impact assessment for changes to railway group … ia12.pdf · impact assessment for changes to...

RSSB Impact Assessment for RIS-0340-CCS issue two of 19 Ref: 14 IA12 Issue: May 2014

Impact Assessment for Changes to Rail Industry Standards

Version: Publication and Withdrawal

Date: 28 May 2014

Relevant Rail Industry Standard

Title: Rail Industry Standard for Onboard ETCS

Number: RIS-0340-CCS Issue: Two

Synopsis: This document was intended to be used by rolling stock owners and operators to assist with the procurement of the European Traffic Control System (ETCS) onboard equipment, and by suppliers in pre-empting likely product aspirations of Great Britain (GB) railway undertakings. It included requirements that may be used in the procurement of ETCS onboard equipment, which have been derived in conjunction with the requirements set out in the Baseline 3 suite of ETCS specifications. The standard was withdrawn on publication because the European Rail Traffic Management System (ERTMS) Programme’s ETCS onboard specifications document (NEPT/ERTMS/REQ/007) provides this information to industry under different change control arrangements, pending efficacy of the set of requirements. When the requirements are sufficiently proven a new or revised RSSB document will be proposed.

Executive Summary

RIS-0340-CCS issue one ‘Rail Industry Standard for Onboard ETCS’ was produced at the request of the industry to provide a consistent approach and solution to design aspects of the ETCS system, in order to avoid a proliferation of design differences within GB where the design / operational detail is not mandated through Railway Group Standards (RGSs) or other legislation.

Issue one of RIS-0340-CCS addressed the Baseline 2 set of specifications comprising version 2.3.0 of the ETCS System Requirement Specification (SRS), together with the mandatory change requests defined in SUBSET-108 v1.2.0. A revised suite of ETCS specifications, known as Baseline 3, has been produced by the European Rail Agency (ERA), and the RIS was amended to address Baseline 3, together with changes that were also included to reflect the experience gained from national and wider European deployment of the ETCS. In addition, changes were made to improve the guidance and terminology used. A summary of the changes is included in Appendix A. Further changes to requirements that were made to address comments raised during the consultation process on draft m of issue two of RIS-0340-CCS are summarised in Appendices B and C.

The revisions incorporated into RIS-0340-CCS issue two ‘Rail Industry Standard for Onboard ETCS’ were considered to enhance its usefulness, and support the cost-effective application of the ETCS on trains through more effective controls and improved guidance. The changes to the requirements were judged to provide benefits by reducing costs and / or system complexity and were therefore considered to be in the long-term best interests of the rail industry.

Uncontrolled When Printed


As explained above in the synopsis NEPT/ERTMS/REQ/007 provides this information to industry, pending efficacy of the set of requirements. When the requirements are sufficiently proven a new or revised RSSB document will be proposed.

1 Initiators of change

In September 2010, RIS-0340-CCS issue one ‘Rail Industry Standard for Onboard ETCS’ was published. Two reviews were subsequently undertaken; the first, completed twelve months after publication, identified that no immediate changes were necessary and recommended that a second review be undertaken in a further six months. The second review identified improvements that could be made to the RIS to benefit from the experience gained from national and wider European deployment of the European Traffic Control System (ETCS). In addition, changes were included to address developments in the suite of ETCS specifications and the recent production of the Baseline 3 set of specifications. Further changes identified in Appendices B and C were made to address comments made during the consultation process on draft m of issue two of RIS-0340-CCS.

2 Summary of changed controls and implications for industry

Issue one of RIS-0340-CCS addressed the Baseline 2 set of specifications comprising version 2.3.0 of the ETCS System Requirement Specification (SRS), together with the mandatory change requests defined in SUBSET-108 v1.2.0. A revised suite of ETCS specifications, known as Baseline 3, has been produced and the Rail Industry Standard (RIS) was amended to remove requirements relating to Baseline 2 and address the changes that the new set of specifications introduced. In addition, changes were made to improve the guidance and terminology used.

2.1 New requirements

A new requirement was included to permit the integration of the Automatic Warning System / Train Protection and Warning System (AWS/TPWS) controls into the ETCS driver machine interface (DMI). This requirement was included to provide flexibility in the design of the driver interface and allow the designs to address cab constraints, and it was judged that it provided a safety benefit as it allowed for a more intuitive and better placed set of indications rather than having the AWS/TPWS indications located elsewhere in the cab. A requirement was included for the integrated display to incorporate separate and clearly identifiable indications (visual and audible) of brake demands which are initiated by train stop activations, overspeed activations or late acknowledgement of the AWS caution warning. This feature was provided to remove any potential driver confusion about the cause of the brake demand. The integrated display was also required to incorporate a brake release procedure that provided protection against inadvertent operation by the driver. This was a safety feature requiring the driver to perform a sequence of operations to enable the brakes to be released after they have been applied by a safety system.

It was also required that isolation of ETCS onboard equipment removed any suppression of onboard Class B safety systems. This was included as a safety feature that reverts the train to using Class B safety systems when ETCS is isolated.

A requirement was included for the ETCS Sleeping (SL) mode to be able to be selected manually where the facility is not provided for the sleeping signal to be received automatically through coupling connections. This new requirement provided a cost effective means of entering SL mode which is used to enable an ERTMS fitted traction unit to be hauled. Without this facility an engineer might need to attend to isolate the ETCS on the unit. This proposed requirement introduced in draft m of issue two of RIS-0340-CCS (see Appendix A item 7) was deleted, as a result of a consultation comment that identified it as unnecessary because its intent is achieved



through ETCS Passive Shunting (PS) mode, which is fully defined in SUBSET-026 (see Appendix C item 6).

A new requirement, identified from industry experience, was introduced for the ETCS onboard equipment to be tolerant of a cab being opened for a short duration and closed before any self-test routine is completed. This requirement was included to address the possibility that a self-test interruption unnecessarily initiated a failure condition when in fact the equipment was working normally. This had the benefit that work would not be needed to address the unnecessary fault condition. This requirement was judged to be safety neutral, as the opening of the cab is not part of the ETCS self-test, and interruption of the self-test by closing the cab is not itself a safety related issue.

A requirement was included for diagnostic information to be recorded with a time stamp that had sufficient resolution to identify the sequence of events accurately and enable them to be correlated with data captured on other recording devices. The advantage in being able to easily correlate event data from different devices was considered to be safety neutral, but had potential cost benefits by simplifying the task of analysing multiple data inputs by reducing the level of data pre-processing required before a sequence of events could be analysed. To further support the correlation of multiple data inputs from different devices, a requirement was included for a common recording channel to be shared by the devices. This requirement was amended in draft v of issue two of RIS-0340-CCS to address a consultation comment, with inclusion of the text: ‘Failure of one device shall not compromise continued operation of another’ (see Appendix C item 1). This change was required as, from availability considerations, it is important that failure of one device does not compromise the capability of the other.

A requirement was included for safety-critical faults to be recorded onboard. The intent of this requirement was that safety-critical system data are captured with a high degree of confidence rather than be transmitted from the train, with the additional potential for data corruption or loss.

A requirement was included to incorporate functionality to remotely interrogate ETCS diagnostic information which is stored onboard the train. This facility would enable data about train equipment to be examined remotely while the train is in operation and appropriate actions to be taken which could have operational, safety and cost savings benefits by identifying abnormal conditions before failure occurs.

It was also required that information on faults that needed immediate driver attention was presented to the driver in an unambiguous, operationally meaningful manner and persisted until acknowledged. This requirement was intended to reduce the potential for additional driver workload in understanding the information being presented. The requirement for the information to be acknowledged before it is removed from the DMI display prioritisation, provided a safety benefit by reducing the likelihood that the information is inadvertently missed by the driver.

A new requirement was included for the ETCS onboard equipment to be fully integrated into the train systems, in order to minimise the complexity and quantity of components in the interfaces. This requirement had originated from industry experience with the fitting of complex systems onto rail vehicles and was considered to provide cost and safety benefits associated with the reduction in complexity and number of components which have the potential to improve system reliability and safety.

ETCS equipment was required to be protected by correctly rated resettable protective devices and, in order to avoid introducing unnecessary multiple serial circuit protection for ETCS equipment, a new requirement was included to make use, where appropriate, of electric circuit protection devices already fitted on the train. Where this



is done the hierarchy of protection was also required to be maintained. These requirements had the benefit of reducing complexity and cost, and were considered to be safety neutral as they do not change the necessary electric circuit protection to be provided.

A requirement was included for the fault reporting and feedback of ETCS onboard equipment not to be compromised by the failure of any device interfacing with the ETCS onboard system. The intent of this requirement was that failures of the ETCS are not masked by faults in other interfaced systems. This provided the safety benefit that potential safety related ETCS faults would be reported, which would assist in fault identification and corrective maintenance.

A new requirement was included that specified the form and the area in which the location of the set speed point is to be displayed on the DMI. This requirement established a common location of the set speed point on the display and was considered to provide a safety benefit through driver familiarity with the speed display in different trains.

A new requirement was included to prevent unnecessary repeated ETCS interventions when automatic set speed control is implemented with the ETCS. This design requirement was necessary to gain the benefits when using automatic speed control, as unwarranted interventions would negate the potential operational benefits that could be achieved. This requirement minimised the number of challenges to the safety related automatic set speed control and was therefore judged to have potential safety benefits.

To achieve consistency a new requirement was included for the input or configuration of a set speed to be in the same units of measurement as that to be displayed on the speedometer. The intention of this requirement was to minimise the potential for confusion and errors associated with unit conversion that could prejudice safety-critical functions and therefore it had safety benefits.

2.2 New requirements - post-consultation

Three new requirements identified in Appendix B as items 1 to 3 were included in draft v of issue two of RIS-0340-CCS as a result of consultation comments.

A new requirement was included (see Appendix B item 1) to facilitate the introduction of ETCS and driver training on those routes where conventional signals are provided. The requirement provided the capability for drivers to inhibit the use of those ETCS levels for which they do not have the appropriate competencies. This functionality facilitated migration and provided a safety benefit.

The second new requirement (see Appendix B item 2) was included to mitigate the risk associated with a train moving while the ETCS onboard equipment is in isolation mode (IS) and the movement is not detected by the cold movement detector, which may also be isolated. To address this risk it was required that cold movement detection is not used to validate a train’s position when the ETCS onboard equipment is de-isolated. This restriction had the safety benefit of eliminating a means of introducing erroneous data into the ETCS system.

The third new requirement was included to permit the fixed train data to be changed by an authorised person (see Appendix B item 3). This change, which allowed the maintainer to be able to re-configure the fixed train data, had the benefit that it avoided the need for reprogramming by the original equipment manufacturer. Vehicles are cascaded and operations can change, and it was considered that it would be advantageous if the presets could be amended to reflect their new operations, without needing the manufacturer to amend them.



2.3 Revised requirements

The requirement that the active ETCS onboard equipment shall not enter the no power (NP) mode in the event of the engine auxiliary or external vehicle power being lost for periods relevant to the anticipated duty of the vehicle throughout its life, was replaced by a requirement for cold movement detection to determine that the traction unit had not moved following entry into NP mode, together with a requirement that the cold movement detection shall function for at least 72 hours following entry to NP mode. The changed requirement provided an operational benefit on loss of power, as without cold movement detection the train location information would need to be input, in staff responsible mode, under operational procedures on repowering. Automatic recovery of the location information had a potential safety benefit in that it reduced the opportunity for data entry corruption of the information during input.

The requirement for the cold movement detection to remain active for 72 hours following entry into NP operation was based on the longest duty cycle that trains in service are reasonably expected to be in NP mode.

This requirement for the cold movement detection to remain active for 72 hours following entry into NP mode was removed in draft v of issue two of RIS-0340-CCS (see Appendix C item 2). A minimum of 72 hours is mandated in SUBSET-026, although a longer time period could be a contractual requirement. The 72 hours was derived by considering the minimum time that a passenger multiple unit might be in NP over a bank holiday weekend; however, a longer period could be specified where there is a cost benefit. This change had potential cost benefits.

The requirement that the ETCS onboard equipment shall confirm train integrity using any existing appropriate circuits in the train design was relaxed to use suitable existing circuits where there is a need to provide train integrity information about the ETCS onboard equipment. The relaxation of the requirement was considered to be safety neutral but provided cost saving benefits, as train integrity information on ETCS equipment is only required where it is determined to be necessary.

With the introduction of the Baseline 3 set of specifications, the terminology was revised in the context of the technical level of ERTMS employed when using national train control (NTC) ‘Class B’ systems, including AWS/TPWS; in particular, with the removal of Baseline 2 related requirements from the RIS, the reference to level Specific Transmission Module (STM) in relation to AWS/TPWS operational functions was replaced by Level NTC, which is the terminology used in Baseline 3. This change was safety neutral and did not affect the functionality of the system.

The requirement stipulating that the use of a maintainer key for de-isolation of ETCS equipment shall not necessitate the use of a laptop computer or similar was relaxed to only require the operation of the maintainer key to be simple and efficient. This change had the benefit that it removed an unnecessary restriction and provided for cost-effective solutions. This requirement was judged to be safety neutral as it would not impose any restrictions on achieving the safe de-isolation of any ETCS equipment.

The means of resetting the ETCS was changed from using a circuit breaker or other switch to isolate the ETCS onboard equipment to include a dedicated reset function, unless a design analysis demonstrated that it was not cost effective from operational performance or reliability considerations. The operation of the reset function was intended to cause a transition into NP mode, which would remove the reset instruction, before initiating the normal ETCS power up procedure. In addition, it was required that the ETCS reset facility is located within each driving cab outside the reach zone of the train driver when in the normal seated position, and positioned such that it is protected against accidental use. The isolation and de-isolation of the ETCS onboard equipment was also required to be recorded where the onboard driving data recording equipment is powered by a separate supply to that provided for the ETCS onboard equipment, or



possesses its own power storage capability equipment. This functionality enabled, where the power capability is provided, details on the operation of the reset to be recorded. This was not essential but it provided a means of monitoring the usage of the reset function. Following consultation, the requirement for isolation and de-isolation of the ETCS onboard equipment to be recorded (see Appendix A item 26) was changed in draft v of issue two of RIS-0340-CCS to refer to recording the operation of the ETCS reset function. This change was considered to be safety neutral and non-material, only addressing monitoring capabilities.

Clarification to the requirement for the adjustment of the DMI luminance and loudspeaker volume was included to require the hardkeys to be separate to the DMI. This change had the benefit that it provided clarification and removed potential ambiguity regarding the use of hardkeys. The requirement did not change the type of functionality provided and was therefore considered to be safety neutral. The wording of this requirement was changed in draft v of issue two of RIS-0340-CCS as a result of a consultation comment (see Appendix C item 4). The requirement was relaxed so that adjustment of the brightness / volume was achievable without navigating a menu. This change provided flexibility to use buttons or other means, if preferred, and provided a benefit by permitting the most appropriate method to be used.

The requirement relating to the frequency that the DMI data is refreshed from the European Vital Computer (EVC) was changed to read: ‘There shall be no apparent latency between the driver’s interactions with the DMI and the response of the ETCS onboard equipment’. This requirement was changed to address all interactions with the DMI and was based upon good human factors design for the DMI. This requirement was judged to have safety benefits by providing the driver with timely information, which reduced uncertainty and workload in knowing whether a command was being actively executed.

The requirement relating to the DMI size and location, which was originally specified in terms of the fifth percentile female to the 95th percentile male GB populations was changed to specify that the DMI display shall be positioned within 758 mm of the driver’s seat back. This change would achieve the same as the original requirement, as the 95th percentile male size requirement would not be the limiting factor in the positioning of the DMI. This change was considered to simplify the requirement but not have any effect on the positioning of the DMI display and was therefore considered to be safety neutral.

The requirement for the hierarchal order of preference for DMI data entry was changed to include a preconfigured data entry option that involved the use of a device preconfigured with verified train data that automatically entered the train data for validation by the driver. This additional option provided flexibility in data entry and had the advantage of reducing the potential for incorrect data entry. In addition, flexible train data entry that enables data to be entered manually was included to replace the requirement that permitted the data entry combination that enabled the driver to be able to select pre-defined options, where available, and enter other data manually. This combined data entry capability was changed, as it is not permitted by the European Railway Agency (ERA) DMI specification ERA_ERTMS_015560 version 3.3.0. The amended requirement for flexible train data entry capability to always be available to the driver was changed in draft v of issue two of RIS-0340-CCS as a result of a consultation comment (see Appendix C item 5). The requirement was changed to provide the capability for flexible train data entry to be configurable by the maintainer. Flexible data entry allows the driver to enter the train data, which can provide an operational benefit especially when there is not a suitable train type pre-configured option available.

The ETCS data set menu structure used on the DMI display was changed so that, where there are more than nine data sets, the ninth data set on the first menu level



shall be ‘Next’, and selection of this shall present the next menu level. This arrangement was specified to repeat for the ninth data set, as necessary, subject to the constraint of there being no more than five menu levels. The benefit of this change was to provide a consistent menu structure, which helps users gain familiarity with the interface. It was therefore considered that this change had the potential to provide a safety benefit by reducing driver workload when using a consistent menu structure.

2.4 Revised requirements - post-consultation

The requirement in issue one of RIS-0340-CCS for part numbers, serial numbers, modification versions and firmware status of all line-replaceable components to be clearly marked with a robust label was amended in draft v of issue two of RIS-0340-CCS (see Appendix B item 4) to clarify that the labelling was to be in a position that could easily be read with the unit installed in its normal working position. In addition, the reference to firmware status was removed from the requirement because it was unnecessary as it would be part of the version modification.

The change, to have the information in an easily readable location, was considered to have the benefit that it would facilitate maintenance and potentially reduce cost by saving time and effort in identifying replacement units.

The requirement for the service brake intervention to be applied by the supervising ETCS onboard equipment (see Appendix B item 5) was changed, as experience on the Cambrian Line had demonstrated that non-application of the service brake by the supervising ETCS onboard equipment facilitates an improvement in driveability. The implementation of the service brake interface is a Technical Specification for Interoperability (TSI) option and is not a mandated safety requirement. The change to specifying that interface to the service brake is provided, permitted configuration of the trackside infrastructure to determine the circumstances under which the service brake is applied. It was anticipated that the ETCS trackside equipment would be configured to command the ETCS onboard equipment to use the service brake for ceiling speed supervision, but not target speed supervision as this was considered to provide operational benefits.

The requirement for an ASD, independent of the EVC, which displays speed in miles per hour (mph) and kilometres per hour (km/h), to be provided when ETCS is isolated (see Appendix B item 6) was relaxed to permit its use. It was considered to be unnecessarily prescriptive to mandate the use of an ASD. An ASD was intended to mitigate the risk associated with non-availability of the speedometer when the ETCS DMI is unavailable; however, as individual railway undertakings are responsible for managing this risk, the use of an ASD was identified as a permitted solution. The supporting guidance identifies that it would be preferable to present single units in mph or km/h, as appropriate to the route.

The requirement that mandated the provision of a flat space on the desk to allow drivers to write down and read information on written orders comfortably and without moving from the driving position (see Appendix B item 7) was clarified to only apply to new designs of driver’s desks. This change was made as it was considered unnecessarily prescriptive for existing rolling stock, some of which may not be able to be economically retrofitted to meet the original requirement. The changed requirement was considered to provide a cost benefit.

As referred to in section 2.2 the requirement introduced in draft m of issue two of RIS-0340-CCS for a common channel to be shared by devices, when more than one device is used for data recording, so that the recorded data can be correlated across devices, was amended in draft v of issue two of RIS-0340-CCS to address a consultation comment. The requirement was amended with the inclusion of the text: ‘failure of one device shall not compromise continued operation of another’ (see Appendix C item 1). This change was required because it is important for reliability.



As referred to in section 2.2 above, the requirement in draft m of issue two of RIS-0340-CCS for the cold movement detection to remain active for 72 hours following entry into NP mode was removed (see Appendix C item 2). A minimum of 72 hours is mandated in SUBSET-026, although a longer time period could be a contractual requirement. The 72 hours was derived by considering the minimum time that a passenger multiple unit might be in NP over a bank holiday weekend; however, a longer period could be specified where there is a cost benefit. This change had potential cost benefits.

The requirement regarding when AWS/TPWS shall be suppressed and unsuppressed (see Appendix C item 3) was amended in response to a consultation comment for AWS/TPWS to be suppressed when operating in ETCS level 0 to be consistent with SUBSET-026. Also, the requirement was clarified by referring to the operation in the unsuppressed National Train Control mode (NTC) with AWS/TPWS operational, as the ‘NTC (AWS/TPWS)’ mode. The ‘NTC (AWS/TPWS)’ mode descriptor was used to avoid any potential ambiguity as there are several different levels of operating in NTC mode. These changes aligned the requirement with TSI requirements.

The requirement introduced in draft m of issue two of RIS-0340-CCS for hardkey controls, separate to the DMI, to be provided for luminance adjustment and loudspeaker volume control, referred to in section 2.2 above, was changed in draft v of issue two of RIS-0340-CCS as a result of a consultation comment (see Appendix C item 4). The requirement was relaxed, so that adjustment of the brightness / volume was to be achievable without having to navigate a menu. This change provided the flexibility to use buttons or other means, if preferred, and therefore was considered to provide potential cost benefits.

2.5 Withdrawn requirements

The requirement to provide a separate AWS acknowledgement button when integrating the AWS and TPWS with ETCS was withdrawn as a duplicated requirement. This requirement is a National Technical Rule and has been included in GE/RT8075 issue one ‘AWS and TPWS Interface Requirements’, which was published in September 2013.

The requirement that the driver shall always be able to override any train type or pre-defined option offered by the system for verification by entering the data manually was withdrawn as it is not permitted by the latest version of the ERA DMI specification ERA_ERTMS_015560 version 3.3.0, included in the ETCS Baseline 3 set.

The requirement that the ETCS onboard equipment design shall include the ‘unclassified’ change requests defined in SUBSET-108, that have a beneficial effect on system reliability or mission time, was withdrawn because the content of SUBSET-108 is required through the Baseline 3 set of requirements.

Requirements that address achieving non-specified levels of risk by implicit or explicit reference to the As Low as Reasonably Practicable (ALARP) principle during the design and maintenance of the ETCS system have been withdrawn. This is because they were unnecessary, as the common safety method for risk evaluation and assessment is applied to significant changes to the ETCS design, which are likely to include the initial fitment and retro-fitment of trains as well as operational changes. In particular, the requirement stating that ‘the risk of the ETCS onboard equipment train interface causing a hazard to the railway shall be demonstrated to be ALARP and tolerable using the principle of EN 50126’ was withdrawn. Also the requirement that ‘the safety consequences of incorrect maintenance or component fitment shall be limited through the design to current levels of risk’ was withdrawn as it was considered inappropriate and in conflict with the philosophy of risk reduction. It was also judged unnecessary to have a requirement effectively stating that maintenance shall not compromise safety.



The requirement that the DMI shall display speed in mph when running in level 0 or level Specific Transmission Module (STM) on infrastructure was withdrawn from the RIS as it is addressed in clause 2.2.1 of GE/RT8402 issue one. Similarly, the requirement stipulating that when changing between mph and km/h speed scales, the position and angle of the speedometer pointer shall not change was withdrawn as it is also addressed by the detail design in GE/RT8402 issue one. The requirement that the DMI shall indicate the units the speed is displayed in, using a label ‘mph’ or ‘km/h’ is addressed in clause 2.3.10 of GE/RT8402 issue one and was withdrawn from the RIS.

The requirement for ceiling speed monitoring (CSM) transition over-speed status was withdrawn, as it is addressed in the DMI specification ERA_ERTMS_015560 which is a part of the Baseline 3 set of requirements.

The requirement for the DMI display to have a contrast requirement of 6:1 was withdrawn, as it was considered to be unnecessarily prescriptive and may not have provided the optimum visual clarity that could be achieved, taking into account the installed position of the display in the cab. This had the benefit that the designer is able to identify the optimum contrast ratio, taking into account the cab design, and was therefore judged to be safety neutral.

The requirement permitting the suppression of existing non-ETCS cab alarms, where the tone and frequency conflict with standard ETCS DMI alarms, was withdrawn. The suppression of alarms was removed because alarms are used to provide warnings where safety related issues are involved and it was considered inappropriate to suppress them when alternatives such as changing their tone and frequency are possible. This change had the safety benefit that those alarms which provide warning of conditions that need a controlled response would be retained.

2.6 Withdrawn requirements post-consultation

Four requirements were withdrawn in their entirety because they were either considered to be unnecessary or addressed elsewhere.

The requirement for User Identification numbers to remain consistent with numbers already used for On Train Data Recorders (OTDRs) or other cab equipment was withdrawn (see Appendix B item 8) to address a consultation comment, as it was outside the scope of the RIS because it was not a requirement for the onboard equipment.

The requirement for the ETCS onboard equipment to display an easily verifiable indication that the system is configured correctly was withdrawn (see Appendix B item 9) as it was identified that it duplicated the ERA DMI specification ERA_ERTMS_015560 version 3.3 which sets out the requirements for the display of system status and health.

As referred to in section 2.2.1 above, the proposed requirement introduced in draft m of issue two of RIS-0340-CCS (see Appendix A item 7) for the ETCS onboard equipment to enable sleeping (SL) mode to be selected manually, where the facility is not provided for the sleeping signal to be received automatically through coupling connections, was withdrawn. This requirement introduced to facilitate the hauling of a traction unit fitted with ERTMS was withdrawn (see Appendix C item 6) as a result of a consultation comment which identified it to be unnecessary, because its intent was achieved through ETCS Passive Shunting (PS) mode which is fully defined in SUBSET-026.

The requirement for the OTDR/Juridical Recording Unit (JRU) to record the isolation status of ETCS onboard equipment was withdrawn (see Appendix B item 10) as it was identified that this is set out in SUBSET-027, the Functional Interface Specification (FIS) for Juridical Recording.



3 Impacts

The requirements within a RIS do not need to be adhered to until they are adopted and specified in a company’s procedures or contract conditions. Where this is the case the nature and extent of their application is also required to be specified. Consequently, the impact of the new and revised requirements is dependent on the extent to which they are adopted and applied. The RIS was produced at the request of the industry to provide a consistent approach and solution to design aspects of the ETCS system, in order to avoid a proliferation of design differences within GB where the design / operational detail is not mandated through RGSs or other legislation. It was considered for this reason that all requirements relevant to the railway undertakings’ current and projected operations would have been adopted.

The core functional and safety requirements of the ERTMS system are mandated through a suite of specifications, including the Safety Requirements Specification (SRS) and the FIS Specifications. The requirements in the RIS improved operational performance and provided for consistent controls that support the core ETCS functional and safety requirements, while providing for the highest available level of supervision to be achieved. The requirements were intended to provide consistency in the procurement of ETCS onboard equipment, with the aim of preventing a proliferation of designs within GB with the attendant implications of higher costs and incompatibilities that could arise. The requirements in RIS-0340-CCS issue one were originally reviewed by industry ERTMS technical specialists and the Engineering Operational Safety Review Group before being submitted for industry-wide consultation on their adequacy. Following industry consultation the RIS was published in September 2010. The material comments received on the requirements since they were issued in September 2010, together with those received from consultation on draft m of RIS-0340-CCS issue two, were addressed in this impact assessment and they were judged to be safety neutral or provide a safety benefit.

The revisions to the RIS were included to enhance its usefulness and support the cost-effective application of the ETCS on trains through more effective controls and improved guidance. It was considered that the changes to the requirements would not adversely affect the ETCS risk profile and would provide benefits by reducing costs and / or system complexity and were in the long-term best interests of the rail industry.

The RIS was withdrawn on publication because the ERTMS Programme’s ETCS onboard specifications document (NEPT/ERTMS/REQ/007) provides this information to industry under different change control arrangements pending efficacy of the set of requirements.

4 Relevant strategies and compliance with decision framework

The RIS was consistent with the Strategic Direction for the Control Command and Signalling (CCS) TSI and met the relevant criteria in the Standards Manual.

The requirements in the RIS were provided for adoption by members of RSSB. The RSSB member may adopt any or all of the requirements through company procedures or contract conditions. Where this is the case the member of RSSB will specify the nature and extent of application.

The requirements do not fulfil the criteria to be either a National Technical Rule (NTR) or a National Safety Rule (NSR) and therefore cannot be mandated in a Railway Group Standard.



5 Conclusions

It was considered that the impact of the changes to the requirements in the RIS would not adversely affect the ETCS risk profile. The changes were judged to be of benefit to the industry by maintaining the currency of RIS-0340-CCS and developing its content in line with industry objectives for the design of the onboard ETCS and were therefore in the long-term best interests of the rail industry.

When the requirements in NEPT/ERTMS/REQ/007 are sufficiently proven, a new or revised RSSB document will be proposed.



APPENDIX A Summary of material changes to the requirements in RIS-0340-CCS Issue 1 September 2010

SUMMARY OF MATERIAL CHANGES TO REQUIREMENTS IN RIS-0340-CCS ISSUE 1 SEPTEMBER 2010

ITEM

NO

REQUIREMENT IN ISSUE 1 CHANGED REQUIREMENT IN ISSUE 2

COMMENT CLAUSE

NO REQUIREMENT

CLAUSE

NO REQUIREMENT

New Requirements

1 N/A 2.11.14 It is permissible to integrate AWS/TPWS ETCS DMI.

This provides for flexibility with the driver interface.

2 N/A 2.11.15 The design of an integrated display shall incorporate:

a) Separate and clearly identifiable indications (visual and audible) for brake demands initiated by train stop activations, overspeed activations or late acknowledgement of the AWS caution warning.

b) A brake release procedure that provides protection against inadvertent operation by drivers.

Indicates to the driver the reason for the brake application. Text amended to address consultation comment with a non-material change to replace ‘display’ with ’DMI’ to read: ‘The design of an integrated DMI shall incorporate:…’

3 N/A 2.13.5 Isolation of ETCS onboard equipment shall remove any suppression of onboard Class B safety systems.

Provides for automatic swtich to class B safety system

4 N/A 2.16.1 Where the facility is not provided for the sleeping signal to be received automatically through coupling connections, the ETCS onboard equipment shall provide for SL to be selected manually to facilitate the hauling of a traction unit fitted with ERTMS.

This requirement proposed for inclusion in RIS-0340-CCS issue two has not been retained following consultation see Appendix C item 6

5 N/A 2.19.7 The ETCS onboard equipment shall be tolerant of circumstances that cause a cab to be open for a short duration (for example, when coupling or uncoupling) and the cab is closed before the ETCS onboard equipment has completed any self-test routine.

Eliminates self-test interruption unnecessarily initiating a failure condition when the equipment is working normally.

6 N/A 2.20.2 Diagnostic information shall be recorded with a time stamp with sufficient resolution to identify all events accurately and enable them to be correlated with data captured on other recording devices.

Reduces post-processing of event data

7 N/A 4.4.2 Where more than one device is used for data recording a common channel shall be shared by devices so that the recorded data can be correlated across devices.

Reduces post-processing of event data. Requirement amended to address consultation comment with inclusion of the text: ‘Failure of one device shall not compromise continued operation of another’ See Appendix C item 1

8 N/A 2.20.3 Safety critical faults shall be recorded onboard.

Reduces potential for data corruption

9 N/A 2.20.4 The functionality to remotely interrogate ETCS diagnostic information stored onboard shall be provided. This capability shall be available whilst the rain is moving as well as when stationary.

Potential safety and cost benefits in early identification of abnormal condition

10 N/A 2.20.9 For faults that require immediate driver attention the information shall be presented in an unambiguous, operationally meaningful manner and shall persist until acknowledged.

Reduces the potential for the driver to miss important information.

11 N/A 3.1.2 The ETCS onboard equipment shall be fully integrated into the train systems so as to minimise the complexity and quantity of components in the interfaces between them.

This requirement originated from industry experience with the fitting of complex systems onto rail




ITEM

NO


COMMENT CLAUSE

NO REQUIREMENT

CLAUSE

NO REQUIREMENT

vehicle.

12 N/A 4.2.2 ETCS equipment shall be protected by correctly rated resettable protective devices. Where an adequate protective device already exists on the vehicle, the equipment shall be connected directly to this device so as to avoid multiple serial circuit protection.

These requirements are included to reduce complexity and cost while maintaining appropriate protection.

13 N/A 4.2.3 Installation of ETCS equipment shall not compromise the hierarchy of protection of the vehicle’s circuits.

Maintains system integrity.

14 N/A 4.4.1 Any devices interfaced to ETCS onboard equipment shall maintain ETCS fault reporting and feedback.

Failures of the ETCS are not to be masked by other interfaced systems.

15 N/A 5.3.13 The set speed point shall be displayed in area B2 of the DMI in the form specified in Figure 2.

Provide a common DMI

16 N/A 5.3.14 The automatic set speed control shall be disengaged following an ETCS intervention.

Prevention of unnecessary ETCS interventions

17 N/A 5.3.15 Any input or configuration of set speed shall be in the same units of measurement as displayed on the speedometer.

Consistent use of units to minimise potential for conversion errors and confusion.

Changed Requirements

18 2.3.2 The active ETCS onboard equipment shall not enter NP mode in the event of the engine auxiliary or external vehicle power being lost for periods appropriate to the anticipated duty for the vehicles throughout their life

2.3.2 Cold movement detection shall be provided to determine that the traction unit has not moved following entry into NP mode.

Provides a control on the accuracy of the train location information. Requirement amended to address consultation comment by deletion of the need for cold protection to’ function continuously for at least 72 hours’ See Appendix C item 2

2.3.3 Cold movement protection shall function continuously for at least 72 hours following entry into NP mode.

19 2.12.1 The ETCS onboard equipment shall confirm train integrity using any existing appropriate circuits in the train design.

2.10.1 Where there is a need to provide train integrity information for the ETCS onboard equipment then suitable existing circuits shall be used.

Minimises system complexity. Text amended to address consultation comment with a non-material change to clarify that if a suitable circuit exists it shall be used. The amended text reads ‘if suitable existing circuits exist, these shall be used.’

20 2.13.2 b) Unsuppressed when the ETCS onboard equipment is operating in either:

i) Level 0 or Level STM. or

ii) Unfitted (UN), IS and NP modes

2.11.3 b) Unsuppressed when the ETCS onboard equipment is operating in either:

i) Level 0 or Level NTC or ii) Unfitted (UN), IS and NP modes

Level STM only applies to Baseline 2 which is not addressed in this RIS Requirement amended to address consultation comment regarding when AWS/TPWS shall be suppressed and unsuppressed. See Appendix C item 3

21 2.15.2 (The operation of the maintainer key used for de-isolation) …shall not require use of a laptop computer or similar.

2.13.3 The operation of the maintainer key used for de-isolation shall be simple and efficient.

Relaxes and clarifies the intent of original requirement.




ITEM

NO


COMMENT CLAUSE

NO REQUIREMENT

CLAUSE

NO REQUIREMENT

22 2.15.3 The driver shall have access to a circuit breaker or other switch to electrically isolate the ETCS onboard equipment

2.14.1 An ETCS reset function shall be included unless a design analysis assessment demonstrates that it is not cost effective from operational or reliability considerations.

Efficient means of restarting ETCS without affecting other onboard systems.

23 2.14.2 Where an ETCS reset facility is provided it shall operate by causing a transition to NP mode.

Design detail for restart function Text amended to address consultation comment with a non-material change to replace ‘reset facility ’ with ’reset function’

24 2.14.3 On entering NP mode following activation of the reset function:

a) the reset shall no longer be effective and

b) the ETCS onboard equipment shall commence its power up procedure as normal.

25 2.14.4 The ETCS reset facility shall be: a) protected against accidental use

and b) located within each driving cab

and c) outside the reach zone of the train

driver’s normal seated position.

Reduces the potential for inadvertent operation of the reset function Text amended to address consultation comment with a non-material change to replace ‘reset facility ’ with ’reset function’

26 2.14.5 Where onboard driving data recording equipment is powered by a separate supply to that provided for the ETCS onboard equipment or possesses its own power storage capability, it shall record isolation and de-isolation of the ETCS onboard equipment.

Enables identification of reasons for the isolation demand. Text amended to address consultation comment with a non-material change to refer to ’reset function’. The final clause reworded to read: ‘it shall record operation of the ETCS reset function.’

27 5.1.6 Up and down volume and brightness adjustment shall use separate distinct hardkeys on the DMI.

5.2.11 Hardkey controls separate to the DMI shall be provided for luminance adjustment and loudspeaker volume control.

Requirement amended to address consultation comment by relaxing requirement for the use of hard keys. See Appendix C item 4

28 5.1.7 The DMI screen shall be refreshed from EVC data at a frequency sufficient for there to be no apparent latency between the driver’s actions and the response of the ETCS onboard equipment or vice versa.

5.2.5 There shall be no apparent latency between the driver’s interactions with the DMI and the response of the ETCS onboard equipment.

Good human factors design for DMI.

29 5.3.2 The DMI size and location shall be suitable for operation by the 5th percentile female to 95th percentile male sizes of the GB population.

5.2.8 The DMI shall be within 758 mm of the driver’s seat back.

The 95th percentile male size requirement has been removed as it is not a limiting factor in the positioning of the DMI.

30 2.5.1 The following for data entry preference shall apply

5.3.3 The following hierarchal order of preference for data entry shall apply:

b) Preconfigured data entry Where the driver uses a device preconfigured with verified train data to automatically enter the train data which is then offered by the system for validation by the driver.

Addition of a preferred option ‘b)’ which involves data being held within a preconfigured device.




ITEM

NO


COMMENT CLAUSE

NO REQUIREMENT

CLAUSE

NO REQUIREMENT

31 2.5.1 c) Least preferred – Driver selecting pre-defined options for the configuration, where available, and entering other data manually.

5.3.3 d) Flexible train data – where the driver enters the data manually

Original requirement is not permitted by the ERA DMI specification ERA_ERTMS_015560 version 3.3.0. Revised requirement enables data to be entered when there is not a suitable pre-configured option available.

32 5.3.5 Flexible train data entry shall always be available to the driver

Flexible train data entry is an option in ERA_ERTMS_015560 and has been included as a requirement to enable data to be entered when there is not a suitable pre-configured option available.

33 2.5.2 The risk of the driver selecting a Train Type or an option which compromises the safe operation of the train shall be managed in the onboard design to an ALARP level and be at least tolerable.

5.3.4 The design of the data entry arrangements shall minimise the likelihood of the driver selecting a train type or a parameter value which compromises the safe operation of the train.

Reference to ALARP principle removed as the Common Safety Method for risk evaluation and assessment applies to ETCS in accordance with Principal 8 of the ERTMS Industry Safety Strategy v1 22/03/12

34 5.8.2 The DMI shall support train type data sets on up to five menu levels, with no more than 10 data sets per menu level.

5.3.9 If there are more than nine data sets the ninth data set on the first menu level shall be ‘Next’, and selection of this shall present the next menu level. This arrangement shall repeat for the ninth data set, as necessary, subject to the constraint set out in 5.3.7.

Menu structure clarification/development

Withdrawn Requirements

35 2.1.2 The ETCS onboard equipment design shall include ‘unclassified’ Change Requests defined in SUBSET-108 that have a beneficial effect on system reliability or mission time.

Withdrawn The requirement has been withdrawn as SUBSET-108 is required through the Baseline 3 set of requirements.

36 2.5.3 The driver shall always be able to override any Train Type or pre-defined option offered by the system for verification by entering the data manually

Withdrawn This requirement is not permitted by the ERA DMI specification ERA_ERTMS_015560 version 3.3.0

37 3.10.2 The safety consequences of incorrect maintenance or component fitment shall be limited through the design to current levels of risk.

Withdrawn Does not allow for risk reduction improvements.

38 4.1.2 The risk of the ETCS onboard equipment train interface causing a hazard to the railway shall be demonstrated to be ALARP and tolerable using the principles of EN50126.

Withdrawn Common Safety Method for risk evaluation and assessment applies to ETCS in accordance with Principal 8 of the ERTMS Industry Safety Strategy v1 22/03/12

39 5.1.10 The DMI shall display speed in mph when running in level 0 or level STM on infrastructure signed in mph.

Withdrawn Duplicates clause 2.2.1 of GE/RT8402 issue 1 ERTMS/ETCS DMI National Requirements




ITEM

NO


COMMENT CLAUSE

NO REQUIREMENT

CLAUSE

NO REQUIREMENT

40 5.1.11 When changing between mph and km/h speed scales, the position and angle of the speedometer pointer shall not change.

Withdrawn Addressed by the detail design in GE/RT8402 issue 1 ERTMS/ETCS DMI National Requirements

41 5.1.12 The DMI shall indicate the units the speed is displayed in, using a label ‘mph’ or ‘km/h’.

Withdrawn Addressed in Clause 2.3.10 of GE/RT8402 and by ERA-ERTMS-015560

42 5.1.13 During ceiling speed monitoring (CSM), transition between the following states shall coincide:

State Speed

displayed

to the

driver

Over-

speed

Status

(OvS)

a Permitted speed or below

not activated

b above permitted Speed

activated

Table 3 Ceiling speed monitoring transition over-speed status

Withdrawn Ceiling speed monitoring is addressed in the DMI specification ERA-ERTMS-015560

43 5.2.1 The DMI installation shall meet the requirements for legibility in the cab environment described in EN894 Part 2, 4.1.3 and 4.1.4 with a contrast requirement of 6:1

5.2.3 The DMI installation shall meet the requirements for legibility in the cab environment set out in EN 894-2:1997, 4.1.3 and 4.1.4.

The sentence containing the contrast requirement of 6:1 has been withdrawn as it is considered to be unnecessarily prescriptive

44 5.6.2 Where existing non-ETCS cab alarms conflict with standard DMI alarms, the existing alarms shall be changed or, where appropriate, suppressed.

5.2.13 Where the tone and frequency of existing non-ETCS alarms conflict with standard DMI alarms, the existing non-ETCS alarm tone and frequency shall be changed.

The permitted suppression of alarms has been withdrawn because alarms are used where safety is an issue.



Appendix B Summary of post-consultation material changes to the requirements in RIS-0340-CCS Issue 1


ITEM

NO

REQUIREMENT IN ISSUE 1 CHANGED REQUIREMENT IN ISSUE 2 DRAFT V

COMMENT CLAUSE

NO REQUIREMENT

CLAUSE

NO REQUIREMENT

New Requirements

1 N/A 2.2.2 Where it is necessary to support migration, there shall be the capability for the driver to inhibit use of ETCS levels for which the driver is not yet competent to use.

This requirement facilitates introduction of ETCS and driver training for operation on routes where conventional signals are provided.

2 N/A 2.3.4 If the ETCS Onboard Equipment enters isolation mode (IS) cold movement detection shall not be used to validate a train’s position when the ETCS Onboard Equipment is de-isolated.

This requirement addresses the risk that whilst in IS mode a train moves and this movement is not detected by the cold movement detector, which may also be isolated.

3 N/A 2.4.4 It shall be possible for an authorised person to be able to change the fixed train data.

Avoids the need for reprogramming by the original equipment manufacturer.

Changed requirements

4 2.6.2 The part number, serial number, modification version and firmware status of all line-replaceable components shall be clearly marked with a robust label.

2.4.1 The part number, serial number and modification version of all line-replaceable components shall be robustly labelled and in a position that can be easily read with the unit installed in its normal working position.

Additional requirement for visibility is good human factors design.

5 2.7.1 The service brake intervention shall be applied by the supervising ETCS onboard equipment.

2.5.1 The ETCS onboard equipment shall be interfaced to the service brake.

Interfacing the service brake provides for effective speed supervision during ceiling speed monitoring, the use of the service brake for target speed monitoring is likely to be inhibited by the trackside to permit an improvement in driveability, demonstrated by experience on the Cambrian Line. Implementation of the service brake interface is not relevant to safety.

6 2.8.1 An additional speed display (ASD), independent of the EVC, displaying speed in miles per hour (mph) and kilometres per hour (km/h), shall be provided, which operates only when ETCS is isolated.

2.6.1 It is permissible to provide an additional speed display (ASD), independent of the EVC, displaying speed in miles per hour (mph) and kilometres per hour (km/h), which operates only when ETCS is isolated.

This has been revised as it is unnecessarily prescriptive, especially as the associated guidance relates to non-provision of the display.

7 5.3.5 There shall be flat space on the desk to allow drivers to write down and read information on written orders comfortably. The driver shall be able to use this area without moving from the driving position.

5.2.10 For new designs of driver’s desks, there shall be flat space on the desk to allow drivers to write down and read information on written orders comfortably. The driver shall be able to use this area without moving from the driving position.

This requirement has been revised as it is unnecessarily prescriptive for existing rolling stock, some of which would have difficulty in complying.




ITEM

NO

REQUIREMENT IN ISSUE 1 CHANGED REQUIREMENT IN ISSUE 2 DRAFT V

COMMENT CLAUSE

NO REQUIREMENT

CLAUSE

NO REQUIREMENT


8 2.4.1 User Identification numbers shall remain consistent with numbers already used for OTDRs or other cab equipment.

Withdrawn Technical requirements for ETCS equipment are set out in SUBSET-026. Allocation of user identification numbers is outside the scope of this standard.

9 2.5.1 The ETCS onboard equipment shall display an easily verifiable indication that the system is configured correctly.

Withdrawn The requirements associated the display of system status and health are set out in the ERA DMI specification ERA_ERTMS_015560 version 3.3.0.

10 2.15.6 Where the OTDR/JRU is powered by a separate supply to the ETCS onboard equipment, or possesses its own power storage capability, it shall record isolation and de-isolation of the ETCS onboard equipment.

Withdrawn The requirement to record isolation is set out in SUBSET-027.

Appendix C Summary of post-consultation material changes to the requirements in RIS-0340-CCS Issue two draft m

SUMMARY OF MATERIAL CHANGES TO REQUIREMENTS IN RIS-0340-CCS ISSUE TWO DRAFT M SEPTEMBER 2010

ITEM

NO

REQUIREMENT IN ISSUE 2 DRAFT M CHANGED REQUIREMENT IN ISSUE 2 DRAFT V

COMMENT CLAUSE

NO REQUIREMENT

CLAUSE

NO REQUIREMENT

Revised Proposed Requirements

1 4.2.4 Where more than one device is used for data recording a common channel shall be shared by devices so that the recorded data can be correlated across devices.

4.4.2 Where more than one device is used for data recording a common channel shall be shared by devices so that the recorded data can be correlated across devices. Failure of one device shall not compromise continued operation of another.

Reduces post-processing of event data. See Appendix A Item 7.

2 2.3.3 Cold movement protection shall function continuously for at least 72 hours following entry into NP mode.

2.3.3 Cold movement protection shall function following entry into NP mode.

Requirement amended to address consultation comment by deletion of the need to’ function continuously for at least 72 hours’. See Appendix A Item18.

3 2.12.3 AWS/TPWS operational functions shall be:

a) Suppressed when the ETCS onboard equipment is operating in Levels 1, 2 or 3. And

b) Unsuppressed when the ETCS onboard equipment is operating in either: i) Level 0 or Level NTC

or ii) Unfitted (UN), IS and NP

modes

2.11.3 AWS/TPWS operational functions shall be:

a) Suppressed when the ETCS onboard equipment is operating in Levels 0, 1, 2 or 3.

And

b) Unsuppressed when the ETCS onboard equipment is operating in either: i) Level NTC AWS/TPWS

or ii) National system (NS), IS and NP

modes

Level 0 is defined as where there is no train protection system Requirement amended to address consultation comment see Item 20 Appendix A. When AWS/TPWS is interfaced through an STM, SUBSET-035 requires AWS/TPWS to be suppressed in Level 0. The requirement extends the suppression of AWS/TPWS in Level 0 when an STM is not



SUMMARY OF MATERIAL CHANGES TO REQUIREMENTS IN RIS-0340-CCS ISSUE TWO DRAFT M SEPTEMBER 2010

ITEM

NO

REQUIREMENT IN ISSUE 2 DRAFT M CHANGED REQUIREMENT IN ISSUE 2 DRAFT V

COMMENT CLAUSE

NO REQUIREMENT

CLAUSE

NO REQUIREMENT

used, for consistency. This is consistent with the definition of a Level 0 area, as set out in SUSBET-026, that is an area not equipped with ERTMS/ETCS trackside equipment or with a national train control system See Appendix A item 20

4 5.2.11 Hardkey controls separate to the DMI shall be provided for luminance adjustment and loudspeaker volume control.

5.2.11 DMI luminance adjustment and loudspeaker volume control shall be possible without navigating a menu on the DMI.

Requirement amended to address consultation comment relaxing requirement for the use of hard keys. See Appendix A item 27

5 5.3.5 Flexible train data entry shall always be available to the driver.

5.3.4 The vehicle maintainer shall be able to configure the DMI for fixed, variable or switchable data entry.

Requirement amended to address consultation comment to provide this capability only when there is an operational benefit.


6 2.16.1 Where the facility is not provided for the sleeping signal to be received automatically through coupling connections, the ETCS onboard equipment shall provide for sleeping (SL) mode to be selected manually to facilitate the hauling of a traction unit fitted with ERTMS.

Withdrawn This proposed requirement see Appendix A item 7 has been deleted as ETCS PS mode fulfils this purpose and is fully defined in SUBSET-026.


impact assessment for changes to railway group … ia12.pdf · impact assessment for changes to...

Documents