Prevention and Mitigation of Overruns – Risk Assessment Iss 1.pdf · Railway Group Standard Prevention and Mitigation of Overruns – Risk Assessment 2 RAILTRACK GI/RT7006 Issue

This document is the property of Railtrack PLC. It shall not be reproduced in whole or in part without the written permission of the Controller, Railway Group Standards, Railtrack PLC. Published by: Safety & Standards Directorate Railtrack PLC Evergreen House 160 Euston Road London NW1 2DX © Copyright 2000 Railtrack PLC

Railway Group Standard GI/RT7006 Issue One Date December 2000

Prevention and Mitigation of Overruns – Risk Assessment

Synopsis This document defines the requirements for risk assessment of the design and operational use of track and signalling, so as to control the risks associated with trains exceeding the end of their movement authority.

Signatures removed from electronic version

Submitted by

Marie Marks Standards Project Manager

Authorised by Brian Alston Controller, Railway Group Standards

Uncontrolled When Printed Document to be superseded as of 06/12/2014

To be superseded by RIS-0386-CCS Iss 1 published on 06/12/2014

This page has been left blank intentionally




R A I L T R A C K 1

Railway Group Standard GI/RT7006 Issue One Date December 2000 Page 1 of 14

Contents Section Description Page

Part A

Issue Record 2 Technical Content 2 Responsibilities 2 Compliance 2 Health and Safety Responsibilities 3 Supply 3

Part B

1 Purpose 5 2 Scope 5 3 Definitions 6 4 Assessment of Overrun Risk during Track Layout and Signalling Design 7 5 Operational Use of Infrastructure 10 6 Review of Overrun Risk at Existing Layouts 11 7 General Requirements for Overrun Risk Assessments and Reviews 11

References 14




2 R A I L T R A C K


Part A Issue Record

This document will be updated when necessary by distribution of a complete replacement.

Revisions in the reissued document will be marked by a vertical black line in the right hand margin adjacent to the revision.

Issue Date Comments One December 2001 Original Document

In conjunction with GK/RT0064 issue 1, this document supersedes GK/RT0078 issue 5

Technical content

Approved by: Francis How, Principal Signalling & Telecoms Engineer

Enquiries to be directed to the Industry Safety Liaison Dept. Tel: 0207 904 7518.

Responsibilities

Railway Group Standards are mandatory on all members of the Railway Group * and apply to all relevant activities that fall into the scope of each individual’s Railway Safety Case. If any of those activities are performed by a contractor, the contractor’s obligation in respect of Railway Group Standards is determined by the terms of the contract between the respective parties. Where a contractor is a duty holder of a Railway Safety Case then Railway Group Standards apply directly to the activities described in the Safety Case.

* The Railway Group comprises Railtrack and the duty holders of the Railway Safety Cases accepted by Railtrack.

Compliance

The provisions of sections 4 and 5.1 of this document are mandatory for design and implementation work undertaken on all schemes for which the signalling scheme plan is first approved on or after 07 April 2001.

Where a signalling scheme is to be re-approved after this date, consideration shall be given to the reasonable practicability of applying the provisions of section 4 of this document to the scheme.

The provisions of section 5.2 are mandatory as from 07 April 2001, except in respect of timetable changes that are to be implemented prior to May 2002.

Implementation of the requirements of section 6.1 shall commence as from 07 April 2001.

The provisions of section 6.2 are mandatory as from 07 April 2001.

The provisions of section 7.1 are mandatory as from 01 December 2001.

Sections 5.3, 6.3, 7.2, 7.3, 7.4, 7.5 and 7.6 shall be implemented in accordance with the compliance dates set for the related sections (4, 5 and 6) to which they are linked.

Any Railway Group member deviating from the requirements set out in this document shall ensure that the situation is regularised in accordance with the requirements of GA/RT6001, GA/RT6004, or GA/RT6006.




R A I L T R A C K 3


Health and Safety

Responsibilities In issuing this document, Railtrack PLC makes no warranties, express or implied, that compliance with all or any documents published by the Safety & Standards Directorate is sufficient on its own to ensure safe systems of work or operation. Each user is reminded of its own responsibilities to ensure health and safety at work and its individual duties under health and safety legislation.

Supply

Controlled and uncontrolled copies of this document may be obtained from the Industry Safety Liaison Dept, Safety & Standards Directorate, Railtrack PLC, Evergreen House, 160 Euston Road, London, NW1 2DX.




4 R A I L T R A C K


This page has been left blank intentionally




R A I L T R A C K 5


Part B 1 Purpose

The purpose of this document is to define the requirements for risk assessment of the design and operational use of track and signalling so as to control the risks associated with trains exceeding the end of their movement authority.

2 Scope 2.1 Subject Matter that is Within the Scope of GI/RT7006 2.1.1 The overall scope of Railway Group Standards (RGSs) is as specified in Appendix A of GA/RT6001.

This document contains requirements which are applicable to the duty holders of the Infrastructure Controller category of Railway Safety Case .

2.1.2 Specifically this document contains requirements that are applicable to:

a) the design of track layouts and fixed block signalling systems on Railtrack controlled infrastructure.

b) the operational use of those layouts and signalling.

Although this document refers to stop signals, this includes fixed block end of movement authorities issued to the driver via a cab signalling system (see definition of stop signal).

2.1.3 This document requires the assessment of risk associated with the overrun of a stop signal at danger arising from:

a) driver misread or disregard of signals.

b) driver misjudgement of braking.

2.1.4 The accident scenarios arising from overruns that are within the scope of this document are:

a) collisions with other trains (primarily those on conflicting paths, but also including rear end collisions).

b) collisions with road users at level crossings.

c) derailments on points and crossings.

2.2 Subject Matter that is Not Within the Scope of This Document 2.2.1 The scope of this document does not include:

a) the control of buffer stop collision risk (see GC/RT5033).

b) specific technical measures applied to the design of the infrastructure to control overrun risk (see section 4.6).

c) requirements for investigation following an overrun (see GO/RT3252).

d) overruns arising from low adhesion (see section 2.2.2).

e) control of collision risk when a train is signalled onto an occupied line (see GK/RT0044).




6 R A I L T R A C K


f) measures applicable to train operators for the control of overrun risk (eg driver training; use of driver reminder appliance; crashworthiness of rolling stock).

3 Definitions Acceptably Low Risk Levels of risk that are:

a) tolerable.

b) As Low As Is Reasonably Practicable (ALARP).

Area of Conflict A section of line ahead of a signal at danger on which a head-on, crossing or same direction converging collision with another legitimately positioned train (whether moving or stationary) could occur in the event of the signal being passed at danger. For the purposes of this document, the area of conflict commences where the two movements first become foul of each other (eg at points, a fixed crossing, a switch diamond crossing, or the commencement of interlaced tracks), and extends to the location where one of the following conditions is first met:

a) The rear of the overrunning train is clear of the route of the authorised train movement.

b) The leading end of the overrunning train reaches another stop signal that is applicable to its direction of movement.

c) The leading end of the overrunning train is 100 metres beyond the Automatic Warning System (AWS) magnet of a stop signal that controls movements in the opposite direction to that of the overrunning movement.

Although this definition specifically excludes a section of line on which the only possible collisions are rear end, such collisions are considered as part of the risk assessment process, and are within the overall scope of this document.

End of Movement Authority The point at which a train is required to come to a stand on completion of a signalled movement (usually denoted by a signal at danger, stop board, buffer stop, or an in-cab instruction where cab signalling is in use).

Full Overlap An overlap of at least 180 metres (or 400 metres in the case of a semaphore signal where the preceding caution signal is also a semaphore type), as defined in GK/RT0064.

The definitions of reduced and restricted overlaps are set out in GK/RT0064.

Operational Use The manner in which the track and signalling is used for the purposes of running trains, including factors such as:

a) frequency, speed and type of train.

b) direction of traffic flow.

c) timetabling of trains.

d) pathing of trains through the layout.

e) regulation policy and rules (both those applied by signallers and those implemented via automatic route setting systems).




R A I L T R A C K 7


f) platforming arrangements (eg platform allocations, stopping positions, method of authorising train departure from platforms, platform sharing).

Overrun Passing the end of movement authority. On lines signalled with lineside signals, the conventional terminology for an overrun is a Signal Passed At Danger (SPAD). The definition includes both failure to come to a stand at a signal at danger, and starting from rest against a signal at danger.

Stop Signal A signal which is capable of displaying a “stop” aspect to a train driver. For the purposes of this document, this includes not only conventional colour light and semaphore signals (main and shunt types), but also stop signs/boards, and in-cab end of movement authority instructions issued to the driver via a cab signalling system.

Train Protection System A system that automatically applies the brakes on a train to control the risk of an overrun arising from driver error. Automatic Train Protection (ATP) systems, the Train Protection and Warning System (TPWS) and trainstops are all forms of train protection systems. The AWS does not constitute a train protection system for the purposes of this document.

4 Assessment of Overrun Risk During

Track Layout and Signalling Design

4.1 Infrastructure Design: Overrun Risk Control Objectives New and modified track layouts and signalling shall be designed so as to:

a) eliminate the potential for overrun collisions and derailments, wherever this is reasonably practicable.

b) make use of risk reduction measures which mitigate overrun risk to levels that are as low as reasonably practicable, wherever the potential for collision has not been eliminated.

4.2 Track Layout Options for the Control of Overrun Risk During the identification, evaluation and selection of options for new and modified track layouts, consideration shall be given to the following design features so that, together with the signalling, the risk control objectives set out in section 4.1 are achieved:

a) The extent to which areas of conflict can be eliminated completely by appropriate design of the layout.

b) The opportunities provided by the track layout to divert overrunning movements away from areas of conflict (eg by flank point protection; trapping; automatic restoration of points).

c) The opportunities provided by the track layout to use a train protection system to bring an overrunning train to a stand before it reaches an area of conflict (principally by the provision of a sufficient length of track between the signal and the area of conflict).

d) The minimisation of the time window during which a collision could occur in an area of conflict (principally by reducing the length of the area of conflict).

4.3 Signalling Options for the Control of Overrun Risk During the development of designs for new and modified signalling, the overrun risk associated with each stop signal shall be assessed, in accordance with sections 4.4 and 4.5. This requirement applies to every stop signal whose




8 R A I L T R A C K


overrun risk could be affected by the project, not just those signals being provided or altered.

In conjunction with the assessment, signalling options shall be identified, evaluated and selected so that, together with the track layout, the risk control objectives set out in section 4.1 are achieved.

4.4 Signals for which a Simple Risk Assessment is Sufficient Where a simple assessment of a stop signal demonstrates that the criteria for one of the categories [(a) and (b)] listed below are met, then no further risk assessment is required, and no additional risk reduction measures need be applied.

The categories and associated criteria are:

a) A stop signal on plain line with no points or crossings between the stop signal and the next stop signal ahead, meeting all the following criteria:

i. The signal and the associated preceding caution signal(s), and the associated AWS equipment, are compliant with the requirements of the RGSs that are in force at the time of the risk assessment and which are relevant to the control of overrun risk.

ii. There are no station platforms between the stop signal and the immediately preceding caution signal.

iii. It is unlikely that a driver would misinterpret another nearby signal as being applicable to his train (this applies at both the stop signal and the preceding caution signal(s)).

iv. A full overlap is provided beyond the signal, with no provision made for the use of reduced or restricted overlaps. See GK/RT0064.

v. There is full signal spacing (in three aspect territory) or at least one third of the signal spacing (in four aspect territory) between the stop signal and the next stop signal ahead. See GK/RT0034.

vi. There are no infrastructure features between the stop signal and the next stop signal ahead that could either increase the likelihood of a collision or could significantly worsen the consequences of a collision or derailment.

b) A stop signal on a line fitted with a train protection system, meeting all the following criteria:

i. The signal and associated preceding caution signal(s), and the associated AWS equipment, are compliant with the requirements of the RGSs that are in force at the time of the risk assessment and which are relevant to the control of overrun risk.

ii. The action of the train protection system and, where applicable, the setting and interlocking of facing points ahead of the stop signal, is such that all trains overrunning the stop signal will be routed so as to avoid, or be brought to a stand short of, all areas of conflict and all infrastructure features that could either increase the likelihood of a collision or could significantly worsen the consequences of a collision or derailment.

iii. The action of the train protection system is such that all trains overrunning the stop signal will be brought to a stand so as to avoid a rear end collision with a train standing at a stop signal ahead (this criteria has to be met in respect of all routes that the train might follow after overrunning the stop signal under consideration).




R A I L T R A C K 9


iv. The action of the train protection system is such that all trains overrunning the stop signal will not derail on any points or crossings ahead (this criteria has to be met in respect of all routes that the train might follow after overrunning the stop signal under consideration).

4.5 Signals Requiring a Detailed Risk Assessment For all signals other than those in the categories set out in section 4.4, a detailed risk assessment shall be conducted which includes consideration of the following elements:

a) Likelihood of an overrun occurring (see section 4.5.1).

b) Extent and path of an overrun (see section 4.5.2).

c) Probability of an overrun resulting in a collision or derailment (see section 4.5.3).

d) Consequences of a collision or derailment (see section 4.5.4).

4.5.1 Likelihood of Overrun Occurring The frequency with which trains are likely to overrun each signal at danger shall be evaluated, taking into account all the following:

a) The possible routes by which the train could approach the stop signal.

b) Site-specific factors affecting the likelihood of a driver failing to stop at the signal.

c) Site-specific factors affecting the likelihood of a driver starting from rest against the signal at danger.

d) The frequency with which trains are routed past the signal.

e) The probability of a driver encountering the signal at danger.

4.5.2 Extent and Path of an Overrun For each stop signal, the extent and the path of all the possible overrun scenarios shall be identified in terms of:

a) which points and line(s) the overrunning train might traverse.

b) where the train might eventually come to a stand (whether by driver action, activation of the train protection system, or by derailment).

The relative probabilities of each overrun scenario occurring shall be evaluated, taking into account site-specific post overrun factors that could determine the route taken by the train or affect where it might eventually come to a stand.

4.5.3 Probability of an Overrun Resulting in Collision or Derailment For all the credible overrun scenarios (as identified in section 4.4.2), the probability of a collision or derailment occurring shall be evaluated, taking into account relevant factors that could affect the probability.

4.5.4 Consequences of Collision or Derailment For each collision and derailment scenario, the credible consequences shall be identified and evaluated, in terms of injuries and fatalities, taking into account relevant factors that could determine the severity of loss.

4.6 Extent of Application of Other Overrun Risk Controls The detailed risk assessment shall take into account the extent of application of, and degree of risk control achieved by, relevant requirements mandated in other RGSs.




1 0 R A I L T R A C K


Where those requirements permit a risk-based approach to the extent of application of a particular risk reduction measure (for example in GK/RT0064), the risk assessment mandated by that RGS shall form an integral part of the risk assessments required by this document.

4.7 Iteration of Design and Risk Assessment Where the risk assessment of overrun risk at signals (as required by section 4.3) indicates, even after the application of risk reduction measures, that the risk is not acceptably low, then:

a) changes to the operational use shall be reconsidered; and/or

b) the options for the track layout shall be reconsidered (in accordance with section 4.2)

to identify ways in which the risk can be further reduced.

4.8 Review and Approval 4.8.1 The infrastructure controller shall review and approve the outputs from the risk assessments (as listed in section 7.6), so as to be satisfied that the proposed track layout, signalling arrangements and operational use reflect the conclusions of the risk assessment and will control overrun risk to an acceptably low level.

4.8.2 The infrastructure controller shall seek and consider the views of train operators, regarding the adequacy of the proposed arrangements from a safety perspective, before giving final approval for implementation.

4.9 Implementation 4.9.1 The infrastructure controller shall ensure that the approved overrun risk reduction measures are incorporated into the design of the infrastructure and also, where applicable, into procedures, timetables and other arrangements for the operation of the railway.

4.9.2 Where the risk reduction measures are not all being implemented together, the infrastructure controller shall agree with the train operator(s) the prioritisation of implementation in order to gain optimal safety benefit.

5 Operational use of infrastructure

5.1 Layout and Signalling to be Used in Accordance with Assumptions The infrastructure controller shall devise and implement documented procedures for track layouts and signalling to ensure that the operational use is not in breach of any constraints or assumptions that were incorporated into, or underpinned, the risk assessment. The application of this requirement is limited to track layouts and signalling that have been assessed in accordance with the requirements of this document.

5.2 Requirement for Re-Assessment The infrastructure controller shall ensure that overrun risk is reviewed in the event of a proposal for a significant change to:

a) the operational use of the track and signalling; or

b) elements of the infrastructure other than the track layout and signalling.

A significant change, in this context, is one that is likely to invalidate the basis of any previous overrun risk assessment. Where no previous assessment exists, a




R A I L T R A C K 1 1


significant change is one that is likely to breach relevant constraints or assumptions that were incorporated into the design of the track and signalling.

The infrastructure controller shall seek and consider the views of train operators, regarding the results of the review.

Where a modification to the track layout or signalling is proposed, the requirements of section 4 of this document apply.

5.3 Risk Reduction Measures Where a review conducted in accordance with section 5.2 indicates that the level of risk is not acceptably low, options shall be identified, evaluated, and where necessary implemented to reduce the risk.

6 Review of Overrun Risk in Existing Layouts

6.1 Requirement for the Review of Overrun Risk on Existing Layouts A review of overrun risk at existing signals that protect junctions shall be conducted at least once by October 2005. Where a signal has been the subject of either a review in accordance with section 5.2, or risk assessment in accordance with section 4 of this document, a further review is not required.

The infrastructure controller shall produce a prioritised programme of reviews. These reviews shall consider the adequacy of existing risk control measures, taking account of the operational use of the infrastructure.

6.2 Review of Overrun in Other Circumstances In addition to the requirements of sections 5.2 and 6.1, if information comes to light which suggests that the existing level of overrun risk is not acceptably low, then a review of the risk shall be carried out.

6.3 Risk Reduction Measures Where a review conducted in accordance with section 6.1 or 6.2 indicates that the level of risk is not acceptably low, options shall be identified, evaluated and, where necessary, implemented to reduce the risk or reverse the trend.

7 General Requirements for Overrun Risk

Assessments and Reviews

7.1 Provision and Application of Documented Procedures The infrastructure controller shall devise and implement documented procedures to support the requirements of this document, including procedures for:

a) overrun risk assessment and review of track layout and signalling design options.

b) ensuring that the operational use of the track and signalling does not breach design constraints and assumptions relevant to overrun risk.

c) the review (and where necessary, detailed risk assessment) of operational changes that could affect overrun risk.

d) the review (and where necessary, detailed risk assessment) of other infrastructure changes that could affect overrun risk.

7.2 Rigour of Assessments and Reviews The rigour of each assessment and review shall be commensurate with the circumstances under consideration, taking into account all of the following:

a) Complexity and topography of the track layout.






b) Operational use of the track and signalling.

c) Provision and effectiveness of train protection systems.

d) Elements of the track layout that may present particular risk.

e) Other infrastructure features that may affect the level of risk.

f) History of overruns, where relevant.

7.3 Competency of Persons Engaged in Risk Assessments and Reviews The infrastructure controller shall ensure that personnel who perform overrun risk assessments and reviews collectively possess:

a) the necessary competencies in respect of the risk assessment processes and procedures.

b) the knowledge/experience necessary to consider technical aspects of the infrastructure and trains that are relevant to the assessment.

c) the knowledge/experience necessary to consider the timetabling, train regulation and other operational matters that are relevant to the assessment.

Additionally, in respect of risk assessments of new or modified track and signalling designs, persons with experience of train driving shall be involved in the risk assessment process.

7.4 Use of Data for Assessments and Reviews Where historical data is used for risk assessments and reviews, the validity of that data for the particular application shall be assessed and confirmed prior to use.

Where benchmarks or targets are used in the evaluation of the tolerability of risk, their validity for the particular application shall be assessed and confirmed prior to use.

The infrastructure controller shall approve the use of any data, benchmarks and targets used in overrun risk assessment and review.

7.5 Use of Tools and Models to Support Risk Assessments and Reviews Where models or other design support tools are used to assist with overrun risk assessments and reviews, these shall be:

a) validated prior to first use, and any subsequent change of use, in order to ensure that they are appropriate for their application.

b) used within the scope of their application constraints.

7.6 Records 7.6.1 Records of risk assessments and reviews shall be kept for as long as they continue to be applicable to the current layout, signalling or operational use. The records shall include details of all the following:

a) Scope of the assessment or review.

b) Methodology applied, including the use of any models or design support tools.

c) Options considered.

d) Assessment/review activities and the names of the participants.

e) Findings and outputs from the assessments/reviews.




R A I L T R A C K 1 3


f) Decisions regarding options and risk reduction measures.

g) Justification for those decisions.

h) Any data, benchmarks or targets used and the justification for their use.

i) Any constraints and assumptions underpinning the assessment/review.

j) Approval by the infrastructure controller (applicable to design assessments only).

7.6.2 In respect of section 5.2, where the decision has been taken not to carry out a review because the change was considered not to be significant, a record of the change and the justification for the decision shall be kept.






References

Railway Group Standards

GA/RT6001 Railway Group Standards Change Procedures

GA/RT6004 Temporary Non-Compliance with Railway Group Standards

GA/RT6006 Derogations from Railway Group Standards

GC/RT5033 Terminal Tracks – Managing the Risk

GK/RT0034 Lineside Signal Spacing

GK/RT0044 Controls for Signalling a Train onto an Occupied Line

GK/RT0064 Provision of Overlaps, Flank Protection and Trapping

GO/RT3252 Signals Passed at Danger (SPADs)

Further Reference Material GI/GN7606 Guidance Note: Prevention and Mitigatation of Overruns - Risk Assessment

The Catalogue of Railway Group Standards and the Railway Group Standards CD-ROM give the current issue number and status of documents published by the Safety & Standards Directorate.



Documents

Prevention and Mitigation of Overruns – Risk Assessment Iss 1.pdf · Railway Group Standard Prevention and Mitigation of Overruns – Risk Assessment 2 RAILTRACK GI/RT7006 Issue