Guidance Note: Signalling Control Centres

Transcription

1 Guidance Note: Signalling Control Centres Synopsis This document provides guidance on meeting the requirements of Railway Group Standard GK/RT0025. Signatures removed from electronic version Submitted by Laura Beales Standards Project Manager Authorised by Anne E Blakeney Acting Controller, Railway Group Standards This document is the property of the Rail Safety and Standards Board Limited. It shall not be reproduced in whole or in part without the written permission of the Controller, Railway Group Standards, Rail Safety and Standards Board Limited. Published by: Rail Safety and Standards Board Limited Evergreen House 160 Euston Road London NW1 2DX Copyright 2003 Rail Safety and Standards Board Limited

2 This page has been left blank intentionally

3 Page 1 of 204 Contents Section Description Page Part A A1 Issue record 2 A2 Implementation of this document 2 A3 Responsibilities 2 A4 Health and safety responsibilities 2 A5 Technical content 2 A6 Supply 2 Part B B1 Purpose 3 B2 Application of this document 3 B3 Definitions 5 B4 Principles 7 B5 General notes 7 Part C Design requirements C1 Provision of Control Centre Equipment Ergonomic considerations 10 C2 Control methods 14 C3 Signalling controls 19 C4 Signalling indications 21 C5 Ancilliary equipment 24 C6 Other information 27 C7 Symbols and text 28 C8 Functional requirements 29 C9 Performance requirements 31 C10 Degraded signalling 32 C11 Control of a disturbed railway 33 C12 Evacuation of a signalling control centre 35 C13 Impact of multi-functional control rooms 36 Part D Design of symbols 38 D1 General notes Part E E1 Signalling control centres with lever frames, non route setting panels or block shelf switches 39 Signalling control centres with lever frames, non route setting panels or block shelf switches Part F Signalling control centres with route setting panels 88 F1 Signalling Control centres with Route Setting Panels Part G Signalling control centres with electronic display systems 142 G1 Signalling Control Centres with Electronic Control and Display Systems References 204 RAIL SAFETY AND STANDARDS BOARD 1

4 Page 2 of 204 Uncontrolled When Printed A1 Issue record Part A Issue Date Comments One October 2003 Original Document. Supersedes sections 1-6 of GK/RT0005 and appendices of GK/RT0025. This document will be updated when necessary by distribution of a complete replacement. A2 Implementation of this document The publication date of this document is 04 October This document supersedes part of GK/RT0005 Safety Related Colours for Signalling Applications. A3 Responsibilities s are non-mandatory documents providing helpful information relating to the control of hazards and often set out a suggested approach, which may be appropriate for Railway Group* members to follow. * The Railway Group comprises Network Rail Limited, Rail Safety and Standards Board Limited, and the train and station operators who hold Railway Safety Cases for operation on or related to infrastructure controlled by Network Rail Limited. Network Rail Limited is known as Network Rail. Rail Safety and Standards Board is known as RSSB. A4 Health and safety responsibilities A5 Technical content A6 Supply In issuing this document, RSSB makes no warranties, express or implied, that compliance with all or any document published by RSSB is sufficient on its own to ensure safe systems of work or operation. Each user is reminded of its own responsibilities to ensure health and safety at work and its individual duties under health and safety legislation. The technical content of this document has been approved by: Jeff Allan, Principal Signalling & Telecommunications Engineer, RSSB Enquires to be directed to RSSB Tel: or enquiries@rssb.co.uk. Controlled and uncontrolled copies of this document may be obtained from the Industry Safety Liaison Dept, Rail Safety and Standards Board, Evergreen House, 160 Euston Road, London NW1 2DX or enquiries@rssb.co.uk. 2 RAIL SAFETY AND STANDARDS BOARD

5 Page 3 of 204 B1 Purpose B2 Application of this document Part B This document provides guidance on meeting the requirements of Railway Group Standard GK/RT0025. B2.1 To whom the guidance applies This document contains guidance that is applicable to duty holders of the infrastructure controller category of Railway Safety Case. B2.2 Documents supported by this Guidance Note This document supports GK/RT0025, issue 2. B2.3 Exclusions from the application of this document Where an existing signalling control centre is to be modified, the requirements in sections C1 to C11 of this document shall apply only to those systems or sub-systems that are introduced or modified, provided that the interface(s) between the existing and new are compatible with each other. An ergonomic assessment of the impact of the changes shall be undertaken for the control centre as a whole. GK/RT0025 is written in a style that applies most readily to the design of a completely new signalling control centre. This section is intended to help interpret the standard for situations where modifications or additions are made to an existing control centre and should be read in conjunction with section B2.3 of the standard, which identifies certain exclusions from the application of the standard. The tables provided below give guidance on how to apply the standard when modifying an existing signalling control centre. Some specific forms of modifications have been included to give a range of scenarios, which together should help designers interpret the standard for other scenarios. Where the modification is on a very small scale, (for example, adding an additional circuit to an existing telephone concentrator), the requirements stated in GK/RT0025 are generally not appropriate other than to consider consistency of operation and appearance. Similarly, for the removal of equipment (for example as a result of track simplification), the requirements stated in GK/RT0025 are not appropriate. GK/RT0025 section B4 Principles B5 General C1 C7 Design requirements C8 Functional requirements C9 Performance requirements C10 Degraded signalling C11 Control of a disturbed railway Apply to the whole control centre. General guidance Apply to whole control centre if change is significant, for example, large extension to control area, otherwise to modified or new equipment only. Apply to the modified or new equipment only. Section C2.4 is intended to maintain consistency between existing and modified/new equipment. Ergonomics and workload assessments should be considered for any change. Minor alterations to an existing control panel may be simply assessed as causing no measurable change. Apply to the modified or new equipment only. C9.1 needs to be applied to the performance of the whole centre. All other clauses apply to modified or new equipment. Apply to the modified or new equipment only. Depending on the magnitude of the change it may be appropriate to maintain consistency with the existing. Apply to the modified or new equipment only. Depending on the magnitude of RAIL SAFETY AND STANDARDS BOARD 3

6 Page 4 of 204 Uncontrolled When Printed the change it may be appropriate to maintain consistency with the existing. C12 Evacuation of signalling control centre C13 Impact of multifunctional control rooms B4 Principles B5 General GK/RT0025 section C1 C7 Design requirements C8 Functional requirements C9 Performance requirements C10 Degraded signalling C11 Control of a disturbed railway C12 Evacuation of signalling control centre C13 Impact of multifunctional control rooms For most modifications to the signalling it may not be feasible to make any new provision. Modifications to communications equipment may introduce opportunities to permit calls to/from trains to be diverted to alternative locations. Apply to the whole control centre but the assessment needs only relate to consequences of the modification. Re-signalling part of the area controlled from a control panel; some features of the existing panel area non-standard or non-compliant. Apply to the whole control centre. Modification should typically keep the indications and controls in the same style as the existing. If the new signalling does not significantly change the interface of the new design and is physically taking the same space in the control centre, the ergonomic and workload impact may be simply assessed as causing no measurable change. Section C2.4 second paragraph may be relevant if the resignalled part uses different logic to operate the indications. A noticeable difference in response time may also create difficulties for the signaller. Apply to the modified or new equipment only. C9.1 needs to be applied to the performance of the whole centre. All other clauses apply to modified or new equipment. If this work includes a new interlocking some provision for degraded working during loss of the remote control link should be included. It may be helpful to the signaller if the degraded mode of operation is the same as for existing interlockings. Apply to the modified or new equipment only. Depending on the magnitude of the change it may be appropriate to maintain consistency with the existing. A local control panel may be an appropriate option if a new interlocking is provided. However if no such provision is available for the existing control centre area, there may be very little benefit in a facility that only assists trains in one small section of the controlled area. The assessment is likely to determine that no change to team working arrangements will occur. GK/RT0025 section B4 Principles B5 General C1 C7 Design requirements C8 Functional requirements C9 Performance requirements C10 Degraded signalling Providing new communication equipment in connection with a train radio scheme Apply to the whole control centre. This work would not normally be considered a significant change. Positioning additional equipment in a number of similar control centres is often troublesome and options are often limited by the existing environment. If similar equipment is to be installed in a number of similar control centres it may be acceptable to assess ergonomic requirements generically. Workload assessments for control centres with broadly equal control areas and staffing levels may be carried out generically. Not applicable. Not applicable. If the signalling facilities include local control panels, any alteration or additions to communications equipment need to make provision for communication links with these additional locations. 4 RAIL SAFETY AND STANDARDS BOARD

7 Page 5 of 204 C11 Control of a disturbed railway C12 Evacuation of signalling control centre C13 Impact of multifunctional control rooms B4 Principles B5 General GK/RT0025 section C1 C7 Design requirements C8 Functional requirements C9 Performance requirements C10 Degraded signalling C11 Control of a disturbed railway C12 Evacuation of signalling control centre C13 Impact of multifunctional control rooms Unlikely to be applicable to this type of scheme unless it includes communication links to other control centres. A facility to allow the signaller to continue to communicate with drivers when evacuated from the control centre should be considered. The specific arrangement will be determined by the evacuation strategy. The assessment is likely to determine that no change to team working arrangements will occur. Extending the control area of an existing mechanical signal box by means of a small control panel Apply to the whole control centre. Layout consideration should include more than just the new panel. Communication equipment in particular may need to be relocated to best suit new and existing control facilities. Requiring a signaller to work two very different forms of signalling at the same time needs particular ergonomic assessment. Whilst there will be many limitations on the layout of the room, attention needs to be given to the position and importance of all equipment. Section C2.4 is intended to highlight particular problems that may arise when one signaller is required to work two different types of control system. Apply to the modified or new equipment only. C9.1 needs to be applied to the performance of the whole centre. All other clauses apply to modified or new equipment. Apply to the modified or new equipment only. Depending on the magnitude of the change it may be appropriate to maintain consistency with the existing. Apply to the modified or new equipment only. Consistency with the existing is unlikely to be possible given the different technology. If the control area is being enlarged the need to consider strategies for coping with an evacuation should also increase. The assessment is likely to determine that no change to team working arrangements will occur. B3 Definitions Automatic route setting sub-area A group of signals for which automatic route setting can be enabled or disabled by one operation. Blockshelf A shelf provided normally above the lever frame or panel, to hold equipment associated with control of the line, for example block instruments, indicators and other ancillary signalling equipment. Catastrophic failure A failure that prevents a signaller from exercising any control over the signalling system, and/or results in loss of all indications on a panel/workstation. Catch handle A handle of a latch that holds a lever in a specific position in the frame. Correspondence Correspondence occurs when the detected position of all point ends forming a set of points matches the normal or reverse position to which they have been instructed to move by an external command. RAIL SAFETY AND STANDARDS BOARD 5

8 Page 6 of 204 Uncontrolled When Printed Ergonomics The science of human performance at work, studying factors and developing tools to reduce error, increase productivity, improve safety and enhance comfort. It is largely synonymous with Human Factors. Interlocking A general term applied to the control of setting and releasing of signals and points to prevent unsafe conditions arising, and equipment that performs this function. Normal (lever) The position of a lever when it is lying fully back, away from the signaller, in the lever frame. Override A facility provided in respect of some remote interlockings for use during failure of the remote control equipment. It enables all signals to be replaced to danger or nominated routes to be set for automatic working. Limited diverse routing at junctions is sometimes provided. Overview A signalling diagram or display that shows the whole of an area being controlled. Reverse (lever) The position of a lever when it is pulled fully towards the signaller in the lever frame. Signal box diagram A diagram, readable by the signaller, showing the track layout and signalling arrangements for all or part of a signalling control centre. Depending on the technology used, this may take the form of a mounted paper diagram, a control/indication panel or display screen. Signalling function An item of signalling equipment that is operated, directly or indirectly, from a signalling control centre. Signalling control centre A collective title for rooms or centres where signallers or crossing keepers operate train control equipment. For the purposes of this standard it excludes ground frames. Situational awareness The perception of environmental features and events, the understanding of their meaning, and the prediction of their status in the near future. Task Analysis A structured procedure that systematically specifies the jobs, duties, tasks and actions that a person performing that task will be doing. Visual Display Unit An electronic screen showing a graphical and/or text image generated by a computer, capable of being continuously updated. Other terms are as defined in GK/RT RAIL SAFETY AND STANDARDS BOARD

9 Page 7 of 204 B4 Principles This document supports HM Railway Inspectorate Safety Principle 20. The signalling system should provide for the safe routing, spacing and control of trains. It also supports HM Railway Inspectorate Safety Principle 21. The signalling system should continue to provide for safe passage of trains permitted to run under degraded conditions. B5 General The infrastructure controller shall provide the signaller with sufficient information and means of control to enable the movement of trains to be controlled safely and to the benefit of Railway Group members as a whole. When a new signalling control centre is being planned, or a significant alteration is being made to an existing one, the infrastructure controller shall identify all equipment to be provided and determine its layout and position on the operating floor, so as to optimise the performance of personnel working therein. Where temporary control centres are established as part of migration strategies, to facilitate major works, or are fallback control centres, all functional requirements in this document shall apply to such temporary control centres, regardless of their intended life. The working environment and the human-machine interface should be designed from the point of view of the signaller s role of controlling train movements and communicating with drivers. The processes listed in this section of the Guidance Note are basic ergonomic techniques or procedures designed to optimise signallers performance in carrying out their duties. Using these procedures will ensure that the human-centred design philosophy has been applied to signalling control centres. Ergonomics is often associated with the study of physical work (lifting, reaching, stress, and fatigue), but it also has a wider goal of improving human interaction with systems by reducing error, increasing productivity, and enhancing safety and comfort. In that sense, ergonomists do not tend to make the distinction between performance and safety that the rail industry does a well-designed system should improve output in all of these areas. A basic assumption throughout ergonomics is to design systems with the human user in mind. Human-centred design considers the capabilities and limitations of the people who will be carrying out the task, and seeks to exploit those capabilities while compensating for limitations. This process will involve design of the environment, the workstation, the interface itself and any associated technology. Each technique addresses a different area of ergonomics, and as a whole they should cover all aspects of performance. Some techniques might not be appropriate in certain situations (for example alarm design, if the system does not require alarms). However, the foundation for all ergonomics methods is task analysis, and thus should be conducted before any other aspect of design. Task analysis A fundamental ergonomics method, task analysis specifies the jobs, duties, tasks and actions that a person will be doing. A common application of this is Hierarchical Task Analysis (HTA), which breaks down the task into a hierarchy of goals, sub-goals, operations and plans. At the top of the hierarchy is an overall task statement (for example Control the safe and expeditious movement of trains ). Although HTA is largely descriptive, it forms the basis of analytical methods and can be extended to assess workload and potential errors. As such, it should be used to determine human resources and team workload, and can even help to establish maximum length of shifts. RAIL SAFETY AND STANDARDS BOARD 7

10 Page 8 of 204 Uncontrolled When Printed Usability requirements specification This analysis determines the key user needs and preferences that correspond to each of the major tasks or goals identified in the task analysis. These requirements should in turn specify design constraints in order to optimise the system around human capabilities and limitations. As an example, it might include the resolution of issues related to automation (for example ARS) does our knowledge of human performance dictate that signallers should do the task themselves or is it better to let the system do it automatically? These decisions will inevitably be context-driven, since human performance is heavily affected by external issues, such as workload or the task environment (see below). Usability requirements specification could follow from the subjective preferences of a representative sample of users, or simply guided by best practice in ergonomics. The process can be quite extensive if the project is a large one affecting many signalling control centres, or it could be much simpler if the design is limited to local modifications. In any case, the output should help to specify the optimum design from the human perspective, which should then be weighted and considered against operational and economic constraints for the overall solution. Workload assessment Assessing the workload in a signalling control centre under normal and anticipated disturbed situations is necessary to determine the optimal number of signallers needed to operate the centre, and the level of automation used in the centre. This should in turn be based on each individual signaller s workload being maintained at an optimal level, neither over nor under-loading the signaller. Both overload and under-load are known to result in performance impairments, even for short amounts of time. The workload assessment should to consider a range of issues as listed in the standard. It may be that during quiet periods a reduction in signallers is possible. Similarly, during disruption additional signallers could be drawn upon to help share the workload. However, in these circumstances, the impact on signallers situational awareness must be considered, since transferring control between signallers could affect their perception of the task and their decisions about which actions to take. Environmental requirements In most cases, the task design should be considered with respect to the specific environment in which the activities are performed. In a signalling control centre, the most critical environmental requirements are likely to be lighting and noise, although ambient temperature and humidity can also have an effect on performance. Where modifications or alterations are planned to an existing signalling control centre, the ergonomics design issues are likely to be compromised by the presence of the existing equipment or structures that are to remain. It is then necessary to consider the ergonomics of the complete installation in the context of the environment presented by the existing or retained equipment. In particular, the integration of existing and new may be considered to be inappropriate for the task. For example, an upgraded display screen may no longer be ergonomically compatible with the associated controls, even though they may be functionally compatible. Layout analysis Layout analysis can be used to design a specific human-machine interface, or it can be extended to cover an entire workstation. It is based on spatial diagrams, thus has a direct influence on the final design. The approach uses the output of a task analysis, coupled with expert opinion, to arrange interface components into functional groupings. These groups are then organised by importance of use, sequence of use, and frequency of use. That is, the analyst might wish to make the most important group of components most readily available. By doing so, interface design is user-driven and maps onto the users perception of the task. At a signaller s workstation, the layout analysis could be used to design the means to see both an overview of the entire signaller s area and the ability to 8 RAIL SAFETY AND STANDARDS BOARD

11 Page 9 of 204 access full information of a specific area. A related technique is link analysis, which could also be used in designing a workstation. Human-machine interface design This stage relates specifically to what signallers see on their displays, and how they interact with the system. In designing the interface, ergonomics experts rely on experience as well as a variety of standards, principles and guidelines. Such standards very often govern detailed choices relating to background colour and the size of letters/characters. However, there are also some core design principles that should be adhered to in making a system easy to use. These include visibility (that is making functions visible on the interface and not hiding them behind menus or obscure keys) and feedback (letting users know what action has actually been performed and what the results have been within the system). The output of the task analysis should be heavily used in this design stage, particularly to determine the optimum mix of technologies and display formats. Physical ergonomics The traditional association with ergonomics and physical work is an important step in workstation design. The analyst will draw upon anthropometric data (human body dimensions) about the user population, in conjunction with knowledge of biomechanics, to determine requirements associated with reach, adjustability, space and visibility. Although the layout of controls will be determined by other design parameters, their actual form will be influenced by ease of operation. This process should result in an arrangement that optimises comfort while minimising the potential of injury. RAIL SAFETY AND STANDARDS BOARD 9

12 Page 10 of 204 Uncontrolled When Printed C1 Provision of control centre equipment Part C Design Requirements C1.1 General The infrastructure controller shall develop and maintain national standards for the operation and indication of signalling control equipment. For established control systems these standards shall be based on existing best practice, particularly where staff work in several control centres. See associated Guidance Note. The signaller shall be provided with: a) a means of operating the signalling equipment being controlled, by means of a lever frame, control panel or workstation (as set out in section C2) b) a signal box diagram displaying the supervised track layout and the associated signalling in a clear, distinct, concise and consistent manner c) a means of carrying out voice communication with traincrew, lineside locations (for example level crossings) and other control centres d) other facilities, such as closed circuit television monitors, necessary to carry out their duties. The infrastructure controller shall carry out risk-based ergonomic assessments of signal control centres so as to demonstrate that the following factors are all designed to optimise the signaller s performance and thus minimise operator error: i) the signalling control and display equipment ii) iii) iv) the communications equipment, including facilities for emergency voice communication (see GE/RT8021) ancillary systems and equipment, for example, hot axle box detectors and wheel impact load detectors the signaller s workload v) the environment. This introductory clause serves to highlight the main requirements for the provision of information and controls needed in a signalling control centre. GK/RT0025 recognises that the ergonomic factors in the design are also significant in ensuring that the signaller is able to work efficiently and in a manner that minimises error. The opening paragraph identifies a need to consider consistency with existing practice. This will be particularly true when modifications are done to an existing centre but will still have validity where staff are to be transferred from existing centres or rostered to work in multiple centres. The need for consistency, however, needs to be balanced against the potential benefits of introducing new technologies or features. GK/RT0025 is not designed to inhibit new technologies but does caution against changes to established practice without good reason. On this basis, new or modified control systems based on lever frames or control panels should continue to operate in the manner most commonly found in that area (recognising that regional variations exist). 10 RAIL SAFETY AND STANDARDS BOARD

13 Page 11 of 204 C1.2 Information to be provided on the diagram A task analysis and specification of usability requirements shall be undertaken to identify all activities required to be carried out by the signaller. The information provided on the signal box diagram shall be determined as a result of these processes but as a minimum the following shall be displayed: a) All of the railway controlled, supervised or monitored, including level crossings equipped with control systems and/or telephones. Sections of the railway that are supervised from the signalling control centre only at certain periods (for example during closure of an adjacent signalling control centre) shall also be shown and be clearly identifiable. b) The track and signalling (for example signals, points, train detection sections) in the correct geographical relationship. It is not necessary to depict the railway to scale, but any distortion due to the representation of the layout not being to scale shall not be such as to cause confusion. c) The limits of each interlocking and ARS sub-area. d) The normal position and present state of each signalling function. e) Distances, where necessary to assist correct judgement. f) Significant geographical features affecting the safe operation of the railway (for example tunnels, station platforms). g) In electrified areas, traction neutral sections and substation/track paralleling hut gaps, station platforms. Equipment and track not under the control of the signaller but required to be shown on the signal box diagram for operational or other reasons shall be depicted in a different manner or colour (for example in outline). For workstations, it is permissible for information not regularly required by the signaller to be suppressed, with a facility for it to be called up as required. For example: i) signal, point and train detection nomenclature ii) iii) iv) the normal positions of points interlocking and ARS sub area boundaries (in electrified areas) traction neutral sections and substation gaps v) user worked level crossings with telephones. It may seem unnecessarily bureaucratic to undertake a formal task analysis when all that is required is a diagram of the area to be controlled. However it is quite possible that details will be missed unless the process is carried out in a structured manner. In particular interfaces and unusual local arrangements are features that could be missed. The list of items provided in the standard are based on existing practice but these may change if, for example, the role of the signaller is extended. Workstation based display systems provide the opportunity to select information to be displayed only when needed. An analysis of what information is needed during particular activities (arising from the usability requirements specification) should identify how to design the suppression of displayed information. Typically activities such as operating with degraded equipment, communicating with the driver or maintenance staff will require details displayed that may not otherwise be required. RAIL SAFETY AND STANDARDS BOARD 11

14 Page 12 of 204 Uncontrolled When Printed In an emergency it may be necessary to call up some of this information very quickly. The method of selecting suppressed information should be designed to be simple to aid recall in such circumstances. C1.3 Workload and assessment of working environment The workload of signallers shall be assessed to ensure that the signaller has the capacity to monitor and control the movement of trains safely and effectively both during normal and disrupted periods. The following factors shall form part of the assessment needed to determine the human resource requirements for the signalling control centre: a) the number of train movements controlled in a specified period, for example, in the busiest hour b) the time and effort needed to enable each train movement c) the degree of operational automation provided d) distractions through other duties or communications with other staff or public e) the situational awareness of the signaller f) the time and effort needed to deal with possible disruptions. Where the assessment indicates that during disruption the work needs to be shared, consideration shall be given to how the duties can be divided to minimise the risk of operator error. Workload assessments shall be conducted for all permitted combinations of signaller positioning. It is permissible for the number of signallers to be reduced at certain times, commensurate with lower traffic levels. The layout and disposition of workstation equipment and functions shall be designed to facilitate this. An assessment of the control room environment shall be undertaken so as to identify factors such as lighting that need to be controlled to enable the signaller to operate efficiently and safely. Developments in technology have enabled the areas controlled by each signaller to increase. However, there needs to be some consideration of how the signaller will manage during the failure of the equipment. In particular the introduction of ARS equipment can leave a signaller seriously overloaded when it fails. Strategies for managing this peak in workload may include reducing the number of trains or providing additional signallers. There are a number of circumstances where the geographic area controlled by a signaller can vary. Where a signal box can close with the line still open, the control of that area should be passed to another centre as stated in clause C RAIL SAFETY AND STANDARDS BOARD

15 Page 13 of 204 C1.4 Layout of controls and indications Controls and indications provided to each signaller shall be determined using the analysis and assessments as set out in sections C1.2 and C1.3. Their physical appearance and layout shall be ergonomically designed. In particular, layout analysis, human machine interface assessment and a physical ergonomics assessment shall be undertaken to identify any weaknesses with the proposed layout. Display systems not associated with a particular signaller s interface shall be similarly designed. Where controls are duplicated, appropriate measures shall be taken to avoid risk of conflict or confusion. Where the external railway being controlled is visible from the normal operating position, the signal box diagram shall be laid out in the same orientation as the external railway. Train detection indications set out in GK/RT0011 shall be provided at locations where the signaller requires to determine the precise position of a train, (for example clear of points) unless it is clearly visible from the normal operating position. Indications and alarms not immediately affecting the operation of the railway shall generally be located away from the track layout area. Means shall be provided to facilitate the updating of controls and associated display information to reflect changes in the track layout or other operating parameters. Ergonomic techniques are set out in more detail in section B5 of this guidance note. In a modern signalling control centre train detection indications are normally provided for the whole of the controlled railway. It is, however, still permissible to rely on signaller s line of sight but the likelihood of this being a practical or acceptable option is very remote for any new work other than minor changes to an existing control centre. The design of the control centre systems should take into account the fact that the track and signalling are likely to be modified during the life of the control centre. Consideration should be given to how these changes can be catered for in the control centre without causing major disruption to the running of the railway. C1.5 Response of controls and indications The equipment shall be designed to ensure that all system inputs made by the signaller generate feedback to confirm that the input has been registered. The response to a request made to the interlocking shall be made within three seconds of the control being operated. Response times of the interlocking are set out in GK/RT0060. A change of state of external equipment shall be indicated to the signaller within three seconds of it occurring. It is essential for good ergonomic design that a prompt response is generated to any input by the signaller. This does not necessarily have to be the completion of the action but does require that the signaller is given some indication that the equipment is responding. As an example, the flashing of the entrance button after it has been pressed confirms to the signaller that the equipment is responding. RAIL SAFETY AND STANDARDS BOARD 13

16 Page 14 of 204 Uncontrolled When Printed Good practice is for responses to signallers commands and changes in external functions to be made within 0.5 seconds. In a hybrid installation (clause C2.4), it may be that response times vary for different parts of the equipment due to the variation in design. This can be unsettling to the signaller who may find the variation in response time causes the rhythm of route setting to be upset. If the difference between the response time on different sections of the signaller s control area is noticeable this could become an irritation and hence distract the signaller from his main role. C1.6 Control area boundaries Boundaries between control areas of signalling control centres, signallers control areas, interlockings and ARS sub areas shall be designed to minimise their complexity and risk of confusion, particularly during the passage of trains during degraded or disturbed working conditions. Boundaries between subsystems of any type should always be kept as simple as possible to avoid complex interface issues. With regards to signalling systems it is normally more important to observe and control trains approaching junctions or critical infrastructure points rather than after they have passed by. As a result, a boundary falling between two junction areas on a two track railway is likely to be implemented with the two tracks controlled one from each control centre so that each signaller controls the trains approaching. Although this may seem complex on a plan, it does provide the signaller with the best chance to regulate trains. Consideration should be given to the management of possessions which occur at the boundary between control areas. If possession of both tracks is required, two signallers may be involved which could increase the likelihood of a communication error. On a four track railway, it is normally preferable to ensure that parallel signals are controlled from the same control centre to minimise the risk of possible confusion about which signaller is in control. If a driver is stopped at a red signal and the SPT is defective, the rule book indicates that the SPT for the parallel signal should be used. If this were routed to a different control centre there is increased risk of confusion. C2 Control methods Control shall be exercised by the signaller by one of the following methods in accordance with the interlocking principles set out in GK/RT0060. C2.1 Lever frames Each lever shall have normal and reverse positions. It is permissible for intermediate positions to be designated if this is required for the operation of signalling equipment. A catch handle shall be provided to retain the lever in the required position. Further requirements for the design of lever frames are set out in GK/RT0039. Signals shall usually exhibit their most restrictive aspect with the lever in the normal position; reversing the lever shall enable the signal to show a proceed aspect. Exceptionally, it is permissible for levers that operate signals which are usually maintained in the OFF position to be normal when OFF. Points shall stand in a position so as to minimise conflicts (as set out in GI/RT7004) with the lever in the normal position. Where an electric lock is associated with the lever this shall be released only at the appropriate time and under the correct conditions (as set out in GK/RT0060), by the operation of the lever catch handle, a separate plunger on the block shelf or a similar device. Where the correct 14 RAIL SAFETY AND STANDARDS BOARD

17 Page 15 of 204 conditions are not obvious, it is permissible for a lever free indication to be provided. Information shall be provided on or adjacent to each working lever displaying: a) the identification number of the function operated by the lever b) a description of the function c) any levers required to be pulled in sequence before the lever. A block shelf shall be provided above the lever frame. The signal box diagram(s) shall be positioned above or supported on the block shelf. No guidance provided. RAIL SAFETY AND STANDARDS BOARD 15

18 Page 16 of 204 Uncontrolled When Printed C2.2 Control panels Where control panels are employed, controls and indications shall be arranged either on a single display (combined controls and indications) or on separate displays for controls and indications, in line with existing control panel designs. Ergonomic assessments shall be used to determine which of these options is most suited for each control centre, giving particular regard to the number and roles of staff needing to work in the centre. Indications shall be clearly visible when operating the corresponding controls. Assessments of working environment shall consider the needs of all control room staff who may need to observe displayed information to ensure that displays are readable and free from glare. Where route setting is employed, operation shall be as follows: a) The action of a signaller pressing a button at the position of a signal shall cause the system to register the entrance to a route at that signal. A flashing light, in or adjacent to the position of the button, shall be provided to confirm registration. b) The sequential pressing of another button at the route exit shall cause the system to register an available destination, including any overlap. The flashing light shall change to steady. c) Where there are alternative paths to the destination, either a preferred route shall, if available, be selected automatically or additional selection devices shall be operated, for example point keys or alternative route buttons. d) The points required shall be automatically set to the required position and be locked. The line of route shall be indicated on the signal box diagram by a number of evenly spaced white lights along the route, including the overlap. e) Point correspondence shall be displayed both adjacent to the point key and in the line of route. Any points that are out of correspondence shall be indicated by a flashing light. f) When the interlocking and selection requirements (see GK/RT0060) have been satisfied, the signal shall display a proceed aspect. Evidence of this proceed aspect shall be displayed on the signal box diagram/panel. g) Replacement to danger of a signal shall be possible at any time by pulling the entrance button. h) Subject to approach locking conditions being satisfied, pulling the button shall also cause the route to restore to normal. It is permissible for train operated route release (TORR) to be provided (see GK/RT0063). i) It is permissible to allow main signals to clear automatically for subsequent trains along prescribed routes or be controlled by ARS. An associated indication shall be provided. 16 RAIL SAFETY AND STANDARDS BOARD

19 Page 17 of 204 It is permissible for alternative methods of route setting to be employed: i) A switch instead of a route entrance button. Operation of the switch shall register the route entrance. ii) iii) A switch for each route. A switch for each set of points and for each signal, the points being set to the required position before the signal switch is operated. Restoration of the signal/route switch shall replace the signal to danger. A switch as a route entrance device shall not be used with TORR or ARS as it is incompatible. Where a signalling control centre is operated by more than one signaller at a time, the controls, indications and layout shall be arranged so that each signaller has the necessary information and access to controls without obstructing or interfering with the other signallers. It is permissible in this situation to duplicate of some or all of the diagrams and indications. When a control panel is to be used, the standard identifies a choice between a combined control and indications display, or separate displays for controls and indications. The ergonomic assessments called for are designed to identify which is most suitable for the particular circumstance proposed. However, as a general rule, separate displays have been provided in control centres where there is a need for staff other than signallers to observe the indications while combined displays have been provided where signallers are the only group needing to observe the display. The alternative methods of control described have been utilised in various parts of the country and may be an appropriate choice when considering the need for consistency but the push button system is generally thought to be simplest and fastest to operate and therefore most suited to high density requirements. C2.3 Workstations Workstations based on processor technology offer a particularly wide range of input and display options. Ergonomic analysis techniques shall be used to establish the human/computer interfaces that optimise the signaller s performance during normal and degraded operations. Where workstations using VDUs are employed: a) The whole of the signaller s area shall be displayed continuously on an overview diagram that shows, as a minimum, the track layout, running signal aspects and positions of all trains. It is permissible for this display to be on more than one screen. b) Other displays, showing the detail for a specific area, shall be available to view on demand. It is permissible for the signaller to be able to call up and suppress signal, point and train detection nomenclature and associated text. c) A track layout diagram shall be provided for emergency use (see sections C10 and C11). This display shall be permanent and not affected by power or system failure. It shall be possible to attach labels (for example by magnets) to this diagram. It is permissible for the diagram to be provided in sections corresponding to signallers workstations. d) Provision shall be made for alerting the signaller to a failure of the display system, for instance, by use of a continually moving icon. It is permissible to provide workstations for control and detailed displays, combined with a fixed display diagram to give an overview display. RAIL SAFETY AND STANDARDS BOARD 17

20 Page 18 of 204 Uncontrolled When Printed Where route setting is employed, operation shall be as follows: i) The action of a signaller selecting an entrance signal icon shall cause the system to register the entrance to a route at that signal. A distinctive indication shall be provided to confirm registration. ii) iii) iv) The sequential selection of a route exit shall cause the system to register an available destination, including any overlap. The distinctive indication shall change to steady. Where there are alternative paths to the destination, either a preferred route shall, if available, be selected automatically or additional selection devices shall be operated, for example point or alternative route icons. The points required shall be automatically set to the required position and be locked. The line of route shall be indicated on the VDU by a white trace along the route, including the overlap. v) Point correspondence shall be displayed in the line of route. Any points that are out of correspondence shall be indicated by a flashing indication. vi) vii) When the interlocking and selection requirements have been satisfied (see GK/RT0060), the signal shall display a proceed aspect. Evidence of this proceed aspect shall be displayed on the workstation. Replacement to danger of a signal shall be possible at any time by selection of a control object associated with the entrance signal. viii) Subject to approach locking conditions being satisfied, the above operation shall also cause the route to restore to normal. It is permissible for TORR to be provided (see GK/RT0063). ix) It is permissible to allow main signals to clear automatically for subsequent trains along prescribed routes or be controlled by ARS. An associated indication shall be provided. It is permissible for route setting and cancellation and point operation to be by clicking on icons, keyboard operation or menu selection. At least two alternative methods shall be available. Displays using VDUs shall be designed and positioned to minimise reflections and glare. The most likely form of a modern signalling control centre is a workstation utilising computer based display systems. Clause C2.3 of GK/RT0025 sets out certain key features that need to be incorporated to allow a signaller to control and monitor the movement of trains safely. The requirement to see the whole of the signaller s control area is to enable the signaller to maintain awareness of all trains under his control. Clause C1.2 identifies the option of simplifying the display by suppressing much of the detail. Clause C2.3 also identifies a need to have some fallback arrangement which provides the signaller with a track layout diagram for use in the event of a complete display system failure. With a control panel system, even with a total loss of power to the display, the signaller still has a track layout onto which can be placed magnetic or sticky labels to show the position of trains. Some equivalent provision should be provided in a workstation in case the display system fails completely. 18 RAIL SAFETY AND STANDARDS BOARD

21 Page 19 of 204 It is essential that the operator is made aware of any control system failure that causes the indication system to freeze. This may be by, for instance, having a continuously moving icon or flashing clock motif on each display unit. Causing the screen to be blanked is a permissible option, but leaving the signaller without any display information during a period of equipment failure may well increase stress levels. C2.4 Hybrid installations Where a signalling control centre contains a mix of control and/or indication systems, the requirements of this section C2, shall be complied with for the relevant parts. The requirements of section C1.4 shall be complied with for the equipment as a whole. In particular the relationship between the various parts shall be considered to ensure a logical arrangement. The mixing of control or indication systems within a signalling control centre which appear similar but operate differently or whose indications have different meanings shall be avoided. Clause C2.4 of GK/RT0025 sets out specific issues associated with hybrid installations. Two quite different situations need to be considered. The first paragraph of the clause refers to the situation where a signaller has more than one method of signalling for the area controlled, typically a lever frame with a small control panel adjacent. The interface between the different parts should be considered carefully to ensure an acceptable method of operation and care should be given to the positioning of ancillary equipment, especially communications, given that there will be multiple work areas for the signaller. The second paragraph of the clause refers to the situation where the technology used to control the signalling is of the same basic type but not entirely consistent. This might occur as a result of a replacement of one remote interlocking of a control panel area with a newer interlocking system. In this situation the method of selecting a warning class route should be consistent, and consideration given to whether emergency replacement buttons function in the same way. C3 Signalling controls C3.1 Control requirements The task analysis and specification of usability requirements (set out in section C1.2) shall be used to determine what control facilities are required on each workstation. As a minimum, the following controls shall be provided for: a) the operation of all signals, points, level crossings, and other movable infrastructure (for example swing bridges) requiring direct control b) the release of movable infrastructure or other signalling functions for local control or operation (for example ground frames, remote token instruments) c) the operation of auxiliary functions (for example CCTV equipment, level crossing stopping/non-stopping controls) d) the operation and receipt of emergency alarms e) facilities supporting the normal signalling system during degraded or disturbed working (see sections C10 and C11) f) signalling lockout systems for staff protection (see GK/RT0030). No guidance provided. RAIL SAFETY AND STANDARDS BOARD 19