent experts to review the issue(s) being escalated, theobjections and rationale, and undertake discussions with the affected parties.



Page 26 of 39 RSSB


3.7 Driveability assessment records

Guidance

G 3.7.1 The driveability assessment record is additional to the signalling asset record, which includes thesignal layout plan, aspect sequence charts and control tables.

G 3.7.2 A formal record of the driveability assessment is created so that it can be referred to in connectionwith future assessments or investigations.

G 3.7.3 The driveability assessment record includes:

a) The driveability assessment plan.b) The driveability assessment participants and representation.c) The signal routes and train operations that were assessed.d) The conclusions arising from each assessed route, including any hazard precursors identified as being

present to the extent that they affect driveability.e) The results of any quantitative assessment.f) Any recommendations for eliminating or controlling the risk arising.g) Any assumptions, dependencies and caveats relevant to the assessment findings and recommendations.

G 3.7.4 Using a templated proforma can help to structure the assessment so that everything in theassessment plan is covered and clearly recorded. The key findings and recommendations from thedriveability assessment can be summarised in a report.



RSSB Page 27 of 39


Part 4 Guidance on the Driveability Assessment Hazard Precursors

4.1 Guidance on assessment of lineside signalling systems

Guidance

G 4.1.1 The guidance in Part 4 of this document is written in the context of an assessment of driveability ofa lineside signalling system.

G 4.1.2 The driveability assessment process and the driveability hazard precursors in Table 1 Linesidesignalling layout driveability hazard precursors on page 11 can also be applied to an assessment of a cabsignalling system, with or without lineside signals. The guidance in Part 4 does not cover this application.Additional driveability hazard precursors might arise from such applications, which also need to be assessed,for example:

a) Multiple information sources on dual fitted lines.b) Transitions between different signalling systems or train protection systems.

4.2 Driveability hazard precursor A1: necessary MA information is not provided bythe signalling system

Guidance

G 4.2.1 All trains need an MA before starting to move. If a train driver cannot obtain MA information usingthe lineside signalling system, the information would need to be obtained from an alternative source (forexample, a written or verbal authority from the signaller).

G 4.2.2 Driveability hazard precursor A1 concerns the totality of the MA information that is provided totrains from the lineside signalling system. The hazard precursor is present within the signalling layout ifsome MA information needed for train operations is not provided. Hazard precursor A1 is controlled if thesignalling system is configured to provide the MA for every train movement and the drivers are able toobtain it.

G 4.2.3 The driveability assessment includes all train movements:

a) On signalled lines.b) From un-signalled lines towards signalled lines.c) From signalled lines towards un-signalled lines.

G 4.2.4 It is not necessary to provide a signalled MA for every foreseen train movement. The operatingrules provide an alternative method of authorising unsignalled train movements. Two examples of wherethis is used are the procedures for:

a) Authorising train movements at a ground frame where signals are not provided.b) Coupling and uncoupling operations within a signal section.

G 4.2.5 The driveability assessment can consider reasonably foreseen train movements that are not set outin the operating specification. Examples include:

a) Unscheduled wrong direction movements on a line that is not fitted with bidirectional signalling.b) Unplanned shunting movements, for example, to detach a vehicle into a siding.c) Permissive train movements when normal operations are disrupted.



Page 28 of 39 RSSB


G 4.2.6 Conformity with the codes of practice in RIS-0703-CCS can be used as the starting point forcontrolling hazard precursor A1.

4.3 Driveability hazard precursor A2: information provided by the signalling system isnot complete

Guidance

G 4.3.1 If the information provided by the lineside signalling system is incomplete, the train driver wouldneed to use alternative sources to complete the information.

G 4.3.2 Driveability hazard precursor A2 concerns the extent to which the information provided by thesignalling system is complete in terms of the train driving task. Hazard precursor A2 is present within thesignalling layout if the information provided by the lineside signalling system does not include all of thesignalling information needed by the train driver to understand any of the following relevant to an MA:

a) The limit of MA.b) The type of MA available.c) The route that the MA applies to.d) The permissible speed.e) The status of any locally monitored infrastructure associated with the MA.f) An operating instruction.

G 4.3.3 Hazard precursor A2 is controlled if the lineside signalling system provides sufficient information sothat the driver is able to take the correct train driving decisions using that information in combination withother available information, route knowledge and prior experience.

G 4.3.4 Examples of signals and indicators that might provide incomplete information include:

a) An independent shunting signal. In this case, the shunt aspect does not provide information thatconfirms whether the line is occupied or is clear as far as the next stop signal ahead. Further guidance onthis is provided in 2.2 Driveability assessment: shunting MA on page 14.

b) A signal that displays the same indication for alternative routes towards a common destination.c) Indications and instructions at a stop board protecting more than one type of locally monitored

infrastructure (for example, facing points and a level crossing). In this case the train driver candistinguish when the infrastructure is set but might not be able to differentiate which asset has failed tooperate correctly.

G 4.3.5 Conformity with the codes of practice in RIS-0703-CCS can be used as the starting point forcontrolling hazard precursor A2.

4.4 Driveability hazard precursor A3: some information provided by the signallingsystem is not current

Guidance

G 4.4.1 If the information provided by the lineside signalling system is not up to date, the train driver mightbe misled as to what action is required.

G 4.4.2 Driveability hazard precursor A3 concerns how up to date the information presented by thesignalling system is. It is present if:

a) Signal aspects or indications do not truly reflect the actual status of the railway at the time they areread.



RSSB Page 29 of 39


b) The information does not update quickly enough and becomes out of date.

G 4.4.3 Driveability hazard precursor A3 is controlled if signal aspects and indications are always updatedin real time to reflect real changes in the state of the railway, with minimal perceivable delay.

4.5 Driveability hazard precursor A4: provided information is not relevant to sometrains

Guidance

G 4.5.1 Any information presented by the lineside signalling system that is not needed adds ‘clutter’ to thesignalling layout and increases the workload associated with train driving.

G 4.5.2 The signalling system cannot always determine what information will be relevant to individualtrains. Where the operational context on the route includes a variety of train types and differential speeds,some required signalling assets and displays might be relevant only to specific train operations (forexample, permissible speed information). This means that some presented information is not relevant tosome trains.

G 4.5.3 Driveability hazard precursor A4 concerns the extent to which all the information provided by thesignalling system is relevant to the driving task. It is present within the signalling layout if informationprovided by the signalling system is not relevant to the train driving task. This includes:

a) Information applicable to the line being used but which is not relevant to that particular train.b) Information applicable to trains on other lines.

G 4.5.4 Driveability hazard precursor A4 is controlled if it is confirmed that train drivers will be able torecognise any non-relevant information as not applicable to their train. Route knowledge and train drivingexperience helps train drivers understand which signal aspects, indications and lineside operational signs arerelevant to the train being operated and which can be ignored.

G 4.5.5 The driveability assessment considers what can reasonably be done to minimise the impact on traindrivers, for example, by providing a clear visual differentiation between information intended for differenttypes of train.

G 4.5.6 Some lineside signalling displays can be extinguished and made readable only when theinformation they present is needed, for example:

a) Preliminary route indications.b) Loading / unloading indications.c) Approach lit signal aspects.

4.6 Driveability hazard precursor A5: information provided by the signalling systemcannot be relied upon

Guidance

G 4.6.1 Train driving is a safety-critical task, which is dependent on the reliability of the informationprovided by the signalling system.

G 4.6.2 Signalling system failures that present incorrect, misleading, or no information, can increase thelikelihood of an operating incident. Driveability hazard precursor A5 concerns the extent to which theinformation can be trusted as a basis on which to make train driving decisions. It is present within thesignalling layout if making train driving actions according to the information presented by the linesidesignalling system might result in an unsafe outcome.



Page 30 of 39 RSSB


G 4.6.3 Driveability hazard precursor A5 is controlled if the reliability performance of the lineside signallingsystem means that train drivers can use the information to inform train driving decisions to achieve a safeoutcome.

G 4.6.4 Signalling system reliability performance is influenced by technical design and compatibility at theCCS subsystem interfaces with the infrastructure, electrification and rolling stock subsystems. Figure 1shows how CCS subsystem technical compatibility, safety and reliability are interrelated. In particular,reliability performance is influenced by technical compatibility. For example, poor rail-wheel interfaces canadversely affect train detection, which might result in an unreliable signalling system.

Figure 2: Safety, reliability and technical compatibility

G 4.6.5 Driveability assessment considers the impact of presenting proceed signal aspects and indicationsto authorise train movements when normal signalling functions are not available due to a failure. Examplesinclude:

a) Presenting a cautionary aspect when the train protection system is detected to be failed.b) Presenting a PoSA aspect when the train detection system has failed.

G 4.6.6 Technical systems that are used to evaluate and generate the information presented by thelineside signalling system should meet a safety integrity level (SIL) that is appropriate to their application.IEC 61508 Functional Safety of Electrical/ Electronic/ Programmable Electronic Safety-related Systems andBS EN 50128:2011 Railway applications - Communication, signalling and processing systems - Software forrailway control and protection systems, set out further requirements relevant to developing signallingsystems and SILs.

G 4.6.7 CCS systems are usually designed to ‘fail-safe’, which means that poor reliability performance canresult in excessive reliance on degraded methods of working. BS EN 50126-1:1999 Railway applications: Thespecification and demonstration of reliability, availability, maintainability and safety (RAMS), sets outfurther requirements relevant to reliability performance.

4.7 Driveability hazard precursor B1: poor readability

Guidance

G 4.7.1 Train drivers need enough time to read the information provided by signalling system displays.



RSSB Page 31 of 39


G 4.7.2 Driveability hazard precursor B1 concerns the ease with which signalling system displays can beread by train drivers, throughout the range of operational and ambient conditions applicable to the asset,within the operational context and while performing typical required duties. Hazard precursor B1 is presentwithin the signalling layout if the train driver is unable to do this at one or more signals, indications or signs.

G 4.7.3 The compatibility of each lineside signalling asset is assessed by a signal sighting committee usingthe process set out in RIS-0737-CCS. The driveability assessment uses the output from the signal sightingassessment to consider the overall level of readability in terms of what the train driver will actuallyexperience during the journey.

G 4.7.4 Hazard precursor B1 is controlled if all lineside signalling assets support the required readabledistance (RRD) and train drivers will be able to manage any variability in readable distance at successiveassets on the route.

4.8 Driveability hazard precursor B2: poor interpretability

Guidance

G 4.8.1 Train drivers have to be able to correctly interpret the signal aspects and indications to understandwhat train driving action is required.

G 4.8.2 Driveability hazard precursor B2 concerns the ease and reliability with which signal aspects andindications can be interpreted by a train driver throughout the range of operational and ambient conditionsapplicable to that asset, within the operational context and while performing typical required duties. It ispresent within the signalling layout if the meaning of a lineside signalling system display is ambiguous orunfamiliar to a train driver.

G 4.8.3 The signal sighting assessment process set out in RIS-0737-CCS includes consideration of theinterpretability of individual lineside signalling assets. The driveability assessment considers the overall levelof interpretability that train drivers will experience during the journey.

G 4.8.4 Hazard precursor B2 is controlled if all presented signal aspects and indications have a clear,unambiguous meaning that is always the same and is familiar to train drivers. It is controlled if train driversare able to manage any variability in display appearance and meaning using their route knowledge andexperience.

G 4.8.5 Examples of where hazard precursor B2 can arise include:

a) A signal aspect or indication that is unfamiliar to the train drivers who are required to interpret it (forexample, the shunting conditional stop aspect).

b) A signal aspect sequence that is unfamiliar to the train drivers who are required to interpret it.c) A signal aspect or indication that conveys ambiguous information (for example, 4-aspect sequences that

incorporate consecutive YY aspects). RSSB research project T998 provides further information relevantto the interpretability of these signal aspects.

G 4.8.6 Conformity with the codes of practice in RIS-0758-CCS and the catalogue of lineside signs can beused as the starting point for controlling hazard precursor B2. A decision to use a signalling display thatdoes not conform with these standards can be supported by one of the following:

a) Confirmation that the non-compliant display(s) is a similar reference system, which is consistent withexisting displays on the route.

b) The non-compliance is for a trial of a new asset type or display.



Page 32 of 39 RSSB


4.9 Driveability hazard precursor B3: poor accuracy of the information provided bythe signalling system

Guidance

G 4.9.1 An inaccurate signalling display can lead to a response based on train driver expectation of thestate of the railway, which is different to the actual state of the railway.

G 4.9.2 Driveability hazard precursor B3 concerns the extent to which the information provided by thesignalling system is an accurate representation of the true system status. Hazard precursor B3 is presentwithin the signalling layout if the information provided is an inaccurate or distorted portrayal of the systemstatus. For example, if a train driver perceives that a cautionary aspect is presented for ‘false’ reasons (forexample, as part of a junction aspect sequence), and assumes that the line beyond the junction is in factclear, this can lead to an expectation that the signal will clear to a proceed aspect.

G 4.9.3 Hazard precursor B3 is controlled if:

a) Signalling displays accurately reflect the system status.b) Train drivers respond to signal aspects and indications in accordance with the train driving rules,

including those that display restrictive aspects as a means of informing drivers to reduce the train speed,even though the MA extends further than the cautionary aspect implies.

G 4.9.4 Examples of signal aspects that do not accurately represent the true state of the railway includeapproach controlled signal aspects, such as those presented in connection with junction aspect sequences:MAR, MAY-YY, MAY-FA3 and MAY-FA4.

4.10 Driveability hazard precursor B4: inconsistent signal aspects and indicationspresented along the route

Guidance

G 4.10.1 Research suggests that train drivers tend to search for the displays that they expect to see basedon previous experience. Driveability hazard precursor B4 concerns the appearance, behaviour and requiredresponse, along the line of route and within the train driver’s wider experience on other routes. Hazardprecursor B4 is present within the signalling layout if:

a) Different products or displays are used to present the same type of information in different contexts.b) The lineside signalling system behaves differently in the same circumstances in different contexts.c) The response required differs even though the information looks the same.

G 4.10.2 Driveability hazard precursor B4 is controlled if:

a) The same type of signalling asset and display is used to present the same information in all contexts.b) The signalling system always behaves the same way and the required response to a given display is

always the same.c) Train drivers' route knowledge and experience of any variability supports the required response.

G 4.10.3 RIS-0036-CCS sets out further requirements for the design and driveability assessment ofsignalling system transitions.



RSSB Page 33 of 39


4.11 Driveability hazard precursor C1: unusual or non-compliant asset positionrelative to corresponding infrastructure features

Guidance

G 4.11.1 Train drivers use route knowledge when deciding what action is required and where it needs to beapplied.

G 4.11.2 Driveability hazard precursor C1 concerns how learnable the signalling layout will be and theextent to which the infrastructure positions of the displayed information facilitate route learning and theapplication of route knowledge. It is present if:

a) A signalling asset is positioned away from the range of specified or normally expected positions.b) Information is presented at unexpected or indistinct locations.c) There is insufficient distance between the hazard and the last point where information is delivered to

allow recovery of an error before the hazard is reached.

G 4.11.3 A driveability assessment can provide some of the evidence needed to support an authorisation todeviate from a compliant asset position. If the asset position is not specified in a standard, the driveabilityassessment confirms that the proposed asset position is driveable.

G 4.11.4 Hazard precursor C1 is controlled if information is displayed at expected and distinctive locations,for example, the position of a stop signal at or beyond the departure end of a station platform.

G 4.11.5 If a signalling asset is positioned so that the information is displayed at an unexpected or unusualposition, alternative options to control the hazard of poor driveability include:

a) Making the asset more readableb) Providing additional signage to remind train drivers of the position of the signalling asset aheadc) Train driver briefing.

4.12 Driveability hazard precursor C2: inconsistent infrastructure position of one ormore signalling assets

Guidance

G 4.12.1 An unusual asset position might lead to a response based on train driver expectation rather thanthe actual position.

G 4.12.2 Driveability hazard precursor C2 concerns the extent to which the position of the displayedinformation in relation to other infrastructure features is consistent. For example, signals that arepositioned on the right-hand side of the line. It is present if some signalling assets are positioned away fromthe range of specified or normally expected infrastructure positions, or information is displayed in aninconsistent or unexpected position.

G 4.12.3 Hazard precursor C2 is controlled if all information is presented in a similar infrastructure position.Consistency is closely associated with driveability hazard precursors B1, B2 and C1 but takes an overall viewof the train driving experience on the route. The assessment identifies any assets that are sited in anunusual position (for example, on the right-hand side of the line) and establishes what measures, if any,would control the hazard (for example, train driver briefing).



Page 34 of 39 RSSB


4.13 Driveability hazard precursor D1: insufficient time for the train driver to complywith the operating requirement

Guidance

G 4.13.1 This hazard precursor is principally concerned with cautionary aspect sequences and reductions inpermissible speeds. Signals and warning boards are positioned so that train drivers will have enough time toreduce the speed of the train from the permissible speed to comply with the limit of MA or permissiblespeed reduction.

G 4.13.2 Driveability hazard precursor D1 is present within a signalling layout if information is provided toolate to be useful. Insufficient time would mean that the required outcome might not be achieved, even ifthe driver immediately responds with the required action.

G 4.13.3 Driveability hazard precursor D1 can be controlled by meeting the signal positioning requirementsset out in RIS-0703-CCS and the minimum signalling braking distances set out in GKRT0075. This results ina lineside signalling system that is capable of providing train drivers with enough time to comply withoperating procedures. These standards include only those requirements which specify the minimumparameters (for example, signalling braking distance) and include design options to support a range ofinfrastructure layouts and operational contexts (for example, there are six junction signalling methods).

4.14 Driveability hazard precursor D2: excessive time for the train driver to complywith the operating requirement

Guidance

G 4.14.1 Too much time before a required response is needed might result in a driver becoming distractedor forgetting the presented information before taking the required action.

G 4.14.2 Driveability hazard precursor D2 is present within the signalling layout if information is providedsignificantly before the time it is needed, so that there is an excessive reliance on train drivers’ memory tobe able to use the information at the relevant time.

G 4.14.3 Driveability hazard precursor D2 is controlled if information is presented close to the time when itis needed. 2.3 Driveability assessment: excessive signal spacing on page 15 provides further guidance onassessment of excess signal spacing, the output of which is used to determine if anything needs to be doneto reduce the risk to an acceptable level.

4.15 Driveability hazard precursor D3: excessive variation in position of successivelineside signals

Guidance

G 4.15.1 Signal spacing acts in combination with train speed to influence the regularity that signal aspectsand indications are presented to train drivers. Variation in the frequency that train drivers are able to obtainMA information would make the driver’s task of interpreting it and understanding operational requirementsmore difficult.

G 4.15.2 Excessive variation would place too much reliance on train drivers’ route knowledge andexperience to take the required action at the correct time.



RSSB Page 35 of 39


G 4.15.3 Driveability hazard precursor D3 concerns the extent to which updated MA information ispresented at consistent time intervals. It is present if MA information is presented at irregular or infrequentintervals.

G 4.15.4 Hazard precursor D3 is controlled if MA information is presented at consistent time intervals. 2.4 Driveability assessment: variation in signal spacing on page 17 provides further guidance on theassessment of variation in excessive signal spacing, which is used to determine what, if anything, needs tobe done to reduce the risk to an acceptable level.

G 4.15.5 Examples of situations where hazard precursor D3 arises include:

a) A route that is intermittently signalled (for example, a line operated in accordance with the absoluteblock system where local clusters of signals are associated with a signal box area).

b) A line where minimum signalling facilities are provided to support wrong-direction operation (forexample, to allow closure of the adjacent line for engineering work).

c) A 4-aspect signalled line where signal spacing means that the 4-aspect single yellow is less than 33%SBD from the main stop aspect. `

4.16 Driveability hazard precursor D4: information is provided at inconsistent times

Guidance

G 4.16.1 Train drivers develop an expectation regarding where and when information will be provided inrelation to particular infrastructure features. If this expectation is not met, then train drivers might act uponthe expectation of when they will receive the information rather than when it is actually presented.

G 4.16.2 Driveability hazard precursor D4 concerns the extent to which the timing of presentation ofinformation is consistent with the timing of similar information along the route and on other routes that thetrain driver is familiar with. It is present within the signalling layout if information relating to a particulartype of hazard is presented at an inconsistent time in relation to when the information is needed.

G 4.16.3 Hazard precursor D4 is controlled if:

a) Information relating to a particular feature is always presented roughly the same amount of time beforereaching the feature (for example, a diverging junction).

b) Train drivers' route knowledge and experience is sufficient to manage the inconsistency.



Page 36 of 39 RSSB


Definitions

CCS Control, Command and Signalling.

CSM RA Common Safety Method for Risk Evaluation andAssessment. COMMISSION REGULATION (EU) No2015/1136 of 13 July 2015 amendingImplementing Regulation (EU) No 402/2013 on thecommon safety method for risk evaluation andassessment.

Drive / Train driving The human tasks and processes necessary to controlthe movement of a train in accordance withoperating rules and procedures.

Driveability The ease and reliability that train drivers are able toperform train operations in accordance with rulesand procedures, throughout the range ofoperational and ambient conditions applicable toeach train, within the operational context and whileperforming typical required duties.

Driveable A capability requirement of the lineside signallingsystem to provide train drivers with the informationneeded to support their conformity with the traindriving rules and procedures.

Independent shunting signal A shunting signal that is capable of presenting astop aspect; includes a signal denoting a limit ofshunt.

Indication of route A lineside signalling system display that conveysinformation about the route set at a divergingjunction in the form of either:

a) A signal aspect and route indicationcombination.

b) A combination of semaphore signal aspects.c) A flashing or splitting distant signal aspect.d) A preliminary junction indication.e) A splitting banner repeater indication.

Indicator A lineside signalling asset that is capable ofdisplaying a signalling indication.

Infrastructure Manager (IM) Any ‘body’ or undertaking that is responsible inparticular for establishing and maintaining railwayinfrastructure, or part thereof, as defined in article 3of Directive 91/440/EEC, which may also include themanagement of infrastructure control and safetysystems. The functions of the infrastructuremanager on a network or part of a network may beallocated to different bodies or undertakings.Source: Article 3 (b) of Directive 2004/49/EC.



RSSB Page 37 of 39


Movement authority (MA) The authority given by a signaller (or ground frameoperator), issued via the signalling system to thedriver, which is the authority to move the trainwithin defined limits.

Non-permissive MA Authority for a train to proceed into a signal sectionthat is not occupied by other rail vehicles.

Permissible Speed The authorised maximum speed over a section ofline, either for all trains or (where differential orenhanced permissible speeds are applied) forspecific types of trains, as set out in the SectionalAppendix.

Proceed aspect Any signal aspect that is used to authorise a trainmovement.

Proposer Proposer is defined in the common safety methodon risk evaluation and assessment as one of thefollowing:(a) a railway undertaking or an infrastructuremanager which implements risk control measures inaccordance with Article 4 of Directive 2004/49/EC;(b) an entity in charge of maintenance whichimplements measures in accordance with Article14a(3) of Directive 2004/49/EC;(c) a contracting entity or a manufacturer whichinvites a notified body to apply the ‘EC’ verificationprocedure in accordance with Article 18(1) ofDirective 2008/57/EC or a designated bodyaccording to Article 17(3) of that Directive;(d) an applicant for an authorisation for the placingin service of structural sub-systems.Source: CSM RA

Railway Undertaking (RU) Any private or public undertaking the principalbusiness of which is to provide rail transport servicesfor goods and/or passengers, with a requirementthat the undertaking must ensure traction; this alsoincludes undertakings which provide traction only.Source: Article 3 (a) of Directive 2004/49/EC.

Record Register in writing a finding from examination, test,inspection or special checks in accordance withprocedures. Source: RIS-2702-RST editedGMGN2497edited.

Shunting MA Authority for a train to proceed for shuntingoperations.

Sign Any surface (usually in one plane) that presents afixed image or text, in order to convey specificinformation to the viewer.

Signal A lineside signalling asset that presents a signalaspect.



Page 38 of 39 RSSB


References

The Catalogue of Railway Group Standards gives the current issue number and status of documentspublished by RSSB. This information is also available from http://www.rssb.co.uk/railway-group-standards.

RGSC 01 Railway Group Standards Code

RGSC 02 Standards Manual

Documents referenced in the text

Railway Group Standards

GKRT0075 Lineside Signal Spacing and Speed Signage

RSSB documents

GEGN8651 Rail Industry Guidance Note for Safe Integration ofCCS Systems with Train Operations

GIGN7634 Index for Lineside Signs

RIS-0036-CCS Transitions Between Signalling Systems

RIS-0386-CCS Rail Industry Standard on Signal Overrun RiskEvaluation and Assessment

RIS-0703-CCS Signalling Layout and Signal Aspect SequenceRequirements

RIS-0734-CCS Signing of Permissible Speeds and Signing ofTemporary and Emergency Speed Restrictions [to bepublished]

RIS-0737-CCS Signal Sighting Assessment Requirements

RIS-0744-CCS Permissive Working [to be published]

RIS-0758-CCS Lineside Signal Aspects and Indications

Other references

IEC 61508 Functional Safety of Electrical/ Electronic/Programmable Electronic Safety-related Systems

EN 50126-1:1999 Railway applications. The specification anddemonstration of reliability, availability,maintainability and safety (RAMS). Basicrequirements and generic process

BS EN 50128:2011 Railway applications - Communication, signallingand processing systems - Software for railwaycontrol and protection systems



RSSB Page 39 of 39


http://www.rssb.co.uk/railway-group-standards