explanation of change new approach to the rule book ... eoc02.pdf · explanation of change . new...

EOC – Signallers, train crew and others involved in emergency train working Final version. Ref 12 EOC02

Explanation of Change

New Approach to the Rule Book – Tranche 6

Date: December 2011

Title: Signallers, train crew and others involved in emergency train working

Relevant current Rule Book modules Title: Train stopped by train accident, fire or accidental division Reference: GE/RT8000/M1 Issue 1 Synopsis: You currently need this module if you carry out duties of a:

• Driver • Guard • Signaller • Operations controller

Title: Train stopped by train failure Reference: GE/RT8000/M2 Issue 2 Synopsis: You currently need this module if you carry out duties of a:

• Driver • Signaller • Pilotman

Title: Floods and snow Reference: GE/RT8000/M4 Issue 1 Synopsis: You currently need this module if you are involved in the arrangements

for: • Dealing with floods • Clearing snow • Operating miniature and independent snow ploughs

Title: Managing accidents Reference: GE/RT8000/M5 Issue 1 Synopsis: You will need this module if you carry out the duties of a:

• Driver • Signaller • Rail incident officer • Operations controller • Person in charge at an incident involving a body on or near the line

Uncontrolled When Printed


You will also need module M5 if you are likely to be involved in:

• Reporting a serious accident or a body on or near the line • Attending an accident site • Looking after the welfare of any employee who witnesses an

accident involving fatal or serious injury Title: Single line working Reference: GE/RT8000/P1 Issue 2 Synopsis: You will need this module if you carry out the duties of a:

• Pilotman • Signaller • Driver

Title: Working single and bi-directional lines by pilotman Reference: GE/RT8000/P2 Issue 2 Synopsis: You will need this module if you carry out the duties of a:

• Pilotman • Signaller • Driver

Title: Wrong – direction movements Reference: GE/RT8000/TW7 Issue 2 Synopsis: You will need this module if you carry out the duties of a:

• Signaller • Driver



Details of new modules Module Title: Dealing with a train accident or train evacuation Reference: GE/RT8000/M1 Issue 2 Title: Train stopped by train failure Reference: GE/RT8000/M2 Issue 3 Title: Managing incidents, floods and snow Reference: GE/RT8000/M3 Issue 1 Title: Single line working Reference: GE/RT8000/P1 Issue 3 Title: Working single and bi-directional lines by pilotman (proposed version 1) Reference: GE/RT8000/P2 Issue 3 Title: Modified working arrangements on single or bi-directional lines (proposed

version 2) Reference: GE/RT8000/P2 Issue 3 Title: Wrong-direction movements Reference: GE/RT8000/TW7 Issue 3

Period of consultation: 14 July 2011 – 06 September 2011

Publication date: March 2012

In force: June 2012



Contents Page 1 EXECUTIVE SUMMARY .......................................................................................... 5

2 INITIATORS OF CHANGE ....................................................................................... 5

3 BACKGROUND ....................................................................................................... 7

4 KEY CHANGES ....................................................................................................... 8

5 CONSEQUENTIAL CHANGES .............................................................................. 13

6 IMPACTS ............................................................................................................... 15

7 COMPLIANCE REQUIREMENTS .......................................................................... 23

8 DECISION CRITERIA ............................................................................................ 23

9 CONCLUSION ....................................................................................................... 23

Appendix 1 .................................................................................................................... 24

Appendix 2 .................................................................................................................... 25

Appendix 3a .................................................................................................................. 29

Appendix 3b .................................................................................................................. 30

Appendix 3c .................................................................................................................. 31

Appendix 3d .................................................................................................................. 32

Appendix 3e .................................................................................................................. 34

Appendix 3f ................................................................................................................... 35

Appendix 3g .................................................................................................................. 37

Appendix 3h .................................................................................................................. 38

Appendix 3i ................................................................................................................... 40

Appendix 4 .................................................................................................................... 41

Appendix 5 .................................................................................................................... 49



1 EXECUTIVE SUMMARY

This Explanation of Change (EoC) document describes the impacts as a result of the application of the New Approach to the Rule Book Strategy to the seven modules of Tranche 6. The modules as part of this Tranche concern signallers, train crew and others involved in emergency train work.

The changes as a result of this Strategy, Tranche 6 introduces five new Modules and two versions of GE/RT8000/P2 to industry. A paper (as shown in Appendix 4) outlines the safety impacts that were considered in determining whether modified working in place of pilotman is acceptable.

The key changes draw attention to those rules, which are introduced, revised, or withdrawn for the current modules. The operational, safety, and other impacts as a result of these changes are highlighted in section 6 of this document.

The changes to these Rule Book modules are considered to promote the long term best interest of the mainline railway, and therefore their introduction is justified.

2 INITIATORS OF CHANGE In December 2008, Traffic Operation and Management Standards Committee (TOM SC) supported the delivery and implementation of the 12 tranches (each Tranche being a group of related existing Rule Book Modules) of the New Approach as indicated in Appendix 1 in delivering the industry’s New Approach to the Rule Book Strategy.

As part of Tranche 6 of the New Approach, the roles and responsibilities from the following seven modules have been reviewed:

• GE/RT8000/M1 – Train stopped by train accident, fire or accidental division

• GE/RT8000/M2 – Train stopped by train failure • GE/RT8000/M4 – Floods and snow • GE/RT8000/M5 – Managing accidents • GE/RT8000/P1 – Single line working • GE/RT8000/P2 – Working single and bi-directional lines by pilotman • GE/RT8000/TW7 – Wrong-direction movements



As a result of the New Approach Strategy, the following modules have been revised and issued as part of Tranche 6.

• GE/RT8000/M1 – Dealing with a train accident or train evacuation This Module has been reissued and applies to drivers, guards, and signallers.

• GE/RT8000/M2 – Train stopped by train failure This Module has been reissued and applies to drivers, signallers and pilotman.

• GE/RT8000/M3 – Managing incidents, floods and snow Module M3 has been introduced which now combines rules from Module M4 and M5. This Module applies to drivers, signallers and anyone involved in or reporting a serious accident.

• GE/RT8000/P1 – Single line working Module P1 has been reissued and applies to drivers, signallers, and pilotmen.

• GE/RT8000/TW7 – Wrong-direction movements Module TW7 has been reissued and applies to drivers and signallers.

Separately to the New Approach work, a proposal (10/052) for the adoption of modified working as the normal practice in place of working by pilotman was submitted by ATOC on behalf of the industry. The proposal was for modified working arrangements to become the normal arrangement that would assist movement of trains on single or bi-directional lines, following signalling failures. The main driver of the proposal being the long wait often experienced awaiting the setting up of working by pilotman could be avoided if modified working was established as the normal method of working.

As a consequence of this work, two versions of Module GE/RT8000/P2 were proposed to industry as part of Tranche 6.

• GE/RT8000/P2 – Modified working arrangements on single or bi-directional lines

• GE/RT8000/P2 – Working single and bi-directional lines by pilotman



A separate paper (as shown in Appendix 4) was produced which introduces the safety implications for adopting modified working. It informs the industry of the key issues associated with the proposal, the differences in the hazards between pilotman working verses modified working, the key difference in approach and the people involved. It included recommendations that a detailed cost benefit analysis was carried out before a decision to change to modified working is made.

Further analysis in the form of a decision support document was produced, (as shown in Appendix 5). The document compares the two different methods of working, the associated advantages and disadvantages, and concludes, when managing delay, the optimum appears to be modified working initially converting to working by pilotman when available or for longer term/planned works. Removing the ability to work by pilotman and only carrying out modified working will hinder performance in some cases.

A briefing leaflet was also produced to provide a summary of changes to Tranche 6.

3 BACKGROUND The New Approach programme started in 2008 and is scheduled for completion in 2013 when all the modules and handbooks will be in force. The project is broken down into three phases.

• Phase 1: Rules for track workers • Phase 2: Safe systems of work • Phase 3: Operating the railways

Phase 1 (Tranche 1) of the New Approach was published in April 2010 and came into force in June 2010.

Phase 2 consists of Tranches 2 – 4. Tranche 2 was published in September 2010 and came into force December 2010. Tranche 3 was published in March 2011 and came into force June 2011, and Tranche 4 was approved for publication in September 2011 and is to come into force in December 2011.

Phase 3 consists of Tranches 5 – 12 which are planned to come into force as follows:

• Tranche 5: December 2011 • Tranche 6: June 2012 • Tranche 7: December 2012 • Tranche 8: December 2012 • Tranche 9: June 2013



• Tranche 10: June 2013 • Tranche 11: December 2013 • Tranche 12: December 2013

Appendix 1 outlines these phases in detail, the tranches of work and modules affected and the proposed in force dates of the new publications. This EoC document refers to Tranche 6 of the work delivered in the New Approach to the Rule Book.

3.1 Operational Principles The set of Fundamental Operational Principles has been approved and published in Module GE/RT8000/G1 General safety responsibilities and personal track safety for non-track workers as part of Tranche 1 of the New Approach. This acts as the scope to the Rule Book, as highlighted in Appendix 2.

Principles 1, 2, 4 and 8, are applicable to Tranche 6 of the New Approach.

3.2 Human Factors A task analysis has been undertaken for the tasks included within Tranche 6 (Signallers, train crew and others involved in emergency train working). These were developed by human factors specialists working alongside front line staff. They provide the initial verification of the tasks currently described in the Rule Book.

A subject matter expert seconded by Network Rail and a human factors specialist led 18 workshops with 86 participants who are competent in, and who implement, the rules associated with Tranche 6. The workshops generated feedback from staff on the Tranche 6 modules.

Issues raised during this process were documented and reviewed, and led to revisions to the Tranche 6 modules.

4 KEY CHANGES As part of Tranche 6, some rules have been introduced or revised and other elements have been withdrawn.

4.1 New Rules

Module P2 – Modified working arrangements on single or bi-directional lines Proposal 10/052 was submitted by ATOC on behalf of the industry, for the adoption of modified working arrangements on single or bi-directional lines as the normal arrangement for dealing with signalling failures on single or bi-directional lines in place of working by pilotman.



In February 2011, TOM SC approved this proposal for further work to take place (minute number 11/TOM/02/11) and to identify if there is an increased level of risk with this alternative method of working as opposed to working by pilotman.

As part of this work, an alternative version of Module P2 was presented to the industry. The decision support paper (see Appendix 5) compares the two methods of working with the associated advantages and disadvantages.

4.2 Revised Rules

Modules M1 and M2 – Arrangements for emergency protection Currently, the rules require emergency protection to be carried out in rear of the train involved, if the signaller cannot be contacted immediately, and:

• temporary block working is in force • working by pilotman is in force • single line working is in force and the train was travelling in the wrong

direction • the Sectional Appendix requires it at that location.

The rules are revised to specify changes that emergency protection is only necessary on the line, which is occupied by the train, if temporary block working is in operation, as this is considered to be the only one of these situations in which there is a real risk of a following train being admitted to the occupied section.

Module M1 – Arrangements for single lines not worked by a token Currently the rules require that on single lines, if a train is divided, leaving a portion behind, the train must not leave the single line, until the driver has placed three detonators behind the first portion. While this protects the second portion of the train left behind, it does not protect against the movement in the same direction.

The revised Module states that on a single line when the front portion of a divided train has gone forward, it must not leave the single line until the signaller has been told that the rear portion has been left behind. As a consequence of the rule revision, it will no longer be necessary to place detonators at the entrance to the single line. This change reflects the improvements in methods of communication that have been made in recent years and therefore significantly reduces the residual risk with the present arrangements if the next train is in the same direction.



Module M3 – Arrangements for train running in floodwater The current rules require running at 5mph when floodwater is between 2 inches below and 4 inches above the rail level, above this depth normal running is suspended. The revised Module now permits normal working when floodwater is up to the bottom of the rail head, and running at no more than 5mph when the water is no deeper than the top of the rail head. Further movements may be permitted by operations control according to the types of stock involved and depth of water.

The rules are revised to recognise that the new depths of bottom of rail head and top of rail head are more readily identifiable by drivers whilst in the cab and are more closely aligned with restrictions placed on individual vehicles by their operators.

Module M3 – Arrangements for train running in snow depths The current rules contain instructions relating to three depths of snow above rail level, which have an impact on train running.

• Up to 200mm is normal running. • Between 200mm and 300mm is for running by local manager's

authority or if the train is fitted with miniature snow ploughs (MSP). • Between 300mm and 450mm trains with MSP may run with local

manager’s authority.

The instructions to front line staff to suspend running at snow deeper than 200mm remains but all other decisions are taken by local management staff and exceptional weather instructions issues by Network Rail, as whether to run trains at a greater depth, or to use MSP or independent ploughs to clear the line. Therefore, it is no longer appropriate to include as rules. MSPs are no longer routinely fitted to locomotives on service trains but only to locomotives performing snow clearance duties. Therefore the proposed rule changes require train running to be suspended when snow exceeds 200mm. The signaller then works to instructions from operations control.

Module P1 – Arrangements for single line working when several running lines are available The rules concerning single line working where more than one running line is available have been re-written to better describe the actual arrangements and responsibilities. Currently the handsignaller (referred to in Module P1 diagram P1.3) is not positioned at a signal, which is a driver's usual expectation during SLW, but at the crossover.



Their role is complicated and can only be discharged by a highly competent person conversant with the rules and the location. They are required to authorise all movements in both directions if conflicting movements cannot be avoided. Performing this role is difficult and might require the handsignaller to move considerable distances between the protecting signals. Any mistakes made could lead to a head-on collision at the conflict point.

The proposed changes to the revised Module when SLW is taking place and more than one running line is available, clarifies the position and role of the handsignaller.

It will no longer be necessary for the signaller to get permission from the pilotman before authorising movements in the right direction, nor the short piece of line used for movements in either direction at each end of the single line. These responsibilities are now addressed to the signaller, with the pilotman’s responsibilities limited to those that he must genuinely carry out.

The new rules recognise that a main aspect signal may be provided to signal the wrong-direction movement back to the proper line. If this is the case, a handsignaller need not be appointed.

Module P2 – Arrangements for working by pilotman if a token is damaged Currently, the rules refer to the need to implement working by pilotman if a token is damaged. This dates from a time when tokens were routinely exchanged by moving trains, which could be damaged when dropped under the train's wheels. The changes to the updated Module remove all references to damaged tokens since tokens are not exchanged whilst trains are on the move, therefore, they are seldom, if ever, damaged.

Module P2 – Arrangements for working by pilotman to and from a point of obstruction Currently, the rules require the introduction of working by pilotman whenever working to and from a point of obstruction is implemented. The new rule will allow a token, if available, to be the authority to work up to the point of obstruction, after the driver has been given the necessary instructions and the obstruction has been protected as necessary. If working to and from the obstruction is required on both sides of the obstruction, working by pilotman will still be needed on the other side.



Module P2 – Arrangements for working by pilotman where token instrument has failed Currently the rules state that working by pilotman must be introduced on a line when there is a failure of the token instrument. The new rules allow the token, if available, to be used to work the single line as if it was a one-train line with staff, where it is operationally possible to do so.

Module TW7 – Arrangements for setting up and securing points Currently the rules require the signaller to set and secure all points in the route of an unsignalled wrong-direction movement and not to release or change any of these points until the movement has passed clear of the last of them. As the movement may be over several miles and involve several sets of points this could mean other movements, which require to use a portion of the route, being detained for a considerable period. The changes to the revised Module will now allow points in the route to be released as soon as the signaller has confirmed the movement has passed over them rather than when the wrong-direction movement has been completed.

Module TW7 – Arrangements for automatic crossing not fitted with wrong-direction controls Currently, the rules in Module M1 do not allow the front portion of a divided train to set back over an automatic level crossing onto the rear portion unless it is under local control. Automatic crossings include AHBC, ABCL, AOCL and R/G. Apart from AHBC, it is not possible to locally control these crossings and there are no rules to do so. In the proposed new Module the prohibition applies only to AHBC.

Module TW7 – Arrangements for rail grinding trains to make wrong-direction movements to extinguish a lineside fire Currently, only a Loram C21-type rail-grinding train is permitted to return in the wrong-direction to extinguish a lineside fire. The proposed changes will allow any rail grinding train to make a wrong-direction movement to extinguish a lineside fire.



4.3 Withdrawn Rules Some rules are withdrawn from the Rule Book on the basis that they:

• are not true rules • duplicate legislation • do not require interaction between Rule Book users.

The withdrawal of these rules does not require of itself Rule Book users to do anything differently.

5 CONSEQUENTIAL CHANGES There is a consequential change to Module T1B ‘Movement of trains during failure of, or when working on, signalling equipment’ as section 21 will be abolished (as shown in Appendix 3a) and all references to modified working will be appear in Module P2.

There are three consequential changes to Module TS2 ‘Track circuit block regulations’ (as shown in Appendix 3b), Regulation 9, to reflect the ability to use a main aspect signal to return a train to the correct line during single line working. The current regulation does not allow for the possibility of a main aspect signal being provided at the crossover where trains are returned to the proper line, which are applicable to the train leaving the single line. Module P1 ‘Single line working’ issue 3 has been amended to allow a main aspect signal to be used in place of a handsignaller. Therefore, regulation 9 of Module TS2 has been amended to align with Module P1 ‘Single line working’.

There are consequential changes to Module TS3 ‘Absolute block regulations’ (as shown in Appendix 3c), Regulation 9. This regulation has been re-titled and amended to align more closely with Regulation 9.4 of Module TS2. The arrangements how trains leave the single line have been clarified, and a reference to main aspect signals at the end of the single line has been included.

It is intended to release these changes in the June 2012 Amendments Modules (AM), and reissue Module TS2 and TS3 in December 2012 to coincide with the issue of Tranche 7 publications.

There are consequential changes to Modules TS4 ‘Electric token block regulations’ (as shown in Appendix 3d), Regulation 8. Damage to tokens has been withdrawn, as the possibility is now considered extremely remote. These regulations date from the time when it was normal to exchange the token from moving trains, which could easily fall under the train’s wheels.



As all tokens are now exchanged at a stand, this regulation is no longer necessary.

An additional amendment has been written for TS4 as a consequential change following the re-issue of module P2. It is no longer necessary to introduce working by pilotman on one side of an obstruction if the token is available and it is possible to run trains to and from the point of obstruction in accordance with module TS8 One-train working regulations.

There are consequential changes to Module TS5 ‘Tokenless block regulations’, (as shown in Appendix 3e), Regulation 8. The arrangements for modified working are now shown completely in Module P2 section 7, and rules formerly contained in Module T1B have been reviewed and where necessary, transferred to Module P2. Reference to Module T1B section 21 has been deleted.

There are consequential changes to Module TS7 ‘No-signaller token regulations’, (as shown in Appendix 3f), Regulation 8.

The regulations concerning damage to the token have been withdrawn as this possibility is now considered extremely remote. These regulations date from the time when it was normal to exchange tokens from moving trains and a dropped token could fall under the train wheels. As all tokens are now exchanged at a stand, this regulation is no longer necessary.

The arrangements for modified working are now shown completely in Module P2 section 7, and the rules formerly contained in module T1B have been reviewed and where necessary, transferred to module P2. References to module T1B section 21 have been deleted.

The title of TS7 regulation 8 is amended, and Regulation 8.1 is withdrawn. Regulation 8.2.1 and 8.3.1 is amended.

An additional amendment has been written for TS7 as a consequential change following the re-issue of module P2. It is no longer necessary to introduce working by pilotman on one side of an obstruction if the token is available and it is possible to run trains to and from the point of obstruction in accordance with module TS8 One-train working regulations.

There are consequential changes to Module TS8 ‘One-train working regulations’, (as shown in Appendix 3g). Arrangements for modified working are now shown completely in Module P2 section 7, the rules formerly contained in Module T1B have been reviewed and where necessary, transferred to Module P2. References to Module T1B section 21 have been deleted.



There are consequential changes to Module TW6 ‘Working single lines with or without a train staff or token’, (as shown in Appendix 3h). Section 2.2 has been amended to show where a train has been divided on a single line (accidentally or purposefully) and it is necessary to leave a portion behind, the train must now not leave the single-line section until the signaller has been told. It is no longer necessary to place three detonators on the line behind the first portion immediately before leaving the single line because the signaller will take the necessary action to protect the section. References to how the rear portion is protected have been removed, as it will be dealt with under the relevant sections of modules M1 or M2. Diagram TW6.1 is no longer relevant and is deleted.

Section 3.2 of Module TW6 has also been amended to include instructions previously shown in module P2.They have been removed from P2 and added to TW6 because they are about handling the train staff, not about working by pilotman. The prohibition on working any points worked by the token has been removed as it is considered an unnecessary restriction.

Section 4.2 of Module TW6 has been amended to include instructions previously shown in Module P2, as the rules relate to handling train staff and not about working by piltoman. The prohibition on working any points worked by token has been removed as it is considered an unnecessary restriction.

It is intended to release these changes in the June 2012 AM, and reissue Module TS4, TS5, TS7 and TS8 in December 2012 to coincide with the issue of Tranche 8 publications.

There are consequential changes to Module TW1 ‘Preparation and movement of trains: General’ to transfer items applicable to the protection of the line during SLW which were previously carried in Module P1 ‘Single line working’ and were applicable to the guard’s duties. (Appendix 3i).

It is intended to release these changes in the June 2012 AM, and reissue Module TW1 (including content of TW6) in June 2013 to coincide with the issue of Tranche 9 publications.

6 IMPACTS

6.1 Safety and operational impacts This section highlights the safety and operational impacts of the revision of Tranche 6 Modules as highlighted in section 4.



6.2 New rules

Module P2 – Modified working arrangements on single or bi-directional lines A separate paper (see Appendix 4) has been presented to TOM SC at the July 2011 meeting (min number: 11/TOM/07/168) which sets out the safety implications for adopting modified working as the normal response to signalling failures on single lines. It provides key safety related issues and compares the causes of potential failure, hazards and the people involved with pilotman working versus modified working.

Recommendations to TOM SC at the meeting proposed to carry out a detailed cost-benefit analysis to determine if the change from pilotman working to modified working would be reasonably practicable. A secondary paper has been produced detailing this (see Appendix 5) which proposes the best method for the industry.

6.3 Revised rules

Modules M1 and M2 – Arrangements for emergency protection The risk being controlled by the current rule of requiring emergency protection to be placed in rear of a train when the signaller cannot be contacted immediately, is that of a potential collision where the full protection of the signalling system is not available and some form of degraded mode operation is in place, which could involve a human error. The requirement to carry out emergency protection has diminished in the modern era due to improved methods of communication.

The requirement to carry out emergency protection of the line on which the train was travelling is retained when temporary block working (TBW) is in force, which is considered to be the only credible scenario where an error could be made during degraded working leading to a second train being irregularly admitted to a section.

In the case of working by pilotman or SLW, the signaller still has to have the permission of the pilotman to admit any train to a section.

If a train travelling in the wrong direction fails then the pilotman will either have sent that train or will be travelling on it. Following re-assessment of this module, for a signaller to forget the existence of the train and to overlook the fact that SLW is in operation is no longer seen as credible.

The safety impacts of retaining this rule during TBW and not other forms of working, will reduce the exposure of drivers to lineside safety risks while walking back a mile and a quarter in difficult conditions when this is now considered unnecessary. A driver will only have to walk as far as is



necessary in the most appropriate direction to establish communication with the signaller.

The assessment of the operational impacts of putting down emergency protection on the line of travelling train, is no longer require, unless temporary block working is in operation. The operational impact of this change will result in reduced train delays as drivers will not have to potentially go back a mile and a quarter on each of these occasions.

Module M1 – Arrangements for single line not worked by a token In the case of a train which is divided on a single line not worked with a token, the risk being controlled is the signaller believing that the first portion arriving is the whole train, and clearing signals for another train onto the single line, which is already occupied by the second portion. This change does not have any effect on risk, as the first portion will not be allowed to leave the single line, until contact with the signaller has been established. This is not believed to be an issue with modern communication. There are potential safety impacts of this change, as it introduces better protection from the rear of the portion of train left behind.

The discontinuance of putting down detonators at the entrance to a single line before the first portion of a divided train removes the risk from slips, trips and falls associated with leaving the train to place detonators.

The operational impact of this change will result in reduced train delay as the driver will not have to stop and put down detonators.

Module M3 – Arrangements for train running in floodwater The current rules require running at 5mph when floodwater is between 2 inches below and 4 inches above the rail level. Above this depth, normal running is suspended. The risk being controlled by the current rule is of preventing trains being stranded in floodwater due to damage to traction equipment.

The revised instructions would prohibit any movement when the level of the water is above the top of the rail head. This water level is one that can be more readily identified by drivers and there is less likelihood of a train encountering deeper flood water than anticipated, and the depth is more in line with the restriction imposed for the safe operation of vehicle types.

There is no increase to safety risk as the new depths are more readily identifiable by drivers passing at speed.



The revised rules have been simplified with depths that will be more easily recognised by drivers and make it more practicable for the newly-introduced requirement for a driver to report depths of floodwater to be carried out. This change will not have any operational impact as operations control may continue to authorise the movement of trains above these depths.

Module M3 – Arrangements for train running in snow depths The current rules contain instructions relating to three depths of snow. There will be no safety impact as all decisions on train running when snow depth exceeds 200mm are currently not made by front line staff and this will not change.

The revised rules have been greatly simplified, and only refer to the actions staff must take at a snow depth of 200mm, this has not identified any operational impacts.

Module P1 – Arrangements for single line working several running lines are available The risk being controlled by the changes to the rules that apply where more than one running line is available is that of a collision between trains in opposite directions during single line working. Through the adoption of these new rules, the risk will be reduced as the handsignaller will be located at a fixed position at a signal where drivers can expect to see them, this being a location where trains can be stopped short of the point of potential conflict.

The duties of the handsignaller can then be more clearly specified than at present, and hence probably more correctly carried out. The signaller will be totally in charge of authorising right direction movements so eliminating the possibilities of miscommunication inherent in transmission through a third party. The present instructions are, to a degree, impracticable to carry out, with the danger that ad hoc modifications will be devised for convenience, with no guarantee that effective control measures are being applied.

Other safety impacts such as slips, trips and falls are minimised as the handsignaller will be located in one place and will not be expected to change location.

The changes proposed for P1, concerning SLW when more than one running line is available are now written in a way which reflects the only way in which these instructions could be carried out, and which accurately



describes the responsibilities of the handsignaller and the pilotman. By doing so, the likelihood of correct understanding and observance of the rules is increased.

The operational impact of this change includes quicker authorised movements, allowing the line to be available sooner, as there would be less need to pass messages through a third party.

Module P2 – Arrangements for working by pilotman to and from a point of obstruction It is very uncommon for a token to be damaged since the prohibition from exchanging tokens whilst a train is on the move was introduced. There is no effect on risk, and there are no safety impacts as a results of this change as the instruction as reworded defines the actions that are required when a token cannot be restored to the instrument, which would be equally applicable should the reason for this be that the token is damaged.

Reference to damaged tokens being removed from the revised Module, has not identified any operational impacts.

Module P2 – Arrangements for working by pilotman where token instrument has failed There will be no increase in risk when working to a point of obstruction as a token must still be available and issued to the driver in place of the pilotman. The site of the obstruction must be protected, exactly the same as at present. The driver will be given clear instructions by the signaller as to how far the movement may proceed.

As the pilotman will not be appointed, messages concerning safety will not be passed through a third party.

Trains need not be detained awaiting the appointment of a pilotman but may proceed as soon as it is known that the obstruction is protected.

The operational impact of this change would be in terms of reduced delay, as this would avoid trains being detained awaiting the appointment of a pilotman. The train may proceed as soon as it is known that the obstruction is protected.

Module TW7 – Arrangements for setting up and securing points The risk being controlled by the current rule for wrong-direction working is that of points being released and changed in front of the wrong-direction movement, thus diverting it to an unexpected line or into a potential



collision. There is potentially a slight increase in risk if a signaller became confused and thought the wrong-direction movement had passed over the points when it had not done so. However, this is considered extremely unlikely and is mitigated by the driver travelling at low speed and checking the position of the points.

The operational impact of allowing points to be released following wrong-direction movements passing over them would result in fewer trains being detained at red signals awaiting the wrong-direction movements to be fully completed when it would otherwise be safe for them to proceed.

Module TW7 – Arrangements for automatic crossing not fitted with wrong-direction controls The risk being controlled by the current rule for wrong-direction working is that an automatic crossing, not fitted with wrong-direction controls, will not operate for the wrong-direction movement and therefore could lead to a collision with a road vehicle. The only control measure that is prescribed at present is that the automatic crossing must be locally-controlled. This is, however, a solution that is only applicable to AHBCs, and in effect movements are precluded over other types of automatic level crossing.

Providing the appropriate arrangements are applied to the other types of level crossing, the movements can be made safely, and by doing so, a potentially complex series of movements to avoid having to make a wrong-direction movement over the crossing can be avoided. Those alternative movements might well include the potential for safety of the line incidents such as passing signals at danger without authority, unfamiliar shunting movements, unnecessary propelling or further wrong-direction movements. Therefore this change has no increase in risk.

The operational impacts of the changes to the existing rule for automatic crossings other than AHBCs will potentially avoid lengthy and convoluted movements to recouple the portions of a divided train, if any other type of automatic crossing is present, as the existing rule effectively prohibits wrong-direction movements over them, although there is no reason to do so.

Module TW7 – Arrangements for rail grinding trains to make wrong-direction movements to extinguish a lineside fire The risk being controlled by the current rule to allow only Loram C21 rail grinding train to return in the wrong-direction, is the timely extinguishing of lineside fires caused by sparks emitted by the grinding process. Water for fire fighting is conveyed on these trains.



There will be a decrease in risk to the network from the effects of lineside fires on cable routes or other flammable furniture.

The restriction that only Loram C21 rail grinding trains can return in the wrong-direction is an artificial one as this type was the only one originally specified. There is no obvious risk in allowing such movements with any other type of rail grinding train, and by doing so it will be possible to extinguish a fire which could otherwise rapidly develop into a more serious incident.

The operational impact of this change would be to speed up the extinguishing of a fire and prevent a more serious incident developing.

6.4 Withdrawn Rules There are no safety or operational impacts as a result of withdrawn rules from the Rule Book, because the withdrawal of these rules does not of itself, require Rule Book users to do anything differently.

6.5 Other impacts As a result of the proposed changes for Modules as part of Tranche 6, there will be a reduction in the volume of required rules, resulting in a safety benefit by lowering the fatality and injury risk to drivers, signallers, pilotman, operations control and any persons who are likely to be involved in reporting a serious accident.

6.6 Impacts on printing costs Further anticipated benefits have been identified as a result of work undertaken in Tranche 6, these are as follow.

Tranche 6 will create greater synergy for signallers, train crew and others involved in emergency train working. The following Tables A and B, show current and future industry costs for current Modules and revised Modules, with predicted percentage savings of 34% in printing costs to industry.

The work undertaken in Tranche 6 of the New Approach confirms that not only is there a reduction in the volume of rules a worker will need to read, but that the rules are specific to them. This will have a positive impact as it is anticipated that there will be an improved understanding of rules, which will lead to a safety benefit.



Table A – Current Rule Book module industry costs

Table B – New Approach industry costs

Work on this tranche of rules has emphasised simplification in order to improve the safety of workers involved in emergency train working. Tranche 6 has resulted in a reduction in the volume of documentation it is necessary for each group of employees to read. This is shown in Table C.

Table C – Number of pages required to be read

Current Requirement Future Requirement

Signallers – 159 pages

Drivers – 159 pages

Pilotman – 93 pages

Operations Control – 44 pages

Anyone involved in an accident or incident – 27 pages

Signallers – 93 pages

Drivers – 93 pages

Pilotman – 44 pages

Operations Control – 0 pages

Anyone involved in an accident or incident – 10 pages

Total 482 pages Total 240 pages

Module M1 40 50000 0.78 £39,000Module M2 28 25000 0.78 £19,500Module M4 20 70000 0.75 £52,500Module M5 28 90000 0.72 £64,800Module P1 64 25000 0.88 £22,000Module P2 36 30000 0.83 £24,900Module TW7 20 25000 0.73 £18,250TOTAL 236 5.47 £240,950

Module Number of pages

Numbers required Price Total

Module M1 28 50000 0.78 £39,000Module M2 16 50000 0.69 £34,500Module M3 16 50000 0.69 £34,500Module P1 48 20000 0.85 £17,000Module P2 28 25000 0.79 £19,750Module TW7 16 25000 0.59 £14,750TOTAL 152 4.39 £159,500

Module Number of pages

Numbers required Price Total



The briefing leaflet takes as its basis the contents of each of the existing Modules M1, M2, M4, M5, P1, P2, and TW7. It explains how individual sections will be published in future, drawing attention to how items that will not appear in future Modules will be dealt with. It will also highlight any significant change of principles that are being introduced.

7 COMPLIANCE REQUIREMENTS

Instructions in the New Approach Tranche 6, Modules M1, M2, M3, P1, P2, and TW7 contain requirements that are applicable to the infrastructure manager and railway undertaking categories of duty holder.

The updated Modules have been developed and are due to published in March 2012, coming into force in June 2012.

8 DECISION CRITERIA

For those elements that are not true rules or are no longer required as they are out of scope of the New Approach to the Rule Book Strategy, withdrawal is therefore justified.

9 CONCLUSION Tranche 6 – Signallers, train crew and others involved in emergency train working, has resulted in the issue of six Modules M1, M2, M3, P1, P2 and TW7.

Revised and new rules are in scope of the Rule Book, and the revision to the proposed Modules are part of Tranche 6. They allow operational benefits, and have a positive or neutral impact on safety.

Tranche 6 of the New Approach therefore promotes the long-term best interest of the mainline railways and its introduction is justified.



Appendix 1 Matrix on phase and modules for the New Approach



Appendix 2

Principle Description Related Rule Book module

1. The method of signalling must maintain a space interval between trains that is safe.

Under normal operation, this underlies the ‘method of signalling’ in each set of block regulations. The concept of ‘one train in one section’ is an example of how this principle is delivered. The principle is equally relevant to variations from that concept, such as permissive working (when the safe distance through controlled means reduces to zero), and to abnormal and degraded operations when the space interval may be controlled by verbal instructions or by use of a Pilotman. The concept of maintaining a safe distance between trains also applies when an overlap is provided, or a constraint on movement applied, to ensure that following or converging movements, or trains approaching one another on a single line cannot come so close together that the effectiveness of any space interval is destroyed.

M2, P1, P2, S4, S5, T1B, TS1, TS2, TS3, TS4, TS5, TS7, TS8 and TW6.

2. Before a train is allowed to start or continue moving, it must have an authority to move that clearly indicates the limit of that authority.

This principle is worded to apply to the issue of any authority to make a movement. It covers situations in which the movement may be made with or without any need for further clarification. Examples of this are when a signal is cleared, or an actual or electronic token indicates that a single line section can be occupied. It also applies when the extent of the authority has to be explained verbally or in writing, or when continuing confirmation that authority to move is given, as for example during a movement controlled by a shunter.

M2, M4, P1, P2, S1, S2, S3, S5, SS1, SS2, T1B, T3, T8, T9, T11, TS1, TS2, TS3, TS4, TS5, TS7, TS8, TS9, TW6, TW7 and TW8.

3. Trains proceeding over any portion of line must not be obstructed in a way that threatens their safety.

This principle covers two major potential operational situations in which a risk could arise. The first is at level crossings where road users might cause such a hazard. The second is when engineering work is to be carried out that makes a line unsafe for trains to pass. In that case, it must be possible to make any required movements in connection with that work safely, and that work must not expose trains to risk whilst they are passing on adjacent lines that are open to traffic.

OTM, OTP, T1A, T1B, T2, T3, T4, T6, T7, T11, TS1, TS2, TS3, TS4, TS5, TS7, TS8, TS9, and TW8.



4. Trains must be prevented from proceeding onto a portion of line where it is known or suspected that it would not be safe for them to pass.

The purpose of this principle is threefold. Firstly, information that a portion of railway is known, or believed to be, unsafe must be promptly and effectively communicated. Unsafe in this context might relate to any defect in track, signalling equipment, electrification equipment or structures, or to any type of obstruction, including any presented by a train or vehicle. Secondly, action must then be taken to prevent the approach of any trains. Thirdly, subsequent movement can only take place after it has been confirmed whether it is safe to permit any movement, and appropriate conditions have been established. This includes making sure that all those involved are aware of what is required to happen.

G1, AC, DC, M1, M2, M4, M5, S2,S3, S5, T1B, T5, T8, TS1, TS2, TS3, TS4, TS5, TS7, TS8, TS9, TW1 and TW8.

5. Trains must not be allowed to commence or continue their journeys until it is established it is safe for them to do so.

The scope of this principle is that prior to any type of train being allowed to start its journey all necessary preliminary activities have been completed. This includes confirmation that in all respects the train is able to run at its intended speed, or the permitted speed has been reduced to overcome any deficiencies. It also requires that the train has been correctly formed up, coupled and marshalled, that traffic has been properly loaded and secured (and in the case of dangerous goods, identified and contained). Work on the train must have been completed, passengers have been safely loaded and doors closed, and that authority to move has been obtained. Although the complete range of activity is necessary before starting a journey from origin, at least some of these will be repeated at any subsequent stops en route where the train formation is altered, or when passengers join and leave the train.

OTM, OTP, SS1, TW1, TW2, TW3 and TW5, and it is of equal importance to conform to the requirements of the Working Manual ‘White Pages’ and ‘Pink Pages’.



6. Trains must only be permitted to operate over any portion of line providing the rolling stock is compatible with the infrastructure on that portion of line.

This principle relates to the requirements to confirm that any traction unit or rolling stock has the authority to operate over any given route before doing so, in respect of features such as dimensions or axle loadings. This includes possession of a form RT3973 (Special movements conditions) or other authority to operate subject to any conditions of travel, or restrictions on routing. A further example would be confirmation that the vehicle and container combination on a train conforms to dimensions that may pass over a specific route. Another issue would be a requirement to be equipped with particular equipment to operate over a specified route, such as train protection or electric traction equipment. It would also address situations in which compatibility can be achieved by applying a reduction in speed, for example when the available automatic brake power may be insufficient to comply with the available braking requirements and signal spacing.

Sectional Appendix and the ‘White Pages’ of the Working Manual, but modules OTM, SP, TS1, TW1, TW2 and TW3 of the Rule Book are also relevant.

7. Trains must not continue to operate after they have been found to be unsafe in any respect, until measures have been taken to allow them to continue safely.

This is the equivalent of the Principle 4 but referring to defective vehicles or on-train equipment that may prevent that train continuing normally without presenting a hazard. The controls relevant to fires on trains, dangerous goods incidents or displaced loads are also addressed. As with Principle 4, the controls are threefold. Firstly, information that a train or vehicle is known, or believed to be, unsafe must be promptly and effectively communicated. Second, action must then be taken to prevent the approach of any trains if they would be put at risk, and finally, subsequent movement can only take place after it has been confirmed whether it is safe to permit any movement, and appropriate conditions have been established including making sure that all those involved are aware of what is required to happen.

G1, S3, TS1, TW1, TW2, TW3 and TW5



8. People must be kept a safe distance from moving trains.

This single principle is designed to address the variety of situations in which personal safety can be at risk, including workforce activities ‘on or near the line’, the risks to members of the workforce who spend a small part of the working day in that environment (such as traincrew required to alight from a train), and ensuring that passengers at stations are made aware by signage or warnings that they should keep well away from passing trains.

G1, G2, M1, OTM, OTP, SS1, SS2, T2, T4, T6, T7, T9, T10, T12, TS1 and TW1.

9. The workforce must be protected from the particular hazards associated with electrified railways.

In defining the scope of this principle it has been concluded that the operational controls against harm arising from electrified railways are almost exclusively directed at the workforce, as legitimate customers do not come into close proximity with hazardous equipment, and trespassers are excluded by physical barriers designed for that purpose and dissuaded by prohibitions.

G1, G2, AC, DC and OTP.



Appendix 3a



Appendix 3b



Appendix 3c



Appendix 3d



Appendix 3e



Appendix 3f



Appendix 3g



Appendix 3h



Appendix 3i



Appendix 4

AGENDA ITEM: XX MEETING: Traffic Operation and Management Standards

Committee DATE: 21 June 2011 SUBJECT: Module GE/RT8000/P2 – The safety implications

for adopting modified working SPONSOR: Colin Dennis AUTHOR: Jay Heavisides

1 Purpose of the paper The purpose of this paper is to:

a) Inform TOM SC of the key safety related issues associated with the proposal to adopt modified working as the default method of working (instead of pilotman working) when normal operation cannot be maintained on single and bi-directional lines.

b) Recommend a detailed cost-benefit analysis to determine if the adoption of modified working as the default method is reasonably practicable.

The paper does not quantify the safety risk but outlines the safety impacts that would need to be considered in carrying out the cost-benefit analysis.

2 Background 2.1 Current arrangements

Module P2 currently describes the rules for pilotmen, signallers and drivers when the normal operation of single or bi-directional line cannot be maintained. However, the rule book also provides provision for modified working arrangements, where it has been authorised in the Sectional Appendix and Signal Box Special Instructions. This can allow for train movements to be made without the presence of a pilotman and potentially reduce train delays. To initiate modified working, the signaller needs to confirm to a responsible person that the section is clear of trains, and the responsible person needs to give authorisation for a train movement through the section. The application of modified working is made on a train-by-train basis.

The Network Rail operations manual (2-17) describes the procedure for assessing a single line section for whether or not modified working is acceptable, and the supporting form (F2-17C) states that if more than 2 hours has elapsed since modified working was introduced no further authorities are to be granted to pass over the single line. Currently some sections of single line are not authorised to use modified working as they score too highly on the risk assessment tool which Network Rail use as part of this operations manual procedure, or the process is permitted for one train only.



The authorisation to the driver to move through the section under modified working is given to the driver in the form of a ticket: the signaller either completes or dictates the ticket for the driver, for each and every train. In the case of pilotman working the authorisation is given by the presence of the pilotman at the end of the section. A driver’s ticket is given by the pilotman to drivers to give a written reminder of the instructions given.

Figure 1: Overview of pilotman and modified working processes

2.2 The causes of pilotman and modified working

For current arrangements a review of events in SMIS from the last year (May 2010-April 2011) identified that track circuit failures due to cable theft or vandalism was the most cited cause (34%) of requiring a pilotman. Cable theft and vandalism contributed to 54% of overall records mentioning the use of pilotman1

SMIS also identified that there were three times more entries in the last year relating to pilotman working rather than modified working

.

2

This implies that if track related cable theft and vandalism increases, the amount of pilotman or modified working will also increase.

. The main cause of modified working was also identified to be track circuit failure due to cable theft or vandalism (33%), with cable theft and vandalism cited as a cause in 52% of instances.

1 SMIS data includes both working by pilotman (module P2) and single line working (module P1), although module P2 is of interest, the causes of module P1 are considered credible. 2 Note not all instances of pilotman working or modified working are required to be entered in SMIS. The data above is based on the narratives entered in SMIS, in some cases the information on the type of working and the causes were unclear.

Authorise and check line is

clear

SPR

Move trainDPS

Clear the lineDPS

Withdraw arrangements

P

S

Establish and agree

arrangements

SPR

For each train

For each train

Involved in both methods

Involved in pilotman working

Involved in modified working

Driver

Pilotman

Responsible person

Signaller

D

P

R

S

Key



3 The safety implications 3.1 The potential hazardous events

The same hazardous events could occur for pilotman working and modified working, except, in some cases they affect different people. The potential hazardous events are given in Table 1.

Table 1: Hazardous events for each type of working

Hazardous event Pilotman working Modified working

Risk to:

Train-train collision (head-on or following-on)

Traincrew, passengers and pilotman (if accompanying train)

Traincrew and passengers

Train-vehicle collision (at a level crossing)

Derailment

Workforce struck or crushed Pilotman Driver/signaller

Workforce slip, trip or fall Pilotman Driver/signaller

Workforce boarding or alighting injury

Pilotman Driver

3.2 The current risk

The current risk from working by pilotman or modified working is unknown. No collisions or derailments with safety losses were identified in SMIS as being caused during working by pilotman or modified working on single or bidirectional track. Nor were there any instances identified of workforce being struck or crushed during working by pilotman or modified working.

Over ten years of injury data, there were:

• Eight pilotman slips, trips and falls accounting for approximately 0.001 fatalities and weighted injuries (FWI) per year.

• Four pilotman boarding and alighting injuries accounting for 0.0004 FWI per year.

3.3 The precursors to hazards events

The precursors of interest in informing a safety decision are those that differ between pilotman and modified working. Following an internal HAZOP study of the two processes, a set of precursors were identified where the cause would be considered different. These were evaluated post the study in terms of likelihood and potential for harm, only the most credible are included in Table 2 and Table 3 below.



Table 2: Distinct precursors to hazards for working by pilotman

Hazardous event Precursor

Train-train collision Train over looked in section at start-up of pilotman working (eg failed train) and second train authorised to enter by signaller/pilotman.3

The first train is authorised to enter the section with the pilotman to follow on the next train - the signaller overlooks the exiting of the first train before authorising the pilotman train to enter.

Two signal boxes involved and the pilotman only agrees arrangements with one box before the first train is moved.

Signaller and pilotman fail to agree location of section or status of signals leading to SPAD and potentially a collision.

Train-vehicle collision

Signaller and pilotman fail to agree level crossing instructions – train passes crossing whilst open/inactive.

Derailment Signaller fails to set points.4

Signaller fails to agree with pilotman the use of a ground frame or the presence of an emergency speed restriction

Pilotman struck/crushed

Pilotman uses signal post telephone (SPT)/crosses track to signal box to inform signaller of current position unaware of another approaching train.5

Pilotman slip, trip or fall

Pilotman uses SPT/crosses track to signal box to inform signaller of current position or changes train.

Pilotman boarding or alighting injury

Pilotman receives injury whilst boarding or alighting train at start or end of train movement.

3 This precursor has a similar precursor for modified working, however, for modified working this may occur for each and every train moved through the section whereas for pilotman working it can only occur once on start-up of method of working. 4 This precursor is common in nature with that of modified working. However, it may be more prevalent in modified working due to the signaller workload involved. 5 This precursor is common in nature with that of modified working. However, it is the pilotman that is affected rather than the train driver.



Table 3: Distinct precursors to hazards for modified working

Hazardous event Precursor

Train-train collision (two trains in section)

Train over-looked in section by signaller (eg failed train) and second train authorised to enter by responsible person

When two signal boxes are involved, the responsible person speaks to both signallers and both think they have the authority to pass a train from their end of section.

When two signal boxes are involved, the signaller A gives signaller B the wrong information and the line is assumed clear.

The responsible person concludes that the train in question is clear of the section, and authorises another train to enter only the train confirmed clear is the wrong train.

The responsible person authorises a train to proceed based on the wrong information being recorded in the train register

Remote signaller assumes that train has gone clear and requests authorisation for second train to enter section.

Signaller loses place in task (due to workload) and requests authorisation/permits second train to enter section.

Signaller authorises more than one train to enter section due to confusion of train identity.

Signaller makes omission or error on driver’s ticket

Responsible person fails to keep proper record/distracted from keeping record whilst multiple instances of modified working and gives wrong instruction to signaller to authorise train.

Driver tells signaller he is clear of section but is not.

Train-vehicle collision

Signaller/driver makes omission or error on driver’s ticket about level crossing – train passes crossing whilst open/inactive

Derailment Signaller fails to set points

Signaller/driver makes omission or error on driver’s ticket about use of ground frame or details of emergency speed restrictions

Driver/signaller struck/crush

Driver uses SPT or crosses track to signal box to talk to signaller/driver or get/return ticket

Driver/signaller signaller slip, trip or fall

Driver uses SPT or crosses track to signal box to talk to signaller/driver or get/return ticket.

Driver boarding or alighting injury

Driver injures self whilst boarding or alighting train to/from using a SPT, collecting a ticket from a signal box or trackside cabinet.



3.4 The key people involved in implementing pilotman and modified working

As shown in Figure 1, the key people involved in implementing pilotman working or modified working are:

• Signaller (pilotman and modified working)

• Driver (pilotman and modified working)

• Pilotman (pilotman working)

• Responsible person (modified working)

The key precursor to train-train collisions is agreement of the section being clear when it is not, and thus authorising two trains to enter the section. This involves the signaller, the pilotman and the responsible person. The signaller is a constant in the two processes, however, he/she has a more involving role in modified working through instructing the driver on each train movement. The main differences in authorising the movement lie between the pilotman and the responsible person. Table 4 summarises some of the key characteristic differences in the two roles.

Table 4: Performance characteristics

Characteristic Pilotman Responsible person

Normal role Likely to be a local or mobile operations manager

Likely to be an on-call senior operations manager

Knowledge Route knowledge, rules exam

Rules exam, Operations Manual, familiar with route though not in as much detail as pilotman

Workload Single focus, on being pilotman

Maybe managing several issues including other degraded works or instances of modified working

Task Guided by signaller Focus on logistics (as human token)

In overall charge Focus on understanding scenario and whether it is safe

Environment In-cab, trackside or signal box

Could be anywhere, including at home asleep

Communication Face-to-face, in cab-radio/GSMR, signal post telephone

Telephone, face-to-face (if available)



3.5 Other escalating or mitigating factors

Other factors will influence the risk from working either pilotman or modified working. These include:

• The number of signal boxes involved. A second signal box will provide a secondary check that the train is clear of the section. For modified working the second box can provide an independent confirmation to the responsible person that the section is clear. For working by pilotman, the additional signaller presents the additional task of agreeing arrangements with a second signaller; if this is not done, there is the hazard that a second train may enter the section.

• The number of trains to pass through the section. For working by pilotman the number of trains is not a significant issue. The process for authorising a train is simple and rapid – the signaller complies with block regulations and tells the pilotman when the train may enter the section. The pilotman would complete the driver’s ticket and travel on or send each train. For modified working each train requires permission from the responsible person, and the signaller would be required to complete or dictate each ticket for the driver. It is anticipated that the process of obtaining authority from the responsible person and dictating a ticket to drivers would take a minimum of five minutes on each occasion as the process is necessarily more cumbersome. The concern for modified working is the additional workload on the signaller and responsible person for each train. If there are a lot of trains, or the modified working is to continue for an extended period (could be days or even weeks in the case of failure components not being readily available) this may lead to shortcuts being taken, mistaking the identity of train, or loss of place in the process, resulting in errors that increase the likelihood of a collision occurring.

• The locality of the signal boxes involved. Signal boxes located at the entrance/exit of the affected section will benefit from visual cues to aid confirming the line is clear and authorising the right train.

• Multiple instances of pilotman or modified working. Where a signal box is dealing with multiple instances of pilotman or modified working, it is possible that confusion may arise between sections in terms of place in the process, or when confirming the line is clear (for modified working) or withdrawing the process (for working by pilotman).

• The presence of level crossings, points, ground frames, emergency speed restrictions (ESRs). The more complex the section, the more likely errors or omissions will be made in relaying instructions.



For the pilotman, this generally would only occur at start-up but for modified working there is potential for the errors or omissions to occur for each and every train authorised to pass through the section.

• Speed limits. During working by pilotman, normal linespeed can be observed (except at points/ground frames, when it is to be reduced to 15mph). However for modified working the speed is limited to a maximum of 50mph through the section with the same exceptions as working by pilotman. This would reduce the potential consequences if there is a collision.

4 Conclusions There are different hazard causes for working by pilotman and modified working, as such, the risk from the two methods is likely to be different. The differences, in some cases, are quite subtle, therefore evaluating the difference in risk will be challenging and require understanding the likely human error rates. It could be that initially the risk from both processes are similar, but differ over time and with the number of trains that need to pass through the section.

It is concluded that a robust decision on the adoption of modified working as the default method could not be made unless it is supported by a detailed cost-benefit analysis. This would include the evaluation of safety benefits/disbenefits, costs, performance increases/decreases and other benefits necessary to determine whether the change is reasonably practicable.

The ability to carry out the cost-benefit analysis will depend on the availability of data, such as understanding how much (instances, trains, length of time) working by pilotman and modified working is currently undertaken.

It is anticipated that the cost-benefit analysis could be completed in time for the TOM SC in September.



Appendix 5

Adoption of modified working as the norm in place or working by pilotman

Decision Support update

Final

Published by

RSSB

Block 2 Angel Square 1 Torrens Street

London EC1V 1NY

© Copyright 2011



1. Background The purpose of this report is to document the outline analysis of proposal 10/052 – to change rules in GE/RT8000P2, module P2 Working of single and bi-directional lines by pilotman, by the adoption of modified working as the norm in place of working by pilotman.

The proposal 10/052 from ATOC was presented to Traffic Operation and Management Standards Committee (TOM SC) at the 1 February 2011 meeting (minute number: 11/TOM/02/11), where continuation of work in connection with the proposal was approved.

At the 12th July TOM SC meeting, a paper looking at the safety implications of adopting modified working as the norm was presented. This identified the causes from both working by pilotman and modified working but was unable to fully quantify the difference in risk due to the absence of specific incident data. As both methods of working are currently implemented, and have been for some time, it is considered that working by pilotman is more robust, with modified working having more potential scope for error. TOM SC approved further continuation of work (minute number: 11/TOM/07/168) with the intention of presenting the results of further risk-assessment work and associated workshop outputs at the November TOM SC meeting.

The appointment of a pilotman when the signal controlling the entrance to a single line section cannot be cleared is the subject of long-standing instructions, with a number of exceptions, such as when the driver can be in possession of a token, or on a track circuit block (TCB) line when authorised in the Sectional Appendix. The arrangements for modified working, under which an individual train can be authorised to proceed with the driver in possession of a modified working ticket was first applied on lines with (Western Region) tokenless block as a method appropriate where the passage of one train would often resolve a difficulty with one of the track circuits or treadles and allow subsequent trains to be signalled normally. In more recent years, a corresponding arrangement was introduced for a number of specifically-authorised single line sections, subject to the signallers involved being able to confirm to a responsible person that the section was clear of trains.

In the review of the signalling regulations that came into effect in 2007, modules P2 and T1B of the Rule Book were amended so that modified working can be applied to any single line regardless of the type of signalling system, subject to authority existing for the section concerned, and authority being granted by the appropriate responsible person on each occasion.

There is a Network Rail procedure involving a risk-assessment tool and a structured expert judgement for assessing whether modified working can be authorised for any single line section.



At a recent ATOC rules workshop it was suggested that modified working should become the normal arrangement, and would therefore be applied on each occasion when the appointment of a pilotman would otherwise be necessary.

2. Methodology The following methodology has been followed for the development of the analysis which has been in the form of:

• Scenario definition. • Assessment of the advantages and disadvantages of working by Pilotman. • Assessment of the advantages and disadvantages of the implementation of

modified working. • Industry workshops.

These are explained in more detail throughout the following sections.

3. Scenario definition In order to assess the impacts of change of the methods of working, the two following scenarios have been compared:

• The current P2 scenario. • Generalised modified working scenario.

3.1 Current P2 scenario This scenario is characterised by the following:

• Working by pilotman can be used on all single or bi-directional lines. • Modified working can be undertaken where permitted at locations specified

in the Sectional Appendix and provided Network Rail’s responsible person gives authority to do so.

• Network Rail enforces a 2-hour limit for modified working on the basis that it should normally always be possible to implement working by pilotman within this time.

• After two hours if there is still a failure of signalling equipment, working by pilotman is instigated for trains to traverse the affected section.

• Whilst waiting for the pilotman to arrive at locations where modified working cannot be authorised, trains are stopped. The driver must wait to be given instructions by the pilotman for authorisation to proceed.

• Trains are allowed to traverse through the affected area during working by pilotman at the permissible speed for the line.



3.2 Generalised modified working scenario The project scenario describes the evolution of the project should the alternative method of working be implemented:

• Modified working will be used on single lines at all locations and for any length of time.

• All rules concerning working by pilotman on single or bi-directional lines would be discontinued.

• All trains are required to traverse the affected section at a speed not exceeding 50 mph or lower if permissible speed is lower.

• Signallers will continue to require authority from the responsible person on each occasion that a train is to use the modified working procedure

• Drivers are directly given instructions by the signaller for authorisation to move.

4. Scenario comparison The key reason for this proposal is the industry believes the current method of working by pilotman has a cost impact from significant performance delays arising from the fact it can take an hour or longer to implement working by pilotman.

It should be noted that both processes have steps in place to mitigate the hazards, albeit with modified working having more different potential errors that could lead to an incident in that a pilotman is effectively a human form of token and thus maintains most elements of interlocking performed by the token. As modified working is effectively working single lines by despatch orders then the process relies completely on accurate record keeping and clear communication processes.

4.1 Advantages of working by pilotman The identified benefits of working by pilotman are:

• Pilotman is on-site and takes responsibility for authorising movements, acting as a human token (one person, one authority of movement)

• The signaller has all the correct (live) information required to brief the pilotman

• The signaller needs to brief the pilotman only once • Working by pilotman can be implemented during telecommunications

failures • Trains can travel through the affected section at permissible speed.

These benefits are further explained below:



Pilotman is on-site and takes responsibility for authorising movements

The pilotman is responsible for completion of driver’s tickets and briefing of drivers. All communications are routed through the pilotman enabling a reduced workload for signallers. The pilotman can repeat information whilst riding through the section with a driver to ensure complete understanding.

The signaller has all the correct (live) information required to brief the pilotman

Any last minute changes advised by the signaller can be addressed by the pilotman, ensuring that the correct information is passed onto the driver.

The signaller needs to brief the pilotman only once

Provided nothing changes in the section, the signaller needs to brief the pilotman initially only once. This frees up the signaller to carry out their normal duties and manage the signals, points etc as required. Not having to manage the briefing of drivers reduces the signaller workload. This is considered less likely to initiate knock-on errors.

Once set-up, working by pilotman allows the fastest processing of trains through the effected section, in particular, the turnaround times at the ends of the section will be much quicker than by modified working as the pilotman will only need a brief telephone call (or confirmation face-to-face) that the points are set and authority to depart is given. The permissible line speed can be observed (except where emergency speed restrictions apply or where there are points/ground frames). This method allows quicker authorisation of trains than with modified working (see Figure 3).

Working by pilotman can be implemented during telecommunications failures

If signal boxes exist at each end of the single line, all communications between signaller and pilotman can be face-to-face.

4.2 Disadvantages of working by pilotman • Delays as a result of waiting for pilotman to arrive on-site for unplanned

work. • A short delay for the signaller to brief pilotman (circa 2mins). • Further delay whilst working by pilotman forms are dictated to each

signaller involved (circa 5 minutes each signaller).

These disadvantages are further explained below:



Delays as a result of waiting for pilotman to arrive on-site for unplanned work

Typically it can take up to two hours, from when the failure is noted, for a pilotman to arrive on site. Hence the time limit applied to modified working within Network Rail’s internal processes.

The Network Rail operations manual describes the procedure whether to allow modified working to be authorised. If modified working is not permitted, all trains are stopped until the pilotman arrives on site and has implemented working by pilotman. Therefore, where modified working is not permitted, additional delays may occur.

Where work involving disconnection of the single line signalling system is planned, this delay will not exist as the pilotman is aware of what time they are required to be on site.

A short delay for the signaller to brief pilotman (circa 2mins)

The pilotman would have to make contact with the signaller to inform them of their presence at site. Either face to face, or via remote communications, the signaller would ensure that the pilotman receives all the correct information to commence movements (including completion of pilotman tickets RT3155).

Further delay for the pilotman to dictate forms to each signaller

In order to implement working by pilotman, the pilotman will have to contact each signaller involved and dictate a signaller’s working by pilotman form. This can take up to 5 minutes with each signaller depending upon the complexity of the details of the affected section.

4.3 Advantages of the implementation of modified working • Quicker movement of authority for the first train. • Mobile Operations Managers (MOM) have more time to deal with other

issues. • Only one method of working to implement.

These advantages are further explained:

Quicker movement of authority for the first train

The responsible person (RP) authorises the signaller to implement modified working. Not having to wait for a pilotman to arrive on-site at all locations would result in overall quicker movements of the first train and reduce the initial delay build-up, although some delay would be accrued whilst obtaining authorisation (see



Figure 2).

Figure 2: Relative time require to authorise the first train (primary delay)

MOMs have more time to deal with other failures

The role of a pilotman would typically be fulfilled by a MOM. By not requiring a pilotman to be onsite full time, this would give the MOM more time to help manage other issues on the network. It has been assumed that there would be no reduction in MOMs if working by pilotman was stopped, given that working by pilotman makes up a small proportion of their role.

Only one method of working to implement

Modified working removes the potential for confusion as opposed to the current method where both modified working and working by pilotman can occur. The signaller is required to get permission from a higher authority to allow a train to proceed onto the single line. If working by pilotman is in force, they themselves give authority to allow a train to proceed, provided the pilotman is present at the correct end of the single line. Having two procedures applicable for the same operational scenario has the potential to lead to confusion between the two methods. For whatever reason (eg workload pressures) obtaining authority from the responsible person for the train to proceed under modified working maybe omitted if the signaller is accustomed to the procedures of working by pilotman.

Confusion may also arise when switching between modified working and working by pilotman (eg when the Network Rail two hour time limit has been exceeded for modified working and working by pilotman is initiated). It should be noted that the potential for, and impacts of, these potential confusions have not been assessed as part of this paper and are accepted on the Network today.

The longer term advantages of only having one method would see a reduction in

Working by pilotman

Modified working

Effective delay (compared to normal operation)

Time to set up

Briefing



competence management costs as only one method would need to be documented, trained and assessed, rather than two.



4.4 Disadvantages of the implementation of modified working • Reduced train speed for sections with line speeds greater than 50mph. • The constant need for driver’s tickets to be available. • Unable to implement during telecommunications failures. • Time required in authorising train movement and briefing the driver. • Planned engineering works. • Driver may have to stop and tell the signaller the section is clear.

These disadvantages are further explained below:

Reduced train speed for sections with line speeds greater than 50mph.

Under modified working the line speed is reduced to 50mph. Therefore on sections where the line speed is normally greater than 50mph, delays will occur from travelling at this reduced speed. This delay has the potential to accumulate with successive trains such that on busy single lines the planned timetable may not be able to be supported.

The constant need for driver’s tickets to be available

For modified working to take place, the driver must have access to driver’s tickets. These are provided in metal cabinets at the line side or kept at signal boxes. To enable modified working to take place at all locations, further cabinets would need to be installed, maintained (general and in case of vandalism) and restocked with tickets. Therefore these cabinets would require some capital and ongoing investment. The responsibility for ticket availability in this instance would lie with Network Rail.

Alternatively drivers could carry tickets with them. This would negate the need for installing and maintaining cabinets. This puts the onus on the driver, and therefore the train operating companies to ensure ticket availability.

Signallers would also need to have a constant supply of tickets. If the degraded working was carried out over long periods of time requiring completing many tickets, sources of additional tickets would be required.

However, in all cases, if tickets were not available, if the cabinet was out of stock or the driver/signaller did not have any, trains would not be allowed to proceed. This would result in performance delays until tickets could be provided.

Unable to implement during telecommunications failures

Should the signal box suffer from a telecommunications failure (eg due to cable theft), in some cases it would not be possible to implement modified working. Such as in the event of two signal boxes governing a section, the responsible person not being present at the signal box, or the effected section being remote from the signal box. Telecommunications are a critical success factor for modified working. In these cases, trains would need to stop, accruing performance delays, until the telecommunications had been reinstated.



Time required in authorising train movement and briefing the driver

Based on random sampling of signal box voice tapes, it is anticipated that the amount of time required to obtain authorisation and brief the driver of each train could take on average 10 minutes depending on whether there are two signal boxes involved, the complexity of instructions and whether the site is remote from the signal box.

This reflects the amount of time required by the responsible person to ascertain that the line is clear and the signaller, if remote from the site, to dictate these instructions to the driver, and then for the diver to repeat/confirm these back to the signaller. This method of authorisation takes longer than working by pilotman (see Figure 3)

Figure 3: Relative time required authorise subsequent trains (primary delay)

This increases the signaller’s workload significantly as he/she has to repeat these instructions to every driver. For busy signalling panels, the signaller may find that modified working takes up a significant proportion of his/her workload. The additional workload pressure may lead to errors being made in other tasks eg route setting or cautioning elsewhere in the control area.

Planned engineering works

In the event of planned engineering works, or known failures that take some time to rectify, such as a failed token machine requiring a bespoke part, modified working would be required for lengthy periods (for example up to two weeks).

Currently modified working is limited to two hours (by a Network Rail instruction). Under proposal 10/052 modified working would be required indefinitely.

For long term works, modified working does not provide the optimum solution as working by pilotman is faster, both in terms of authorising trains through the section and permitted train speeds. For planned works, or works recognised to be continuing the next day, there should be no delay in waiting for the pilotman to attend site as they would be booked to do so.

Working by pilotman

Modified working


Time to set up

Briefing



Continuing modified working for long periods may affect the signaller’s performance due to the additional workload which could lead to errors elsewhere, eg giving a vehicle permission to cross a user worked crossing when it is not safe to do so.

Driver may have to stop and tell the signaller the section is clear

An additional small delay may occur if the driver is required to stop and tell the signaller that the train is clear of the modified working section. This applies to sections where the signaller(s) does not have visibility of the train leaving the section. This delay does not occur when working by pilotman as the pilotman can provide the assurance that the train is clear, where necessary.

5. Industry workshops Two industry workshops were held: one with Network Rail and one with passenger and freight operating companies. During the workshops the advantages and disadvantages of working by pilotman and modified working were discussed. The bar charts presented within this document were also discussed and were validated by the attendees in terms of the logic used to derive them.

Attempts were made to quantify the delays associated with each method of working from analysis of signal box voice tapes and delay attribution records. However, the data sample demonstrated the complex nature of the issue, with several influencing factors (such as time of delay, location of section, type of signal box and experience of involved parties) dominating the overall differences between the two operational practices.

6. Conclusion and next steps In terms of managing delay, the optimum arrangement based on the arguments set out above appears to be modified working initially converting to working by pilotman when available or for longer term/planned works. Removing the ability to work by pilotman and only carrying out modified working will hinder performance in some cases (see Figure 4).



Figure 4: Example delays from different methods of working for a series of ten trains (primary delay)

Note: the chart above excludes delays from modified working where the line speed would normally be greater than 50mph.

The analysis undertaken to date suggests that the industry would require both methods of working, to avoid any long term performance impacts.

The current Rule Book Module P2 set out the rules for both working by pilotman and modified working. However, restrictions are in place within Network Rail to limit the amount of modified working, both in terms of locations permitted and time duration allowed.

The risk assessment used by Network Rail could be reviewed to see if it is overly cautious and therefore whether it is acceptable to allow further, if not most sections to implement modified working. The findings of the safety implications paper presented to TOM SC at their meeting on 12 July 2011 could help inform this review.

In addition, a review could be undertaken to ascertain whether or not the Network Rail two-hour limit of modified working is appropriate, or whether extending this period (for example until the end of the timetabled day) is acceptable to allow more flexibility to operations. Again, the findings of the safety implications paper presented to TOM SC could help inform this review.

The TOCs could consider if there are any particular locations, where modified working is currently not permitted, that they consider would be beneficial to prioritise completing/reviewing a risk assessment.

Working by pilotman

Modified working

Modified working followed by working by pilotman


First train

Subsequent trains


explanation of change new approach to the rule book ... eoc02.pdf · explanation of change . new...

Documents