IRSE Signalling Philosophy Review 2001

IRSE
Institution of Railway Signal Engineers
IRSE
Signalling Philosophy
Review
April 2001
[Intentional Blank]
IRSE
MAINLINE RAILWAY SIGNALLING IN THE UK

A REVIEW
In the aftermath of some serious rail accidents, in particular the terrible
collision at Ladbroke Grove, Railtrack suggested that the IRSE lead a
review of signalling philosophy in the UK, with a focus on the issues
affecting trains passing signals at danger.
Discussion with a variety of organisations, including Her Majesty's
Railway Inspectorate, confirmed that the IRSE was considered to be
uniquely qualified to do this. It is the only independent, international
organisation of professional signalling experts able to offer an
unbiased view of the current situation on UK mainline railways. (The
term UK mainline railways means, in this paper, inter-city, suburban
and secondary routes, as opposed to mass transit railways).
The IRSE immediately declared itself ready, willing and able to review
the issues. It convened a Colloquium on 24 February 2000 and has
been working since then to produce this report.
This document describes what has been done and the findings. The
material and recommendations herein may be used freely but must not
be used out of context and this full document should be referenced in
any articles that make use of this material.
This Review is made available both to the IRSE membership and also
to the wider public. It has been made available to the Cullen Inquiry,
the Health & Safety Executive and Railtrack.
Questions and enquiries for further material may be addressed to:
K W Burrage, IRSE Chief Executive

3rd Floor, Savoy Hill House,
Savoy Hill, LONDON, WC2R 0BS, UK
Tel: +44 (0) 20 7240 3290
e-mail: admin@irse.u-net.com
Objects for which the IRSE was established in 1912 (quoted from our Articles):
a. The advancement for the public benefit of the science and practice of signalling
by the promotion of research, the collection and publication of educational material and
the holding of conferences, seminars and meetings.
b. The maintenance of high standards of practice and professional care amongst
those working in the industry and the promotion of improved safety standards for the
protection of the general public.
February 2001 Page 1 of 39

Mainline Railway Signalling in the UK
A Review by the Institution of Railway Signal Engineers
__________________________________________________________________
EXECUTIVE SUMMARY
FINDINGS:
Concerning Driver Performance
1. Driver performance is surprisingly good in the light of Human Factors analysis.
Nonetheless, human error accounts for a high proportion of railway accidents.
Concerning the Current Standards

2. The Review confirms that improvements are needed to the body of existing UK
signalling principles. These standards, and the use made of them, are falling
behind best practice - particularly when compared with Europe.
3. Existing signalling principles are not sufficiently complete, nor are they written in
a formal manner so as to be a generic specification for signalling systems,
although they do address the main requirements for the signalling of main line
railways in the UK - with the exception of ATP.
4. They also lack explanation of the underlying assumptions and rationale and,
therefore, depend heavily on the knowledge and experience of designers and
testers. These shortcomings are being increasingly exposed by the fragmented
nature of the UK rail industry workforce and the continuing loss of both people
and competence.
Concerning the Application of Signalling Principles

5. It is now difficult for a person to gain appropriate experience and skills.
6. The diversity of technologies and equipments in use is becoming increasingly
demanding on engineers and more thought needs to be given to the risks
generated by current procurement policy.
RECOMMENDED ACTIONS
To reduce the consequences of driver error:-
1. Signalling systems must be designed for better availability, including greater
reliability, fault tolerance and graceful degradation, so as to avoid or minimise the
requirement for human action that is not supervised by the signalling system.
2. ATP should be provided within the shortest possible timescale, preferably in the
context of cab signalling. Experience has shown that human error can occur
even where the design of signalling and driver performance appear near to
optimum, from a human factors point of view.
3. Existing lineside signals will be in use for a number of years. Inevitably there is
scope to improve human reliability in the observance of signals. Principles and
standards relating to the visibility of signals and signal sighting should be revised
as a matter of urgency.
To ensure that signalling systems provide the protection expected:-
4. Signalling systems should be developed and designed as an integral part of a
railway system, especially the track layout. Not every layout can be signalled
satisfactorily - and signalling cannot necessarily be 'bolted on' later to a
predetermined track layout.

__________________________________________________________________
5. In order to minimise reliance on human elements, the degree of protection

expected from the signalling system should be explicitly stated for both normal
and degraded modes of operation.
6. Systems authorities (or equivalent management arrangements) are needed, in
particular for systems installed wholly or partially on-board.
7. There should be a review1 of the extent to which Government should be more
involved in the approval of safety standards for the railway.
To ensure that Signalling Principles are understood and applied consistently
and accurately:-
8. Existing signalling principles and their promulgation, application and underlying
assumptions need thorough review now. This review should take account of the
rate of introduction of ATP and increased use of speed signalling techniques2.
9. The fundamental requirements of signalling systems should be explicitly stated.
Signalling principles should be traceable to these requirements and the rationale,
assumptions and reasons underlying their application to the design of specific
signalling systems should be recorded.
10. More explicit guidelines are needed to remove both individual interpretation and
also reliance on site-specific risk assessments.
11. The UK rail industry needs a strategic framework to provide experience, training
and a robust and comprehensive competence management system.
CONCERNING SUBSEQUENT WORK

1. This Review was a response to a focused request and these Recommendations
are intended to cover only the concerns identified. It was NOT a comprehensive
system review and it is likely that similar messages apply to unexamined
signalling issues and other disciplines.
2. There are a number of bodies that could act on the Recommendations. In most
cases it will be appropriate for the Infrastructure Controller and/or Industry
Standards Setting Body to take action and the Safety Regulator to direct and
monitor.
3. The IRSE 's stated intention is to promote this outcome and to continue to work
with responsible bodies, on request, to improve the situation. The Institution will,
therefore, seek discussions with relevant Infrastructure Controllers, Industry
Standards Setting Body and Safety Regulators with a view to stimulating,
facilitating and supporting appropriate actions.
1
Lord Cullen may include recommendations in his Inquiry Report.
2
The provision of speed information directly to the driver.

__________________________________________________________________
CONTENTS
EXECUTIVE SUMMARY. . . . . . . . . . . 2
BACKGROUND
Context . . . . . . . . . . . . . . 5
Language & Glossary . . . . . . . . . . . 5
Scope, Purpose & Timing . . . . . . . . . 6
Methodology . . . . . . . . . . . . . 6
THE ISSUES
Introduction to the Issues . . . . . . . . . 8
The Purpose and Scope of a Signalling System. . . 9
The Railway as a System . . . . . . . . . 11
Competency and Management of Processes . . . 12
The Driver's Task . . . . . . . . . . 13
Train Protection Systems . . . . . . . . . 14
Signalling Principles. . . . . . . . . . . 15
The Engineer's Task . . . . . . . . . . 17
RECOMMENDATIONS .. . . . . . . . . . . 19
CLOSING STATEMENT . . . . . . . . . . . 21
ANNEXES:
A. Glossary . . . . . . . . . . . . . . 22
B. Remit and Scope of the Work . . . . . . . . . 23
C. Synopsis of the Working Group 1 Report. . . . . . 25
D. Synopsis of the Working Group 2 Report. . . . . . 32
E. Synopsis of International Technical Committee Report. . 36
F. IRSE Position Paper on ATP (published 1995) . . . . 38

__________________________________________________________________
BACKGROUND
CONTEXT
1. The key reasons for the IRSE to lead this Review were its commercial
independence and its access to the best-qualified people to express opinions on this
subject. The Institution has, however, deliberately included specialists and
representatives from other disciplines in the various Groups and Colloquia and also
consulted very widely in order to ensure the best possible result. The IRSE is now
ready to express some considered views and also to undertake further work.
2. Before this work commenced, there was already an emerging view within the
IRSE that the Institution had a responsibility to make its views known. It has,
therefore been decided to make this paper openly available. It is intended equally
for experts on signalling and non-experts who are nevertheless interested in the
subject.
3. It is, however, the responsibility of the reader to ensure that they understand and
interpret correctly the points made and the terms used. (A short Glossary is
provided at the back of this paper - Annex A - but other terms may also have been
used in their specialist sense.)
LANGUAGE & GLOSSARY

4. As may be seen from discussion later in this paper, a key difficulty is the lack of
an unambiguous technical vocabulary. Indeed, a current priority for the IRSE is the
development of such a lexicon.
5. This is not yet available, so care must be taken not to assume too readily that a
definition is unique or a concept is common ground. Confusions have already
occurred within the railway community, particularly between different countries or
disciplines (for example, the meaning of absolute block) and there are the rather
more obvious ones such as sighting and siting of signals.
6. A particular problem is the term 'principle'. British Rail developed a series of
Standard Signalling Principles (SSP) which embodied not only pure theory but also
very precise and prescriptive methods and design details. However, most people
mean a fundamental or underlying principle of a generic nature when they use the
term. It is hoped that, throughout this paper, it is clear which words have a particular
meaning, but the only complete solution is to define a better suite of terms.

__________________________________________________________________
SCOPE, PURPOSE & TIMING

7. This Review is concerned only with the UK Main Line Network, although the
Institution's views take advantage of the objectivity afforded by an international
perspective. More is said within the following pages, but the ITC3 has reported that
those outside the UK are increasingly critical of the failure of the UK to employ the
best modern standards of train control and protection.
8. The IRSE is acutely conscious of the timescales for its contribution to be helpful
and relevant in the context of various Public Inquiries and debate. The date and
scope of this Statement was determined by:
a) The time elapsed since the suggestion that an IRSE view would be helpful4;
b) The deadlines for the Cullen Inquiry5;
c) The fact that five years have passed since the IRSE last made its views
known on this topic (included at Annex F); and
d) The increasing appetite of the wider public to be properly informed.
9. The IRSE has chosen not to challenge, nor to comment on, specific initiatives
and decisions already made by Government or other bodies6. The IRSE's role is to
comment more widely and help steer longer-term policy.
10. As explained towards the end of this Review, the IRSE intends to continue
developing the wider philosophy of signalling and train control in line with its Articles
and may make further Statements at appropriate stages.
11. The purpose of this Review is both to respond to the original requests but also,
as a professional Institution, to give a lead in improving safety standards for the
general public.
METHODOLOGY
12. Some 50 leading individuals were invited to an special forum in London on
24 February 2000. They included senior signal and civil engineers from the UK and
from Europe, representing railways, suppliers and consultancies, as well as the
Institution of Railway Operators and Her Majesty's Railway Inspectorate (HMRI).
13. The aim of the day was to challenge existing operating and signalling
philosophy, to allow thought-provoking comment on future issues and to identify
ideas to be taken forward, together with suggestions for timescales and mechanisms
to achieve this.
3
The IRSE ITC is a group of recognised leading signalling engineers from the main European
Railways and North America, which addresses various topics at the invitation of Council. For this
exercise, they have agreed to contribute as individuals and do not represent the views of their
employers.
4
Letter from Railtrack dated 12 Oct 1999 and discussions with Railtrack and HMRI.
5
The IRSE has provided some information to the Cullen Inquiry already but wishes its position as a
whole to be available in time to be considered fully.
6
Examples include Sir David Davies' Report and Railtrack's decision to install TPWS (Train
Protection Warning System).
__________________________________________________________________
14. The agenda covered was:

a) Factors Influencing Railway Safety;
b) Achieving An Integrated Approach To Track Layout And Signalling
Designs;
c) The Interface With The Driver;
d) Existing Measures To Control Unmitigated Overruns;
e) Train Protection Systems;
f) Signalling Principles.
15. Having reflected on the outcome, most of the concerns focused on either
Human Factors or Signalling Principles. Two Working Groups were appointed to
look into each of these areas in detail and the Remits are summarised in Annex B.
16. The Steering Group, under the chairmanship of the IRSE immediate Past
President, was established to co-ordinate external input, the activity of the Working
Groups and, in particular, to liaise with the Institution of Railway Operators,
Railtrack, suppliers & manufacturers and HMRI. (The Steering Group has, on behalf
of the IRSE, offered information and advice to both Railtrack and the Cullen Inquiry.)
17. The immediate remits were deliberately focused on the UK and issues of
current, widespread concern, rather than the whole range of railway signalling and
control. The matters covered, therefore, were a subset of the philosophy of
signalling rather than its entirety.
18. The Working Groups met extensively over the summer and a number of
recommendations were emerging by the autumn. It was agreed that the findings
justified continued consultation before being finalised.
19. The ITC met several times both to review the conclusions of the Working
Groups and also to generate its own consensus and research. The Working Groups
took account of this input and a summary appears at Annex E.
20. The Steering Group, together with the Working Groups, took account of:
a) the proceedings of a second 'Peer Review' Colloquium (7 November);
b) the views of the International Technical Committee;
c) the views of a number of individual contributions; and
d) feedback at the London Technical Meeting on 13 December;
before submitting the Review to be authorised by Council.
ACKNOWLEDGEMENTS
21. IRSE policy is to avoid listing the participants, because this Review is the
formal considered view of the Institution as a body. Nonetheless, the IRSE wishes
to thank sincerely all those who, as individuals or organisations, have contributed
freely of their time and expertise to do the work necessary to produce this paper.

__________________________________________________________________
INTRODUCTION TO THE ISSUES

22. The following chapter ('The Issues') is intended to help the reader understand
the background to the Recommendations. There is, of course, no substitute for
reading all the source material, Colloquia output and the Working Groups Reports
but, together with the Annexes, most readers should find enough here for their
purposes. The Issues are presented in seven sections as follows:-
(1) The Purpose and Scope of a Signalling System. . . 9
(2) The Railway as a System . . . . . . . . . 11
(3) Competency and Management of Processes . . . 12
(4) The Driver's Task . . . . . . . . . . 13
(5) Train Protection Systems . . . . . . . . . 14
(6) Signalling Principles. . . . . . . . . . . 15
(7) The Engineer's Task . . . . . . . . . . 17
23. There is no universally accepted definition of a signalling system and the first
section describes some of the consequences. This is extended in the second
section to address the railway as a whole - and the pitfalls for the unwary of
assuming all boundaries and interfaces are clear and understood.
24. The third section outlines the railway's dependence on competence and
processes. This has become a concern because so much has changed, subtly or
obviously, with the restructuring of the UK rail industry in the last five to ten years.
Two main areas of competence are of concern: the driver and his task and those
who conceive/plan/design/construct/maintain/correct/manage the railway system
(summarised as the engineer and his task).
25. The fourth section describes the Driver's Task. This is followed (section 5) by a
consideration of the means of protecting the railway, its staff and passengers from
driver error, in particular train protection systems.
26. Signalling principles (in their varying levels and forms) are intended to guide the
engineer in his work. The penultimate section is a resume of the main issues
followed by the final section (The Engineer's Task) covering their application and
other aspects of the engineering activity.

__________________________________________________________________
THE ISSUES
THE PURPOSE AND SCOPE OF A SIGNALLING SYSTEM
27. Railways require a signalling system both because drivers of trains cannot
“steer” around other trains or obstructions and also because the stopping distance of
trains is generally considerably greater than the distance that a driver can see.
28. Signalling systems are generally thought of as something provided to ensure
safety on the railways. In fact, their development has mirrored two needs. One is to
do with safety, but the other, also very important, is to facilitate the efficient operation
of the railway. Indeed, the intensive train services seen on many lines in the UK
would simply not be possible without the provision of a suitable signalling system.
29. It is important to bear in mind these twin purposes of signalling systems, which
can be summarised as follows:
“The purpose of a signalling system is to ensure
the safe and efficient movement of trains on the railway.”
30. The fundamental safety requirements of a signalling system include keeping
trains adequately separated from each other, and stopping (or slowing) trains where
necessary to avoid potentially unsafe situations. Efficient use of the railway, on the
other hand, is mainly about using the minimum of infrastructure to provide as many
train paths as possible.
31. The main functions of a signalling system, therefore, are to:
a) set up a safe route for the passage of each train over the track that it is to
traverse;
b) authorise the train to make the movement;
c) maintain the route while the train is making its movement;
d) supervise and/or enforce the train to stay within its movement authority;
and finally,
e) release the route (for use by other trains) after the passage of the train.
N.B. A safe route should be construed as including protection from other traffic
crossing at grade (level crossings) as well as checks within the railway system.
32. Across the world there is a wide range of signalling systems in use and the
signalling principles underpinning them are not all the same. Even in the UK, there
are differences of principle between, for example, semaphore and colour light
signalling systems.

__________________________________________________________________
33. Despite the differences between signalling systems, it is possible to identify

common “fundamental safety requirements”, for example:
a) The driver must be given unambiguous, consistent and timely information
that enables the train to be controlled safely7.
b) Facilities must be provided to stop a train in an emergency8.
34. Such commonality is obvious only at a very high level. At lower levels (and
certainly at equipment level) there is widely varying mix of embedded assumptions
and 'principles'. However, there is a need for a universally accepted set of
'Fundamental Requirements'. This would enable each railway to state explicitly how
each requirement is fulfilled, whether by technology or by other means.
35. There is no world-wide position on signalling systems. However, most
European railways have more prescriptive Rules & Regulations and allow much less
freedom to signal engineering designers to interpret principles and requirements
case by case. The role of the signalling system and its boundaries are, typically,
also clearer in other European railways.
36. More fundamentally, there is no universally accepted or absolute definition of
the scope of a signalling system. The widest definition of a signalling “system”
includes not only the signalling equipment, but also the people who interact with the
equipment (such as signallers and drivers) and the procedures and rules they have
to apply.
37. It is possible to define the requirements for a signalling system to include
detection of, and protection against the damaging consequences of, a range of
hazards to train movement, for example, rail breaks or tunnel roof fall. This is not
generally the case for UK mainline railways. However, it is now considered to be
necessary to define the whole railway system formally - and with it the boundaries
and requirement of signalling and train control.
38. Signalling systems (or active sub-systems thereof) are increasingly located on-
board the train. It is now essential that the railway 'system' is formally and rigorously
defined in sensible functional units or systems which, themselves, can be
understood and managed properly.
39. It follows that it is also necessary to create one or more 'systems authorities',
which can control the whole lifecycle of such systems, including not only standard-
setting and design but also maintenance and use. Such authorities must enable
joint ownership and have a properly constituted set of rights, obligations, rules and
arbitration. A model could be a formalised and permanent organisation of the sort
that has been supervising the Chilterns, Great Western and TPWS systems.
7
This covers the requirement to give the driver clear proceed/stop information; the provision of
warning information regarding the approach to a stop signal, where necessary (ie. caution signals or
equivalent); the provision of speed information, which may be from the signalling system itself, or by
the use of signs, route information etc.
8
This requirement could be met by the use of radio communication, rather than by the use of the
signalling system itself; the speed and reliability with which a message can be given to a train to stop
needs to be commensurate with the risks associated with the emergency.
__________________________________________________________________
THE RAILWAY AS A SYSTEM

40. The railway 'system' comprises not only the hardware but also the people and
the Rules & Regulations which should govern all activities and operations of a
railway, whether in a steady state or in a degraded or other transitional state.
41. The signalling system is but one part of the total railway; in defining a set of
requirements for a system, it is important that there is clarity regarding its role within
the overall operation of the railway - and its interface to other systems.
42. It seems to have become acceptable in recent years for a signalling system to
be the final addition to any layout or timetable that is desirable for commercial
reasons. Even the most appropriate and satisfactory overall track layout should
impose constraints on the traffic patterns allowed and the IRSE is firmly of the view
that:
a) Some layouts are unsuitable for any conventional signalling system; and
b) The design of track layouts must be undertaken as an iterative process
including the operating requirement, the permanent way, other fixed
infrastructure elements and the signalling system.
43. Another area of potential difficulty is the intrinsic benefits of some technologies
and signalling system elements, which have been introduced as by-products but
have come to be relied upon by others.
44. A good example is the rail-break detection afforded by some track circuits:
some railway operators and civil engineers have believed that they are protected
from all rail breaks by all track circuits (sometimes even being unaware that many
track circuits use only one of the two rails!). Removal of track circuits can have a
fundamental effect, not only on those responsible for the equipment but also people
who may, in emergencies, have little time to consider their reactions (users of track
circuit operating clips, for example).
45. At a deeper level, there is probably insufficient clarity and communications
between operators (and their use and understanding of rules) and engineers (and
their designs and assumptions concerning systems). Often this interface though
inadequately controlled has not caused problems, but it is ever clearer that such
interfaces are becoming more important and need managing. Rules & Regulations
should be designed and developed iteratively with the technology and systems
intended to be used for train control and signalling.
46. The requirements that a signalling system must fulfil, for it to perform its
function adequately, must be made explicit. Any assumptions that are made
concerning the operating environment in which the signalling is required to work
must be stated explicitly, including the behaviour expected and desired under
degraded conditions.
47. It is becoming ever more apparent that an integrated systems approach is
needed for the specification, design and operation of a railway, in order that there is
clarity about which elements of the railway are responsible for what. This is
particularly true in the field of safety and of signalling systems. Critical interfaces
must be specified precisely, whether system/system or system/person, with
particular attention paid to the interface between on-board systems and ground
systems.

__________________________________________________________________
48. The railway is a real-time process with many human elements. It is essential to
understand and prescribe the man/machine interactions and boundaries, not only
during steady-state operation but also during deliberate and unplanned
disarrangement (and the transitions between these states). Ideally just as with the
technology, no single human error should cause an accident.
COMPETENCY AND MANAGEMENT OF PROCESSES

49. In a high proportion of railway accidents human error is either the immediate
cause or a major contributory factor. It seems almost self-evident that human
reliability could be improved and accident rates reduced by paying proper attention
to human factors, both in the design of equipment and operating procedures and
also in the selection, training and management of staff. If human error is a major
source of accidents, it also seems self-evident that the way to improve safety is to
circumscribe the role of humans with safety devices that will eliminate the harmful
consequences of human error.
50. In practice, it is far from self-evident which of the multitude of interacting factors
can be manipulated so as to improve human reliability. Even highly automated
systems of protection still require human intervention at times. A study of human
factors to support improvements in safety is always likely to be of value and never
likely to be easy.
51. A prime example of the role of human factors studies in relation to the safety of
railway signalling is the problem of signals passed at danger (SPADs). There are
many interacting factors, which are believed to contribute to the occurrence of
SPADs, holding out the hope that improved signalling principles or technical
standards (or local detailed design improvements) could significantly reduce SPAD
risk. However, the relative importance of the various factors, and the extent to which
remedial action is possible, are far from clear.
52. Improved knowledge of human factors has the potential for improving the safety
of railway signalling systems through improvements to principles, standards, and
actual designs. The potential for improvement is not limitless, however. Where
human beings are involved, human error will occur. The aim of the signal engineer
should be to reduce both the likelihood and also the consequence of these errors.
53. It is vital that work on signalling systems at all stages of the system lifecycle is
only carried out by those who can demonstrate competence in the workplace and
whose competence is certified and subject to periodic review. A robust,
comprehensive competence assurance system is therefore an essential pre-
requisite for all employers of such staff.
54. Guidance on developing and maintaining staff competence has been (or shortly
will be) issued by the HSE in its series of publications entitled Railway Safety
Principles and Guidance. This work is supported by the IRSE and the Institution’s
Licensing Scheme is a competence assurance and certification scheme fully
compliant with the guidance issued by the HSE.
55. It would be appropriate for major Infrastructure Controllers to review how best
to enable and encourage the recruitment and training of the necessary numbers of
specialist people to fulfil their predictable needs. Particularly important is a structure
to enable individuals to gain sufficient training and wider experience, given the
fragmented nature of the current supply industry.
__________________________________________________________________
THE DRIVER'S TASK

56. Conceptual models of processes such as the train driving task or the driver’s
sighting of signals are being developed to provide a framework and tools to assist
our understanding of human reliability. The studies take as their base case current
mainline British signalling practice (with lineside signals and AWS but with no other
train protection systems). This will be extended to develop general principles
appropriate to various lineside-signalling systems, cab signalling systems, and
automatic train protection systems.
57. The interface between the driver and the signalling system represents the
greatest area of human factors related risk.
58. A number of conceptual models of the process of signal observance9 are under
consideration. All approaches agree that there are three main phases:
a) detection of the signal;
b) interpretation or understanding of the signal; and
c) acting on, or responding to, the signal.
59. There are many factors that influence the driver’s performance in each of these
phases. They include such things as driver’s route knowledge, physical attributes of
the signal (position, intensity, etc), speed/sighting time, visual environmental
features & overgrown vegetation, driver physiological factors (fatigue etc) and so
forth. In fact, more than 50 influencing factors10 have been identified to date. There
are many interactions between the various factors, and their relative weight and
significance is often difficult to predict in advance or determine after an incident.
60. Much other material exists11 and a wide variety of opinion is on offer about the
value and relevance of Human Factors theories to improve train driver performance.
However, the IRSE recognises that railway signals are obeyed correctly, and that
train drivers observe and react to signals, almost all of the time. It is therefore
difficult to gather empirical evidence on the effect of a particular parameter or on the
impact of changing it. In assessing human factors issues there is an inevitable need
to rely on a combination of evidence and expert opinion and judgement.
61. Compared with the European approach, the UK system introduces at least
three factors which all tend to increase dependence on driver infallibility:
a) Approach to, and duration of, driver training;
b) Reliance on the driver's Route Knowledge; and
c) Absence of ATP supervision.
62. However much the average or usual level of performance can be improved,
humans remain less predictable than control systems and will always have the
occasional 'bad day'. The basic choice is to introduce ATP or mitigate the driver
issues individually.
9
The term 'observance' has been chosen carefully: words such as signal sighting or observation which
are widely used tend to focus attention on optical considerations to the exclusion of other factors such
as expectation.
10
Described in detail in the Working Group 2 Report.
11
There is an extensive bibliography in the Working Group 2 Report.
__________________________________________________________________
TRAIN PROTECTION SYSTEMS (ATP)

63. The UK has fallen behind international good practice. Many European railways
have been committed to comprehensive train protection systems (ATP) for a decade
or so. (See Annex A for a concise description of such systems.) Current UK
signalling would not be accepted by authorities in other European countries, who
generally require (by law) the fitment of comprehensive train protection for train
movements above a certain speed.
64. It is no longer acceptable for the safety of train movements to be based on the
assumption that drivers do not misread signals. This is especially true given the
changing nature of railway operations, notably increasing traffic speeds, higher
traffic densities, tighter timetabling and greater flexibility of track usage.
65. The Train Protection and Warning System (TPWS) currently being fitted on UK
mainline railways is an example of a system to prevent and/or mitigate signal
overrun risk. The IRSE recognises the appeal of TPWS as a means of substantially
reducing overrun risk with a system capable of: rapid deployment, equipping only
selected signals and fitting into the same train space envelope as AWS. However,
TPWS does not provide comprehensive protection against driver error (signal
overruns and overspeeding). European authorities would not accept that TPWS
provided sufficient protection for a modern railway network.
66. Train operating companies are the autonomous customers of the mainline UK
railway. This makes more difficult the strategic decisions that must be taken
regarding the specification, provision and management of train protection systems.
No single organisation yet has overall responsibility for these decisions, particularly
their ongoing development to ensure continuing standardisation.
67. The case for any train protection system must take into account a large number
of factors, including the economics. However, cost-benefit and risk assessments are
not the whole story. Neither SNCF nor DB made the decision to implement ATP: the
governments of France and Germany decided, as a matter of public policy, that
railways and their passengers should be protected.
68. Government should consider mandating minimum standards for the extent and
types of ATP, which will be considered adequate for particular UK routes. It may
also wish to set deadlines for the complete replacement of some technologies (or in
some other way simplify the extended variety in use).
69. ATP should in principle be able to largely eliminate the SPAD risk. However, it
will require time to implement - and also requires careful consideration of human
factors issues in the design of driver display, emergency procedures and so on.
70. In theory it is possible to specify or design an ATP system from the beginning:
but this would be to reinvent the wheel. In practice, although even its advocates
would admit it is not perfect, ERTMS/ETCS has been designed and reviewed by
many competent bodies. In any case, the UK will be bound by EC Directives to
accept these specifications.

__________________________________________________________________
71. It is now inconceivable that any UK mainline railway should install any new
signalling without ATP (or retain systems lacking ATP for any significant period). It
is also hard to see any justifiable argument for installing any system that causes UK
railways to be out of line with Europe. Both for reasons of interoperability and
timescale, a national programme should be established urgently, leading to the
provision of comprehensive ERTMS/ETCS train protection across the UK network,
and to existing and new UK train fleets, in the shortest practicable timescale.
SIGNALLING PRINCIPLES
72. Signalling principles are sets of requirements for the design of signalling
systems that amplify and support the fundamental safety and core operational
requirements referred to above. Their prime concern is with safety, although not
exclusively so.
73. In many cases signalling principles are essentially technology-independent, but
some are associated with particular forms of signalling systems and the railway
administration on which they are used. Thus, for example, a principle of mainline
UK lineside signalling is that a driver is provided with information about the direction
in which his train is routed at a junction, the driver then being expected to regulate
his speed accordingly. Some other railway administrations use lineside signalling
where the driver is given only speed information by the lineside signals (ie, not route
information).
74. It should be noted that HMRI publish in the UK: “Railway Safety Principles and
Guidance” (RSP&G). These are intended as goal-setting documents but have a
quasi-legal status. UK railways are expected to comply with them (or progressively
adopt them, since the RSP&G have been in existence in their current form for only a
few years). Three of the Principles focus specifically on requirements for signalling,
and several others are closely related to signalling.
75. It is evident that, in seeking to improve standards of safety, the architecture and
design of signalling systems is as important as the signalling principles which define
the functional requirements for those systems. This is understandable, since these
factors contribute significantly to the safety integrity of signalling systems. Some
attention, therefore, has been given during this review to the architecture and design
of signalling systems of the future. However, the focus was the “principles”
underlying the design of signalling systems used on mainline railways in the UK.
76. These principles are now embodied primarily within a suite of documents
known as Railway Group Standards12. It is the application of these signalling
principles by the Infrastructure Controller and the design contractors that gives
signalling systems the functionality and integrity required for the safe control of train
movements.
77. These signalling principles have been developed and updated over many years
of railway experience, although their current documented form is relatively recent.
Over the past ten years many changes have been made to the previous documents
and a number of new documents have been produced. This work has addressed
both the principles themselves and the form in which they are presented.
12
RGS were produced and owned by Railtrack Line in accordance with Railtrack's Railway Safety
Case and the conditions of its network licence. 'Railway Safety Ltd' has just taken over this task.
__________________________________________________________________
78. The UK mainline signalling principles address a broad range of requirements,

covering the fundamental functional requirements of signalling systems, their
external and internal interfaces and, to a limited extent, constraints associated with
the use of the systems. Topics covered include:
a) locking of points;
b) safe separation of trains;
c) provision of overlaps;
d) interlocking of points and signals;
e) form, visibility and alignment of signals;
f) holding and release of routes;
g) interfaces with the signaller;
h) warning and protection systems for drivers, to reinforce the instructions
conveyed by the signals.
79. Most signalling principles do not go into great detail about how their
requirements are to be met (and many engineers consider this a weakness).
However some principles are more detailed, particularly those that deal with
interfaces between the track equipment and the trains. This arises for a number of
reasons, not least because the two sides of the interface are owned and managed
by different parties within the railway industry. Similarly, interfaces with drivers
(primarily lineside signals) are defined in greater detail, although in this case it is
because of the critical importance of drivers observing and interpreting signals in an
error-free manner.
80. In practice the design of any specific signalling system has to recognise the
context in which it is required to operate. Increasingly, signalling principles have
required the use of site specific risk assessments by individual designers. However,
a risk-based approach is not appropriate in all cases. This is particularly so where
human interactions with the system are involved and consistency in the form of the
interface is important for safety.
81. Associated with signalling principles are unstated assumptions and limitations.
For example, it is assumed that trains will stop at red signals. Train braking
characteristics limit the safe distance between trains and also determine the signal
spacing criteria - and therefore the usable track capacity.
82. There may be assumptions buried in the long evolution of signalling principles
about the driver's route knowledge and behaviour. It is now necessary for the
signalling system to provide an explicitly-stated degree of protection against human
error. In particular it must provide for comprehensive protection against single errors
by operating staff, i.e. driver error and errors by signallers.
83. Some of the present pressures for changes to signalling principles arise from
sources that are outside the immediate domain of the signal engineer. By way of
example, pressures relevant to the risk of overruns include the following:
a) traffic volume and speeds are increasing;
b) modern track layout designs may be more likely to lead to collisions in the
event of an overrun;
c) driver training contains less “on the job” learning with experienced drivers.

__________________________________________________________________
84. It is not the responsibility of the IRSE to review Railway Group Standards (nor
the Infrastructure Controller's Line Standards) either specifically or in total.
However, it has been confirmed that the present body of UK signalling principles,
practices and management processes has weaknesses and needs to be clarified
and strengthened.
85. The structural changes to the UK rail industry have highlighted how, without
integral line accountability, it is even more important to develop a clear suite of
theory and good practice to guide these activities. The situation must be improved
to ensure the UK railway can design, install and maintain coherent and satisfactory
train control systems.
86. Finally, it should be noted that the actual railway is not, and in practice never
can be, totally compliant with all current signalling principles. The long service life of
railway infrastructure makes it inevitable that most of the signalling systems now in
use were designed in accordance with principles current at the time. These may not
be identical in all respects to the principles that are currently applicable for new
designs of systems. When new or modified signalling principles are produced, it is
generally only in exceptional circumstances that retrospective action is mandated to
update the infrastructure to the new principles.
THE ENGINEER'S TASK

87. Designers and testers require a considerable level of knowledge and expertise
in order to apply signalling principles correctly. This should not be surprising but the
level of expertise and knowledge required is higher than might be expected.
88. Two reasons for this are:
a) Signalling principles can not be used directly as a generic specification for
signalling systems. They must be sifted to decide what is applicable to a
particular situation, and then interpreted correctly (bearing in mind that a
slightly different version of the same principle may be being applied
concurrently to another scheme).
b) Signalling principles are substantially complete but there are some
traditionally accepted requirements that are undocumented. The
designer’s knowledge and experience in “filling in” these missing
elements is critical in the production of safe designs.

__________________________________________________________________
89. Various factors have, in recent years, made the application of signalling
principles to the design of signalling systems in the UK a more challenging task than
was previously the case. These include:
a) The frequency with which signalling principles have been revised and re-
issued;
b) The increasing complexity of signalling systems and the introduction of
novel software-based systems, which depend on robust processes for
translating signalling principles into error-free designs;
c) The increasing range of technology and products, which is tending to
create an unmanageable system - the variety needs to be reduced;
d) The fragmentation of the industry, resulting in greater mobility of
individuals and weakening the mechanisms for acquiring skills.
(Designers once gained experience through working alongside engineers
who had spent most of their career in signalling, but this is now rare.);
e) The difficulties that designers have in visiting sites and undertaking
activities such as cab rides and signal box visits;
f) The move away from prescriptive signalling principles, requiring designers
to assess risks and to design the signalling systems accordingly.
90. The technique of Risk Assessment13 (RA) is very useful for bringing structure
and objectivity to the decision making process. It is only a tool, however, and should
be used only by suitably trained and experienced people in appropriate
circumstances.
91. When used widely or in uncontrolled conditions RA tends to produce
undesirable consequences because it leads to complex and site-dependent rules
and conditions. These can be inconsistent and later give rise to confusion about the
detailed logic and justification for specific design decisions.
92. RA is best applied consistently and by specialists who use it frequently and are
familiar with all its strengths and weaknesses. It would be better if the use of RA
was restricted more to those producing signalling principles. These standards
should include user-friendly guidelines and criteria, to help design engineers choose
from clearly described, alternative solutions.
93. There is some anecdotal evidence of insufficient control over the application of
signalling principles, with inconsistencies arising between projects. This is in
marked contrast to the control of design activities before privatisation. Compared
with a small number of regional design offices in British Rail, many more design
organisations have become involved, each of which works all over the country.
94. These weaknesses are becoming more serious. It should not be assumed that
all engineers can be relied on, for the foreseeable future, to apply all relevant
signalling principles accurately and consistently.
13
Quantitative (usually intended by QRA) - but also confused with qualitative. Both often referred to
as Risk Assessment.
__________________________________________________________________
RECOMMENDATIONS
This whole Report - and certainly the following conclusions and
recommendations - is based on a great deal of thorough work and
research elsewhere. Some of this output will be kept in the IRSE
archives but much of it appears in the Working Group Reports (some
150 pages). These need to be read in full for a complete understanding
but, for convenience, the full Working Group Recommendations are
incorporated (together with a synopsis) in Annexes C and D.
These Recommendations are the IRSE's views at the time of writing. It
should be noted that the focus has been short-term issues and
improvements; also that neither Working Group had time to pursue all
the issues which arose.
It is acknowledged that Railtrack, HMRI and other appropriate bodies are
already addressing some issues. It is noted, for example, that Railway
Safety Ltd has issued two standards concerned with overrun mitigation
(GI/RT7006 & GK/RT/0064) and no further comment is made in this
paper.
These conclusions and recommendations are interdependent,

listed in no particular order and cannot be taken individually.
95. Improvements are needed to the body of existing UK signalling principles.

These standards, and the use made of them, are falling behind best practice -
particularly when compared with Europe.
96. Existing signalling principles are not sufficiently complete, nor are they written
in a formal manner so as to be a generic specification for signalling systems,
although they do address the main requirements for the signalling of main line
railways in the UK - with the exception of ATP.
97. They also lack explanation of the underlying assumptions and rationale and,
therefore, depend heavily on the knowledge and experience of designers and
testers.
98. Any weaknesses are being increasingly exposed by the fragmented nature of
the UK rail industry workforce. The safe application of signalling principles is
threatened by progressive and continuing loss of both people and competence.
99. The certainty that signalling principles will be applied accurately and
consistently is being reduced also by the increasing reliance on site-specific risk
assessments (as required by UK signalling principles) and on individual design
decisions.
100. Signalling systems should be developed and designed as an integral part of a
railway system, especially track layout. Not every layout can be signalled safely;
and signalling cannot necessarily be 'bolted on' later to a predetermined track layout.

__________________________________________________________________
101. Existing signalling principles and their promulgation, application and

underlying assumptions need thorough review now. This review should take
account of the rate of introduction of ATP and increased use of speed signalling
techniques particularly the provision of speed information directly to the driver..
102. The degree of protection expected from the signalling system should be
explicitly stated for both normal and degraded modes of operation.
103. Fundamental requirements for train control and signalling systems should be
developed quickly and explicitly stated.
104. Signalling principles should be traceable to these requirements and the
rationale, assumptions and reasons underlying their application to the design of
specific signalling systems should be recorded.
105. More explicit guidelines are needed to remove both individual interpretation
and also reliance on site-specific risk assessments.
106. The language and terms used to describe signalling systems need to be
carefully and unambiguously defined to avoid misunderstanding and confusion.
107. A robust and comprehensive competence management system is essential.
The industry needs also a strategic framework to provide appropriate experience
and training. It is now difficult, even for a willing person, to gain appropriate
experience and skills in the UK rail industry.
108. Human error accounts for a high proportion of railway accidents, therefore
signalling systems must be designed for better availability, including greater
reliability, fault tolerance and graceful degradation, so as to avoid or minimise the
requirement for human intervention that is not supervised by the signalling system.
109. ATP should be provided, within the shortest possible timescale, ideally in the
context of cab signalling. Experience has shown that human error resulting in
catastrophic accidents can occur even where the design of the signalling system and
the training and management of drivers appear near to optimum from a human
factors point of view.
110. Existing lineside signals will be in use for a number of years. Inevitably there
is scope to improve human reliability in the observance of signals. Principles and
standards relating to the visibility of signals and signal siting should be revised as a
matter of urgency.
111. The scope and boundaries of all railway systems need to be clearly defined.
Interfaces that are critical to the correct operation of the signalling system must be
specified precisely, whether system/system or system/person. Examples are:
wheel/rail, driver/signal, and control system/signaller.
112. The diversity of technologies and equipments in use is becoming increasingly
demanding on engineers and more thought needs to be given to the risks generated
by current procurement policy.
113. Systems authorities (or equivalent management arrangements) are needed, in
particular for systems installed wholly or partially on-board.

__________________________________________________________________
114. There should be a review14 of the extent to which Government should be more
involved in the approval of safety standards for the railway.
CLOSING STATEMENT
115. This Review is based upon considerable background work and material, which
may be made available upon application to the Chief Executive.
116. These are the considered views of the IRSE - but are not presented as
infallible doctrine. The Institution is considering further work on its own initiative and
any contributions from any source will be welcomed and considered seriously.
117. There are a number of bodies that could take action on the Recommendations
above. The IRSE has neither the power nor the responsibility to direct any of these
to act. In most cases it will be appropriate for the Infrastructure Controller and/or
Industry Standards Setting Body to take action and the Safety Regulator15 to direct
and monitor.
118. The expectation of the IRSE is that the rail industry will decide how to
implement these Recommendations and where responsibility for implementation
rests. The IRSE 's stated intention is to promote this outcome and to continue to
work with responsible bodies, on request, to improve the situation.
119. The Institution will, therefore, seek discussions with relevant Infrastructure
Controllers, Industry Standards Setting Body and Safety Regulators with a view to
stimulating and supporting appropriate actions.
120. The amount the IRSE can do depends on the resources made available.
However, the IRSE will lead and facilitate the creation of a suitable lexicon of terms
and language associated with signalling and train movement control.
121. The Institution will continue16 to use its best endeavours to:
a) encourage the development of good practice in signalling,
b) maintain high standards of practice of those working in the industry and
c) promote improved safety standards for the protection of the general public
ANNEXES
A. Glossary
B. Remit and Scope of the Work
C. Synopsis of Working Group 1 Report
D. Synopsis of Working Group 2 Report
E. Synopsis of the Report of the International Technical Committee
F. IRSE Position Paper on ATP 1995
14
Lord Cullen may include recommendations in his Inquiry Report.
15
See Glossary in Annex A for definitions.
16
See our Articles - on the front page.

__________________________________________________________________
Annex A
GLOSSARY
Automatic Train Protection

A.1. Comprehensive train protection systems are more commonly known as
“automatic train protection” systems (ATP). They are provided to minimise the risk
of driver error (passing a signal at danger or travelling at excessive speed) leading to
a serious train accident (either a collision or a derailment).
A.2. To be regarded as comprehensive, such a system would:
a) be applied throughout all running lines within a defined area. Lines
operated entirely at very low speeds may be excluded provided there is
no possibility of creating a risk to traffic on other higher speed lines;
b) be fitted and be operational on all trains using those fitted lines;
c) supervise the compliance of the train with the aspects displayed by
lineside running signals, or with the movement authority information given
by a cab signalling system;
d) supervise the compliance of the train with the aspects displayed by
shunting signals where disregard could lead to a collision on a running
line;
e) supervise the compliance of the train with the permissible speeds on the
line, and all temporary speed restrictions, as applicable to the train type;
f) apply constraints to stop a movement in the opposite direction to that
intended.
g) take into account the characteristics of each type of train (braking
performance, length etc).
Industry Bodies
A.3. Infrastructure Controllers are the companies in charge of the railway
infrastructure over which trains operate and have legal responsibility for the design,
provision and maintenance of that infrastructure (in the UK that is Railtrack plc for
the mainline railway network).
A.4. Standards Setting Body is the industry body who on behalf of the railway
companies develop and publish the standards required for constructing, operating
and maintaining the railway network (in the UK that is Rail Safety for the mainline
railway network).
A.5. Safety Regulator is the government body that monitors the safety
performance of the railway companies and enforces any relevant railway safety
legislation (in the UK that is HM Railway Inspectorate which is part of the Health and
Safety Executive).

__________________________________________________________________
Annex B
REMIT AND SCOPE OF THE WORK
B.1 The Working Groups were established as part of a collaborative project

between the Institution of Railway Signal Engineers, Railtrack and Her Majesty’s
Railway Inspectorate. The overall purpose was to consider the appropriateness and
adequacy of UK main line signalling philosophy and principles, particularly in the
light of the Ladbroke Grove accident.
B.2 They were to work over the next few months to consider key aspects of
signalling philosophy and principles, under the direction of a Steering Group (also
being managed by the IRSE). The outputs were to be reviewed by the IRSE
Technical Committee and eventually made public (the means of doing this to be
considered later).
B.3 The Groups were expected to make recommendations in each of the areas
described below. It was recognised that this was a substantial workload, and that
the priorities for the work may not necessarily be in the order first given.
B.4 It was intended that good progress would have been made by September 2000
in the most urgent areas, and that some consideration will have been given to all the
subject areas described above, in order that the IRSE could give an interim report on
its work.
B.5 The recommendations would almost certainly be incomplete, but would be
sufficient in order that the IRSE could recommend:
a) What should be done (either by the railway authorities or in terms of
further work by the IRSE).
b) Who should take responsibility for the actions or further work.
c) What roles the other interested parties should take.
WORKING GROUP 1 - SIGNALLING PRINCIPLES

B.6 This Working Group would consider four key areas in relation to signalling
principles, as follows:
a) The hierarchy, broad purpose and content of, and the relationships
between, UK signalling principles, HMRI principles and guidance,
technical specifications and codes of practice. Particular consideration will
be given to:
i) How these fit together underneath an overall “signalling philosophy”,
and how / where this should be expressed.
ii) The extent to which principles should be prescriptive, as opposed to
performance-based or relying on risk assessment.
iii) The need for compatibility between the signalling principles and the
operational rules for the running of the railway.

__________________________________________________________________
Annex B
REMIT AND SCOPE OF THE WORK
b) How signalling principles and related standards should be made intelligible

and visible (to those who have to apply them) and promulgated, used and
applied (taking into account the current industry structure).
c) The extent to which current signalling principles reflect the signalling
philosophy of main line railways in the UK and are adequate for the needs
of the modern railway (including emerging requirements for ERTMS).
d) Key areas of signalling principles that need urgent attention, including:
i) SPAD risk at junctions
ii) Junction signalling
iii) Capacity & timetabling issues
iv) System availability & degraded modes of operation
v) Coping with the limitations of lineside signalling
vi) Positioning and visibility of signals
vii) Principles for ERTMS
WORKING GROUP 2 - HUMAN FACTORS

B.7 Bearing in mind that a signalling system is a means of communicating
information to a train driver or signaller, this Working Group would consider:
a) The human factors principles relating to the transmission and
understanding of information sent to the driver (and signaller) via both
lineside and in-cab signalling systems, including:
i) optical (and aural) perception, response times, etc.
ii) nature of the driving or signalling task, the interface with the
signalling system distractions, etc
iii) cognitive features relating to drivers' or signallers' understanding,
knowledge, memory, etc.
iv) what should be assumed to be the reasonable envelope of human
performance as a part of a signalling system
b) How human factors parameters and criteria relating to signalling should be
developed (including a review of existing values and their history, but
excluding, for the moment, driver training as such unless it had a direct
bearing on the philosophy and principles of the whole signalling system)
c) Review of existing signalling philosophy and principles from a human
factors perspective.
d) Advise Working Group 1 on human factors implications of their
recommendations.

__________________________________________________________________
Annex C
Synopsis and Detailed Recommendations from
Working Group 1 - Signalling Principles
SYNOPSIS OF WORKING GROUP 1 REPORT

C.1 The focus of the group’s activities has been the “principles” underlying the
design of signalling systems used on main line railways in the UK. These principles
are embodied primarily within a suite of documents known as “Railway Group
Standards”. It is the application of these principles that gives signalling systems the
functionality and integrity required for the safe control of train movements.
C.2 The Working Group’s report concentrates primarily on the processes by which
signalling principles are produced and applied, rather than on their detailed technical
content. This is deliberate, and although it is important that particular technical
deficiencies are rectified, this alone would not address the more fundamental issues
that the report exposes. The issues that the report considers include:
a) The railway “system” context in which signalling principles have to be
applied.
b) The constraints and assumptions associated with the design and use of
signalling systems.
c) The documented form of signalling principles and the ease with which they
can be understood by signalling designers.
d) The competence of signalling designers to apply correctly the
requirements of signalling principles, and the factors that are adversely
affecting that competence.
e) The suitability of the current signalling principles for today’s railway.
f) Overrun (SPAD) protection, including train protection systems.
g) Management of systems that are partially track-based and partially train-
borne.
h) Signalling system reliability and degraded modes of operation.
C.3 The report includes a number of detailed recommendations, set out in the
following logical groups, but not ranked in any order of priority or importance:
a) Signalling systems architecture and management
b) Signalling principles – general
c) Degraded modes of operation and signalling systems reliability
d) Overrun protection : train protection systems
e) Overrun protection : processes for assessing overrun risk
f) Overrun protection : other measures

__________________________________________________________________
Annex C
SIGNALLING SYSTEMS ARCHITECTURE AND MANAGEMENT

1. Systems authorities, or equivalent management arrangements, should be
created to manage systems that are partially train-borne and partially
infrastructure-based, with the objective of ensuring that such systems are
specified, used, maintained and supported in a manner which ensures that
they are safe and fit for purpose throughout their service life. Given the multi-
party nature of the UK rail industry, accountabilities need to be clearly defined.
2. Consideration should also be given to the need for a systems authorities

approach to other interfaces, rather than limiting the application to systems
such as ERTMS, TPWS and CSR. Examples might include, for instance, the
wheel-rail interface, and safety-related people interfaces between companies
.
3. Signalling principles and architectures for signalling systems should, so far as
is reasonably practicable, avoid susceptibility of systems to single-point failures
that could result in unsafe situations arising.
4. The relationship of international standards (IEC61508, EN50128, EN50129) to

the signalling principles and the design processes mandated in Railway Group
Standards should be clarified, and the UK standards harmonised with the
international standards.
5. Consideration should be given to the practicability and benefits of designing

signalling systems such that the “control” and “protection” functions are
separated, in accordance with the safety principles advocated in IEC61508. If
this proves to be feasible and beneficial, signalling principles documents and
requirements specifications for signalling systems should reflect this
separation.
6. When planning the next generation of systems, the assumptions associated

with signalling principles and with the design and use of signalling systems
should be identified and considered in terms of their appropriateness.
SIGNALLING PRINCIPLES – GENERAL

7. There should be a defined and agreed set of fundamental safety requirements
that is common to all methods of signalling used on UK mainline railways.
This set should be applicable to the whole “system”, regardless of whether they
are fulfilled by technical means or by application of procedures and rules.
8. The contribution that the application of signalling principles (in the design of the
signalling system) and the use of operational rules (by signallers, drivers and
others) each make to the safe control of train movements should be clearly
defined and documented.

__________________________________________________________________
Annex C
9. Signalling principles should expand upon, and be clearly traceable to, the
fundamental safety requirements of signalling systems. The manner in which
signalling principles together comprise a logical and hierarchical set of
requirements should be visible to those who have to apply the principles.
10. Signalling principles documents should make clear those elements that are
mandatory, those that are discretionary and any caveats, conditions or
constraints that apply to mandatory and discretionary elements.
11. Risk assessment should be mandated in signalling principles documents only

where the nature of the situation under consideration makes it necessary to
consider the risks and select appropriate risk control measures on an
application-specific basis. The mandating of risk assessment is not
appropriate where:
• the data/knowledge is not available to enable a meaningful assessment of
the risks; or
• uniformity in the application of measures across the network is essential.
12. Where signalling principles mandate risk assessment as the means of

selecting the control measures to be applied in the design of a specific
signalling system, guidance should be given on how to conduct the
assessments, supported wherever practicable by factors for consideration and
data that will facilitate the process.
13. The processes by which signalling principles are produced and revised should
be reviewed, to ensure that the production processes identify and address all
non-negligible risks systematically, and in a manner that ensures that the views
of key stakeholders are obtained and considered.
14. The effects of change on the validity of signalling principles should be

monitored and reviewed periodically, to ensure that appropriate levels of safety
are maintained. Changes, in this context, include operational, organisational,
process, technical and legislative changes.
15. Signalling principles documents should set out clearly how decisions are to be
made as to which principles are applicable to a specific situation. Thus, for
example, principles relating to the various forms of junction signalling should
also define the decision-making criteria whereby the most appropriate form of
junction signalling is selected for a particular location.
16. Signalling principles documents should explain why particular requirements are
mandated, and how they related to operational rules (eg. in the Rule Book), to
aid industry understanding.

__________________________________________________________________
Annex C
17. The rationale, assumptions and justification for signalling principles should be
recorded, and this information made available to users of signalling principles
documents.
18. The rationale, assumptions and reasons underlying the application of signalling
principles to the design of specific signalling systems should be recorded.
19. The reasonableness of the assumptions associated with signalling systems,

and the dependency of signalling principles upon them, should be reviewed.
Particular attention should be given to “driver route knowledge” assumptions.
20. Processes for proposing and authorising non-compliances against signalling

principles need to be made known better to the industry, and rigorously
applied.
21. The arrangements for communicating changes to signalling principles should

be reviewed, to find more effective ways of ensuring that those who have to
apply them are aware of changes and the impact on the projects on which they
are engaged.
22. Ways should be found and implemented for monitoring the application of
signalling principles, so as to promote consistency of application.
23. Formal mechanisms should be established for dialogue between train

operators (in particular, drivers and driver standards managers), signallers and
signal engineers (both standards-setters and designers) to provide feedback
from the “customer” on signalling system design.
24. Signalling designers should be provided with ready access to the sites for
which they are preparing designs, and with facilities for occasional cab riding,
in order that they can better understand and meet the needs of the driver.
DEGRADED MODES OF OPERATION AND SIGNALLING SYSTEM

RELIABILITY
25. A study of options for providing degraded modes of operation within signalling
systems should be undertaken to build on previous work undertaken by the
IRSE17 and the output disseminated for industry debate. Consideration should
be given to the associated operational rules to be applied when making use of
such modes.
26. Other European railways are perceived to achieve high reliability of their
signalling systems. If this perception is correct, their means of achieving it
should be investigated and best practice adopted, since unreliability has
secondary safety implications.
17
Report: “Operational Availability of Railway Control Systems”
__________________________________________________________________
Annex C
27. The causes of the large number of Category B overruns (ie, overruns caused
by technical failures within the signalling system) should be systematically
investigated, with a view to reducing the number significantly.18
28. Principles should be established for ensuring “continuity of control” of the

railway (including, but not only, principles for the design of large control
centres), in view of the potential for secondary safety risks associated with
major system failure. The principles should address:
• system availability
• ensuring safety in the event of a major failure
• control of train movements during the failure
• recovery from the failure
OVERRUN PROTECTION : TRAIN PROTECTION SYSTEMS

29. UK signalling principles should require the provision of comprehensive train
protection systems, and every opportunity to introduce train protection systems
should be investigated, both when new trains are planned to be introduced
onto the network, and when re-signalling is being planned.
30. The goal should be fitment of a nationwide comprehensive train protection

system (ERTMS/ETCS compliant) to provide full protection for trains on
passenger lines. Ideally this should take place within the context of a strategy
for providing cab signalling instead of lineside signals. The rail industry must
collectively find the will, and develop the strategies, to pursue this goal.
31. In developing the plans for the implementation of comprehensive train

protection systems, use should be made of the knowledge and experience of
other railway administrations, particularly in areas such as human factors, low
adhesion management, dependency on route knowledge, operational rules
(including operation under failure conditions), and warning/intervention
arrangements.
32. It is likely that there will be for the foreseeable future a variety of train
protection systems on the UK main line railway. Therefore the technical and
operational issues concerning the upgrading and compatibility of such systems
should be identified and managed from the outset by all affected organisations,
on a co-operative basis.
18
Although overruns in this category are less serious from a safety perspective when considered
individually, they are undesirable, and are indicative of the general unreliability of the signalling
system. In volume terms, they have significant secondary safety implications. It is with this in mind
that this recommendation is made.
__________________________________________________________________
Annex C
OVERRUN PROTECTION : PROCESSES FOR ASSESSING OVERRUN

RISK
33. The processes for the assessment of overrun risk when designing track and
signalling should be strengthened to ensure that a multi-disciplinary, integrated
and systematic approach is adopted which explores all options for risk
reduction. It should involve not only signal design engineers, but operators
and track design engineers as well. Such processes need to start at an early
stage in the design of track and signalling.
34. So far as is practicable, the overrun risk assessment of layouts should include
consideration of the effects of timetable disruption, specifically in terms of the
increased likelihood of signals being encountered at danger. This is
particularly important where comprehensive train protection systems are not in
use.
35. The design of track layouts and signalling should consider at an early stage the
extent to which features that have the effect of increasing collision risk are
operationally necessary (eg. bi-directional facilities). This is of particular
significance where train protection systems are not in use, and the alternative
risk mitigation measures may provide only limited control of the risk.
36. Planned changes to the use of the track and signalling which could have a
significant impact on overrun risk should be subject to review before they are
implemented, to ensure that risk is not increased to levels which would be
unacceptable. Such review is particularly important where comprehensive
train protection systems are not in use.
OVERRUN PROTECTION : OTHER MEASURES

37. The current signalling principles regarding the setting of points to protect
authorised train movements from overrunning trains should be strengthened
and made less open to interpretation, so as to provide greater protection
wherever this is practicable.
38. In due course it may be possible to amend some of the existing principles
regarding overrun protection, when train protection systems are fully
operational. However, caution should be exercised in this area, particularly in
respect of TPWS, until significant experience is gained of the benefits of such
systems in controlling overruns.

__________________________________________________________________
Annex C
39. Signalling principles should specify that an overrun of a signal at danger should
always be detected by the signalling system at the earliest possible
opportunity, and that such detection should be used to replace other signals to
danger automatically (ie, without the intervention of the signaller), to reduce the
likelihood/severity of a collision (unless there is clearly no safety benefit in so
doing). This recommendation is made irrespective of the level of train
protection provided, to mitigate hazards such as poor adhesion and incorrect
application of procedures for the movement of trains after an overrun has
occurred.
40. Investigations should be conducted into the feasibility and benefits of providing
a diverse means of ordering a train to stop when it has overrun a signal at
danger, either automatically or by the action of the signaller (eg, by use of radio
to send an emergency stop message).
41. The requirements for the visibility of signals should be revised, with particular
attention paid to:
a) providing extended viewing times for signals that require it (eg. complex
signals and signals on gantries spanning multiple lines that are signalled in
the same direction);
b) better definition of acceptable levels of obscuration of signals;
c) importance of correct alignment;
d) making sure the driver is “in the beam” (avoiding signals of excessive
height);
e) difficulties of sighting signals that have curved approaches;
f) helping drivers to identify which one of a number of parallel lines they are
on and which signal ahead is applicable to their line.
42. The processes by which the form, position and alignment of signals is decided,
including the role of signal sighting committees and the competency of those
involved, should be reviewed so that there is minimal risk of a signal being
positioned/aligned inappropriately.

__________________________________________________________________
Annex D
Working Group 2 - Human Factors
SYNOPSIS OF WORKING GROUP 2 REPORT

D.1 The aim of Working Group 2 has been to increase the understanding in the
railway signalling profession of the way that human factors affect the overall safety
of the system of control of train movement by signals. The report is intended to be
read for the sake of the information which it contains, and not simply as support for
its recommendations.
D.2 The report starts with an overview of the basic principles of human factors,
following on from the earlier IRSE Technical Committee report on this subject. It
goes on to consider a conceptual model of the train driving task and classify the
relevant types of human error. Current data on the causes of SPADs (Signals
Passed At Danger) is analysed in relation to these error types.
D.3 There follows a detailed analysis of the task of observing signals, from which a
large number of relevant design, operation and management are identified and
discussed.
D.4 Issues arising out of recent investigations of multi-SPAD signals are also
reported.
D.5 There is some consideration of method assessing how the factors relevant to
the observance of signals combine and interact.
D.6 The characteristics of the driver as a human component of the railway system
are reviewed, and the extent to which the use of ATP changes the scope for human
error is examined.
D.7 The report closes with a survey of relevant human factors research.
D.8 The report includes a number of detailed recommendations, set out in the
following logical groups, but not ranked in any order of priority or importance:
a) Principal Recommendations
b) Overall Design of Signalling Schemes
c) Signal Sighting
d) Driving Cabs
e) People
f) Further Work

__________________________________________________________________
Annex D
PRINCIPAL RECOMMENDATIONS
1. There is scope for human reliability in the observance of signals to be improved
by attention to human factors in the development of signalling principles and in
the design of signalling schemes. It is essential that human factors are taken
into account in the development of signalling principles.
2. There is significant risk that human error resulting in catastrophic accidents can
occur even where the design of the signalling system, and the training and
management of drivers, appear to near optimum from a human factors point of
view. The elimination of human error would require the elimination of the
human element. Provision of a system of automatic train protection is
recommended as by far the most effective means of minimising the
consequences of human error in the observance of signals.
The remaining recommendations are grouped by topic but are not in any order of
priority.
OVERALL DESIGN OF SIGNALLING SCHEMES

3. Human factors considerations need to be part of the high level design brief for
a signalling scheme. The scope for adequate design of signals and other
feature with regard to human factors should not be constrained by prior
decisions concerning train service performance, line capacity, and track layout
etc.
4. All new signalling schemes must have as a prime objective the achievement of
clearly visible and unambiguous signalling. All track, structures, and other
infrastructure equipment must be designed to facilitate this objective so far as
possible.
5. The use of computer simulation to aid the design and sighting of signals and
the training of drivers is highly desireable. This should be considered for all
new layouts, and retrospectively for existing complex layouts to support driver
competence refreshment.
6. All technological solutions must be assessed for human factors risks in both
normal and degraded modes of operation, to ensure that any change does not
create a greater overall risk.
7. There is a need to ensure consistency in the human factors related features of

signalling design, to avoid confusion or ambiguity in the observance of signals.

__________________________________________________________________
Annex D
SIGNAL SIGHTING
8. Individual signals are elements in a continuous system and should not be
considered in isolation. Each signal must be considered in the overall context
of the driving task at that point, the information conveyed by the preceding
signals, and the driver’s likely expectations of what will be encountered ahead.
9. Signals should be spaced consistently and provide aspect sequences that

convey clear and unambiguous messages and which minimise the creation of
false expectations (see section 8.3).
10. Signals must be considered in relation to speed changes and other signs and
infrastructure features affecting the driving task. This refers both to the risk of
sensory overload when a driver may be required to observe a number of
closely spaced markers and signs as well as a signal, and to other features
which require his attention, such as neutral sections or station platforms.
11. Signal sighting times must take account of the complexity of the identification
and reading task at the signal concerned.
12. The background against which a signal is viewed must be considered, and
additional measures such as large backboards should be provided where it is
not possible to locate the signal to be viewed against a satisfactory
background.
13. AWS should be treated as part of the infrastructure directly associated with the
signal, both in relation to its audible warnings and its role as a visual marker
(see section 8.5).
14. The signal post acts as marker and should be sufficiently conspicuous to fulfil
this role. Where signals are gantry mounted, the use of a stopping marker at
ground level should be considered.
15. Signalling structures should be designed, constructed, and positioned to

maximise their visibility and ease of identification to the driver. All aids and
signs required to identify the position or aspects of signals (e.g. count down
markers, signal reminder boards, etc) should be consistently and universally
applied throughout the network.
16. More research is needed to establish the relative importance of factors which
influence the reliable observance of signals. Recommended priorities in this
area are sighting time, and signal position, alignment, and intensity.

__________________________________________________________________
Annex D
DRIVING CABS
17. Driving cabs should be designed and maintained to provide a good
environment for alert and stress free driving.
18. The design of the cab and windscreen should ensure that the driver has clear
and uninterrupted sightlines to any position where signals may be located.
This should take account of the possibility of signals located in less than ideal
positions, e.g. to the right of the line.
PEOPLE
19. All people involved in signalling and layout design should be made aware of
human factors influences and how these impact on the final users of such
designs.
20. The input of the final user should be an essential part of all design
development.
21. Guidance should be prepared and published to assist engineers to incorporate

human factors in the development of signalling principles and in the design of
signalling installations.
22. There is scope for human reliability to be improved through the selection,
training, and management of drivers. Signal engineers should assist by
producing guidance to operators on the significant factors relating to signal
observance.
23. The fact that train drivers have other tasks to perform besides the observance
of signals (e.g. station duties, neutral sections, control of trains on gradients
etc) should be taken into account in signalling design.
24. An understanding of the principles of railway signalling should be part of the

training of all drivers. This training should be updated when new and revised
signalling principles are introduced.
25. It is important to ensure that all those involved in signal sighting, design,
checking decision making, and approval have a suitable knowledge and
competence in relevant human factors.
FURTHER WORK
26. The work of this report should be extended to include other tasks such as the
activities of signallers and control room operators - and handsignallers and
others involved in degrade mode or emergency operation. It should also be
extended to cover in-cab signalling.

__________________________________________________________________
Annex E
Synopsis of the Report of the
International Technical Committee
INTRODUCTION
E.1 The IRSE Technical Committee was asked to consider UK signalling practice in
relation to that applied in other countries and to highlight the important differences.
The ITC members have collected and presented this information under their
personal responsibility and the information represented here does not represent
official positions from their national railways or safety authorities.
E.2 The committee considers that there is no worldwide common position on
signalling and therefore its comments reflect the experience of the countries
represented in the ITC only. Even in those countries represented the practices
differ. Contributions representing the situation in the various countries are provided
as appendices to the ITC Report.
ATP
E.3 In contrast to the position in the UK, in all the countries examined, the fitment of
lines and trains with ATP is mandated by the government. The requirements are
satisfied by currently available commercial systems. In general, where passenger
trains are permitted to exceed a designated speed (e.g. above 79mph in USA and
above 120Km/h in Austria), lines and trains are fitted.
E.4 The present extent of network fitment varies from country to country, for
example all signalled lines in Germany and in the Netherlands are covered; in SNCF
80% of locomotive cabs and signals are fitted.
MANAGEMENT OF SAFETY STANDARDS

E.5 In the countries considered in appendices A-D the approval and enforcement of
railway safety standards (and systems and equipment) is the responsibility of a non-
commercial body.
ROUTE KNOWLEDGE
E.6 The UK route signalling system requires drivers to possess route knowledge in
order to understand and interpret the information presented to them by lineside
signals and to deduce the required speed or braking action.
E.7 The ITC believes that the extent of the route knowledge requirement constitutes
a major difference in practice between the UK and the countries examined.
E.8 A positive outcome of the fitting of ATP systems in the UK will be to take the
interpretation of information and the supervision of safety related actions into the
system, reducing the dependence on route knowledge and reducing the
opportunities for human errors to affect safety.

__________________________________________________________________
Annex E
Synopsis of the Report of the
International Technical Committee
FUNDAMENTAL REQUIREMENTS
E.9 The ITC endorses the list (for convenience, shown in outline below) of
fundamental requirements drawn up by Working Group 1, together with the
explanatory and qualifying remarks that are made with them, but has identified two
additional fundamental requirements that must be added:
i) Whenever the safety requirements, which had to be met before a train was
authorised to proceed on a given stretch of line, are no longer met, the authority
to proceed must be revoked.
j) Protection shall be provided for people working on or near the track..
RAIL INTEGRITY
E.10 In many countries the signalling system is not considered part of the process
for the assurance of rail integrity. If the signalling system is to be used for this
purpose, its expected role and the associated limitations must be clearly defined and
understood. For example, SNCF have a clearly laid down strategy by which the
contribution of track circuits to the detection of broken rails is defined. Other
administrations rely entirely on a system of track maintenance and non-destructive
testing for the identification and management of rail defects
===========
Fundamental Safety Requirements for Signalling Systems

on Mainline Railways in the UK
Extracted from Working Group 1 Report (without comments)
a) Before a train is been given authority to move onto the section of line, the line must be proved to
be secure (to prevent derailment and potential conflict with other authorised movements) and
clear of other traffic (to prevent collision). That security must subsequently be maintained until
the train has passed clear.
b) The driver of the train must be given unambiguous, consistent and timely information that
enables him to control his train safely.
c) Sufficient space must be provided between following trains, to allow each train to brake to a
stand safely. This space must be calculated on the assumption that the train ahead is stationary.
d) The signalling system must prevent, and/or mitigate the consequences of:
• drivers passing the limit of the movement authority given to them; and
• drivers exceeding the maximum permitted speed for the train.
e) Facilities must be provided to stop a train in an emergency.
f) Protection must be provided for the public and trains at level crossings.
g) In the event of a failure of the signalling system, the system must remain in, or revert to, a state
which preserves the safety of trains.

__________________________________________________________________
Annex F
IRSE Document Issued in 1995
POSITION PAPER ON ATP
1. Background
1.1 Automatic Train Protection (ATP) systems exist to act as a technical

safeguard against train driver error and vary in their complexity
depending upon the characteristics and requirements of the particular
railway administration concerned.
1.2 A considerable variety of ATP systems exist supplied by a number of

manufacturers both in Europe and world-wide to meet the needs of the
numerous railway administrations concerned.
1.3 High speed passenger railways, e.g. TGV in France, ICE in Germany
and AVE in Spain are equipped with ATP.
1.4 New railways, e.g. Docklands and Eurotunnel, are equipped with ATP
as are most metro railways (e.g. London Underground).
1.5 The railway signalling suppliers can supply ATP systems appropriate to
the technical and operating requirements of the railway authorities,
including BR/Railtrack.
1.6 Railway signal engineers can design, supply, install, test and maintain a
suitable form of ATP system for any of the existing known requirements
of the railway administrations in the world.
2. BR/Railtrack Situation
2.1 Two pilot installations of BR-ATP on the Chiltern line and Great Western
mainline Paddington - Bristol have been operating since 1993 to test the
adequacy of ATP technology on Britain's mixed traffic mainline railway.
The pilots have successfully demonstrated that BR/Railtrack operating
requirements can be met.
Continued
-1-

__________________________________________________________________
Annex F
3. London Underground Situation
3.1 All London Underground lines are equipped with a basic form of ATP
which applies emergency braking should a train pass a signal at danger.
3.2 New lines are equipped with modern forms of ATP (which provide
continuous protection) and existing lines are usually equipped with ATP
when resignalled. For example, the Victoria line and, more recently, the
Central and Waterloo and City lines are so equipped, as will be the
Jubilee line as part of the Jubilee line extension project when it is
completed.
4. Attitude of the Regulatory Authorities
4.1 It would not be permitted by the safety regulatory authorities of any of the
major railway administrations for a railway signalling system to be
installed that did not have safeguards against signal operator error and
similar pressure is being exercised to protect against train driver error.
4.2 Safety regulatory authorities frequently call for ATP to be provided on new
lines or on lines subject to major renewals.
5. IRSE Position
5.1 The IRSE believes that it is the responsibility of railway administrations to

provide adequate support for drivers of trains, including an appropriate
combination of clear unambiguous instructions via signals and speech
communication systems, in-cab warnings and reminders, and
interventions following lapses in driver performance. The exact choice of
such facilities must be made by railway administrations according to the
traffic, speeds and relevant circumstances of the particular railway.
5.2 The IRSE and its members continue to do all they can to work to improve
the safety, efficiency and cost-effectiveness of signalling and ATP
systems for the protection of the travelling public and the commercial
success of rail transport and the railway equipment suppliers.
April 1995
-2-

[Intentional Blank]
IRSE

A REVIEW
REPORT BY WORKING GROUP 1
1. INTRODUCTION
1.1 This report has been produced by a Working Group established by the
Institution of Railway Signal Engineers. The membership of the group is
shown in Appendix A of this report, and the remit for the work of the group is
shown in Appendix B.
1.2 The focus of the group’s activities has been the “principles” underlying the
design of signalling systems used on main line railways in the UK (the term
main line refers to inter-city, suburban and secondary rail routes). These
principles are embodied primarily within a suite of documents known as
“Railway Group Standards”, which are currently produced and owned by
Railway Safety (previous Railtrack’s Safety and Standard Directorate). It is the
application of these signalling principles that gives signalling systems the
functionality and integrity required for the safe control of train movements.
Throughout this document, the term “signalling principles” refers both to the
principles themselves and also the Railway Group Standards in which they are
documented.
1.3 This report concentrates primarily on the processes by which signalling
principles are produced and applied, rather than on their detailed technical
content. This is deliberate, because the adequacy of the contents is largely
attributable to the processes by which signalling principles are produced,
reviewed and revised. Although it is important that particular deficiencies in the
principles are identified and rectified, this alone will not address the more
fundamental issues that this report exposes.
1.4 In the time available the Working Group has not been able to fully address all
the elements of the remit. Specifically, the following have not been considered
in any detail:
• Capacity and timetabling issues
• Coping with the limitations of lineside signalling
• Principles for ERTMS
1.5 A second IRSE Working Group has examined human factors, particularly in
relation to drivers. Input has been received from that second group, in order to
facilitate consideration of signalling principles that have a significant human
factors dimension.
1.6 The Working Group welcomes comments and responses to this report. All
comments should be directed to the Institution of Railway Signal Engineers.

Report by Working Group 1 - Signalling Principles
__________________________________________________________________
2. EXECUTIVE SUMMARY AND CONCLUSIONS

2.1 The main conclusions of this report are summarised in this section of the
report. The associated recommendations are in section 10.
Sections 3 to 9 of the report explain the issues that led to the conclusions and
recommendations.
2.2 SIGNALLING PRINCIPLES - GENERAL
The existing signalling principles address all the main requirements for the
signalling of main line railways in the UK, with the exception of comprehensive
train protection (see paragraph 2.3). However, they are not sufficiently
complete to be regarded as a generic specification for signalling systems, and
their adequacy is further undermined by a number of factors, specifically:
a) The incompleteness of the signalling principles means that their correct
application relies heavily upon the knowledge and experience of
designers and testers. Whilst this may have been acceptable in the
past, with a relatively stable and experienced workforce, it is now
questionable as to whether it is safe to depend upon individuals so
heavily in this way, given the fragmented nature of the signalling design
workforce. IRSE licensing can only go part-way towards addressing this
problem.
b) From a railway “system” perspective, the principles are not fully
integrated with all the other control measures that are necessary for a
safe railway, and the boundaries between those risks that the signalling
system addresses and those that are addressed by other means is not
always entirely clear (eg. broken rail detection; low adhesion problems).
c) The assumptions associated with the signalling principles (such as driver
route knowledge) may no longer be valid to the extent that they once
were.
Whilst there are specific features within signalling principles that require
attention, there is considered to be no benefit at this stage in considering any
fundamental change to the UK route-based lineside signalling philosophy.
Such a change would generate significant human factors and other problems,
with relatively little gain, at a time when comprehensive train protection and cab
signalling offer the prospects of much better solutions to the limitations of
lineside signalling.
A considerable number of recommendations have been made regarding
improvements to the processes for the production, revision and application of
signalling principles. Underlying some of these are fairly fundamental issues
concerning the organisation of the industry and its engineering skill base.
2.3 OVERRUN PREVENTION AND MITIGATION – TRAIN PROTECTION
SYSTEMS
It is no longer acceptable to rely solely on a driver to obey lineside signals, and
the introduction of comprehensive train protection systems is essential (see
Appendix E for a definition of comprehensive train protection systems). A
national programme should be established urgently, leading to the provision of
__________________________________________________________________
comprehensive train protection (based on ERTMS/ETCS standards) across the

UK network, and to existing and new UK train fleets, in the shortest practicable
timescale. Ideally, this should take place as part of a wider strategy for the
provision of cab signalling.
2.4 OVERRUN PREVENTION AND MITIGATION – OTHER MEASURES
Because of the number of signalling schemes now proposed or under
development, and because of the lack of comprehensive train protection,
urgent attention needs to be given to clarification and strengthening of:
(a) The signalling principles that specify the requirements for the visibility of
signals and the processes for signal sighting;
(b) The principles that specify design requirements for the protection of trains
in the event of an overrun (flank track protection, overrun detection etc.).
It is noted that the relevant Railway Group Standards for (a) is currently subject
to revision to address these deficiencies, and that the relevant Standard for (b)
has recently been revised and re-issued to address the deficiencies.
2.5 OVERRUN PREVENTION AND MITIGATION – PROCESSES FOR
ASSESSING OVERRUN RISK
For the same reasons as stated in 2.4, urgent attention needs to be given to
improving the overrun risk assessment processes that are applied during the
design of track layouts and signalling, in order to ensure that a consistent
approach is adopted which results in satisfactory control of overrun risk.
It is noted that the relevant Railway Group Standard for this subject has
recently been revised and re-issued to address these deficiencies.
2.6 SIGNALLING SYSTEMS - GENERAL
Systems authorities, or equivalent management arrangements, need to be
implemented to control the whole life cycle of systems that are partially
trainborne and partially infrastructure-based (such as AWS, TPWS and, in the
future, ERTMS).
The design of current signalling systems is based on the use of fail-safe
equipment, but is vulnerable to single point safety-critical failures (eg. of track
circuits). Systems of the future should avoid this type of vulnerability and be
based on internationally recognised design standards for safety-critical
systems, for instance making use of diversity.
2.7 DEGRADED MODES OF OPERATION AND SIGNALLING SYSTEM
RELIABILITY
The reliability of signalling systems on main lines in the UK is perceived as
being poor compared with other European railways. This has safety (as well
as commercial) implications. Work needs to be undertaken to identify ways in
which reliability could be improved (both through better design and better
maintenance). Signalling principles are required for degraded modes of
operation, to improve overall system availability and reduce dependency upon
the use of people and procedures in the event of a failure.

__________________________________________________________________
3. WHY DO WE NEED SIGNALLING SYSTEMS

3.1 There are three features about railways that make the provision of a signalling
system necessary:
(a) Trains have to share the same infrastructure;
(b) Drivers of trains cannot “steer” around other trains and obstructions;
(c) The braking distance of a train is generally considerably greater than the
distance that a driver can see.
The main function of a signalling system is therefore to set up a route for the
passage of each train over the track that it is to traverse, authorise the driver to
make the movement, maintain the route while the train is making its
movement, and finally release the route (for use by other trains) after the
passage of the train.
3.2 The development of signalling systems has mirrored two needs. One is to do
with safety, but the other, also very important, is to facilitate the efficient
operation of the railway. Indeed, the intensive train services seen on many
lines in the UK simply would not be possible without the provision of a suitable
signalling system.
3.3 Throughout this report, therefore, it is important to bear in mind the overall twin
purposes of signalling systems, which can be summarised as follows:
“The purpose of a signalling system is to facilitate
the safe and efficient movement of trains on the railway.”
3.4 Safety and efficiency, both of which are mentioned in the statement of
purpose, do not always sit easily with each other. The fundamental safety
requirements of a signalling system include keeping trains adequately
separated from each other, and stopping (or slowing) trains where necessary
to avoid potentially unsafe situations. Efficient operation of the railway, on the
other hand, is mainly about sending as many trains as possible along a given
portion of line, as quickly as possible, using the minimum of infrastructure.
4. THE ROLE OF A SIGNALLING SYSTEM WITHIN A RAILWAY

4.1 Across the world there is a wide range of signalling systems in use, and the
signalling principles underpinning them are not all the same. Even in the UK,
there are differences of principle between, for example, semaphore and colour
light signalling systems.
4.2 More fundamentally, there is no absolute definition of the scope of a signalling
system, in terms of what functions it has to perform. The widest definition of a
signalling “system” includes not only the signalling equipment, but also people
such as signallers and drivers who interact with the equipment, and the
procedures and rules they have to apply. The allocation of signalling functions
into two groups, namely those that are to be performed by the equipment and
those that are to be performed by people, is not the same on every railway.
4.3 The role of a signalling system may well involve more than just controlling the
movement of a train from one location to another. A real part of the facilitation
of train movements involves, for instance, the provision of management
__________________________________________________________________
information relating to train movements, and the provision of possession

management and trackworker protection systems for maintenance purposes.
Modern signalling systems can fulfil these roles.
4.4 Even more broadly, the signalling system is but one part of the total railway,
and in defining a set of requirements for a system, it is important that there is
clarity regarding its role within the overall operation of the railway. It is
becoming ever more apparent that an integrated systems approach is needed
to the design and operation of the railway, in order that there is clarity about
how responsibility is apportioned between the various elements. This is
particularly true in the field of safety and of signalling systems, and on the UK
main line railways it is of additional significance given that many companies are
involved in the operation of a complex and busy railway, with a shared
responsibility for safety systems and the people who operate them.
4.5 Despite these challenges, and the differences between signalling systems, it is
possible to identify a set of “fundamental safety requirements” with which all
signalling systems on main line railways in the UK should conform. An initial
attempt at listing these fundamental safety requirements appears in
Appendix C. It is also possible to identify a smaller number of core operational
requirements that should characterise a signalling system. An initial list of
these also appears in Appendix C.
4.6 It should also be noted that in the UK, Her Majesty’s Railway Inspectorate
publish a suite of principles and guidance for railways [“Railway Safety
Principles and Guidance”]. It is an expectation that railways comply with them
(or progressively adopt them, since the Principles have been in existence in
their current form for only a few years). Three of the Principles focus
specifically on requirements for signalling, and several others are closely
related to signalling.
5. SIGNALLING PRINCIPLES
5.1 Signalling principles are sets of requirements for the design of signalling
systems that amplify and support the fundamental safety and core operational
requirements referred to above. Their prime concern is with safety, although
not exclusively so.
5.2 In many cases signalling principles are essentially technology-independent, but
some are associated with particular forms of signalling systems and the railway
administration on which they are used. Thus, for example, a principle of main
line UK lineside signalling is that a driver is provided with information about the
direction in which his train is routed at a junction, the driver then being
expected to regulate his speed accordingly. Some other railway
administrations use lineside signalling where the driver is given speed
information by the lineside signals, but not route information.
5.3 As stated earlier, on main line railways in the UK, the signalling principles are
currently documented in the form of Railway Group Standards. These
signalling principles have been developed and modified over many years of
railway experience, although their current documented form is relatively recent.
Over the past ten years many changes have been made to the signalling
__________________________________________________________________
principles documents, and a number of new documents have been produced.

This work has addressed both the principles themselves, and the form in which
they are presented.
5.4 The UK main line signalling principles address a broad range of requirements,
covering the fundamental functional requirements of signalling systems, their
external and internal interfaces and, to a limited extent, constraints associated
with the use of the systems (see section 6). Topics covered include:
(a) locking of points and opposing routes
(b) safe separation of trains
(c) provision of overlaps
(d) interlocking of points and signals
(e) form, visibility and alignment of signals
(f) holding and release of routes
(g) interfaces with the signaller
(h) warning and protection systems for drivers, to reinforce the instructions
conveyed by the signals
5.5 Most of the UK main line signalling principles do not go into great detail about
how the requirements are to be met. However some, particularly those that
deal with interfaces between the track equipment and the trains, are more
detailed. This arises for a number of reasons, not least because the two sides
of the interface are managed by different parties within the railway industry.
Similarly, interfaces with drivers (primarily lineside signals) are defined in
greater detail, although in this case it is because of the critical importance of
drivers observing and interpreting signals in an error-free manner.
5.6 During the 1990’s there has been, in the re-writing of UK main line signalling
principles, a move towards less prescriptive requirements, and a greater a
degree of emphasis has been placed on the requirement to assess risks and
apply suitable control measures. This has reflected the industry’s recognition
of the UK’s safety legislative philosophy of risk management. It has also been
an acknowledgement of the fact that it is difficult to prescribe a complete and
universal set of detailed rules for all signalling systems when in practice the
design of any specific signalling system has to recognise the context in which it
is required to operate. However, a risk-based approach is not appropriate in all
cases. This is particularly so where human interactions with the system are
involved and consistency in the form of the interface is important for safety.
5.7 Generally the signalling principles do not set safety performance or availability
targets for signalling systems. In that sense, they are a statement of the ideal,
and they do not acknowledge the fact that when failures occur, the signalling
principles have to be invoked by other means (generally the use of procedures
applied by signallers).
5.8 It should be noted that the actual railway is not, and in practice never can be,
totally compliant with current signalling principles. The long service life of
railway infrastructure makes it inevitable that most of the signalling systems
now in use were designed in accordance with principles which are not identical
in all respects to the principles that are currently applicable for new designs of
systems. When new or modified signalling principles are produced, it is
__________________________________________________________________
generally only in exceptional circumstances that retrospective action is

mandated to update the infrastructure to the new principles.
6. CONSTRAINTS AND ASSUMPTIONS ASSOCIATED WITH SIGNALLING

PRINCIPLES
6.1 Signalling principles are applied in conjunction with operational rules and with
other non-signalling technical requirements (covering both infrastructure and
trains), which means that there is a complex set of interdependencies upon
which the safety of the railway depends. Firstly, associated with signalling
principles, and with signalling systems, there are constraints on how the
signalling is used. Some of these are “hard” constraints - for instance, there is
a physical limit to the frequency with which trains can be sent through a
particular portion of line, imposed primarily by the braking capabilities of trains,
and then reflected in the principles that are applied to maintain a safe distance
between trains. On main line UK railways these principles determine the
minimum distance between successive signals, and this spacing limits the
throughput of trains.
6.2 Other constraints are “soft” - for instance the frequency with which platform
sharing facilities can be used at a station is limited by the need to control the
risk of collisions to acceptably low levels. Such a limit arises as a
consequence of applying the risk assessment process that is mandated by the
signalling principles for the provision of such facilities. The signalling system
itself imposes no such limitations in a technical sense, but clearly it is important
that the signalling system is used in a manner that is consistent with these
constraints.
6.3 Likewise, signalling principles and signalling systems have various
assumptions associated with them. These generally relate either to the way in
which the signalling will be used, or to interactions with other parts of the
railway (eg., the track, trains or train drivers). A first attempt at recording these
assumptions, as currently applicable to UK main line railways, is shown in
Appendix D. It should be noted that several assumptions are associated with
features of the railway that lie outside the signalling system itself.
6.4 In some cases there is a constraint associated with an assumption. Thus, to
take the example in 6.2 above, assumptions are made about train braking
capabilities when deciding how far apart to position signals on a line, but a
constraint then arises in that all trains authorised to operate on the line need to
have braking capabilities that meet or exceed the assumptions made.
6.5 Furthermore, in some cases we make assumptions, but then recognise that
they may not always be valid. Thus whilst we expect drivers to stop at red
signals, and the signalling is largely designed around this assumption, we
acknowledge that this is occasionally not true, and therefore the signalling
incorporates some limited measures to address the risks of signals being
passed at danger.
6.6 There is some concern that the assumptions associated with signalling
systems may not be as valid as they once were, particularly the assumptions
surrounding driver route knowledge. This is significant, in that if the
__________________________________________________________________
assumptions cannot be depended upon in the way that they once were, then
the signalling principles that make use of those assumptions may themselves
be of questionable validity.
7. THE APPLICATION OF SIGNALLING PRINCIPLES BY DESIGNERS

7.1 Designers and testers require a considerable level of knowledge and expertise
in order to apply signalling principles correctly. In some ways this is not
surprising, but various factors make the level of expertise and knowledge
required higher than might be expected. Two such factors are:
a) The signalling principles are not written in a formal manner that can be used
directly as a generic specification for signalling systems. They have to be
sifted by designers to decide what is applicable to a particular situation, and
then interpreted in the context of that situation.
b) Although the signalling principles are substantially complete, there are some
traditionally accepted requirements that are undocumented. The designer’s
knowledge and experience in “filling in” these missing elements is critical in the
production of safe designs.
7.2 Furthermore, in recent years the application of signalling principles in the
design of signalling systems has become an even a more challenging task than
was previously the case. The reasons for this include:
(a) the fragmentation of the railway industry, resulting in greater mobility of
individuals between groups and organisations, with a consequential weakening
of the mechanisms by which designers and others have traditionally acquired
their skills. Notably, designers once gained experience and became skilled
through working alongside engineers who had spent most of their career in
railway signalling. This is increasingly rare;
(b) the move away from prescriptive signalling principles in favour of requiring
designers to assess risks and to design the signalling systems accordingly;
(c)the frequency with which signalling principles have been revised and re-
issued, which is particularly challenging when designers are working on a
number of projects in parallel, to which different versions of the same principles
may have to be applied;
(d) the increasing complexity of signalling systems and the introduction of
novel software-based systems, requiring a heavy dependency upon robust
processes for translating signalling principles into error-free designs;
(e) the difficulties that designers have in visiting the sites for which they have
to prepare designs, and in undertaking activities such as cab rides and signal
box visits. It is impossible to place a monetary value on such activities, but
they are essential to keep them in touch with the users of the systems and their
needs.
7.3 There is some anecdotal evidence that there is insufficient control over the
application of signalling principles, with inconsistencies arising between
projects. The difficulties of ensuring consistency are considerably greater than
in the pre-privatisation era, because more design organisations are involved,
__________________________________________________________________
each of which is producing design work for installations all over the country.
This is a marked contrast with the days when the British Railways Board
controlled the design activities through a small number of regional design
offices.
8. THE SUITABILITY OF CURRENT SIGNALLING PRINCIPLES FOR MAIN LINE

RAILWAYS
8.1 Historically, the development of signalling principles has been a process of
attempting to keep pace with changes that have been necessitated through
accidents and incidents, and of addressing the needs of railway operators for
greater flexibility.
8.2 The need for changes to signalling principles is also driven by other factors that
are not accident-related. By way of example, current pressures relevant to
overrun risk include the following:
a) traffic levels and speeds are increasing;
b) modern track layout designs are more likely to lead to collisions in the
event of an overrun;
c) the training of drivers contains less “on the job” learning with experienced
drivers;
d) there is a perception that there is a decreasing public tolerance of
accidents;
e) larger geographical areas are covered by signallers, with a greater
dependency upon automatic route setting systems, and a consequential
lack of familiarity on the part of the signallers with the layouts and
signalling they control.
Because of these, there is an ongoing need to review the adequacy of
signalling principles. A belief that there is an ideal set of signalling principles
which will hold good for all time, if only we can identify them, is probably
illusory.
8.3 The railway industry has not generally taken a systematic approach to the
definition of signalling system requirements. However, factors such as those
listed in paragraph 8.2 reinforce the need for a systems approach to be
adopted, and for hazards to be reviewed on a proactive basis. This is
particularly important with the application of new technology.

__________________________________________________________________
8.4 The Working Group has considered a number of the specific areas of
signalling principles set out in the remit. Areas to which consideration has
been given are:
a) Overrun risk at junctions;
b) Junction signalling;
c) Degraded modes of operation (where the signalling system is not fully
available);
d) Positioning and visibility of signals;
Where the group considers it appropriate to make recommendations in these
areas, they have been made in Section 10 of this report. No recommendations
have been made in respect of changes to the principles of junction signalling,
although there is considered to be some scope for clarification of the
application of junction signalling principles. It is known, however, that some
operations managers are of the view that some changes to junction signalling
principles would be worthwhile, and further work needs to be done in this area.
8.5 Of the four issues listed in 8.4, the two major areas of concern are overrun risk
prevention and mitigation, and the positioning and visibility of signals.
In respect of overrun risk mitigation, the processes in Railway Group Standard
GK/RT0078 are too ill-defined, and depend too much upon signal engineers
providing “bolt on” solutions to a track layout whose design and usage has
already been decided. The technical requirements for overrun mitigation, also
in GK/RT0078 (specifically, for diverting trains away from areas of conflict, and
for overrun detection) are insufficiently clear to facilitate application in a
consistent manner, and may cause signal engineers to provide an inadequate
level of overrun protection.
In respect of signal visibility, issues have emerged from the Ladbroke Grove
and Southall accidents which suggest that a major re-think of technical
requirements in GK/RT0037 is necessary, together with a review of the way
that signal sighting is carried out within the signalling design process.
As previously noted, the relevant Railway Group Standards covering these
topics have been (or are currently) the subject of revision to address these
deficiencies.
8.6 In addressing the remit for the Working Group, some attention has been given
to the architecture and design of signalling systems of the future. It is evident
that, in seeking to improve standards of safety, the architecture and design of
signalling systems is as important as the signalling principles which define the
functional requirements for those systems. This should not be surprising, since
these factors contribute significantly to the safety integrity of signalling
systems. Recommendations have therefore been made in this area.

__________________________________________________________________
9. TRAIN PROTECTION SYSTEMS

9.1 The deliberations of the Working Group have included debate about train
protection systems (ie., systems that prevent/mitigate signal overrun risk by
automatic application of the brakes on the train). Trainstops are one type of
train protection system. The Train Protection and Warning System (TPWS)
currently being fitted on UK main line railways is another, the automatic train
protection system used on Great Western and Heathrow Express trains is a
third.
9.2 Given the changing nature of railway operations, notably increasing traffic
speeds, higher traffic densities, tighter timetabling and greater flexibility of track
usage, it is no longer acceptable for the safety of train movements to be based
on the assumption that drivers do not misread signals. Current UK signalling
would not be accepted by authorities in other European countries, who
generally require (by law) the fitment of comprehensive train protection for train
movements above a certain speed. European authorities would not accept
that TPWS provided sufficient protection for a modern railway network.
9.3 The introduction of any train protection system requires that a large number of
factors are taken into account. The more obvious factors include the
economics of a programme of fitment, the functionality offered by any
proposed system, compatibility with emerging European train control
technology, and the direct benefits in terms of lives saved. There are also less
obvious issues that need consideration in the overall assessment of risk, such
as the following:
(a) the risk exposure (to both installation teams and the operational
railway) during the implementation and subsequent maintenance of the
equipment;
(b) the reliability of the system, and the risk exposure associated with train
movements during periods of failure;
(c) the impact of the system on the reliability and integrity of the
infrastructure and train-borne systems to which it is connected;
(d) how the use of the system impacts upon other overrun risk mitigation
measures (eg., flank protection);
(e) human factors issues, such as driving style, which may be affected by
the introduction of the system, and which could alter the balance of
risk;
(f) the integrity expected of the system (ie., its dependability in performing
its function);
(g) whether the system is to be fitted selectively on the infrastructure, and
if so, the criteria for such fitment;
(h) the complexity and compatibility issues associated with managing a
variety of train control systems.
9.4 Whilst the working group recognises the appeal of TPWS as a means of
substantially reducing overrun risk by technology that is capable of rapid
deployment, it should be observed that it does not provide comprehensive
protection against driver error (the errors being signal overruns and
overspeeding). It is therefore important that, in parallel, plans are developed

__________________________________________________________________
for providing systems that will provide full protection across the complete range
of train speeds, with the initial focus being on routes that form part of the
European high speed railway network.
9.5 The autonomy and customer status of train operating companies on main line
UK railways makes more difficult the strategic decisions that have to be taken
regarding the provision and management of train protection systems (and
indeed, of all partially train-borne systems, such as GSM-R and
ETCS/ERTMS). There is no single organisation that has overall responsibility
for decisions regarding the specification, provision and management of such
systems.
9.6 It is important to recognise that the fitment of a comprehensive train protection
system is not a panacea for all the problems associated with overruns.
Problems associated with poor rail adhesion, for instance, are not solved by
such systems (and indeed, can be exacerbated), and new human factors
problems can arise during operational use because drivers acquire a
dependency upon the existence of the system. Train protection systems
(including non-comprehensive systems such as TPWS) can cause wheel flats
and possible rail damage where they invoke emergency brake applications.
9.7 The fitment of TPWS is being used to provide some measure of train
protection as soon as possible, but concerns remain about the issues listed in
9.3 in relation to TPWS, and about the programme for implementation of
TPWS. It is perceived that inadequate co-ordination of train fleet fitment and
route fitment, and problems with keeping the fitment programme on track, may
mean that the benefits of the system will not arise until close to the legislative
deadline of 31 December 2003, or even beyond.

__________________________________________________________________
10. RECOMMENDATIONS
10.1 The recommendations are made in groups, as follows:
• Signalling principles – general
• Overrun protection : train protection systems
• Overrun protection : other measures
• Overrun protection : processes for assessing overrun risk
• Signalling systems architecture and management
• Degraded modes of operation and signalling systems reliability
10.2 There is no implied priority associated with the order in which the
recommendations are listed.
10.3 The recommendations should be addressed in the groups listed in 10.1, not
individually, as many of them are inter-related.
No. Recommendation
1 SIGNALLING PRINCIPLES – GENERAL

R1.1 There should be a defined and agreed set of fundamental safety requirements
that is common to all methods of signalling used on UK main line railways.
This set should be applicable to the whole “system”, regardless of whether they
are fulfilled by technical means or by application of procedures and rules.
R1.2 The contribution that the application of signalling principles (in the design of the
signalling system) and the use of operational rules (by signallers, drivers and
others) each make to the safe control of train movements should be clearly
defined and documented.
R1.3 Signalling principles should expand upon, and be clearly traceable to, the
fundamental safety requirements of signalling systems. The manner in which
signalling principles together comprise a logical and hierarchical set of
requirements should be visible to those who have to apply the principles.
R1.4 Signalling principles documents should make clear those elements that are
mandatory, those that are discretionary, and any caveats, conditions or
constraints that apply to mandatory and discretionary elements.
R1.5 Risk assessment should be mandated in signalling principles documents only

where the nature of the situation under consideration makes it necessary to
consider the risks and select appropriate risk control measures on an application-
specific basis. The mandating of risk assessment is not appropriate where:
• the data/knowledge isn’t available to enable a meaningful assessment of the
risks; or
• uniformity in the application of measures across the network is essential.

__________________________________________________________________
R1.6 Where signalling principles mandate risk assessment as the means of selecting
the control measures to be applied in the design of a specific signalling system,
guidance should be given on how to conduct the assessments, supported
wherever practicable by factors for consideration and data that will facilitate the
process.
R1.7 The processes by which signalling principles are produced and revised should be
reviewed, to ensure that the production processes identify and address all non-
negligible risks systematically, and in a manner which ensures that the views of
key stakeholders are obtained and considered.
R1.8 The effects of change on the validity of signalling principles should be monitored
and reviewed periodically, to ensure that appropriate levels of safety are
maintained. Changes, in this context, include operational, organisational,
process, technical and legislative changes.
R1.9 Signalling principles documents should set out clearly how decisions are to be
made as to which principles are applicable to a specific situation. Thus, for
example, principles relating to the various forms of junction signalling should
also define the decision-making criteria whereby the most appropriate form of
junction signalling is selected for a particular location.
R1.10 Signalling principles documents should explain why particular requirements are
mandated, and how they related to operational rules (eg. in the Rule Book), to
aid industry understanding.
R1.11 The rationale, assumptions and justification for signalling principles should be
recorded, and this information made available to users of signalling principles
documents.
R1.12 The rationale, assumptions and reasons underlying the application of signalling
principles to the design of specific signalling systems should be recorded.
R1.13 The reasonableness of the assumptions associated with signalling systems, and
the dependency of signalling principles upon them, should be reviewed.
Particular attention should be given to “driver route knowledge” assumptions.
R1.14 Processes for proposing and authorising non-compliances against signalling

principles need to be made known better to the industry, and rigorously applied.
R1.15 The arrangements for communicating changes to signalling principles should be

reviewed, to find more effective ways of ensuring that those who have to apply
them are aware of changes and the impact on the projects on which they are
engaged.
R1.16 Ways should be found and implemented for monitoring the application of
signalling principles, so as to promote consistency of application.
R1.17 Formal mechanisms should be established for dialogue between train operators
(in particular, drivers and driver standards managers), signallers and signal
engineers (both standards-setters and designers) to provide feedback from the
“customer” on signalling system design.

__________________________________________________________________
R1.18 Signalling designers should be provided with ready access to the sites for which
they are preparing designs, and with facilities for occasional cab riding, in order
that they can better understand and meet the needs of the driver.
2 OVERRUN PREVENTION AND MITIGATION :

TRAIN PROTECTION SYSTEMS
R2.1 UK signalling principles should require the provision of comprehensive train
protection systems, and every opportunity to introduce train protection systems
should be investigated, both when new trains are planned to be introduced onto
the network, and when re-signalling is being planned.
R2.2 The goal should be fitment of a nationwide comprehensive train protection

system (ERTMS/ETCS compliant) to provide full protection for trains on
passenger lines. Ideally this should take place within the context of a strategy for
providing cab signalling instead of lineside signals. The rail industry must
collectively find the will, and develop the strategies, to pursue this goal.
R2.3 In developing the plans for the implementation of comprehensive train protection
systems, use should be made of the knowledge and experience of other railway
administrations, particularly in areas such as human factors, low adhesion
management, dependency on route knowledge, operational rules (including
operation under failure conditions), and warning/intervention arrangements.
R2.4 It is likely that there will be for the foreseeable future a variety of train protection
systems on the UK main line railway. Therefore the technical and operational
issues concerning the upgrading and compatibility of such systems should be
identified and managed from the outset by all affected organisations, on a co-
operative basis.
3 OVERRUN PREVENTION AND MITIGATION : OTHER MEASURES

R3.1 The current signalling principles regarding the setting of points to protect
authorised train movements from overrunning trains should be strengthened and
made less open to interpretation, so as to provide greater protection wherever
this is practicable.
R3.2 In due course it may be possible to amend some of the existing principles
regarding overrun protection, when train protection systems are fully operational.
However, caution should be exercised in this area, particularly in respect of
TPWS, until significant experience is gained of the benefits of such systems in
controlling overruns.
R3.3 Signalling principles should specify that an overrun of a signal at danger should
always be detected by the signalling system at the earliest possible opportunity,
and that such detection should be used to replace other signals to danger
automatically (ie, without the intervention of the signaller), to reduce the
likelihood/severity of a collision (unless there is clearly no safety benefit in so
doing). This recommendation is made irrespective of the level of train protection
provided, to mitigate hazards such as poor adhesion and incorrect application of
procedures for the movement of trains after an overrun has occurred.

__________________________________________________________________
R3.4 Investigations should be conducted into the feasibility and benefits of providing a
diverse means of ordering a train to stop when it has overrun a signal at danger,
either automatically or by the action of the signaller (eg., by use of radio to send
an emergency stop message).
R3.5 The requirements for the visibility of signals should be revised, with particular
attention paid to:
a) providing extended viewing times for signals that require it (eg. complex
signals and signals on gantries spanning multiple lines that are signalled in
the same direction);
b) better definition of acceptable levels of obscuration of signals;
c) importance of correct alignment;
d) making sure the driver is “in the beam” (avoiding signals of excessive
height);
e) difficulties of sighting signals that have curved approaches;
f) helping drivers to identify which one of a number of parallel lines they are on
and which signal ahead is applicable to their line.
R3.6 The processes by which the form, position and alignment of signals is decided,
including the role of signal sighting committees and the competency of those
involved, should be reviewed so that there is minimal risk of a signal being
positioned/aligned inappropriately.
R3.7 The timetabling and regulation of trains (including that applied through automatic
route setting systems) should seek to minimise the likelihood of trains
encountering signals at danger, thus reducing the number of collision
opportunities. This is particularly important where comprehensive train protection
systems are not provided.
4 OVERRUN PREVENTION AND MITIGATION :

PROCESSES FOR ASSESSING OVERRUN RISK
R4.1 The processes for the assessment of overrun risk when designing track and
signalling should be strengthened to ensure that a multi-disciplinary, integrated
and systematic approach is adopted which explores all options for risk reduction.
It should involve not only signal design engineers, but operators and track design
engineers as well. Such processes need to start at an early stage in the design
of track and signalling.
R4.2 So far as is practicable, the overrun risk assessment of layouts should include
consideration of the effects of timetable disruption, specifically in terms of the
increased likelihood of signals being encountered at danger. This is particularly
important where comprehensive train protection systems are not in use.
R4.3 The design of track layouts and signalling should consider at an early stage the
extent to which features that have the effect of increasing collision risk are
operationally necessary (eg. bi-directional facilities). This is of particular
significance where train protection systems are not in use, and the alternative
risk mitigation measures may provide only limited control of the risk.

__________________________________________________________________
R4.4 Planned changes to the use of the track and signalling which could have a
significant impact on overrun risk should be subject to review before they are
implemented, to ensure that risk is not increased to levels which would be
unacceptable. Such review is particularly important where comprehensive train
protection systems are not in use.
5 SIGNALLING SYSTEMS - GENERAL

R5.1 Systems authorities, or equivalent management arrangements, should be
created to manage systems that are partially train-borne and partially
infrastructure-based, with the objective of ensuring that such systems are
specified, used, maintained and supported in a manner which ensures that they
are safe and fit for purpose throughout their service life. Given the multi-party
nature of the UK rail industry, accountabilities need to be clearly defined.
Consideration should also be given to the need for a similar management

approach to other interfaces, rather than limiting the application to systems such
as ERTMS, TPWS and CSR. Examples might include, for instance, the wheel-
rail interface, and safety-related people interfaces between companies.
R5.2 Signalling principles and architectures for signalling systems should, so far as is
reasonably practicable, avoid vulnerability of systems to single-point failures that
could result in unsafe situations arising.
R5.3 The relationship of international standards (IEC61508, EN50128, EN50129) to

the signalling principles and the design processes mandated in Railway Group
Standards should be clarified, and the UK standards harmonised with the
international standards.
R5.4 Consideration should be given to the practicability and benefits of designing

signalling systems such that the “control” and “protection” functions are
separated, in accordance with the safety principles advocated in IEC61508. If
this proves to be feasible and beneficial, signalling principles documents and
requirements specifications for signalling systems should reflect this separation.
R5.5 When planning the next generation of systems, the assumptions associated with
signalling principles and with the design and use of signalling systems should be
identified and considered in terms of their appropriateness.

__________________________________________________________________
6 DEGRADED MODES OF OPERATION AND SIGNALLING SYSTEM

RELIABILITY
R6.1 A study of options for providing degraded modes of operation within signalling
systems should be undertaken to build on previous work undertaken by the IRSE
[*], and the output disseminated for industry debate. Consideration should be
given to the associated operational rules to be applied when making use of such
modes.
* Report: “Operational Availability of Railway Control Systems”
R6.2 Other European railways are perceived to achieve high reliability of their
signalling systems. If this perception is correct, their means of achieving it
should be investigated and best practice adopted, since unreliability has
secondary safety implications.
R6.3 The causes of the large number of Category B overruns (ie., overruns caused by
technical failures within the signalling system) should be systematically
investigated, with a view to reducing the number significantly.
(Although overruns in this category are less serious from a safety perspective
when considered individually, they are undesirable, and are indicative of the
general unreliability of the signalling system. In volume terms, they have
significant secondary safety implications. It is with this in mind that this
recommendation is made).
R6.4 Principles should be established for ensuring “continuity of control” of the railway
(including, but not only, principles for the design of large control centres), in view
of the secondary safety risks associated with major system failure. The
principles should address:
• system availability
• ensuring safety in the event of a major failure
• control of train movements during the failure
• recovery from the failure

__________________________________________________________________
APPENDIX A
Working Group Members
Name Company Title
Bob Barnard Alstom Signalling Ltd Principal Consultant
Roy Bell - Consultant signal engineer
John Corrie Mott MacDonald Divisional Director
Alan Cribbens - Consultant signal engineer
Alan Fisher Adtranz Business Development Manager

– Product Strategy
Terry George Westinghouse Signals Ltd Chief Engineer
Francis How Railtrack (Safety and Principal Signalling and

Standards Directorate) Telecommunications Engineer
Richard Morris Shadow Strategic Rail Director of Technical Services

Authority
Andrew Simmons Railtrack Head of Signals Asset Group
Colin White London Underground Ltd Systems Assurance Engineer,

InfraCo BCV

__________________________________________________________________
APPENDIX B
REMIT FOR WORKING GROUP 1 - SIGNALLING PRINCIPLES
1. This working group has been established as a part of a collaborative project

between the Institution of Railway Signal Engineers, Railtrack and Her
Majesty’s Railway Inspectorate. The overall purpose is to consider the
appropriateness and adequacy of UK main line signalling philosophy and
principles, particularly in the light of the Ladbroke Grove accident.
2. This working group is to be chaired by Francis How, Principal S&T Engineer,

Railtrack Safety and Standards Directorate. It will work over the next few
months to consider key aspects of signalling philosophy and principles, under
the direction of a Steering Group (which is also being managed by the IRSE).
Its outputs, which are to be documented, will be reviewed by the IRSE
Technical Committee, and eventually will be made public (the means of doing
this are to be considered later).
3. This working group will consider four key areas in relation to signalling
principles, as follows:
a) The hierarchy, broad purpose and content of, and the relationships
between, UK signalling principles, HMRI principles and guidance,
technical specifications and codes of practice. Particular consideration will
be given to:
i. How these fit together underneath an overall “signalling
philosophy”, and how / where this should be expressed.
ii. The extent to which principles should be prescriptive, as opposed
to performance-based or relying on risk assessment.
iii. The need for compatibility between the signalling principles and the
operational rules for the running of the railway.
b) How signalling principles and related standards should be made
intelligible and visible (to those who have to apply them) and
promulgated, used and applied (taking into account the current industry
structure).
c) The extent to which current signalling principles reflect the signalling
philosophy of main line railways in the UK and are adequate for the needs
of the modern railway (including emerging requirements for ERTMS).

__________________________________________________________________
APPENDIX B
d) Key areas of signalling principles that need urgent attention, including:

i. SPAD risk at junctions
ii. Junction signalling
iii. Capacity & timetabling issues
iv. Degraded modes of operation
v. Coping with the limitations of lineside signalling
vi. Positioning and visibility of signals
vii. Principles for ERTMS
4. The group is expected to make recommendations in each of the areas

described above. It is recognised that this is a substantial workload, and that
the priorities for the work may not necessarily be in the order given above.
It is intended that good progress will have been made by September 2000 in
the most urgent areas, and that some consideration will have been given to
all the subject areas described above, in order that the IRSE can give an
interim report on its work.
The recommendations to be made by September will almost certainly be
incomplete, but will be sufficient in order that the IRSE can recommend:
a) What should be done (either by the railway authorities or in terms of
further work by the IRSE).
b) Who should take responsibility for the actions or further work.
c) What roles the other interested parties should take.
APPROVED by the IRSE Signalling Philosophy Steering Group: 19 May 2000

__________________________________________________________________
APPENDIX C
Requirements for Signalling Systems
The following fundamental requirements support the overall purpose of a signalling

system, as set out in section 3.3 of this report.
1. FUNDAMENTAL SAFETY REQUIREMENTS FOR SIGNALLING

SYSTEMS ON MAINLINE RAILWAYS IN THE UK
a) Before a train is been given authority to move onto the section of line, the line
must be proved to be secure (to prevent derailment and potential conflict with
other authorised movements) and clear of other traffic (to prevent collision). That
security must subsequently be maintained until the train has passed clear.
[The term “secure” actually refers to a limited set of safety requirements, primarily relating to the
positions and locking of points, and the routing of other trains. The signalling system does not, for
instance, prove that the line is clear of all physical obstructions, or that the track gauge is correct].
b) The driver of the train must be given unambiguous, consistent and timely
information that enables him to control his train safely.
[This covers the requirement to give the driver clear proceed/stop information; the provision of
warning information regarding the approach to a stop signal where necessary (ie. caution signals
or equivalent); the provision of speed information, which may be by the signalling system itself, or
by the use of signs, route information etc.]
c) Sufficient space must be provided between following trains, to allow each train to
brake to a stand safely. This space must be calculated on the assumption that
the train ahead is stationary.
[ie. motorway-style driving is not allowed]
• drivers passing the limit of the movement authority given to them; and
• drivers exceeding the maximum permitted speed for the train.
[This requirement covers overlaps, train protection systems, flank protection, etc.]
[This requirement could be met by the use of radio communication, rather than by use of the
signalling system itself; the speed and reliability with which a message can be given to a train to
stop it needs to be commensurate with the risks associated with the emergency]
[Not all level crossings are necessarily protected by the signalling system itself; in simple cases
an independent means of protection may be provided].
g) In the event of a failure of the signalling system, the system must remain in, or
revert to, a state which preserves the safety of trains.

__________________________________________________________________
APPENDIX C
2. CORE OPERATIONAL REQUIREMENTS FOR A SIGNALLING SYSTEM
a) The signalling system should facilitate efficient use of the infrastructure (track
and stations) by trains.
b) The intrusiveness of the signalling system into the efficient running of the railway
in performing its safety function should be minimised.
c) Signalling facilities must be provided to enable trains to move when elements of

the signalling system have failed, so as to avoid over-reliance on human
intervention.
[This relates to the provision of “degraded modes” of operation]

__________________________________________________________________
APPENDIX D
Current assumptions associated with signalling principles,
signalling systems, and their operational use.
These assumptions are associated with main line UK signalling systems, and will not
necessarily be true of systems for other railway administrations. The list is the
Working Group’s perception of current assumptions. It is important to observe that:
• it is not claimed that the list is complete – rather, it serves to illustrate the sorts of
assumptions currently associated with main line UK signalling;
• the Working Group does not necessarily endorse continued dependency upon
these assumptions, either for today’s railway or for the railway of the future.
Indeed, where the assumptions may no longer be depended upon, they are
presented as concerns that need to be addressed.
• the assumptions are not listed in any particular order of priority.
No. Assumption Comments

1 Drivers possess route knowledge Route knowledge dates from days when most
(ie., in particular, they know the journeys were short distances and the
speed limits applicable to their trains promotional path from fireman to driver helped
on the routes over which they with route familiarity. Drivers now have less
operate, and they can relate time in which to acquire their route knowledge,
information given by the signals to and the complexity of permissible speeds
the speeds at which it is safe to increases the route knowledge required. Higher
drive). speeds require faster response times, so the
knowledge must be more secure if errors are to
be avoided
2 Drivers know where they are at any Signalling is becoming more standardised, and
point in their journey (ie., they can there are less landmarks for drivers to use, so
relate their current position to their that it is more likely that a driver would lose
route knowledge). spatial awareness.
3 Train braking performance is Wheel-rail interaction is a complex subject.
compliant with Railway Group Adhesion is dependent upon weather and the
Standards (and therefore is effects of recent rail traffic. In some cases
compatible with the permissible braking performance can be variable between
speed and signal spacings chosen similar trains. These variations lead to a wide
for the route). variety in braking profiles.
4 The infrastructure is complete and The assumption is made, before a movement
safe (gauge is correct, bridges authority is given to a train, that other
intact. clearances correct, etc.). engineering disciplines have predicted that the
route will remain safe for the passage of the
train. This prediction is usually made on the
basis of inspections and checks on the
infrastructure carried out in the
days/weeks/months before the train runs.

__________________________________________________________________
No. Assumption Comments

5 Drivers intend to obey signals (ie., There is no evidence to support a view that
they do not deliberately set out to drivers deliberately set out not to obey signals.
disobey signals), but they do Thus, improving the obedience to signal aspects
sometimes make mistakes in depends upon ensuring the clarity of the
observing signals (although in the aspects and reminding drivers to
signalling principles and the design look/remember/act, rather than on motivating
of signalling systems it is primarily them to do so. The view of this report, and of
errors of misjudgement in braking other experts, is that it is not sufficient to
that are addressed, not errors where depend just on the clarity of signals and the
a driver has misread a signal). diligence of drivers.
6 Signallers sometimes make The automation of control has resulted in
mistakes (therefore interlocking signallers controlling larger geographical areas.
systems are provided to protect This is not usually a problem when the signalling
against the effects of such errors), system is working correctly. It is a problem,
although where a signalling system however, when failures occur, because
fails, we generally rely almost signallers will be less familiar with the area for
completely on the signaller to which they have to apply safety procedures for
authorise train movements. the movement of trains.
7 The signalling system is maintained The signalling across the network dates from a
properly, and used in a manner that wide range of ages. The railway is heavily
is consistent with any constraints dependent upon maintenance personnel having
that are associated with the design the skills and knowledge appropriate to the
of the system (this applies to fixed particular systems for which they are
infrastructure and to any train-borne responsible, and the ability to discern where to
items of signalling equipment). apply them. IRSE licences are generic, and
need to be supported by equipment-specific
competency assessments.
8 Trains normally operate train There is concern that there is a growing
detection systems correctly. incidence of failures of train detection devices to
perform their primary function. This is due to
new designs of bogie suspension, differing
wheel profiles, brake arrangements and the
incomplete management of railhead
contamination.
9 The safe state to revert to is for the The railway is safest when it is operating as
signalling system to instruct trains to planned, with trains moving in accordance with
stop the movement authorities given to them. Any
need to bring a train to a stand places “stress”
on both the driver and the signalling system.
10 Road users obey level crossing The relatively long stopping distances of trains
instructions, indications etc,. makes them vulnerable to any activity which
suddenly obstructs their path. At open
crossings in particular there is, therefore, a
heavy reliance on road users to interpret and
respond to crossing signs and signals correctly.

__________________________________________________________________
APPENDIX E
A Definition of Comprehensive Train Protection Systems
The term “comprehensive train protection” is used several times within this report,
and it is important to understand what the report means when using the terminology.
Comprehensive train protection systems are more commonly known as “automatic

train protection” systems (ATP). They are provided to minimise the risk of driver
error (passing a signal at danger or travelling at excessive speed) leading to a
serious train accident (either a collision or a derailment).
To be regarded as comprehensive, such a system would:
a) be applied throughout all running lines within a defined area. Lines operated
entirely at very low speeds may be excluded provided there is no possibility of
creating a risk to traffic on other higher speed lines;
c) supervise the compliance of the train with the aspects displayed by lineside
running signals, or with the movement authority information given by a cab
signalling system;
d) supervise the compliance of the train with the aspects displayed by shunting
signals where disregard could lead to a collision on a running line;
e) supervise the compliance of the train with the permissible speeds on the line,
and all temporary speed restrictions, as applicable to the train type;
f) apply constraints to stop a movement in the opposite direction to that intended.
g) take into account the characteristics of each type of train (braking performance,
length etc).
ETRMS/ETCS is regarded as being capable of providing the functionality required

for comprehensive train protection.

IRSE

A REVIEW
REPORT BY WORKING GROUP 2

HUMAN FACTORS
CONTENTS
1 Human Factors and Signalling Principles Page 2
2 Theoretical Framework Page 2
3 Human Reliability and Signals Passed At Danger Page 5
4 Conceptual Model of Train Driving Page 12
5 The Observance of Signals Page 15
6 Signal Sighting as Part of the Driving Task Page 16
7 The Parameters of Signal Observance Page 29
8 Recent Investigations into Multi-SPAD Signals Page 40
9 Range and Variability of Parameters Page 43
10 Combination of Parameters Page 49
11 The Driver Page 51
12 Research Page 55
13 Conclusions and Recommendations Page 72
Appendix A Human Factors: Findings from Ladbroke Grove Page 76
Appendix B Bibliography and References Page 86

Report by Working Group 2 - Human Factors
__________________________________________________________________
1. HUMAN FACTORS AND SIGNALLING PRINCIPLES
1.1 INTRODUCTION
Railway signalling may be regarded as a means of communicating information to
trains primarily to enable them to be driven so as to ensure that a safe separation is
maintained between them, and in some instances so as to ensure that the safe
maximum speed is not exceeded.
Essentially this involves the interaction between a technological system, the
signalling, and a human operator, the driver. There are two approaches to making
technological work systems safer. The first attempts to assess how reliable
individuals are at what they do, and design the system accordingly. The second
approach accepts that people vary in their performance, and that inevitably they will
make errors. Therefore the system itself should take the human factor into account
and be designed with human fallibility in mind. The system must be designed to be
error tolerant. The latter approach leads us to look at implementation of systems
such as TPWS and ATP, where the aim is to prevent or mitigate the effects of an
error.
The current draft of this report restricts itself to the safety related human reliability
aspects of the train driving task, and takes as its base case British main-line
signalling and operating practices, with AWS, but without other train protection
systems. The effects of automatic train protection (ATP) and cab signalling are
considered by building on the principles developed in relation to train operation with
lineside signalling. The report builds on and extends the IRSE Technical Committee
Report No. 3 on the influence of human factors on the performance of railway
systems. The underlying principles can also be applied to other safety-related tasks,
such as activities in signal boxes or control rooms and this may be covered by a
further report.
2. THEORETICAL FRAMEWORK
2.1 HUMAN FACTORS

Attributing incidents to human error has often been seen as a sufficient explanation
in itself and something that is beyond the control of managers and the organisation.
However, as the origins of human errors are now better understood it must be
realised that this is no longer an acceptable explanation. There is a need to
consider human factors as an essential element to managing risks. The term human
factors is used to describe a wide range of issues which include:
a) Individual factors: the attributes and capabilities of the person including
their personal attributes, habits and personalities as well as their skills
and competence
b) Job Factors: how the requirements of the task match the capabilities of
the person undertaking the task including consideration of workplace and
environmental factors

__________________________________________________________________
c) Organisational factors: the organisation has a great impact on the

performance of individuals, yet the importance of the health and safety
culture is often overlooked.
Indeed, the HSE defines human factors in its guidance note HSG 48 as:
“…environmental, organisational and job factors and human and individual
characteristics which influence behaviour at work in a way which can affect health
and safety”.
By taking account of these human factors we can begin to identify those factors that
will influence human reliability.
2.2 CONCEPTUAL MODELS

A model is a simplified representation of a complex reality, built up consciously or
unconsciously, and allowing its users to better understand and master their
environment. There are, for example, models of the world, of oneself and of one’s
relation to the world. Such models are often deeply embedded in a culture: they are
created and used by a community and passed on by its members.
For the present, task explicit models have been developed and are set out in the
following sections, to ensure that there is no confusion over what is included, the
relationship between elements, and the meaning of terms.
Several models are introduced in the course of this report:
a) a generalised framework for human errors
b) a model of the safety related aspects of the train driving task
c) a more detailed model of the signal sighting task
d) an example of a model for combining the factors which influences the
likelihood of a signal being passed at danger
2.3 HUMAN ERROR

A number of human error classifications are detailed in this report:
Reason defines different types of human failures as either errors or violations. He
describes how the different types of error are associated with certain types of task or
behaviours.
Carnino in his book “Man and Risks: Technological and Human Risk Prevention”,
(1990) defines an error classification which is used and explained more fully in
section 3 below.
Buck (1963) attempted to classify errors specifically in relation to the driving task.
He looked at the causes of SPADs from a job analysis perspective and was able to
offer some explanation of how errors may occur. He distinguished between
perceptual errors and response errors (passing a signal at the wrong speed).
2.3.1 Reason Model of Human Error

A human error is an action or decision which was not intended, which involved a
deviation from an accepted standard and which led to an undesirable outcome.

__________________________________________________________________
A violation is a deliberate deviation from a rule or procedure.

Slips and lapses occur in very familiar tasks which we can carry out without the need
for conscious attention.
Slips tend to be failures in carrying out the actions of a task. For example, a slip
might involve reading the wrong signal for example, or misjudging the braking
required to bring the train to a stand at the signal.
Lapses cause us to forget to carry out an action, to lose our place in a task or even
to forget what we had intended doing. They can be reduced by minimising
distractions and interruptions to tasks and by providing effective reminders.
Mistakes, on the other hand, are more complex where we do the wrong thing
believing it to be the right thing. The failure involves our mental processes which
control how we plan, assess information, make intentions and judge consequences.
Reason’s error types can be related to different types of behaviour. Slips and lapses
are very typical of skill based behaviour where the activity is highly learnt, routine
and in a familiar operating environment. Mistakes can either be rule based when our
behaviour is based on remembered rules or familiar procedures, or knowledge
based when the situation and circumstances are novel and we are dependent on
problem-solving to work out and decide on a course of action.
2.3.2 Buck (1963)

Buck (1963) offers some explanation of how errors occur amongst drivers by
distinguishing between perceptual errors and response errors (passing a signal at
the wrong speed). He identified six sources of perceptual error, which can occur in
the perception of railway signals. These are:
(1) Incorrect Assessment of Position

In normal circumstances the driver knows his location on the route and can
anticipate the position of the next signal. This is important, as the signals are often
only visible for a short length of time and at varying positions within the visual field.
If the driver is unsure of his position then the chances of missing a signal increases.
In order to make a correct assessment of his position the driver must be presented
with a set of discriminable stimuli adequate in number and intensity and he must be
able to recognise the temporal and sequential position of each as it is presented.
Other auditory and sensory cues the driver uses must not be overlooked.
(2) Selecting the Wrong Signal

This often occurs when a number of signals are displayed in one location and the
driver selects the signal inappropriate for his track.
(3) Distraction
A signal can often be seen if the driver is not doing something else while the signal
is in view in his potential visual field. Subjective thoughts alone may divert the
drivers attention for long enough to miss a signal. There is some evidence that

__________________________________________________________________
attention to task suffers less from irrelevant stimuli than it does from a monotonous
absence of stimulation.
(4) Failure to Look at a Signal

A driver may sometimes fail to look a signal because he can infer what aspect the
signal is displaying from other sources, or information may be received second hand
from other railway personnel. If this inference or alternative information is incorrect
he will make an erroneous response. The driver’s expectation of what will be the
aspect presented at a given signal may be so high that he will not bother to look
irrespective as to whether he has alternative information or not.
(5) Sensory Error

There should be adequate contrast between the signal and its background.
Temporary conditions of fog, sun, smoke etc can distort brightness contrast and
increase the possibility of error. Colour signals require a more precise definition of
hue and better colour sense on the part of the driver. Although the driver enters the
service with good colour vision and acuity this may change over time so periodic eye
examinations are important. Haze may also affect a signals colour perception.
(6) Perceptual Illusion

Part of this problem may be caused by the driver’s expectations. If he looks at a
signal and expects it to be green he may perceive it as being green when it is in fact
red or yellow. General fatigue and anxiety increase the chance of this illusion
occurring.
3. HUMAN RELIABILITY AND SIGNALS PASSED AT DANGER

Reference 1 gives the following definition for human reliability:
"Human reliability is the probability that an individual, team or human
organisation will accomplish a mission, under the given conditions, within
acceptable limits and for a certain duration"
It goes on to define the following error classifications illustrated in Fig 1.
• Perception Error
• Decoding Error
• Misrepresentation Type Error
• Disrespect for a Procedure or a Rule
• Communication Error (Person to Person)
• Decision to Act at Wrong Time
• Action Wrongly Executed
As outlined above, there are various ways of classifying human error. This
classification has been adopted for this report because it maps readily on to the
conceptual model of the driving task and thus helps to direct attention towards
suitable areas for remedial action.
__________________________________________________________________
Rules
Represent
Decode
Perceive
Commun-
icate
Wrong
Act Untimely
Act
FIGURE 1
3.1 PERCEPTION ERRORS

There are various causes of perception errors as shown by the following examples:
a) Information is not always consciously perceived, since the subject may be
otherwise preoccupied, susceptible to stress or, for other reasons,
incapable of perceiving an information item. A classic example of this
type of error is provided by the accident at Norton Fitzwarren in 1940
where the driver of the train apparently cancelled a warning given by his
automatic warning system (known as ATC at the time) but did not
otherwise react.
b) Information is present only fleetingly, and the operator does not have time
to perceive and memorise it. This might be the case for a signal with a
short sighting time, compounded by the driver being distracted for much
of the available time.
c) Information is drowned in a large number of stimuli which solicit the
operator’s attention. This could occur where there is a large array of
signals, each with a variety of subsidiary indicators, located at a place

__________________________________________________________________
where there are multiple lineside signs. Lineside activities and

movements of other trains can also compete for a driver’s attention.
d) The source of information is scarcely differentiated from its environment,
and is thus difficult to perceive. Examples of this might be dimly lit signals
in hazy conditions, signals against a background of city lights at night, or
signals in bright low sunlight.
3.2 DECODING ERRORS

In this case, the stimulus received or collected from the environment has been
perfectly perceived, but poorly interpreted because of difficulty transposing it into
useful information. Although in the British signalling system the number of aspects a
driver is required to learn is small, and their meaning apparently clearly defined,
complications such as junction signalling, especially where additional sequences
such as flashing aspects are included, have been misinterpreted by drivers. Besides
conveying information to the driver by the aspect it is displaying, a signal conveys
information about the line to which it applies by its position relative to the track. In
multi-track areas it can be difficult to identify the correct signal for a given line:
reading the wrong signal can be regarded as a decoding error.
3.3 MISREPRESENTATION ERROR

People act according to their understanding of their situation. Such understanding is
based on a mental model or image constructed from current sense data, short-term
memory of recent events and perceptions, and longer-term memory of rules,
procedures, and past situations. When this mental image deviates from reality
serious errors can result, both in the form of wrong actions and of rejection of
information which might have corrected the situation. This can be illustrated by a
few examples:
A driver forgets that the previous signal was at caution. He allows his train to
accelerate, expecting to find the next signal at green, and is then unable to stop
when confronted with the reality of a red signal.
Running up to an approach – released signal, a driver “knows” that it will clear just
before he reaches it, because it always has in the past. He therefore does not come
to a stand, and does not even look at the signal which he “knows” is going to clear.
A driver reads the wrong signal on a gantry: it is green when the signal for his line is
red. He ignores the AWS warning because he “knows” his signal is green, and
consequently the AWS must be defective.
3.4 DISRESPECT FOR A PROCEDURE OR RULE

It might be considered unlikely that anyone would disobey a rule or procedure which
would put themselves at risk. However, disregard or violation of safety rules is not
generally a simple matter of wilful disobedience. Studies have shown that violations
are often the result of failure to appreciate the significance of the rules, and may be
due to the operator seeking an alternative way of achieving the end result. Simple
violations may be improbable where the observance of signals is concerned, but
they may be made more likely if a misrepresentation error (see above) has led the
__________________________________________________________________
driver to believe that strict adherence to rules is unnecessary. For example, at a

platform starter signal, having been given “right away” by the guard, the driver may
believe that the signal must be clear and consequently not trouble to look at it.
Rules which affect the driver’s performance, and thus make other types of error
more likely, may be more susceptible to disrespect or violation. This would include
rules on alcohol and drugs, working time, possession of route knowledge or other
aspects of competence, or allowing other persons in the cab.
3.5 COMMUNICATION ERROR

Errors in verbal communication are at their most critical in relation to signalling when
they concern degraded mode operations such as giving permission to pass a signal
at danger. Nothing in the design of the signal, at least in British practice, will prevent
this, nor will most forms of ATP, which generally include manual override facilities for
use in such circumstances.
Communication errors may also lead to drivers receiving incorrect information about
temporary or permanent changes to the system (speed restriction, relocation of
signals etc) emergency situations. This may be due either to inadequacies or verbal
briefings, or to errors in or non-availability of notices and circulars
3.6 WRONGLY TIMED ACTIONS

Performing an action at the wrong time may have consequences as serious as
performing the wrong action, or not acting at all. One of the most crucial timing
issues for a train driver is deciding when to apply the brakes. The underlying
philosophy of the British route signalling system is that on receiving a caution aspect
a driver travelling at line speed is required to make a service brake application in
order to come to a stand at the subsequent red signal. There is some room for
uncertainty as to whether the driver should brake when he first sees the caution
aspect, when he passes the AWS magnet on the approach to the caution signal, or
when he passes the actual signal post itself.
However signal spacing actually varies considerably, so that the driver may have to
do anything from braking immediately on sight of the caution signal to not braking
until some time after having passed it. If the train was approaching at less than line
speed, having started from a station, been subject to a speed restriction, or
encountered several successive caution signals, then the driver may not need to
brake until well after passing the caution signal. Overall, a heavy reliance is placed
on a driver’s knowledge of the route in order to ensure that he acts on caution
signals at the right time.
3.7 WRONGLY EXECUTED ACTION

This category would include all misjudgement of train handling, failure to take
account of adhesion conditions and gradient etc. It covers all cases where the right
action at the right time was intended, but was not performed correctly. Taking the
wrong action because of a misunderstanding of the situation would be a
misrepresentation error. This may be illustrated by the example of a driver entering
train data into an ATP system. If, say, he knows the correct train length, but enters
the data into the system wrongly by passing the wrong button then this would be a
__________________________________________________________________
wrongly executed action. If, on the other hand, he is mistaken about the length of
the train, and enters this mistaken information successfully into the system, then this
would be a misrepresentation error.
3.8 INATTENTION
Lack of attention on the part of the driver has been a significant factor in a number of
incidents and accidents. The collision at Southall was an extreme example of this,
where the driver spent some time searching in his bag on the floor of the cab.
However, inattention is not regarded in this report as an error it self, it is rather the
potential causes of inattention which are considered.
To a disciplinarian, inattention might be regard as a clear example of disrespect for
rules or procedures, but it is felt that this is likely to be true in only a small minority of
cases. For a task such as train driving, the root cause of inattention is likely to be
some form of misrepresentation error. The driver does not pay attention to the
signal either because he thinks that he already knows what aspect the signal is
displaying, or because he thinks that he has not yet arrived at a point on the track
where he needs to observe the signal.
When faced with competing demands for attention, distraction or preoccupations,
the human judgement of elapsed time is likely to be very defective and lead to an
erroneous belief that the point where the next signal has to be observed has not yet
been reached. It also may be the case that competing demands for attention cause
the probability that the next signal may be clear to be turned into a convenient
consumption of fact, so that checking its actual state will make no demands on the
driver’s attention.
3.9 SPADS AND ERROR CATEGORIES

SPADs on Railtrack are now classified according to the error categorisation in
Table 1. A mapping to the generic error classification used in this report is also
shown in Table 1.
The percentages of SPADs associated with each of these error types for each year
between 1992 and 2000 is shown in Table 2, which is taken from an HSE report on
SPAD performance published on the Internet. Table 3, from the same source, gives
a similar analysis for SPADs in the higher severity categories (severities 4 to 8).
It can be seen that when all SPADs are considered, perception errors account for
about 15% of the total. This proportion remains much the same when only the more
severe SPADs are considered.
Some 50% of SPADs appear to be caused by misrepresentation or decoding type
errors, although this depends on whether failure to check signal aspect is interpreted
as being due to the driver not checking the aspect because he believes he knows it.
Similarly, it depends on whether failure to react to the caution signal is interpreted as
forgetting the aspect seen, or mistaking the current position on the track
(misrepresentation) or simply misjudging the passage of time since passing the
caution signal (wrongly timed action).

__________________________________________________________________
Overall, the data tends to show that actions to improve signal sighting could at best
account for 15% of SPADs, although it is possible that such improvements might
help to prevent other types of error which result in SPADs.
SPAD CAUSE HUMAN ERROR TYPE

Anticipation of signal clearance Misrepresentation
Failure to check signal aspect Misrepresentation
Disrespect for rules
Failure to locate signal Perception
Failure to react to caution signal Misrepresentation
Wrongly timed action
Ignorance of rules/instructions Communication
Misrepresentation
Violation of rules/instruction Disrespect for rules
Wrong information given Communication
Ambiguous or incomplete Communication

information given
Correct information given but Communication
misunderstood Misrepresentation
Viewed wrong signal Decoding
Viewed correct signal, misread Perception

aspect
Misread previous signal Perception
Misjudged train behaviour Wrongly executed action
Misjudged environmental conditions Wrongly executed action
TABLE 1

__________________________________________________________________
Correct information given but misunderstood

Ambiguous or Incomplete information given
Viewed correct signal misread aspect
Misjudged environmental conditions

Failure to react to caution signal
Anticipation of signal clearance
Ignorance of rules/instructions
Failure to check signal aspect
Violation of rules/instructions
Misjudged train behaviour

Wrong information given
Misread previous signal

Failure to locate signal
Information not given
Viewed wrong signal
Not yet categorised

% of
all
None of these
CAT A
by
error
Other
type
92/93 4% 17% 4% 0% 1% 4% 2% 1% 1% 1% 4% 2% 3% 25% 10% 4% 7% 10%
93/94 4% 15% 5% 1% 1% 6% 2% 2% 1% 1% 6% 2% 2% 19% 11% 4% 6% 9%
94/95 4% 13% 7% 14% 1% 5% 2% 2% 1% 1% 4% 3% 1% 15% 9% 2% 4% 12%
95/96 4% 16% 8% 18% 1% 6% 3% 2% 0% 1% 5% 2% 1% 13% 7% 2% 2% 9%
96/97 5% 17% 10% 20% 1% 5% 2% 2% 0% 1% 6% 2% 1% 8% 8% 2% 3% 8%
97/98 6% 18% 7% 25% 1% 4% 2% 1% 0% 1% 4% 2% 1% 7% 7% 3% 2% 10%
98/99 6% 15% 9% 23% 2% 6% 1% 1% 1% 1% 6% 1% 2% 7% 6% 3% 0% 12%
99/00 5% 17% 6% 22% 1% 3% 0% 1% 0% 0% 4% 4% 0% 5% 3% 1% 0% 30%
Table 2 Category A SPADs by error type and year

Correct information given but misunderstood
Ambiguous or Incomplete information given
Viewed correct signal misread aspect
Misjudged environmental conditions

Failure to react to caution signal
Anticipation of signal clearance
Ignorance of rules/instructions
Failure to check signal aspect
Violation of rules/instructions
Misjudged train behaviour

Wrong information given
Misread previous signal

Failure to locate signal
Information not given
Viewed wrong signal
Not yet categorised

None of these
% of
4 to 8
CAT A by
Other
error type
92/93 1% 28% 12% 0% 0% 4% 8% 3% 0% 5% 11% 1% 0% 5% 0% 5% 4% 11%
93/94 0% 20% 5% 0% 1% 5% 9% 3% 4% 3% 29% 3% 0% 5% 4% 3% 1% 5%
94/95 1% 30% 6% 0% 0% 10% 3% 3% 0% 0% 9% 6% 0% 4% 4% 3% 4% 16%
95/96 0% 37% 2% 0% 2% 10% 0% 2% 0% 2% 12% 7% 0% 0% 0% 7% 5% 12%
96/97 4% 35% 10% 8% 0% 8% 4% 10% 0% 0% 8% 0% 0% 0% 4% 2% 4% 6%
97/98 0% 29% 2% 10% 0% 12% 0% 0% 0% 0% 12% 7% 0% 2% 2% 0% 2% 20%
98/99 4% 20% 4% 2% 0% 11% 2% 4% 0% 2% 16% 2% 2% 5% 0% 2% 0% 25%
99/00 0% 28% 0% 0% 0% 6% 0% 0% 0% 0% 17% 0% 0% 0% 0% 0% 0% 50%
Table 3 Category A SPADs with more serious consequences

__________________________________________________________________
4 CONCEPTUAL MODEL OF TRAIN DRIVING

A number of attempts have been made over the years to develop a conceptual
model of the train driving activity.
Categorising errors can help us to understand some of the underlying causes.
Further insights are achieved when these human error models are mapped to the
task of driving.
Reason (1984) outlined a cognitive driving model which breaks down skilled
behaviour into sets of interlinked routines. A novice is not usually equipped with the
appropriate routines and they are instilled in him by training. Key influences
determining the efficiency with which the individual performs his task are the status
of the routines he has developed within the driving task, his level of arousal, the
feedback he is receiving from his activities, and the ability he has to switch his
limited attention from one routine to another. An individual’s susceptibility to
mistakes can be traced back to problems with developing sufficiently reliable
routines, an inability to switch attention fast enough and personality characteristics
which make them unsuitable for certain types of work. The report argues that this
model could be modified and used in the train-driving context. Psychometric testing
could be employed to investigate the nature of the characteristics relating to the train
driver’s task and the people who perform this function.
Moynihan and Bowen (1987) produced a psychological model, the Driving Task
Model (DTM). They argue that a driver is equipped with a fund of knowledge (ie
route knowledge, traction knowledge, rules) which allows the driver to recognise and
interpret needs (ie speed restrictions, track obstructions) as they arise. Needs are
conveyed clearly and quickly by task information (ie signalling system, warning
boards). The decision the driver makes is based on the needs and task information.
Factors such as route and train type will place different demand characteristics or
task characteristics on the driver. For example, when a driver changes traction they
encounter a different set of task characteristics.
Task Conditioners
Needs
Train
Task Information Knowledge Decision Skill
Behaviour
Man Conditioners
This model must be viewed with care,

as there is little experimental evidence to confirm or dispel it.

__________________________________________________________________
The driver also brings a set of variables to bear on the driving task in his personality,
competence and mental state. These conditions may also include false expectation,
distraction, concentration, skill and knowledge. These are referred to as man
conditioners.
The driver then uses his skill to determine if to brake and when to start. If all the
driver calculations are correct and the skill adequate, then the train should respond
as predicted. If it doesn’t, but the driver has time to recognise he is receiving
unpredicted behaviour, and can make another appreciation of his new need. The
overall aim of the driver is to respond to the needs and calculate predicted train
behaviour and achieve this. Sometimes things go wrong and Moynihan and Bowen
were able to use this model to analyse why things might go wrong.
When this model is reviewed against SPAD data, false expectation and task
information factors appear to be important. When looking at what factors lead to the
driver developing false expectations, the results of a west coast mainline cab riding
study are quoted. This revealed that 86.14% of signals were green, 8.13% were
double yellow 3.14% were yellow and 2.32% were red. It is therefore argued that
when a driver approaches a signal he uses past experience to develop expectations
regarding the signal aspect and due to the low probability of red lights he rarely
expects the signal to be red.
Branton (1979) developed a model based on interviews with drivers and
observations of their behaviour. Branton suggested that drivers have internal
representations of the signals and other features that develop with experience. They
use these internal representations to anticipate the route, as quite often a driver will
not be able to see the “target” or signal. Not only do drivers know where the
“targets” are but they use their internal representations to identify where along the
route they must seek further information about the target. Branton referred to this
further information as variable and part of the skill involved in driving is being able to
anticipate the values of a large number of variables, be aware of their consequences
and the relative significance of variables and then control the train accordingly.
The internal representation or the driver's internal model of the external system is
considered to be an idealised version of the world and in driving the driver is
performing a continual reality test: how much is the mental model matching what is
going on in reality. The sort of computations going on might be as follows: “If all is
going well, I should be seeing this scene in 3 minutes and then I do nothing.
Anything else is an error and I must either speed up or slow down. The internal
model consists not just of anticipated external events but also the probable actions
consequent upon those events.
The model is shown diagrammatically in Fig 2. In order to control the movement of
the train by means of the traction controls and the brakes, the driver must decode
information obtained by his perception of an array of external objects and events,
and decide upon actions on the basis of this information, his knowledge, and his
memory of earlier information.
In the model a distinction is made between fixed or relatively slowly changing
knowledge (i.e. rules and procedures, route knowledge, train characteristics, traffic

__________________________________________________________________
notices), and short term memory of last signal seen, recent line side signs, recent
verbal messages or conversations.
Verbal Communications
PERCEP- Driver’s Brain

TION
KNOWLEDGE
Visual: • Rules &
• Signal MEMORY Procedures
• Signs • Last signal • Notices
• Scenery • Previous signs • Route
• Cab • Conversations • Train
display • Timetable
• Events
• Stations
Decode
Audible:
• AWS
• Vigilance Decide/act
Disturbances
Distractions
Preconceptions
TRACTION Driver’s arm

CONTROLLER
Brakes
FIG. 2: CONCEPTUAL MODEL OF TRAIN DRIVING

__________________________________________________________________
Under the heading of visual perceptions:

• Signals means all railway signals, and could be extended to include flags and
hand signals
• Signs refers to all lineside signs, notice boards, etc
• Scenery refers to the lineside features observed by the driver from which he
deduces his location
• Cab display includes AWS indicator, speedometer and other instruments
• Events refers to workers, trespassers or other people on the line, obstructions, or
anything else the driver is required to look out for
• Stations is intended to encompass everything to be observed for station or
platform duties, whether mirrors, CCTV, direct observation of platforms, or
anything else
• The driver’s perceptions are subject to disturbances, such as rain or fog, and
distractions in the form of competing stimuli and other events attracting his
attention
• The driver may also be subject to mental pre occupations, due perhaps to worry
or boredom, which adversely affect his performance
• Knowledge of the timetable, and of the usual pattern of train movements, may
give the driver preconceived ideas as to what signal aspect to expect, leading
him to act according to his preconceptions rather than observing the actual state
of the signal
5 THE OBSERVANCE OF SIGNALS

The term observance has been chosen carefully so as to include all components of
the driver’s task of responding to signals. Words such as signal sighting or
observation which are widely used, both in this report and elsewhere, tend to focus
attention on optical and visual considerations to the exclusion of other factors such
as preconception or inattention.
The process of signal observance can be regard as having three main phases:
a) detection of signal
b) interpretation or understanding of the signal
c) acting on or responding to the signal.
There are many factors which combine to influence the driver’s performance in each
of these phases. With the assistance of a more detailed model of signal sighting in
section 6 of this report, these factors are developed and tabulated in section 7.

__________________________________________________________________
6 SIGNAL SIGHTING AS PART OF THE DRIVING TASK
6.1 INTRODUCTION
In order to improve the knowledge of the interface between the signalling system
and the train driver, it was necessary to construct a theoretical model of the driving
task. The objective of this model was not to replicate the driver’s thought and
decision processes but to analyse what information he/she may require in order to
carry out each stage in responding to the signal.
To present these input parameters the process has been divided into six sub-
processes each of which is further broken down in a fishbone diagrams. These
show both the positive inputs (i.e. those which can be optimised to increase their
effectiveness) and negative inputs which detract from the quality of the information
input.
The sub-processes address the interfaces between the signalling system and the
driver over a period of time. This starts with a pre-conditioning phase where the
driver establishes some form of mental picture of the next signal. Once the point is
reached where the signal comes in to sight, he/she carries out two further
processes. These involve identifying the signal and then reading the display. These
two activities are closely interconnected and so are better shown as parallel
activities rather than serial ones. Both depend on certain visual conditions being
met for the signal.
Once the signal has been read, the driver makes a decision based on the observed
signal display and implements it.
Although the six elements of the top-level process model are shown in a sequence
format, the driver’s mental processes do not necessarily follow the same sequence.
It was, therefore, felt necessary to include the driver’s experience as an input in
order to show the impact it could have on the time required for the task sequence.
This process model is not intended to replicate the driving task in anything more
than the simplest form. It takes no account of the thinking and decision making
processes which are fundamental to the driving task. Its role is limited to providing a
framework for the extraction and categorisation of driver inputs: it may, or may not
have further applications in subsequent studies in this area.

__________________________________________________________________
6.2 THE OVERALL PROCESS

A representation of the relationship between the six phases selected is shown
below. Each of the phases is then further analysed in terms of the positive and
negative parameters affecting that phase.
Driver Signal
Expectation
{ In sight
Sight
Experience
Identification
In view
Reading
Decision
Action
FIGURE 3

__________________________________________________________________
6.3 EXPECTATION
This is the baseline start position and embraces the driver’s expectation before the
signal comes into sight.
PONs/WONs Spacing Displayed AWS Usual Structure

aspect state and position
Briefings
Previous Expected Personal
signal signal factors
Route
knowledge
Other events
Other trains
Weather
Stops PSR/TSR
FIGURE 4
The following parameters affect the driver’s expectation:
Route Knowledge
Depending on experience, the driver will have a level of route knowledge that will
include a variety of information on signals, routings, station locations, lineside
equipment, junctions, speed restrictions and many other items of information about
the route. Additional information may be gained from PONs and WONs and other
briefing material.
The level of route knowledge will have a significant effect on the processes a driver
adopts for dealing with signal information. Those with less experience will still be
following the view-identify-read process outlined earlier. As their experience
increases these activities will take less time and there may be opportunities for both
__________________________________________________________________
a first look and a confirmatory look at each signal. The most experienced driver may
even omit the “view” and “identify” phases and look directly at the signal at the point
where he or she wishes to read the signal.
Previous Signal(s)
The previous signal or signals will affect the driver’s expectation in two ways.
Clearly a restricted aspect from the previous signal will provoke an expectation of
the next higher restricted aspect ahead. In addition, the positioning and spacing of
previous signals may instil a pattern in the driver’s mind which will, in turn, affect his
idea of when and where the next signal is likely to appear.
The Expected Signal

Although closely associated with route knowledge, the expectation of finding a signal
in its usual state has been separately identified. This is a parameter which regularly
appears in SPAD reports, particularly where the signalman has deliberately replaced
the signal as a control measure for some other event on the track. A second feature
of this parameter also occurs when drivers “expect the signal to clear” at some stage
during their approach.
The driver will also have an expectation of the position and support structure of the
signal ahead. This will be based on route knowledge but conditioned by the
previous pattern of structures experienced.
Personal Factors
There may be factors present in the expectation phase which are individual to a
particular driver or group of drivers. Although it is not possible to define all of these
such factors as fatigue are relevant. There may also be other conditioning factors
such as recent reversions or near SPADS which will cause a driver to modify his/her
expectation and driving style over the short or medium term.
Other Events
Included here are a wide range of events, both inside and outside the cab, which
may affect the driver’s expectation and driving pattern during the approach to a
signal. Prevailing weather, stops, other traffic, speed restrictions and trackside work
may all have an impact. It is pertinent here to comment that, the more significant
these factors become, the greater the gap between the “learned” route and the
“actual” route being experienced and hence the less reliance the driver can place on
his/her expectation. Such factors are, therefore, on the negative side of the
diagram.
6.4 SIGNAL IN VIEW

This phase starts at the point where some, or all, of the display comes into the
driver’s view. This is not an easy point to define, because on a straight track the
signal may be visible from distances of a mile or more. For practical purposes, we
consider a limit of 800 metres as being the point where a signal starts to provide
valid information to a driver and thus becomes the target signal. Outside that
distance the signal is treated as an “other signal” with respect to the signal in rear.
__________________________________________________________________
Its possible contribution to the problem of drivers “reading through” can then be
considered.
In terms of the driver model, the initial view needs to be sufficient for the driver to be
alerted and to be able to ascertain that there is a signal ahead. There is no need, at
this stage, for the criteria for identifying or reading the signal to be satisfied.
Voltage
Intensity Spatial
Position
Shape
Beam
Signal
Alignment Attributes
Colour
Discrimination
Obscuration
Background Day/Night
Cycle
False
Weather images
Objects in Cab
Transmission the way design Contrast
losses
Reflections
Ambient Dirt on Ageing
light lens
FIGURE 5

__________________________________________________________________
The relevant parameters at the ‘Signal in View’ stage are:
The Signal Attributes

This embraces all the physical parameters relating to the signal including spatial
position, beam shape and alignment, colour and light intensity. These are all shown
as positive parameters contributing to the “view quality” of the signal.
The Viewing Environment

This is a collective name for the negative parameters shown in the diagram. This
grouping can be divided into two related groups. In the first group are the day/night
parameters which affect the daily cycle in ambient light level as well as the direct
effect of sunlight falling on the signal or other objects in the vicinity of the signal. All
of this group of parameters follow a defined pattern and it is possible to predict the
likelihood of their occurrence at any particular time or date.
The second group of parameters comprises weather-related factors. In particular
the meteorological visibility will be reduced in fog, snow or rain. Significant local
variations may be experienced depending on wind speed and direction, and the
orientation of the track and signal.
The final parameter to be considered is any obscuration of the signal which may
occur after it has initially come into view. This will mainly be caused by objects on
the trackside such as bridges or overhead electrification equipment but may also be
attributed to shorter-term causes such as smoke, overhanging foliage, passengers
on platforms or staff working on the trackside.
It is also important to consider any obscuration which may arise from the train itself.
The driver has a field of view which is defined on the rolling stock design. This may
well restrict his/her ability to actually see a signal from the driving position even
though it may meet the requirements for being “in view”. In certain circumstances,
such as rain or snow, the driver’s field of view will be further restricted to the swept
area of the windscreen.
6.5 SIGNAL IDENTIFICATION

Once the signal is in view, the driver will start the process of signal identification.
This is the process of identifying the signal as pertinent to his route.
Positive Parameters
Position and Displayed Aspect
The positive factors contributing to correct identification are the spatial positioning of
the signal and the absence of alternative signals in view. The aspect displayed will
also be relevant if it conforms to the expectation developed at the previous signal or
signals.
Other Signals in View

Other signals in view may contribute positively to the correct identification if they
provide supporting evidence towards validation of the position or aspect of the signal

__________________________________________________________________
being identified. The ability to see all the signals on a gantry facilitates identification
by counting across; a view of the next signal may also help identification, both by
confirming the aspect sequence and by contributing to the comprehension of the
track orientation beyond the signal.
AWS
Although not making a major contribution to identification of the correct signal from a
group of alternatives the AWS will provide the driver with an indication of the
distance to the signal to be identified and also an indication of the aspect being
displayed.
Rhythm
from earlier Next signal in
signals aspect
sequence
Position of Expected
Spatial AWS
other visible message
position
signals
Structure
Track Day/Night
geometry
“Alternative” Other Events
Signals
In Cab External
FIGURE 6

__________________________________________________________________
Negative Parameters
Track Geometry and Other Signals
Identification of signals becomes increasingly difficult where there is a curved
approach on multiple tracks since there are often a number of signals visible at the
identification stage. In OLE areas the likelihood of some of the signals being
obscured at any one time is high and the resultant confusion may take some time to
clarify. In such cases the other signals make a negative contribution since they offer
alternatives rather than contributing to the identification of the correct signal.
Other Events
Other events, both inside and outside the cab may deprive the driver of the time
needed to identify the correct signal in a complex situation. Since the driver will not
yet have established and recorded the correct signal there is a need for the time
spent on the identification to be continuous so that the driver can collate all the
information across the whole field of view. This means that interruptions, particularly
visual ones, will be significant and may cause a “loss of place error” resulting in the
need to re-start the identification process from the beginning or, in the worst case,
cause a misidentification error to occur.
6.6 READING THE SIGNAL

This is the process of the driver assimilating the displayed aspect of the signal.
Although shown as a serial activity with the process of signal identification it is likely,
in practice to overlap significantly. This will be particularly the case when the driver
is anticipating a restricted aspect and may use that information as the primary tool in
the earlier identification process.
The transition from reading the signal to interpreting it is also blurred. For simplicity,
the model uses the point where the message changes from a visual stimulus
(eg “double-yellow”) into an input to the process of formulating a course of action.
(eg “implement a speed reduction – look for the single yellow”).
The process of reading the signal involves the driver fixating the displayed aspect.
In this context, fixating is the process of placing the image of the signal on the most
sensitive area of the retina of the eye, and retaining it so that the image can be
interpreted by the brain. Scientific studies have shown that, in order to achieve
fixation of an object, a minimum period of continuous observation is required. The
start of the fixation period is most likely to be defined by the driver’s sub-conscious
need for information; this, in turn, may be dictated by some form of optical patterning
which moves between the instruments, track and signals in a regular sequence.
Positive Parameters
The Displayed Aspect
To assimilate the complete message being transmitted it is necessary for the driver
to be able to fixate the whole display. It is important that the driver is able to
unambiguously determine the difference between the two yellows and also
incorporate the information from any supplementary signals.

__________________________________________________________________
Supplementary
aspects
Spacing
between Displayed AWS
double aspect
aspects
4
Day / Night Background Other Events

effects
In Cab
Weather External
Driver’s visual
cycle pattern
FIGURE 7
AWS
AWS plays an important role in this phase as it is the AWS which not only informs
(or reminds) the driver of the need to read the signal at this moment but also
provides additional information on whether the aspect displayed is a restrictive one.
In poor visibility or certain bright sunlight situations, the AWS may be providing
information on a restricted signal before the driver is able to see, identify and read
the lineside display.
Negative Parameters
Time and Weather
All of the negative components of the viewing phase are equally applicable here.
Time and weather will have a greater significance because this is the first phase of
the process where phenomenon such as phantom aspects or background reflections
become relevant. The entire signal needs to be clearly readable in all lighting
conditions if the intent of the signalling system is to be unambiguously transmitted to
the driver.

__________________________________________________________________
Background
Although the background against which the signal is seen remains constant, it will
change both with the weather and day/night effects and also may change as the
driving cab moves towards the signal. Whilst primarily affecting the ambient light
level behind the signal it may also include components such as reflections or other
light sources which could be read as being part of the display itself.
Other Events
As stated earlier, other events occurring either inside or outside the cab can disturb
the physiological fixation process, which may then need to be repeated to be
successful.
6.7 DECISION
Making a decision is one of the most complex processes and this model focuses on
evaluating the inputs and outputs rather than the process itself. The assumption is
made that the driver will be supplied with signalling and other information and will
make a decision based on that data: the validity of that decision and the process by
which it is reached can be examined elsewhere. This assumption is, however,
compatible with a generic Decision Making Framework which could be used to
analyse the various steps in the decision making process itself.
Unlike the other diagrams, the decision making process cannot have positive and
negative parameters since all the inputs are considered. The model does, however,
separate those parameters which may have an adverse effect on the decision
making time since this is of more significance to the current study.
The significant parameters in the decision process are those relating to a detected
change of state of the system – in this case the train movement. These fall into
three groups:
The Expected Signal Display

The driver will have a subconscious plan for the short-term control of the train. This
will include an expectation of the displayed aspect of the signal.
The Fixated Signal Display

This will be compared with the expected signal display and either reinforce or
contradict the factors which formed the subconscious plan in the drivers mind. The
outcome of this comparison will be an alert to a possible need to change the current
state by an undefined amount. It should be noted that the fixated signal display may
not necessarily be the actual display: this is likely to result in a “misread” type of
SPAD.

__________________________________________________________________
Signal spacing
rhythm
PSR/TSR
Gradient
Type of Stops
Stock Target
speed
Actual
speed Expected
Fixated
signal signal
Speed
display display
profile
Weather
Other events
In Cab External
FIGURE 8
The Speed Profile

The primary component of the driver’s current plan will be a speed profile. This will
depend on a number of parameters covering the track profile, stock type, weather,
stops and speed restrictions. Not only will these factors dictate the current speed of
the train but they will also input to the rate of change of speed needed to attain the
target speed. In this context, it is worthy of note that the driver may commit to a
speed reduction plan aimed at stopping at a red signal which is not yet in view. If so,
the signal spacing rhythm, which the driver has assimilated from earlier signals, may
be the only usable estimate of the intended stopping point.
The distractors to the decision process are those activities either in or outside the
cab which require the driver’s attention during the decision process.
__________________________________________________________________
6.8 REACTION
This is the final stage of the process where the driver’s intention is converted into a
train control command. It is essentially an iterative process comparing the driver’s
intention with the reality. In this phase, the actual parameters can be seen as the
positive ones with the negatives being the errors in the decision process.
Weather Stock
Track
Actual Distance to Acceleration/
Speed signal deceleration
Speed Distance Rate of

errors errors change
errors Weather
Signals
Stops
Stock
Track
TSR/PSR
Route Signal
knowledge rhythm
FIGURE 9
Actual Parameters
These will be the set of parameters which affect the train control. They will include
the actual speed, intended speed profile, braking characteristics in the prevailing
conditions and actual distance to the intended point where the train will be at the
intended speed or stopped.
Decision Errors
Although these will match the actual parameters above it is worth considering each
to see how the error can be affected by the signalling system.

__________________________________________________________________
Speed
Speed is the primary parameter for the driver and he/she is constantly monitoring
the speedometer. At steady speed this monitoring is a check process to ensure that
the actual speed conforms to that for the section of route. During acceleration or
deceleration the driver is concerned, not with the actual speed, but with the
difference from the intended speed. It is this difference that he/she compares with
the acceleration/deceleration profile. It is a further consideration that the process of
assessing the speed profile generates a need for a series of readings of speed.
Constantly checking the speedometer will consume more of the driver’s task –
possibly at the expense of allocating less time to identifying and reading signals.
This area is worthy of significant further analysis because acceleration or
deceleration are often cited in reports as contributing to SPADS, incidents or
accidents. The effect of stops, PSRs, TSRs, and previous speed restrictions
imposed by the signalling system on SPADs and other incidents should be a priority
topic for future investigation.
Braking Characteristics
Although the braking performance will be part of the driver’s training and stock
knowledge, local conditions of weather, rail or stock condition, or a wrong estimate
of gradient will introduce local variations. Once again the effect variations will need
to be checked: although much of this check is likely to be achieved by intuitive “feel”
some additional speedometer data may also be sought.
Stopping Point
During this phase the role of the signal changes from being a message carrier to
being a stop or speed marker for the driver. In some cases the deceleration profile
will be decided by the driver at a warning signal before the danger signal has come
into view. The deceleration plan will be based on where he or she thinks the signal
will be: this will be derived from route knowledge and the signal rhythm picked up
from previous signals. The chance of misjudgement of the stopping point is likely to
increase at signals which are not normally encountered at danger since there have
been fewer opportunities for drivers to practice stops at these signals. Add this to
the earlier considerations on expectation and it becomes clear that on such signals
good viewing and positioning are essential if the SPAD risk is to be contained to a
reasonable level.
Although a red signal provides the reference stopping point for the train,
consideration should be made of the need to stop some distance in rear of the
signal. This distance has been increased by the recent instructions on defensive
driving. Stopping further back from the signal may reduce the number of SPADs but
has other implications, in terms of close viewing segments, and signal positioning
and alignment, which also need to be considered. The ability to judge the approach
to signals which are mounted in different ways (post or gantry) may also have an
effect.

__________________________________________________________________
7. THE PARAMETERS OF SIGNAL OBSERVANCE
7.1 SIGNAL DESIGN AND MAINTENANCE

The key factors under this heading were identified as:
• Signal intensity
• Beam shape
• Beam alignment
• Reflections
• Colour
• Light loss
• Position cues
• Height
• Lateral displacement
• Appearance of post or structure
• Spacing of aspects
• Supplementary/subsidiary aspects
• AWS
• Acquisition time
• False images
There are many influences on each of the above factors and much interdependence
between them. Consideration of these influences, and their interaction, is key to the
achievement of successful intelligent message passing from the signalling system to
the driver. For example a high intensity signal light is only of value if it is focussed
through an optically correct and clean lens system which produces a light beam of
the right colour and points in a direction that will be intercepted by the eye-line of the
drivers of all approaching trains for a sufficient length of time for the drivers to
receive, understand and react to the message being conveyed. Any one of these
factors failing to perform at optimum level will give less than the maximum possible
opportunity to convey the correct message to the drivers and thus detract from the
overall intelligibility of the message.
In itself a signal light of the correct intensity is dependent on the type of light emitting
device, its age as performance tends to decline with age and the constancy and
regulation of its power supply which may vary considerably with time of day,
instantaneous load and for many other reasons, including its own age deterioration.
Creation of an adequate beam of light is then dependent on the design of the lens
system, its position relative to the light source and the transmission properties of the
lens system that can easily be affected by dirt or natural incursions. The colour of
the emerging light is important as the signalling system is basically one of colour
coding and this may be affected by ageing or stability of the lens material or the
colour of the light source.

__________________________________________________________________
Having created an adequate light beam, the directing of this is dependent on many
influences not the least being the physical properties of the mounting structure, any
restrictions on these due to the surrounding infrastructure and the track geometry at,
and on the approach to, the point at which the signal is located. The overriding
considerations are the point at which the beam first intercepts the driver’s eyeline
and for how long that beam is identifiable and visible. This has a lot to do with the
environment in which any particular signal is located which is dealt with in the next
section.
The above commentary considers only the most simplistic case of a single beam of
light (or aspect). In reality most signals are multiple aspect and often include a
plethora of subsidiary and routing light displays, the optical and physical
characteristics of which, are quite different. Under the 4-aspect system there are, by
definition, four separate beams of light, the coincidental focus of which can only be
achieved at a single point on the signal approach. With the development of
satisfactory LED or fibre optic main aspect signals it may be possible to combine 3
of the 4 into a single source but the need to separate the double yellow aspect will
remain. The reduced visibility of subsidiary and routing displays is partially
addressed through standards, which limit their application, but the overriding
requirement is for a signal to convey all the necessary intelligence to the driver to
enable the response that the signalling system is demanding. The more complex
the design the more difficult this is to achieve.
The final point in this section relates to the identification of the point on the track at
which the signal is located. In the light of the requirement for drivers to have
detailed route knowledge this may seem to be a simple issue but as a red signal is
the limit of movement authority it is important that a driver is able to judge exactly
where this is. Clearly in daylight a post mounted signal on straight open track is less
of a problem but a gantry mounted signal in the middle of a multitrack section has no
physical connection with the track and at night can appear as a disparate red light
making the judgement of the stopping point difficult. Achieving maximum
conspicuity of the signal position is a key issue.
7.2 SIGNAL ENVIRONMENT

• Objects in the way
• Track geometry
It is clearly not possible to control natural occurrences such as the weather or the
day/night cycle but as most signalling is in the open air and subject to the influences
of these they need to be taken into account in the consideration of each signals
environment. For example no adjustment is made for the variation in ambient light,
which reaches its extreme through the day/night cycle. A light signal has to be good
to be viewed in full sunlight yet this same output can be too bright at night and
overwhelm the output from less powerful signals in the vicinity thus reducing their
readability. It can equally have this same effect on its own subsidiary/routing
displays thereby, in reality, reducing its own effectiveness.

__________________________________________________________________
Ambient light is also generated from other sources and the principle of keeping the
signal light at the driver’s eye level, wherever possible, very often results in the
presentation of the signal aspect against a background of other light sources. The
proliferation of lighting for advertising, street and road illumination, domestic and
security purposes in the last 20 years and particularly in urban and metropolitan
areas has not made the signal-viewing task any easier.
Special consideration needs to be given to the effects of sunlight falling full on to the
signal lens and this is particularly relevant when the sun is low in the sky and the
normal hoods are less effective. Environments most prone to these effects are
those where the route of the railway runs east/west and the face of the signal is
bathed in the rays of the rising or setting sun at times of the year when it is
reasonably strong.
On straight open track the focussing of the signal beams from all aspects to give the
driver maximum viewing time is not usually a problem even on electrified railways.
In fact it is sometimes the converse that is true, in that there is too great a visibility of
a number of signals in advance of the train, creating the risk that a signal with poor
light output will not be seen and the aspect of the next one be taken instead, the
phenomenon known as “reading through”. However in more complex areas where
there is a multiplicity of tracks and signals, track curvature, switch and crossing
work, stations and other structures and possibly overhead line equipment or any
combination of these, the achievement of the intelligent message passing process,
or acquisition time, is more difficult. Thus the decisions on the sighting of the signal
are more critical.
The standard of the 4 and 7 seconds sighting times have been universally applied
although the origin of these figures is uncertain and the adequacy of these values is
now questionable. The time required for a driver to receive and understand the
messages from the signalling system is not necessarily constant and is likely to be
influenced by the context in which the signal is observed.
For example the choice of the applicable signal where more than one is in view, by
whatever method the driver adopts, takes time. Equally his powers of observance
and interpretation can be influenced by a multiplicity of distractions from the simplest
of a passing train or a lineside spectacle to the complexities of the final approach to
a terminal station, coping with an under performing train, reaching the end of his shift
or even just the task of normal driving.
The task of observing the signalling is only one that the driver has to undertake.
Speed restrictions, permanent and temporary, neutral sections and track workers
are examples of other things that a driver has to observe and react to as part of his
normal duties. The audio output from the signalling, usually in the form of the AWS
horn or bell, is seen as an assistance to the driver. What is less obvious is the use
that the drivers make of the AWS magnet in assisting their judgement of the distance
to the signal. This being the case, it raises the issue of why the AWS distance is
fixed but the sighting distance is variable due to it being time based and hence
speed dependent.

__________________________________________________________________
7.3 Signal Arrays

• Other signals in view
• Signal identifiers
There is clearly greater opportunity for error when a driver is presented with a view
of more than one signal at any point on his journey and it is accepted that the
avoidance of such viewing opportunities is impossible in a complex railway network.
All measures can only therefore be mitigatory.
The main risk is that a driver will take the wrong signal, which if displaying a less
restrictive aspect, could lead to danger. A slightly lesser risk is that, in the viewing
time available, the driver will fail to positively identify his applicable signal and make
a presumption that turns out to be wrong. The key requirement in these
circumstances is to get two messages to the driver:
• This is the line your train is on
• This is the signal applicable to that line
In general, the difficulties are less on four track unidirectional railway than on multi-
track bi-directional railway due to there being only two signals to choose from and a
better awareness by the driver of which track he is on. Where the two same
direction tracks are not adjacent, there is greater separation between the two signals
and hence less chance of taking the wrong signal. Where the two same direction
tracks are adjacent, opportunity exists to provide height differential as well as the
lateral spacing, which has the added advantage of putting the lower aspect more at
driver’s eye level. In either case the identification process is improved if signals for
both tracks are parallel and this is a practice that should be universally applied. If in
addition the signals for the opposite direction can be positioned so as to be on the
same structure then this will enhance the identification of the signal location.
Where there are more than two signals the identification of the correct signal
becomes more complex particularly if the approach is not straight, the viewing of all
signals on the array is not continuous from initial sighting or there is the possibility of
switching from one track to another during the approach. It is an accepted practice
by drivers to identify the applicable signal by counting across ie fifth track from the
left equals fifth signal across the gantry. However if at the moment of counting all
signals are not visible due to an obstruction moving across the field of view the count
will give the wrong signal. Equally a count made from the wrong track if routing is to
take place between the point of count and the signal, will give the wrong result.
The application of height differentials to adjacent signals may assist the identification
process although this needs to be balanced against the need to mount signals in
gantry cages higher than the minimum with the risk of further obstruction to viewing
caused by overhead line equipment.
Track or line identification in the multi-track scenario is important to create an
absolute understanding in the driver’s mind of which line he is travelling along. This
understanding can be enhanced or weakened by the consistency or confusion of
messages he receives so it is vital that maximum consistency is achieved. It is also

__________________________________________________________________
for consideration whether the line ID system should be integral to, or separate from,
the signalling system, which may, for example, determine the type of route
indications that are given through the signalling system.
[NB This section touches on many of the issues that have been key to the Cullen
Inquiry following the Ladbroke Grove accident and have occupied much time and
expert opinion during the course of this Inquiry. This being the case, the IRSE feels
that any recommendations from the Cullen Inquiry will be based on a much more
comprehensive consideration of the issues and therefore restricts its comments in
this section to those briefly given above.]
7.4 SIGNAL SPACING

• Overbraking
• Underbraking
• Gradient
• Rhythm
• Station stops
• PSR/TSR
• Route knowledge
It is standard practice in the UK for drivers to learn the route so that the location and
meaning of each signal is known and understood as a prerequisite to a driver being
permitted to drive on any particular route. This is not true in all countries where a
combination of consistently regular presentation of information and advice on
permissible speed, is deemed to be adequate to enable the safe passage of trains.
As a result of this UK practice, the design of signalling spacing is more liberal and is
adjusted to suit local circumstances and to place signals at positions of greater
convenience. A further result of this is that, under certain conditions, warning
signals can be placed at up to a 100% greater distance from the relevant stop signal
than is necessary for the braking capabilities of the trains using the route. There are
also situations where the application of previous practices has resulted in signal
approaches that are underbraked.
On long open stretches of track many drivers prefer the rhythmic appearance of
signals to be regular and on this type of line the practice of breaking the rhythm to
position signals at special locations such as stations or level crossings is no longer
necessary. In fact the removal of starting signals at stations provided the achievable
headways are not seriously affected, together with the respacing of signals to
remove overbraking may provide a double benefit in reducing SPAD problems. The
impact at level crossings would need to take into account any possible increase in
delay to road traffic and the associated risk of that.
As signalling in the UK is route, rather than speed based, and the arising need for
temporary speed restrictions is largely independent of the signalling system, it is not
considered that changes in the principles currently applying to signal spacing would

__________________________________________________________________
have much effect. There may be an impact on permanent speed restrictions but this
could be favourable where such a speed restriction has had to be applied for
previous under braking reasons.
7.5 ASPECT SEQUENCES

• Previous signal aspect
• Previous signal AWS
• Expected signal
• Visual state of signal
• Varying number of aspects
• Repeat aspects
• Delayed release
• Flashing aspects
• AWS at PSR/TSR
• Splitting distants
The purpose of aspect sequences is seen to be twofold. It is there to promote the

maximum use of the line by conveying information to the train that although passed
intermittently is part of a single, and continuous, source of intelligence on the state of
the line ahead ie that intelligence held by the signalling system. Its second purpose
is to convey to the driver how far ahead he is able to travel at any particular speed in
anticipation of a need to lower his speed, or stop, at some point ahead. It may be
argued that these are one and the same thing but the distinction is that between
design and practice, signalling is designed for particular speeds and capacity, which
will only be achieved if the driver exploits that to the full.
In theory there is no limit to the number of aspects that a signalling system can use
with each extra one improving line capacity or allowing higher speeds. Current UK
mainline practice uses four with a fifth having been trialled in the past. By this
means the driver sees a succession of aspects each of which either confirms his
authority to proceed, gives him a warning of the need to stop at some point ahead or
instructs him to stop at that signal. Because drivers have to know the route they
build up a very good picture, not only the geographical features but also the
operating characteristics of that route. This in turn builds particular expectations of
certain sequences or timings of events at particular localities and drivers anticipate
such events based on previous experiences. Thus when approaching a particular
junction past a yellow signal, if 9 times out of 10 the junction signal clears for his
route on approach, he will anticipate it doing so on the tenth. The risk is greatest
when it doesn’t. In this situation and others similar where the correct speed profile is
enforced through the delayed clearance of the junction signal, one might question
whether the aspect, and AWS response, of the previous signal was fully effective.
Equally it is argued that where trains are running close together on restrictive
aspects the understanding of the driver that this is the situation leads him again to
__________________________________________________________________
anticipate signal aspects and that the process of resetting the AWS becomes semi-
automatic and thereby less effective.
On the other hand the driver’s intimate route knowledge is put to good use in not
only knowing the location of signals but understanding those which are easy or
difficult to sight and thus using the aspect sequence leading up to such signals, to be
more prepared. The use of additional aids such as banner repeaters, where sighting
difficulties cannot be overcome by adequate positioning of the prime signal, do not
form part of an aspect sequence but can provide assistance to the driver particularly
if the signal he is approaching is at red. Such assistance is however limited by the
fact that it is only a two-state device and cannot convey routing information.
Similarly the use of ground level repeaters has limitations but can perpetuate the
aspect sequence as it repeats all aspects. The use of flashing yellows actually
introduced two new aspects which changed the traditional aspect sequence, and
this, together with differences in application have led to confusion amongst drivers to
the extent that the advantages appear to be outweighed by the disadvantages. It is
certainly true that if their use is perpetuated then consistency in application is
essential.
7.6 CAB DESIGN

The design of the Driving Cab can effect the driver’s ability to concentrate on the
correct observation and react to signalling displays. Coupled with the task of
operating the driving controls to move the train, conflicts could develop between
tasks.
• Windsceen view area
• Windscreen distortion
• Windscreen reflections
• Screen wiper performance
• Protection against glare
• Ambient noise
• Windscreen de-misting
• Temperature
• Ventilation
• Position of controls and indications
Most of the above factors are concerned with the creation of a suitable environment
in which the driver can carry out his tasks to the maximum efficiency and with the
minimum of stress. It is perceived that if a driver is constantly having to fiddle with
the controls of a windscreen wiper which is operating erratically or manually support
a sun visor which fails to stay in the correct position for the height of the sun then he
will be seriously distracted from the task of observing and responding to signals.

__________________________________________________________________
The key requirement is for the forward field of vision to be of a size that is adequate
to observe, in all four directions, all that is necessary from the driving position. It is
equally important that this viewing area, normally a windscreen, is designed to
minimise internal reflection and reduce glare and that it is equipped with wipers,
demisting and sun protection all of which operate reliably and with the minimum
intrusion.
Control of the environment should include a plentiful supply of fresh air and the
means to control the temperature at comfortable but not soporific levels. The danger
of a driver falling asleep has to be recognised and this can be assisted by good
environmental control as well as by the provision of vigilance devices.
For the same reason the driving position should be comfortable and ergonomically
designed to provide good access to all controls and for the viewing of indicators,
panel lights etc as well as to body support in the correct manner. If a second seat is
required it should not compromise the functionality of the driving position unless it is
provided for a particular role. In this case a balance will need to be struck
dependent on the respective role of the two cab occupants.
Finally it is essential that noise in the cab be controlled to a level that not only allows
full hearing of all audio signals and permits clear radio/telephone conversations but
also is below a level that can become a distraction or an irritant. This may not be
easy to achieve in a large diesel locomotive operating in a railway environment, but
is essential to avoid a reduction of driver performance.
7.7 DRIVER TASKS

The overall scope of the driver’s task is expanding to cover some commercial
activities that have to be “ranked” by the driver as to their priority of action. This can
only be monitored by “in cab/on train” monitoring by those in the driving
management field. This is essential to ensure that bad practices do not effect the
risk analyses of performing these associated driving tasks.
• Train handling
• Fault alarm management
• Communications
• Train preparation
• Station duties
• Observe people on track
• Level crossing operation
The focus on the interface between the driver and the signalling can overshadow the
fact that the driver’s main role is to drive the train and that without ATP or some
other automatic system it is only through the driver that the train can, and does,
respond to the signalling system. There are many other tasks, the importance and
duration of which vary with location and circumstances that also come with the
driver’s role of “being in charge” of the train.

__________________________________________________________________
The mechanics of driving should be simplified to the greatest extent possible with
maximum use being made of modern technology to automate tasks and functions
wherever achievable and clear instructions to deal with alarms and malfunction. The
greater complexity introduced by such an approach will put other than the simplest
of faults beyond the capability of the driver but the use of relatively simple condition
monitoring techniques can identify both actual and developing fault conditions.
Using good communication links this information can be relayed to maintenance
control either at the instigation of the driver or automatically via dial-up or permanent
telemetry links.
Good communications are an essential feature of the modern driving task and it is
important that a driver has the right links to achieve this. Basic requirements are
seen as the need to be able to communicate with all other staff on the train and
constant communication with the controlling signal box for the section of the line the
train is currently on. It is preferable that these are dedicated links rather than
achieved through the use of mobile cell phones although the latter need to be
provided for emergency and possibly external use. It is considered that using these,
or other systems, the driver could be provided with advance traffic information thus
allowing him to optimise his driving to the circumstances ahead. As part of the
above package there should be a gradual abandonment of lineside telephones
particularly SPTs but clearly retaining no lesser level of security.
Other driver duties such as train preparation and station duties should decline due to
the increased use of technology and whilst tasks such as inputting train weight are
important they tend to be performed in a static mode and are not therefore in conflict
with the task of signal observation. However it is perceived that the mental load of
such tasks and the anxiety of ensuring they have been completed may just make the
driver a little more vulnerable in his response to the signalling system on the initial
start of a journey. Of far more significance is the responsibility placed on the driver
of one person operated trains to use platform end mirrors or CCTV to observe that
passengers are safe as the doors are closed and the train moves off. The
requirement to do this, at the same time as he needs to observe the platform starting
signal, puts him in a position of having to perform two vital tasks simultaneously, and
creates a very high-risk situation.
The final role of the driver is to observe everything on or about the line as his journey
proceeds. Part of this is the need to see people working on the track and to give
audible warning of the trains approach. This is a vital task and it is not seen that
there is any alternative. However the policy to reduce red zone working and the
ongoing development and use of reliable warning devices will eventually diminish
this particular task. Nonetheless the vigilance of the driver will always be an
essential part of his role.
7.8 DRIVER’S KNOWLEDGE

A base knowledge requirement of signalling is needed by the driver to be able to
interface with the signalling equipment effectively. This base knowledge
requirement must embrace not only the differing style of displays but also they use
that can be made of the signalling equipment. This will allow a greater
understanding of the correct displays and responses.

__________________________________________________________________

• Briefings
• Location cues
As the UK system of signalling and train movement is based on the system of the
driver having an intimate knowledge of each route including the track layout and
signalling then clearly the on-going safety of the railway is hugely dependent on the
successful establishment and up to dateness of the knowledge of all drivers.
Thus these processes of establishing the knowledge base and keeping it up to date
not only have to be robust but also need to be supported by systems that regularly
test that level of knowledge and certify them as being adequate. This clearly
involves the trainers and managers of the drivers as well as the drivers themselves
in what is a vital safety process.
Initial knowledge can be acquired in a number of ways, the most obvious of which is
by cab riding and learning from experienced drivers the techniques they use to
memorise essential route features. Classroom training using such basic documents
as the General and Sectional Appendices have limited value but the increasing
availability of videos brings much more reality into the teaching environment. The
development of simulations for complex layouts by using the data developed for the
signalling system is a massive step forward and, in the one developed for the current
resignalling at Euston, enables every route from every signal to be simulated on a
VDU so that, a driver can have that experience in the classroom. The simulation
developed for Leeds is reputably better and undoubtedly such simulations will
become more sophisticated and interactive so that unexpected situations can be
created and the drivers reaction and competency be fully tested in an off line
environment. Apart from basic route learning, a key benefit of simulation is the
ability to train drivers on changed layouts rather than having to experience it in
reality on day one after the change over.
A further important part of the process is ensuring that drivers are aware of short and
medium term changes to the routes they drive on, particularly such matters as speed
restrictions or temporary signalling alterations. The main medium for this is through
the Periodical, Weekly and Emergency Operating notices, the existence and use of
which is embedded in the driving culture, and thus, although a paper based system,
seems to work. A drawback is the need to carry and refer to such documents on the
move but until such changes are fully controlled through an ATP system it is difficult
to see a reasonable and practical alternative. It is desirable that all route changes
other than those of very short duration should be reinforced through a briefing
process although it is not clear whether the variability of the driver’s shift
arrangements makes this a practical proposition.
The difficulty of identifying signal positions has been mentioned before particularly in
the context of stopping a train. A driver has to have cues for every signal position so
that he understands at which points he can see signals and, in complex layouts,
which are his signals. Clearly these cues are also part of a driver’s route knowledge
and whilst many railway features provide the reminders the use of off-railway
features is quite common and needs to be taken into account when these features
also change. For example the demolition of a high rise building could remove a

__________________________________________________________________
commonly used cue for looking for the next signal and this needs to be taken into
account in future instruction.
A driver’s understanding of how signalling works is possibly an area for
improvement. Whilst the example of approach clearance has previously been
mentioned, this is more to do with experience than an understanding of the
principles. The debate is whether a better understanding of the principles and the
reasoning behind the way particular layouts have been signalled would make for
better drivers. Additionally a broader knowledge of the operating “rules” particularly
in terms of prioritisation and regulation, would enable a driver to adjust his train
movement to optimise his expectation of what he is going to find ahead. Again a
certain amount of this comes through experience but an underpinning knowledge of
the operating rules could improve defensive driving techniques and avoid needless
efforts to recover lost time when paths have already been lost.
7.9 DRIVER COMPETENCY AND FITNESS

• Train handling
• Knowledge of rules
• Judgement of distances
• Visual Acuity
• Peripheral vision
• Fatigue
• Stress
• Shift working
• Time into shift
As driving relies on the observations, understanding and reaction of the driver, then
fitness is a vital factor in the successful achievement of his task. This is fitness in its
broadest sense, which includes not just the long term or basic health issues but also
the short-term fitness for purpose and regular delivery of the requisite competencies.
Clearly achievement of basic health standards is a prerequisite and obvious
requirements such as eyesight can be routinely tested. The question of whether all
visual characteristics that come into play, for example peripheral vision, during the
normal driving process or even under severe stress, are actually tested or are even
testable, is perhaps one that needs further debate. Colour vision is obviously
important and is tested. The colours of signals do vary, as does the relative
brightness from signal to signal. Does a driver’s colour vision test cover this same
range of variation and are the different individuals’ perceptions of colour fully
explored? If not, is there a point at the limit, where a wrong colour could be
perceived?
The states of stress and fatigue can influence behaviour; particularly reaction and
thinking time and the degree to which either state will affect anyone individual may
vary considerably. Whilst it is difficult to prevent the influences of an individual’s
__________________________________________________________________
personal life spilling over into work time, it is important that a driver’s mental state is
at best for the job he has to perform. Thus work issues need to be managed to
facilitate this. The cab environment has previously been covered and is a good
example of things that can influence mental well-being. Patterns of work can be
managed to minimise stress and managers need to be sensitive to the impact of any
serious or disciplinary discussions they need to have with drivers and the timing of
these. The impact of work patterns and working time on human behaviour has been
well researched and the results published. It is not proposed to expand further on
this here.
The basic competency of a driver to exercise the necessary skills on matters like
train handling, judgement of distances and rule understanding and application can
very often only be judged on the job, which places a heavy burden of responsibility
on his manager or whoever is certifying that competency. It is also time consuming
and costly. It is felt that better simulation techniques should be introduced, similar to
those in pilot training, so that more of the basics can be taught offline and that,
subsequently the use of interactive simulation to better prepare drivers for
emergencies, can be part of their on-going development and refreshment. It is
possible that more lineside assistance could be provided to assist drivers in the
identification of signal locations and as an aid to judging braking distance.
Countdown markers as being used for SPAD problem signals could be universally
applied, as could regular distance marking throughout the network. There are
perhaps some useful techniques that could be imported from the motorways.
8 RECENT INVESTIGATIONS INTO MULTI-SPAD SIGNALS
8.1 BACKGROUND
Since the Ladbroke Grove accident HMRI has been conducting an investigation into
the management of the risks at signals that have been passed at danger more than
once. During the course of this investigation over 200 multi-SPAD signals have
been viewed from the driving cab, including over 60% of the signals that have been
passed at danger four or more times in the last six years.
The number of signals that have been repeatedly passed at danger is much greater
than would have been expected if the distribution of such incidents were random. It
is therefore almost certain that the majority of these signals embody features in their
structure, environment, or presentation to the driver that render them particularly
susceptible to being passed at danger.
This section outlines some of the features that are emerging as contributing to
signals being passed at danger, and factors that need to be considered in the design
of line side signalling systems and in the investigation of Signal Passed At Danger
incidents.

__________________________________________________________________
8.2 CONTEXT / EXPECTATION

The observation of signals is part of a continuous driving activity, with a mental
picture being built up from successive signals and from other signs and indications.
This mental picture is not confined to what has been observed, it extends forward as
an expectation of what is going to be encountered ahead, based on route knowledge
and previous experience.
When considering signals and other signs relating to the driving task, such as speed
signs, it is necessary to consider them in the context of the preceding and
succeeding signals and signs, and the total driving task, rather than in isolation.
Banner Repeaters, Signal Reminder Boards, and Count Down Markers all need to
be positioned after careful consideration of their proposed location and the context in
which they will be seen by drivers.
The effects of stations require particular attention. Where a station platform
intervenes between single yellow and red signals, particularly where the red signal is
not visible from the platform, there is a significant risk that the warning of the single
yellow will be forgotten during the station stop. (Current restrictions on the use of
DRA prevent its effective use to mitigate this particular risk). The other common
scenario is when a train starts from a platform on the authority of a single yellow
aspect. Firstly this requires the train to accelerate towards a red signal and requires
good judgement as to where to change from ‘acceleration mode’ to ‘braking mode’;
and secondly drivers can falsely enter a ‘right away’ mind-set and believe that the
route is being cleared ahead of them and that the next signal will have cleared by
the time they reach it.
Also of importance are permissible speed change boards, both permanent and
temporary, particular those with associated AWS; all of which can convey messages
that may be at variance with the action required by the aspects displayed by the
signals.
8.3 CONSISTENCY
In order that the mental picture built up by the driver is as accurate as possible and
the possibility of false expectations is minimised, it is essential that the signalling is
as consistent in its configuration and as unambiguous in its meaning as it is possible
to achieve.
Several generic ‘traps for the unwary’ have been recorded:
a) The most common relate to changes in signal configuration within a
sequence, for instance: a signal to the left of the line after a succession of
signals on the right, or three signals on a gantry after a succession of
gantries carrying two signals. Both of these examples might be the best
solution in a particular situation and are not inherently 'wrong'; however
designers need to be aware of the possible human factors risks that can
arise when a pattern is established and then broken.
b) A more specific case is where the aspect sequence changes from 3 to 4
aspect. There are still a number of examples around where following a
green at the last three aspect signal, the next signal can either display a
__________________________________________________________________
double yellow for a red two signals ahead or a single yellow with the next
signal ahead at red (usually with minimum signal spacing). For reasons
of headway this ambiguous signal is much more often seen at double
yellow, and drivers can be taken by surprise – and led into errors of
judgement - on finding it at single yellow.
c) Another specific case is where a junction is approached under a flashing
aspect sequence and the next signal beyond the junction signal is at red.
In this case the signal before the junction will be a single flashing yellow
which gives no indication of the state of the signal beyond the junction.
Drivers are expected to remind themselves that a flashing single yellow
might be the equivalent of a steady double yellow. If however in their
experience the signal beyond the junction is nearly always at green there
is a strong temptation to assume that it will always be green. This case is
further compounded by the fact that the first and only positive indication of
the state of the next signal is given at the junction signal when part of the
drivers’ concentration is likely to be directed towards the junction.
8.4 VISIBILITY
It must be self evident that the driver’s ability to see and correctly identify the signal
is a fundamental requirement.
The visibility of a light signal to the human eye is dependent on the contrast in
luminance between the signal itself and its surroundings, which confirms that the use
of a matt black backboard is scientifically correct.
Recently much larger backboards have been fitted to a small number of signals
which are viewed against bright sky or illuminated cityscape backgrounds. These
have been very well received by drivers who consider them to greatly improve
visibility of the signals concerned.
Most colour light signals have a very narrow beam; and the ability of the human eye
to distinguish colour decreases rapidly as the image is moved away from the axis of
the eye. The position of the signal and the alignment of the beam are of great
importance.
While it may be possible to see a light signal it is often not possible to establish its
exact position, particularly in relation to multiple running lines, without further visual
information. The signal post can play an important part in aiding the driver to ‘fixate’
the signal, particularly if it can be seen right down to ground level so that the post
can be related to the track. Evidence suggests that it may be worth painting signal
posts white.
Correctly spaced Count Down Markers may also be a useful aid in accurately
judging the correct stopping position.
The profuse vegetation growth alongside much of the railway is interfering with the
sighting of many signals. At present, corrective action is largely confined to
providing 7 seconds sighting time to comply with the standard. It must be
remembered that the figures of 7 seconds (and 4 seconds uninterrupted) are
minimum times, at best only suitable for some situations. If nothing better is offered

__________________________________________________________________
in the way of vegetation clearance, drivers are being condemned, at best, to work
continually at the lower limit of acceptable sighting.
8.5 AWS
Besides providing its audible/visual indication in the cab, the AWS magnet itself
forms an important visual marker used by drivers to help in judging their approach to
a red signal, a role which is now formally recognised in ‘Defensive Driving.’ In
fulfilling this role it is desirable that the magnet is kept at a standard distance from
the signal. An exception being where platforms are involved and there are
overriding benefits to giving the warning as the train leaves a platform rather than as
it arrives.
The current standard distance of 183 metres appears to date from an age when
average speeds were much lower than today. At 125 mph, 183 metres represents
3¼ seconds, giving very little time in which to see a signal after the warning has
been received. This suggests that the magnet needs to be much further from the
signal on high-speed lines.
This in turn is likely to result in more cases where the signal cannot be seen from the
‘standard’ position of the magnet. A number of instances have been seen where, in
contravention of the current Group Standard, the signal was not visible from the
magnet but clearly the greater benefit was derived from the earlier warning.
All of the above indicates that the magnet positioning criteria in the current standards
would benefit from a review.
It is however, unlikely that a revised standard set of criteria can be found to satisfy
all situations. The AWS magnet should therefore be considered as an integral part
of the signal infrastructure and the position of each magnet should be considered
and decided with this in mind.
9. RANGE AND VARIABILITY OF PARAMETERS

The parameters which affect the interface between the signalling system and the
train driver as set out in section 7 will each have a statistical range of values. If
measurements were made of, say, drivers’ visual acuity, height of signal aspect, or
signal sighting time, a plot of the statistical distribution of the values would indicate
the range of the parameter in questions. Fig 10 illustrates such a distribution, but
although it has been drawn to look like the bell curve of a normal distribution it
should not be assumed that this will necessarily characterise the acted ranges of
real parameters.
Many of the parameters for an individual signal or individual person are themselves
variable. Whilst some parameter such as the height of a signal, may be fixed, others
will vary. The luminous intensity of a given signal will vary with lamp voltage and
other factors; the sighting distance of a given signal will vary with weather
conditions. Human parameters, such as response time, may vary according to state
of health, fatigue, or diurnal body rhythms. The range of values of a parameter can
still be represented as a statistical distribution such as Fig 10, but it must be
remembered that the position of a given signal, or a given driver, within such a
distribution may vary.

__________________________________________________________________
Population
Strength of Parameter
FIGURE 10
Drivers Signals
No. of
drivers
No. of
signals
Perceptibility of signal
Driver’s perception threshold
FIGURE 11

__________________________________________________________________
Signals
Drivers
No. of
Drivers
No. of
Signals
SPADs
Perceptibility of signals
Driver’s perception threshold
FIGURE 12
“Poorest driver”
threshold
% of 100%
drivers
Strength of parameter
FIGURE 13

__________________________________________________________________
Positive effect
% of
drivers
Negative effect
FIGURE 14
Threshold of
perception
Viewing time
FIGURE 15

__________________________________________________________________
Ts = Static sighting (i.e. indefinite time)
T1, T2 = Progressively shorter sighting times
% of
drivers
Ts
T1
T2
FIGURE 16

__________________________________________________________________
9.1 COMPOSITE PARAMETERS AND OVERALL RELIABILITY

In order to illustrate the way in which all of the parameters combine to influence the
reliability of the interface between the signalling system and the train driver, it may
be helpful to introduce the concept of two composite parameters:
Perceptibility of signal: a composite of all of the positive and negative parameters
relating to the signal and its environment
Driver’s perceptive threshold: a composite of all of the human parameters affecting a
driver’s ability to perceive signals and act correctly in response
In principle, provided the perceptibility of the signal exceeds the driver’s perception
threshold, then the driver will respond to it correctly. Thus, in the ideal situation, if
the distributions of these two parameters were plotted something along the lines of
Fig 11 would result. Here the perceptibility of all signals is greater than the
perception threshold of any of the drivers, and no SPADs should occur.
In reality, however, due especially to the variability of some of the parameters, the
distributions overlap as shown in Fig 12. Where the curves overlap, there are
instances where the perceptibility of the signal is below the driver’s threshold. The
curve extends indefinitely towards the right, because it is known that in rare
instances drivers may be totally inattentive, as at Southall, where the driver was
looking into his bag, and therefore incapable of perceiving any signal, no matter how
prominent. The tail of the signal perceptibility curve extends to zero because a
signal with a failed lamp at night may be completely invisible.
Of course, mitigating measures such as AWS, drivers’ vigilance devices, signal lamp
proving etc will reduce the incidence of the events where the curves overlap, but it is
clear from experience that they do not totally eliminate them.
Even if it were possible to assign values to those composite parameters, and
measure their statistical distribution, it would be very difficult to draw the overlapping
region to scale, as its area would be very small to be consistent with the estimated
probability of SPADs.
It can be seen from Fig 12 that in order to improve the reliability of the interface
between the signalling system and the train driver, and to reduce the number of
SPAD’s it is necessary to seek measures that will shift apart the ranges of the
various parameters and reduce their variability.
9.2 INTERACTION OF PARAMETERS

Section 6 shows that many parameters interact in the overall process of sighting and
responding to signals. A predictive quantitative model of these interactions would be
very difficult to produce but a qualitative understanding can be helped by a graphical
representation of parameter distributions.
Fig 13 represents the general situation where, as the strength of a given parameter
(luminous intensity, say) increases, the percentage of drivers who can correctly
perceive the signal increase. To ensure a reliable interface, signals should be
designed so that for any given parameter the threshold of perception of the poorest
driver would be well to the right of the upper knee of the curve.

__________________________________________________________________
Interaction with a parameter which had a negative effect on the parameter in

question would make the curve lean to the right, as shown in Fig 14, whilst
interaction with a parameter which tended to aid the perception of the parameter in
question would pull the curve to the left.
This can be illustrated by consideration of the effect of sighting time on almost any
signal parameter. It is suggested that for any individual, the threshold of intensity at
which perception occurs varies with time according to a relationship like that of
Fig 15. Nothing can be perceived in zero time, no matter how strong the stimulus,
whilst there is a lower threshold which will not reduce even with prolonged viewing.
This suggests that the effects of sighting time on a given parameter can be
represented by a family of curves as in Fig 16, which lean further to the right as
sighting times reduce, and eventually collapse.
10 COMBINATION OF PARAMETERS
It is frequently the case than an incident of a signal being passed at danger is due
not to a single cause but to a combination of conditions. For example, a fatigued
driver might have been approaching a complex array of signals in difficult ambient
light conditions with minimal sighting time and various distractions in his field of
vision. Many of the parameters in Table 1 could be invoked as less than ideal, but
no single one of them could definitively been identified as the cause of the incident.
In designing the layout of signals, the physical constraints of the locality may make it
impossible to achieve optimum values of many parameters. There is a need for
designers and safety assessors to have a means of estimating whether the
achievable combination of parameters is acceptable, and of identifying the extent to
which improvements in individual parameters can ameliorate the overall situation.
It is not possible to produce a deterministic mathematical model to predict the effects
of combinations of parameters, at least for the time being, because the way in which
parameters interact is not sufficiently well understood, and many of the parameters
do not have objective numerical values.
The problem has been approached by preparing check lists of parameters, using
expert judgement to assign a numerical value to each of them for a given signal,
summing the numerical values, and deciding on further action if the total falls above
or below a threshold criterion also chosen by expert judgement.
A more sophisticated version of this approach is exemplified by the MARS model
(Ref 2,3), or “Model for Assessing and Reducing SPADs”. This starts with the basic
information processing model of Fig 17, and then develops influence diagrams like
the example in Fig 18. These combine scientific research on accident causation
with insights from the experience of “domain experts”, e.g. drivers or signal
engineers.
Numerical values are assigned to factors by positioning them on a scale from best to
worst (typically 1-9), and the relative value of each factor is determined by giving it a
relative weighting, such that all weights sum to 1. When it is available empirical data
can be used to assign these values, but a heavy reliance on expert judgement and
informed opinion is almost inevitable.

__________________________________________________________________
Detection Decision Response

Signal Signal Correct
detected interpreted actions
made
FIGURE 17
Signal detection
failure
Signal visibility Attention focus Alertness
Signal Signal Aspect Signal Shift Fatigue

clarity location assumption position match
cues policy
Job route Degree of

stimulation exposure AWS cue
to route
Maintenance Weather
policy conditions Environmental
cues
FIGURE 18

__________________________________________________________________
11 THE DRIVER
11.1 MAIN CHARACTERISTICS OF THE HUMAN OPERATOR

In the preceding sections of this report, conceptual models of the train driving and
signal sighting tasks have been used to classify human errors and identify factors
affecting human reliability in the observance of signals. Here the characteristics of
the driver as a human component of the overall system are considered so as to
understand the scope and limitations for improvement by attention to human factors.
The main characteristics of human operators are that they:
• Operate through a single channel. The human being is able to effectively
attend to only one task at a time. Whilst some tasks, such as walking or
driving a car, may seem to operate at an almost sub-conscious level,
attempts to combine them with another activity, such as use of a mobile
phone, can lead to fatal distraction.
• Have limited capacity for workload. An operator’s ability to perform complex
or multiple tasks cannot increase indefinitely. If a peak workload exceeds an
operator’s capacity, then it is likely that errors will be made, or tasks may be
abandoned to deal with immediate urgent priorities. For example, the task
of looking out for signals may be temporarily abandoned in order to attend to
in-cab alarms relating to train equipment.
• Need information. Humans cannot tolerate lack of information; indeed,
sensory deprivation has been used as a form of torture. They are drawn to
any changing stimulus, and have difficulty in attending to an unchanging
scene while waiting for some thing to happen. Drivers’ attention may readily
be caught by an interesting but irrelevant activity rather than monitoring
featureless railway for the appearance of signals.
• Anticipate. An operator observing a developing situation can anticipate
what may happen next. This is especially likely when similar situations have
been experienced in the past. In train driving, anticipating the clearance of
an approach-released signal is a well-known example of this.
• Estimate risks poorly. A number of studies have shown that human
perception of risk is often irrational, and that people’s ability to understand
probabilities is poor. Whilst train drivers and other operators may not be
required to make risk assessments, their perception of risks may influence
the rigour and precision with which they obey rules and follow procedures.
• Have an ability to fill in gaps. When faced with incomplete information
human beings have a great ability to fill in the gaps by using “common
sense”. Thus a driver may be prepared to act on a broken-up message, a
half-remembered procedure or notice, or a patchy knowledge of railway
signalling on the basis that what is needed to complete the picture is
obvious. With complex messages, subtly worded instructions, or intricate
systems, people’s perception of what is obvious or a matter of common
sense may vary.

__________________________________________________________________
• Are variable. Not only is there variation between individuals in their innate
abilities, but any individual will vary in ability from day to day according to
their state of health, fatigue, stress etc.
• Are subject to motivation. There are many types of motivation which may
affect an operator’s performance and reliability. Positive influences may
include pride in the job, concern for the safety of oneself or others, or fear of
peer group or organisational response to errors, all of which are likely to
encourage care and attention to correct performance. Negative motivations
might include fear of appearing stupid, tending to a reluctance to ask for
clarification of instructions, or fear of appearing weak, leading to a
reluctance to ask for relief when fatigued or unwell.
11.2 WHY ARE DRIVERS SO RELIABLE?

In spite of concern over the number of SPADs, it has often been remarked that the
equivalent error rate achieved by train drivers is considerably lower than error rates
quoted in generic human reliability studies. The mean time between passing signals
at danger has been estimated to be 17 years for the average driver, in other words,
a once in a lifetime event for most drivers. There are a number of factors which may
well contribute to this level of performance:
• Personal safety: the driver is the person most exposed in the event of a
collision.
• Drivers are well aware that all SPADs will be recorded and investigated.
• The adverse consequences to the driver of committing even a low-risk
SPAD: questioning, re-training, inclusion on at-risk register, and for serious
or multiple transgressions, disciplinary action.
• Peer pressure from other drivers.
• Pride in the job, professional attitude.
• Long and thorough training.
• Recruitment and selection policy.
• Strict drugs and alcohol policy.
• Competence and fitness standards.
• Route knowledge as part of competence.
• Control of working hours and shift patterns.
• The structured nature of the task and limited number of possible signal
aspects.
It is likely that other groups of workers exhibit error rates for particular activities that
are similarly better than generic error rates. For example, professional road drivers
of heavy goods vehicles or public service vehicles may have significantly lower
accident rates than other drivers. A better understanding of how such performance
is achieved might assist further improvement.

__________________________________________________________________
11.3 THE SCOPE FOR IMPROVEMENT

Whilst it appears that the performance of train drivers in human reliability terms is
good in relation to the working population as a whole, it is reasonable to believe that
it could be improved further by the systematic application of human factors
knowledge. As indication of the scope for improvement is given by Appendix A,
which sets out consensus principles on human factors developed by the experts
assisting the Ladbroke Grove inquiry. Section 12 below gives an overview of past
and current research which could further enhance the possibilities for improving
drivers’ performance.
The role of the signal engineering profession is primarily to ensure that the design of
technical systems and equipment gives proper consideration to human factors so as
to minimise risks. It is not for the signal engineer to determine standards for driver
competence or to advise on selection procedure for drivers. It is important, however
for engineers and operators to co-operate closely to ensure that the technical
systems and the human components are appropriate for one another. The signal
engineers need to understand the operators’, and particularly the drivers’,
requirements. It is especially important that the principles and philosophy of the
signalling system are fully understood by all of those involved, so that there can be
no room for doubt or divergent understanding of the meaning of a signal. A clear
understanding requires two-way communication between all of the parties involved.
The scope for improvement in human performance is not unlimited. Even the most
carefully selected, thoroughly trained and highly motivated groups of individuals,
such as airline or military pilots, are capable of error. The statement of the human
factors experts at the end of Appendix A makes it clear that there is scope for the
reduction of risks by the application of human factors in principles, but that they
cannot eliminate all risks. The prominence amongst the SPAD statistics of causes
such as “inattention” and “disregard signal” shows that even if perfection were
achieved in signal sighting the system can still be defeated by the human capacity to
be distracted or to act on a false impression.
11.4 AUTOMATIC TRAIN PROTECTION

It is widely recognised that the provision of a system of automatic train protection
(ATP) would eliminate a large part of the risk associated with signals passed at
danger. The concept of automatic train protection is illustrated in Fig 19. This
shows the driving task as part of a closed loop control system. There are two loops:
one includes the manual driving task, and approximates to the conceptual models in
Figs 1 and 2, and the other is the superimposed automatic train protection process.
By intervening with warnings and subsequent brake applications if the train strays
outside the safe speed profile, the ATP system effectively contains the
consequences of most, but not all, of the error categories set out in section 3. In
general, failure of a driver to control the speed of the train in relation to the signal
aspect (or, for many ATP systems, permanent or temporary speed restrictions) will
be counteracted by the intervention of the ATP system.

__________________________________________________________________
Tacho
ATP track ATP train Brake

system system interface
Signalling Driver Traction Train

system drive/brakes position
Train
detection
FIGURE 19

__________________________________________________________________
However, it is usual for ATP systems to include facilities to enable the driver to
override the system and proceed past a signal at danger, to allow for systems of
degraded mode working in the event of signalling equipment failure. It is possible for
a driver to use this facility to wrongly pass a signal at danger, either as a result of an
error in communication with the signaller, or in violation of the rules. As a
consequence, the introduction of an ATP system needs to be accompanied by the
development of suitable rules and procedures to manage ATP equipment failures.
Some systems of ATP require the driver to enter train data such as length, braking
performance, maximum speed, etc at the start of a journey. There is scope here for
human error in entering the data. This could be particularly serious in the case of a
misrepresentation type error, where the driver has a mistaken idea of the
characteristics of the train. With both the driver and the ATP system relying on the
same erroneous data, the driver is likely to act incorrectly, and the ATP system is not
likely to intervene.
If the ATP system makes frequent or confusing warnings and interventions, then the
driver may be led to anticipate that warnings are false alarms and make
inappropriate use of override or violation facilities.
The human operator, being more adaptable, can be better than automatic systems
at handling exceptional circumstances. For example, most ATP systems do not
allow for exceptionally low adhesion conditions on the railhead, and would not
adequately supervise the train speed in such circumstances, when reliance is still
placed on the driver’s abilities.
12 RESEARCH
12.1 PAST RESEARCH

It should be clear from the review of the cognitive models of driving earlier in this
report that there is no single cause of human error. It is usually, a combination of
factors and it is difficult to determine the contribution of each of these factors. This
conclusion is supported by some work undertaken by Van der Flier and Schoonman
(1988). They found that there was no substantial correlation between the variables
they tested (eg age, time of year) and the occurrence of SPAD incidents. They
concluded that there was no discrete set of factors that could be managed to
significantly reduce the incidence of SPADs.
The past research detailed below draws strongly from research into SPADs and
trying to understand why they occur. The factors that have been identified as
contributing to this error, for the purposes of this report, have been categorised in
accordance with the earlier definition given of human factors in terms of the
individual, the job and the organisation.

__________________________________________________________________
12.2 THE INDIVIDUAL
12.2.1 Fatigue and Alertness

Causes Consequences
Recovery time
Overload
Shift length Start time Underload Memory
Decision
Workload making
Shift system Vigilance
Rotation
Human Errors
Performance
Rest period Breaks Job factors
Reaction
time
Diet FATIGUE Accidents
Age Operational
Individual Performance Absenteeism
factors
Personality Costs
Fitness Social factors
Health
Body clock
FIGURE 20
Causes and Consequences of Fatigue: an Influence Diagram
In Railtrack Safety & Standards Directorate’s paper (1) on the impact of fatigue and
work patterns on safety, they describe how fatigue is a key component in many
accidents where human error is a contributing factor. There are a number of causes
of fatigue and also a number of possible consequences as illustrated in Figure 20.
The diagram does not necessarily consider all the potential influences nor does it
represent the complexity of the relationships between the factors.
12.2.2 Work Patterns

From the significant amount of research on the subject of fatigue and work patterns
we are able to deduce that there are certain features of shift working that can lead to
a build up of fatigue. For example, the risk of accidents rises quite substantially over
successive night shifts, suggesting that the number of successive nights should be
limited to a maximum of two or three nights (unless those concerned are
“permanent” night-workers). Early starts are likely to be associated with a reduction
in sleep duration and studies have found that sleep periods prior to the early start (ie
before 07:30) were found to be, on average, 3 hours shorter than those obtained on
a rest day (2). Other important features of shift patterns include the start times, the
duration of the shift, the shift rotation, commuting times and the rest and recovery
periods between shifts and during the shift. The Railtrack S&SD paper referred to
above and a report by Buck and Lamond (3) give a full review of the literature
relating fatigue effects to critical incidents in drivers.
__________________________________________________________________
Other relevant studies include the research by Verhaegen and Ryckaert (4) who,
using on-board instruments, studied drivers’ responses to signals with a yellow
(cautionary) aspect. Drivers had to operate a vigilance device and brake if the
speed of the train was too high. During the month long study drivers kept diaries
recording the time they started and finished work and the length and quality of sleep
periods. They also completed personality tests. Delays in responding to the
vigilance device were most likely to occur between 0700 and 0800.
Endo and Kogi (5) and Kogi and Ohta (6) have noted the tendency for train drivers to
drowse while driving. Endo and Kogi suggested that drowsing was 'dominant after
90 minutes of driving'. Kogi and Ohta studied critical incidents in Japanese train
drivers. They looked at 288 drivers and over 2290 trips over a 2-3 week period.
This yielded 198 critical incidents of which 34 (17%) were instances where a driver
was drowsy or actually fell asleep. (The other causes were equipment problems or
trespassers on the line.) Drowsiness occurred more often between midnight and
0800 (ie later in the night shift) and often involved delayed braking. It was not
related to the type of train, the running conditions, the size of the crew or the
weather conditions.
A study of Australian train drivers by Austin and Drummond (7) identified that 25% of
drivers who responded to a questionnaire claimed they had fallen asleep at least
once whilst driving the train or standing at a station.
Lobban and Tedre (8) highlighted the following shift pattern related problems
associated with SPADs:
a) Drivers working longer hours were more liable to be involved in an
incident.
b) Drivers involved in frequent shift changes were more likely to be involved
in incidents.
c) More incidents occurred on the first day after a change in shift or break
than at any other time.
As well as this research which was specifically aimed at investigating the effect of
shift patterns on SPAD occurrence, a number of other studies have reported working
patterns as an issue for drivers. In their study on stress and drivers, Cox and
Haslam (9) recommend a review of the irregular hours and changes to shifts without
any real consideration of the effects on individuals involved. Gilchrist (10) in his
survey of drivers who had had a SPAD, found that the quality of the work such as
repetition, long hours, irregular start times and general dissatisfaction with flexible
rostering was quoted as a cause.
12.2.3 Time into shift

While still related to work patterns, there has been some specific research to
indicate that time into shift effect has an effect on errors and the likelihood of a
SPAD occurring. However findings differ slightly regarding the most susceptible
time for human error. Hildebrandt (11) found peaks in driver error in 12-hour work
cycles (at approximately 03.00 and 15.00 hours). This finding is allied to the length
of time on duty which demonstrates that the duration of time at work (up to nine
hours) can be related to error peaks. Gilchrist (10) found that when the time into a
shift was investigated then error rates were found to be greater than expected in the
__________________________________________________________________
4th-5th hour of the shift and less than expected in the later hours of the shift. There
was no evidence of impaired performance in the late hours of a shift. This was
supported by Hutchings (12) who also found that SPADs were significantly likely to
be caused in the 4th or 5th Hour into shift. More recently, Wharf (13) showed a peak
in the SPAD rate during the second to fourth hour on duty and that this peak
accounted for about 50% of all SPADs.
Taking a slightly different approach, DERA in their study of visual and mental acuity
of drivers (14) examined how drowsiness fluctuated during a typical shift.
Drowsiness was identified from an analysis of the electrical activity of the brain (EEG
data) recorded from drivers throughout their shift. Results revealed that levels of
tiredness changed as the shift progressed with peaks at one and a half-hours and
three and a half-hours.
What this research has been unable to do is explain the underlying causes of the
peaks and troughs in levels of alertness. Railtrack, HSE and British Rail
commissioned a joint project to explore the reasons for this effect (15). The study by
Vectra and University of Birmingham was inconclusive but pointed towards the effect
being due to changes in the nature of the cognitive processing of drivers during a
shift. The most likely hypothesis is that a driver starts a shift in a controlled mode of
information processing which requires a degree of conscious attention. However
after a few hours a driver may switch into a more unconscious, automated and
hence less effortful mode. The unconscious ‘switching’ between these two modes
may lead to a temporary period of vulnerability and increased risk.
12.2.4 Personality factors

All the research seems to point to the fact that some personality characteristics are
linked to error rates:
• Davis (16) established that drivers displaying psychiatric and psychosomatic
symptoms were more likely to experience a SPAD, although Andrews (17)
threw some doubt on these findings suggesting that drivers interviewed in
this study were anxious to rationalise their error by producing a
“psychological excuse”.
• Verhaegen and Rijkaert (4) found correlations between error frequencies
(delayed reactions to yellow signals and speeding) and personality
dimensions of neuroticism and extroversion.
• Van der Flier and Schoonmen (18) found that involvement in previous
accidents, worse performance on multiple reaction tasks and less job
satisfaction are important factors. They went on to outline the psychometric
testing programme used by Netherlands Railways which is used as part of
the recruitment test and also periodically to identify drivers most likely to be
involved in a SPAD.
• Gilchrist (10) found that 20% of SPAD offenders were physically or
psychologically unfit at the time of their incident. Most drivers blamed
SPADs on low concentration rather than poor equipment design. Drivers
suggest the main problems were domestic worries, the nature of the work
and shift work. Many drivers experienced low morale and a sense of

__________________________________________________________________
alienation in the driving community from policy formation, equipment design

and life in general.
When you take account of evidence from other industries and activities, there is
sufficient to confirm that personality variables do relate to all sorts of accidents in all
sort of populations (19), with extroverted, emotionally unstable people being more
accident prone. This is supported by studies investigating the relationship between
personality and car driving accidents which finds the personality dimensions of
extroversion and neuroticism to be positively related to driver error and accidents
(20). Similar support can be found from railway orientated research where it has
been found that there is a strong positive correlation between extroversion and
emotional instability and the occurrence of errors (measured in terms of speeding,
reaction time and false alarms) (4). UK SPAD research also identifies a significant
relationship between risk and SPADs and personality, with those drivers who rated
themselves on a personality questionnaire as more extroverted, outgoing,
gregarious, socially confident and spontaneous being more likely to be rated at risk
(21).
Personality characteristics associated with a tendency towards risk, decisiveness
and activity were predictive of misread SPADs. In terms of concentration and
attention, those drivers rating themselves with a high tendency towards risk for
example, might, following distraction, be more willing to accept the aspect of the first
signal they see without confirming whether it is their signal, than a driver with a
lesser tendency towards risk.
12.2.5 Previous SPAD Involvement

Fairburn (22) states drivers who have had previous SPAD involvement are more
likely to be involved in future incidents. Williams (23) agrees but says there is no
hard evidence to explain why some drivers are more liable to be involved in SPADs.
12.2.6 Age and Experience

Given that there is research that indicates that adjustment to shift-work tends to
become more difficult with increasing age (24, 25, 26), you might expect older
drivers to suffer more from fatigue and the resulting reduction in alertness.
However, the research into the impact of age on error and SPADs varies. Recent
studies have shown no difference in terms of the number of accidents in car drivers
of different ages, but that the distribution of accidents throughout the 24 day varied,
with younger drivers tending to have more accidents at night and older drivers in the
afternoon (27). Some skills have been reported to be intrinsically more difficult for
older drivers, including vigilance, speed and distance judgements and co-ordination
(28). Williams (29) and Van der Flier (18) found no effects for age and SPAD
occurrence, while Haitt (30) found more SPADs were committed by drivers in their
twenties. Fairburn (22) found significant effects for drivers in the 25-34 year age
group even when data is controlled for which locomotive they drive.
Van der Flier and Schoonman (18) in their study of personal and situational
circumstances found that the number of years’ service a driver had completed was
found not to be an important influence on SPAD rate although the proportion of
SPAD cases in the 40-45 age group was high.

__________________________________________________________________
12.2.7 Track or rolling stock experience

Van der Flier and Schoonman (18) found previous experience of track and rolling
stock not to be important. This however contrasts with Gilchrist (10) who found that
when driving certain units for the first time or after a long break then the driver was
more likely to commit a SPAD. Williams (29) also suggested that there was a
possible effect between the time spent on a certain locomotive and the occurrence
of a SPAD.
12.2.8 Stress
Any number of issues can cause stress and the source of the stress can be a
distraction for drivers, affecting their performance. Cox and Haslam (9) looked at the
possibility of stress induced by driving trains. While the report is inconclusive they
did find that drivers were concerned with vandalism, poor pay and conditions, the
organisation of the work (diagramming and shifts) and the general level of “relations
with management”. On the other hand drivers expressed satisfaction with the
variety of work, being their own masters and the camaraderie with colleagues.
Hockey (33) also considered stress and anxiety and concluded that because
individuals are affected by stress in different ways (what is stressful to one person,
may not be to another), it is difficult to assess it on a general basis.
12.2.9 Concentration
Just as the quality of eyesight varies between individuals, so concentration ability
varies between drivers. There is evidence to support this from the bus and rail
industry (31, 32). The majority of drivers cited the existence of differing ability levels
in drivers in terms of being able to split attention. A particular reference was made
to those drivers who were generally believed to be unable to do two things at once.
12.2.10 Visual Perception - Signal Detection

The recent study by DERA on the visual and mental acuity of drivers (14) detailed
how there are limitations of our visual system that can affect our ability to correctly
detect a signal. These limitations are caused by the make up of our eye, which
consists of two types of cells: rods and cones. Cones tend to be concentrated in the
centre of the eye (or fovea) and are very good at detecting light and colour. Rods,
which tend to be found round the outside of our eye (periphery), are good at
detecting movement and are used in low light situations but they are not very good
at detecting colour. Therefore if the angle of your vision changes your visual acuity
changes. If you are looking directly at an object you are using your foveal vision.
The further away you move from looking directly at it the more you begin to use your
peripheral vision and the greater the decrement in visual acuity and colour
perception.
Clearly, the train-driving task and signal reading in particular require colour
discrimination to be carried out at different viewing distances from the signal. In the
context of signals passed at danger (SPADs) one possible contributory cause may
be confusion of a red and a yellow signal. While there is evidence to suggest that
colour vision and visual acuity decrease with eccentricity, it is more difficult to
determine whether an observer is able to discriminate between two colours if they

__________________________________________________________________
are not looking directly at them. The results from the DERA study showed it
becomes increasingly harder to discriminate between red and yellow as the distance
and angles at which the colours are being viewed increase. This suggests, for
accurate reading, signal lights should be seen in a driver’s central line of vision. By
implication, minor distractions could mean the driver runs the risk of misreading a
signal if he looks at it in his peripheral vision.
However, consideration must also be given to the fact that the red and yellow signal
aspects have a large difference in luminance. This difference could aid or reduce
signal discrimination. For example, the difference in luminance may aid
discrimination when colour information is degraded. However, in the absence of
other information brighter lights can appear closer (34), which could contribute to
read through of signals at night. Further research is required to fully understand the
contribution of luminance to signal discrimination.
As well as limitations caused by human physiology and anatomy the dynamics of
visual attention must also be considered in relation to our ability to detect the signal.
In evidence submitted to both the Southall and the Ladbroke Grove public inquiries,
Prof Neville Moray (35) describes how a driver allocates his attention to objects (eg
equally or favouring one at the expense of the others) illustrating that there is a
substantial probability that at least some items in the visual field will not receive
attention for periods in excess of 8 seconds.
This suggests that there is a significant probability of the driver not looking in the
right direction for the period that the signal is in view. However, these conclusions
must be treated with care as the calculations were based on a theoretical model as
no empirical evidence currently exists. Further research is required about how
drivers allocate their attention. Such research would also assist our understanding
of the impact of:
a) temporary interruptions of previews of the signal caused by changes in
visual attention (eg between track, signal and in-cab instruments)
b) signal obscuration
c) changes in signal position on approach (eg when approaching a signal on
a curve)
d) multiple signals on gantries
12.3 THE JOB
12.3.1 The Driving Task

The specific nature of the task and the circumstances in which it is carried out has a
significant impact upon performance. There are a number of characteristics
associated with the task of driving that make it prone to error:
a) driving requires vigilance: an activity involving both monitoring (checking
for signals and changes in speed limits) and tracking (checking the
speedometer where speed of correction and accuracy are important).
b) drivers are required to act appropriately in the event on abnormal or
unexpected circumstances, which do not happen often

__________________________________________________________________
c) driving is simple, monotonous, predictive and repetitive and boredom

tends to result
d) drivers are highly skilled and the driving process is automatic
As a result of these characteristics, drivers are vulnerable to:
a) lapses in attention
b) fatigue and reduced levels of alertness
c) distraction
d) expectancy and anticipation
e) habituation
There are a large number of SPADs that are put down to drivers having attentional
difficulties whether because they were thinking about something else or anticipating
that the signal would clear. Indeed Andrews (17) reviewed the SPAD process and
based on data available at the time he concluded that “the majority of incidents can
be accounted for by perceptual or vigilance difficulties. Similarly Gilchrist (10), who
categorised 3 SPAD situations: Run SPADs, Starting against signal SPADs and
Shunt SPADs, found that both the Run SPADs and the SAS SPADs could be
attributed to attentional difficulties such as assumption, anticipation, knowledge
gaps, inattention and miscommunication
12.3.2 Attention
In their research on driver distraction (36), the Occupational Psychology Centre
(OPC) described how attention could be understood using two analogies: that of a
finite resource, for example like energy, and that of a moveable spotlight or beam of
attention. These two features of attention create the potential for error by limiting the
capacity of human attention in a given situation. Individuals have the ability to filter
out the majority of information that floods the senses, to prevent sensory overload.
This means that the spotlight of attention tends to be directed by information which is
novel, changing or of interest.
There are a number of studies that describe the problems of attention. Lapses of
attention are characterised by a decrease in the number of stimuli correctly detected
or by an increase in response times. Performance has been shown to deteriorate
rapidly on tasks requiring continuous monitoring for 2 hours or more, and decrease
in performance can be expected as early as 20-35 minutes after the start of a vigil
(37) Visual reaction time performance is more susceptible to fatigue than auditory
reaction time (38).
A useful explanation of how lapses in attention occur is provided by May and Gale
(39) who report the phenomenon, in relation to car driving, of driving without
attention mode (DWAM). Essentially DWAM is a situation where the driver loses
attention while driving. May and Gale use, as an example, the situation where a car
driver suddenly realises his location without being able to recall how he got there.
Among the theories described by May and Gale, which could account for DWAM,
was the phenomenon of automation of the driving task. Automation is where a task
is learned so thoroughly that it does not require conscious responses and the task
can be undertaken automatically. They state, “Where the driving environment

__________________________________________________________________
becomes more predictable, less feedback is required and it is such predictability that
induces DWAM.” They suggest that DWAM may be associated with some SPADs on
the railway. A key comment by May and Gale was their suggestion that the AWS
had to be cancelled with such frequency that the responses became automatic and
therefore it could lose its effectiveness as a mechanism to prevent attention loss.
Another specific problem relating to lack of attention and automisation was identified
by Haga (40) who found of the 44% of train accidents on Japanese National
Railways from 1976 to 1981 caused by train drivers, 20% were due to a driver
starting from a station against a stop signal. Haga related these errors to two
factors:- automising of information processing resulting from the repetition of simple
reactions, and the absence of attention due to any distracting factors causing a
failure to observe this signal.
12.3.3 Distraction
As part of British Rail’s SPADRAM project the issue of driver distraction as a cause
of SPADs was considered (41). The SPADMIS database was used to explore this
issue together with interviews of drivers, the collection of data for ‘critical incidents’
and the involvement of an expert panel of drivers and traction inspectors. The
research concluded that the presence of a second person in the cab might be both a
causal and a preventive factor for SPADs. Using data from the enhanced SPADMIS
database an analysis showed that driver distraction due to a second person in the
cab was only relevant to 1.3% of SPADs. Drivers perceived distractions by activities
or objects or the environment outside the cab as being far more likely to cause a
SPAD and this was supported by the SPADMIS data. Altogether the number of
SPADs attributed to distractions was 15.2% and to the driver being inattentive or
preoccupied 25.6%.
Distractions are reported to come from a number of sources. In their paper on driver
distraction (36), the OPC outlined the different sources of distraction categorising
them into environmental, social influences, individual differences and control
systems and infrastructure. Environmental factors included passengers, people on
the track and vandalism for example. Social influences were considered in relation
to having more than one person in the cab. Two people can be a distraction in that
some drivers may feel a perceived lack of control over what that other person might
do, some feel it is an invasion of their personal space or feel the presence of another
contributes to their workload. On the positive side, a second person may add variety
to an otherwise monotonous activity, can provide support and may cause the driver
to drive more safely if they feel they are being evaluated or because they want to
prove their ability as a safe driver.
The OPC report also described how there are inherent differences between
individuals that have the potential to affect driver performance, both directly or by
moderating an individual’s susceptibility to distractions. These include personality,
concentration ability, age and personal problems.
12.3.4 Expectation, Anticipation

Various reports describe how drivers build up knowledge and experience of the
route and the handling of the train (36, 42). They store past perceptual events such
as where signals are positioned. Through knowing where the exact locations of the
__________________________________________________________________
signals are that they must respond to, the driver searches for signals in the places
where they are expected to be. This is called model driven search behaviour. Such
mental models reduce the mental workload and allow the driver to drive to their
upper limits by being able to anticipate certain events or circumstances. However,
two types of error may result from over reliance on mental models. A driver
approaching a red signal may anticipate a signal clearing on the basis of past
experience and fail to prepare to stop appropriately. Alternatively the driver may
look at the signal but actually believe the aspect is showing something different: a
model –induced illusion.
The OPC research (36) gives two examples of problems created by mental models
and anticipation:
a) Approach locked signals usually step up to green on the approach of the
train and as a result drivers have a tendency to approach the signal at a
speed more aligned with the intention to move forward rather than stop.
b) Flashing yellows at route junctions, are commonly interpreted as a sign to
“keep the train moving”, and this, combined with the expectation that the
signal at the end of the sequence will clear increases driver expectation
and so increases the likelihood of a SPAD.
Both types of error (anticipation and model-induced illusion) occur because using
these mental models, and driving in autopilot as it were, means attention levels are
limited. Changes in the environment, for example a signal change, require active
attention. Drivers are known to get stuck in autopilot and cannot shift mental gears
from automatic, unconscious processing to active attention.
The disadvantage is that such mental models are difficult to override so that
information, which should suggest that the normal set of conditions do not apply, is
ignored. (Lawton) (43)
12.3.5 Habituation
As the driving task involves the repeated presentations of the same information the
driver can become habituated. This is a process by which perceptual sensitivity
decreases and therefore performance decreases. For example, the driver becomes
habituated to the sound of the AWS and the repeated presentation of yellow signals,
which results in a lack of awareness of the red signal. This contributes to the
problem described above where drivers are using their mental models to drive and
are unable to shift mental gears. The research by DERA (14) described in more
detail below, aimed to reduce the likelihood of habituation by making the task more
engaging and by associating a specific sound to a specific signal aspect.
12.3.6 Vigilance Devices

Vigilance devices have been introduced in various circumstances where levels of
attention are known to be reduced. Over the years various vigilance devices have
been incorporated into the driving cab such as the driver’s safety device and the
automatic train warning system. However, a study by Wilde and Stinton (44) of crew
on North American Railway Systems demonstrated that certain types of vigilance
devices, which are not directly linked with the control of the train, can be distracting
and thus defeat their purpose. In their paper they design a device for attention
__________________________________________________________________
monitoring and excitation (DAME) which requires the driver to respond to specific
vigilance warnings directing his attention to some specific train driving task such as
speed control. Devices that are based on detecting a lack of movement, which
occurs when drivers are tired, are sound in principle, but in practice few, if any, have
been proved to be effective. Drivers may have reached an unacceptable level of
fatigue before it is detected by the device, or they may learn to deceive such
devices. Indeed, drivers of German electric locomotives learned to avoid signals
from an intermittent vigilance device by making spontaneous movements within the
critical time interval. As the level of alertness decreased, the interval between
spontaneous movements became more varied, but most signals were still avoided
(45).
The driver distraction work undertaken by the OPC (36) observed that while auditory
warnings, such as those you get for the AWS, are an attention/alerting feature, the
provision of auditory warnings for all signals is likely to actually lower the relative
effectiveness of the warning system because both green and yellow become salient.
This observation was again made by DERA in their visual and mental acuity study of
drivers (14). They suggested that it is important to engage the driver’s attention and
avoid automated processing created by overly simple responses to warning sounds.
It is better if the operator is required to make a judgement about the meaning of a
stimulus and a decision about the appropriate response. In a laboratory-based
simulation they changed the driving task slightly so that the sounds from the AWS
were distinct for each type of signal aspect. They also required different buttons to
be cancelled depending on the signal. They found that the time taken to cancel
AWS increased in this situation and was far greater than during the test involving the
existing AWS driving arrangement. This indicates that the candidates’ responses
were less automatic and that they had thought about their action. There was no
evidence, however, that the introduction of distinct sounds and specific buttons had
any effect on the other behavioural measures such as SPAD rate, emergency brake
use, excessive speeding, fatigue or workload ratings. As this research was
undertaken on a limited number of people and in a simulated, laboratory
environment further research was recommended before any absolute conclusions
could be drawn.
12.3.7 Environmental Factors

Other factors about the job that affect the driver are associated with the environment
in which they carry it out. There have been several research studies that have
examined the effect of high ambient temperatures on performance over time. An
early study by Mortagy and Ramsey (46) found the combination of high
temperatures, long work periods, and short rest periods had a significantly
detrimental effect upon monitoring performance, although the factors did not have an
effect individually. A more recent study by Behir and El-Sabagh (47) found that
raising the temperature from 20 to 26oc caused the error rate on a tracking task to
double. Interestingly, they also found that a group of subjects who performed
similarly under normal conditions, diversified under higher temperatures indicating
that a higher temperature will have a different impact on different people.
Poor ventilation is also often a cause of drowsiness. The negative effects of
inadequate ventilation systems are often combined at any one time and include
raised carbon monoxide and carbon dioxide concentrations, deterioration in
__________________________________________________________________
temperature regulation, insufficient air change or high levels of monotonous

ventilation noise. One study (48) showed a 25% deterioration in performance for
vehicle drivers exposed to 60 ppm carbon monoxide for periods of 90 minutes.
In a recent study of the train cab environment (49), DERA took cab measurements
of environmental factors and, through some mathematical modelling which linked
models of human responses to the environment, were able to assess the likely
responses of drivers to the various environmental conditions. They concluded that a
number of environmental factors such as noise, air quality, lighting and vibration,
would not influence driver performance, providing those factors were within the
statutory limits.
However, they did find that the thermal environment could affect performance by
causing dehydration as a result of sweating, which is known to increase reaction
time and error rates in vigilance tasks. The decrease in performance was found to
be greater when the cab had sunlight pouring in (solar load) which meant the driver
was hotter, sweated more and was therefore more likely to become dehydrated.
They concluded that a cab environment of 18 – 22oc in which the effects of sunlight
are eliminated from shades, for example, may be expected to reduce the bulk of the
risk.
As well as temperature, noise can also be a stressor that affects performance.
Hockey (33) demonstrated that noise significantly affected peripheral detection of
objects (light) and recommended that for an 8 hour day, the overall level of noise
should not exceed 85dBA.
12.3.8 Situational Factors

• Weather/Month of the Year
An analysis of SPAD data by Williams (29) suggested that there might be a link
between the month of the year and SPAD occurrence. This link was unclear and
may in fact be due to other factors such as the weather. Williams followed this
research up later by concluding that there was an approximate 60% increase in the
perceived distance of a signal in “rain conditions”. This was due to the effect of rain
on the windscreen. When looking at the reported causes of these SPADs, more
misjudgement SPADs seemed to be occurring when it rained because of lower
adhesion. Further support for the importance of weather as the key factor, rather
than month of the year, came from Fairburn (22) who found incidents of SPADs
were evenly spaced over the months of the year but that the risk of a SPAD
increased in the fog and poor rail conditions.
However, the study by Van der Flier and Schoonman (18) in which they analysed
the contribution of situational and personal factors for all 224 Dutch signals passed
at danger occurring during 1983 and 1984, found that adverse weather, poor
visibility, rain and fog were not a significant factors.
• Days of the week
Again within this category the literature is not conclusive. Williams (29) and
Hutchings (12) found no effect between the occurrence of a SPAD and the day on
which it happened, while Fairburn (22) reported that the highest incidence of SPADs
was at the start or end of the week. However he also found that drivers who had

__________________________________________________________________
more frequent shift changes and were working the first day after a change in shift
were more likely to experience a SPAD. Thus it may be that the important factor is
not a day of the week but the time when a SPAD occurs in a driver’s shift pattern
that is important. This is supported by Van der Flier and Schoonman (18) who
determined that the distribution of incidents throughout the days of the week
corresponds with the number of train driver shifts.
• Hour of the Day
Neither Williams (29) or Hutchings (12) found a significant effect for the hour of the
day at which a SPAD occurred. However Van der Flier and Schoonman (18) found
most cases of SPADs occurred during morning hours (midnight to 6am and 8am to
noon), while Fairburn (22) found most incidents of SPADs between 06.00 and 10.00.
These effects are most likely linked to the influence of work patterns and described
in Section 1.2
12.3.9 Traction and Rolling Stock

• Cab Design
Human factors aspects of train driving cover not only the characteristics of the driver
and the task but also the interface between the driver and the equipment. Full
evaluation of this human-machine interface is vital for the reduction of opportunities
for human failures.
The work of Sen and Ganguli (50) draws particular attention to the man-machine
interface. They concluded that there are deficiencies in the cabs of Indian railway
locomotives which “make working conditions unsafe and open the door to human
error accidents”. They stressed the need for proper attention to be given to the cab
design in order to ensure efficiency and alertness, “along with both physiological and
psychological well-being…the workplace is an essential part of operational safety
and reliability”.
A number of studies have been carried out over the years assessing cab
ergonomics, particularly in relation to the introduction of driver only operation. There
are some simple ergonomic principles that can be followed in cab design. For
example, it is important that
a) the critical displays are in the driver’s immediate visual scene
b) drivers can reach controls easily
c) drivers are able to work in a comfortable position
d) controls are divided according to functions and are set out in the order
they are used
e) controls are clearly marked and adequately arranged to avoid
unintentional use
• Traction and Rolling Stock Type
Williams (29) identified that the traction unit the driver was using had a role in SPAD
causation. This was later supported by Hutchings (12) who reported that older
classes of electric locomotives are involved in more SPADs, particularly the class
141 railbus and class 317 EMU’s. This may be due to features in the braking

__________________________________________________________________
system. He could reach no conclusions regarding disc brakes and WSP increasing
the probability of misjudgement errors in locomotive hauled stock. However he
reported that this could be concluded for EMU’s. Gilchrist (10) also identified several
differences between various locomotives. He reported the following: -
a) Multiple unit operation showed the highest SPAD rate.
b) Some classes of individual rolling stock are at a disadvantage such as
class 73, 81-85, 141, 150-154, 317 and 318.
c) The most important physical influence is the design of the braking
system. The combination of disc brakes, wheel slide protection, 3-step
controllers and load weighting implemented in the 1980’s is
disadvantageous. New standards have been introduced to counter this.
d) A rise in SPADs has been identified following a change from block braked
to disc braked stock or upon the introduction of a new signalling scheme.
This has implications for driver training and briefing.
12.4 THE INFRASTUCTURE
12.4.1 Signal Layout

Of course as well as the interaction with the cab equipment a driver must also
interact with the signalling system. Problems of signal layouts are outlined by Buck
(51), Gilchrist (10) and Moynihan and Bowen (52). Clearly, if the driver cannot easily
see a signal or is only able to see it for a short time, the importance of that signal
and the likelihood of remembering it is not likely to be very high.
Unfortunately, the research on the impact of signalling layouts on driver error and
SPADs is not as extensive as the research associated with the individual factors that
affect driver performance; however, there are plenty of examples from drivers’
experiences and reports of the types of problems that occur.
12.4.2 Signal Characteristics

Mashour (53) in his book ‘Human factors in signalling systems: Specific applications
to railway signalling’ applied the principles of information theory to the problems of
signal detection. He stated that: 'it is when man is required to work rapidly and
accurately with tools and machines in man-made environments, that human
limitations in processing information (e.g. detection and attention) cannot always
cope with the demands of the tasks and may even be critical for safety’.
In a summary paper in the journal Ergonomics, Mashour (54) noted that there were
two main types of human error with signals, which were important for the designer:
a) a perceptual error where a signal pattern is perceptually confused with
another pattern (this is termed a ‘similarity error’); and
b) a recall error - when a signal pattern is perceived correctly but the
meaning is either not remembered or confused with the meaning of
another signal.
Similarity errors are more likely if the difference between signals is not perceptually
large. For example, if two signals differed only in terms of flashing frequency and
__________________________________________________________________
this difference is not large enough to identify each signal when it is presented alone.
Recall errors are dependent on the method of coding the signals and the degree of
complexity of the meanings of the signals.
Mashour and Devine (55) estimated that on average 32 Swedish drivers missed two
signals out of approximately 270 presented to them; reaction times to the signals
also varied. The frequency of the missed signal and the reaction time relate to the
signal intensity in relation to its background, the intensity of the signal light and the
frequency of flashing.
12.4.3 Signal Location

Van de Flier and Schoonman (18) found that a high percentage of SPADs occurred
at identified black spots. The most frequently reported hazard was a signal behind a
bend. They also reported that 90% of cases were located near stations and that the
position of the signal in relation to the track was an important issue.
It has been argued in a number of studies that the infrequency of red signals and the
predictability and consistent spacing of signalling leads to states of habituation and
false expectations of the signalling system. (Buck (51), Moynihan (52) and
Grant (56)). Certainly, consistency and predictability assist the development of
internal mental models which, while having the advantage of reducing the mental
workload of the driver, also lead to false expectations, whereby the driver anticipates
the signal aspect, and habituation, whereby the driver does not recognise the
significance of the signal aspect because they are in autopilot.
Contrary to this, anecdotal evidence from drivers suggests that regular and
consistent spacing of signals is advantageous allowing them to adjust their speed
more easily when driving in a delayed situation. Further research is required.
Finally, the OPC reported that signals positioned close together were an issue. This
was based on evidence from drivers who described that signals positioned close
together in horizontal formations across the track or above on gantries have the
potential for causing a distraction for the driver as it increases the chance that the
driver may confuse their signal with others. Seeing signals so close together my
also reinforce the expectation effect if the expected signal aspect is close to the
actual signal aspect.
12.4.4 New Signalling Schemes

Over the years, there have been suggestions that the SPAD rate increases when a
new signalling scheme has been installed. Fairburn (22) reported more SPAD
incidents at signals that had been installed for less than 6 months. Gilchrist (10)
confirmed that “with few exceptions, the introduction of new signalling was
accompanied by adverse changes in the SPAD rate in the area concerned”. More
recently AEA investigated Scotrail’s concerns about a rise in SPAD rates following
some resignalling and concluded that the increase experienced could be attributed
to the false hypothesis phenomenon (57). As outlined earlier in this section, drivers
build up mental models of the routes over which they drive and can anticipate what
aspect the signal will show. The introduction of change and, in Scotrail’s case, an
increase in the number of cautionary signals encountered as a result of new
signalling layout and timetable, increased the likelihood of error. As described in

__________________________________________________________________
Section 2.1.3 of this report, well-developed mental models are difficult to override.
This leads to drivers continuing to anticipate signal aspects in accordance with the
old route. The AEA report also suggested that the key to reducing this effect was in
comprehensive training and briefing of drivers to include details of the signal aspects
they were likely to experience over each route rather than just details about the
changes made to the signal position or number.
12.4.5 Gradient of Track

Williams (29) reported that the gradient of the track might be an important influence
on the distance a train travels past the signal having passed in at danger. He
suggests the steeper the gradient the longer the overrun. While this is hardly a
surprising result it does have implications for possible SPAD mitigation measures
and how to provide drivers with lineside information about the gradient of the track.
12.4.6 Signal Conspicuity

Signals should be highly visible to ensure early detection. Visual conspicuity refers
to the difference in visual signature of a target (eg a railway signal) and its local
background that attracts an observer's attention (58), or more simply its ability to
‘pop out’ from its surrounding. Previous research has demonstrated that conspicuity
is reduced if the object to be detected is in a complex background or surrounded by
irrelevant objects with similar features (59). In the railway environment, the signal is
the target and it can appear against complex backgrounds of buildings and railway
structures, or simply be positioned against the background of an urban environment.
DERA (14) explored two ways of making signals more conspicuous: by changing the
nature of the aspect or the backboard.
As the different signals have very specific meanings DERA concluded that their
opportunity to change this was limited. However, they considered one alternative
which was to make the lights flash. DERA examined this idea in more detail and
discovered that flashing lights have been used to great effect on plain backgrounds,
and for emergency and maintenance vehicles.
Research has also been carried out to test flashing running lights on motorcycles
during daylight hours, which showed an improvement in visibility. In these situations
the benefit of the flashing lights comes from the fact that it is uniquely associated
with the vehicle and there do not tend to be other flashing lights in these
environments. This suggests that the success of flashing lights depends on
uniqueness.
This is confirmed by research carried out by the Road Research Laboratory (60, 61),
which showed that detection of a flashing light was significantly better when amongst
other steady lights than it was when amongst other flashing lights. From this it can
be concluded that use of a flashing red signal could increase performance but only if
it was the only one in the driver’s visual scene. As flashing yellow signals are
already in use and a driver may be presented with a number of flashing signals at
any one time, particularly in complex layouts, it was concluded that flashing red
lights would not improve driver performance.
The other alternative that was considered by DERA to improve signal conspicuity
was to modify the signal backboard to make it stand out more from the background.

__________________________________________________________________
They considered increasing the size of the backboard, making the backboard white
to increase contrast to the background and putting a white edge round the existing
backboard to give a high contrast edge defining the edge of the signal against the
background, whilst maintaining the dark immediate surround to the light to retain
maximum contrast for the colour signal.
They concluded that the preferred option was the white border on the black signal
backboard rather than the white signal backboard, which can be obscured in poor
weather conditions such as fog, ice or snow.
12.4.7 Operational Parameters

Gilchrist (10) examined whether operational parameters such as usage and number
of approaches at danger were correlated with the number of times the signal had
been passed at danger. It was concluded that there was a higher probability of
some signals being passed at danger than others. This was due to both an inherent
property of the signal or the previous signal (eg the number of aspects or the
sighting of the signal) and operational issues such as traffic levels and the usage of
the signal (eg the number of times it is approached at danger). A detailed study of a
small set of multiple SPAD signals found that the probability of a SPAD increased as
the number of trains stopped at that signal increased and as the day to day
variability in the number of trains which stopped there increased.
On signal type and SPADs, the research found that:
a) controlled running signals were more likely to be passed at danger than
automatic/semi-automatic signals
b) controlled running signals were more likely to be passed at danger than
position light signals
c) controlled running signals with main route information are more likely to
be passed at danger than those without main route information
d) a controlled running signal with conflict is more likely to be passed at
danger than one without any conflict
12.5 THE ORGANISATION

Organisational influences are described by Reason, in his book on organisational
accidents (62), as latent conditions. Latent conditions, such as poor design, gaps in
supervision, maintenance failures, shortfalls in training and unworkable procedures,
may be present and undetected for many years before they combine with
circumstances to cause an accident. It is therefore important to understand how
organisational factors can moderate driver’s behaviour.
There are a number of studies that have linked organisational factors to the SPAD
rate. Gilchrist (10) attributed the rise in SPAD incidents partly to drivers’ low morale
caused by management structure and polices adopted at BR. When interviewed,
drivers reported feelings of alienation, isolation and redundancy.
During the early 1990s British Rail sponsored a research project with Reason to look
at such management and organisational factors. As a result a methodology called
RAIT was developed. This method consisted of a system for analysing accidents to

__________________________________________________________________
identify both active (immediate) and latent (underlying or root) failures. An

associated method called REVIEW was a proactive technique for identifying
weaknesses in management and organisational factors on the UK railway. The
organisational factors specified in REVIEW were: tools and equipment, materials,
supervision, working environment, staff attitudes, housekeeping, contractors, design,
communication, staffing and rostering, training, planning, rules, management and
maintenance. Whilst the method was fully developed it has not been widely used by
the UK railways and case studies have not been published in the open literature.
Edkins and Pollock (63) published a study showing the use of the method on the
Australian public rail system. They looked at 112 accidents and incidents of which
39% were SPADs. Attentional factors were the causes of 70% of these rail
accidents with organisational factors cited in 15%. The study found that staff
attitudes had a significant impact on driver performance. ‘Staff attitude’ covered low
morale, over complacency/familiarity with the job, lack of pride, poor motivation, and
taking short cuts. Results also revealed poor dissemination of information from
management, the reliability, quality and usability of frequently operated equipment,
maintenance problems, lack of standardisation and many drivers expressed
dissatisfaction and questioned job worth. They recommended that the best
approach to reduce attentional deficits among drivers would be to improve the
organisational deficiencies that reinforced a poor safety culture amongst drivers.
In the OPC report on driver distraction, they consider a number of organisational
influences that they believe impact on driver attention by decreasing the driver’s
general ability and motivation to perform. These include: fears for job security,
privatisation as a source of conflict, lack of control, career progression concerns,
alienation, safety culture and staff/ management relations.
13 CONCLUSIONS AND RECOMMENDATIONS

Improved knowledge of human factors has the potential for improving the safety of
railway signalling systems through improvements to principles, standards, and
designs. The potential for improvement is not limitless, however. Where human
beings are involved, human error will occur. The aim of the signal engineer should
be to design, install and maintain systems which reduce the likelihood and
consequence of these errors.
Much attention has been given over the years to developing an understanding of
human factors in railways, as can be seen from the summary of research in section
12 of this report. To date, a great deal of what has been learned is qualitative in
nature. It is not yet possible to provide a scientific basis for quantified parameters
and criteria relating to the human factors requirements of signalling system design.
There is thus a need for signal engineers to understand the basic principles to which
this report is an introduction, in order to exercise their professional judgement in an
appropriate way.
Signal sighting is recognised to be a complex issue. Much has been learned, but
there is still more to learn. It should not, however, dominate the application of
human factors to the exclusion of other considerations, as there is evidence that
sighting problems are but a part of the overall picture.

__________________________________________________________________
Due mainly to limitations of time, the Working Group has concentrated on

experience with British main-line railways. The Group firmly believes that human
factors are universal in nature, and that much could be learned from exchange of
experience with railways in other countries.
The Principal Recommendations arising out of this study are:
R1 There is scope for human reliability in the observance of signals to be

improved by attention to human factors in the development of signalling
principles and in the design of signalling schemes. It is essential that human
factors are taken into account in the development of signalling principles.
R2 There is significant risk that human error resulting in catastrophic accidents

can occur even where the design of the signalling system, and the training
and management of drivers, appear to near optimum from a human factors
point of view. The elimination of human error would require the elimination of
the human element. Provision of a system of automatic train protection is
recommended as by far the most effective means of minimising the
consequences of human error in the observance of signals.
The remaining recommendations are grouped by topic but not in any order of priority.
Recommendations relating to the Overall Design of Signalling Schemes are:

R3 Human factors considerations need to be part of the high level design brief for
a signalling scheme. The scope for adequate design of signals and other
feature with regard to human factors should not be constrained by prior
decisions concerning train service performance, line capacity, and track
layout etc.
R4 All new signalling schemes must have as a prime objective the achievement
of clearly visible and unambiguous signalling. All track, structures, and other
infrastructure equipment must be designed to facilitate this objective so far as
possible.
R5 The use of computer simulation to aid the design and sighting of signals and
the training of drivers is highly desirable. This should be considered for all
new layouts, and retrospectively for existing complex layouts to support driver
competence refreshment.
R6 All technological solutions must be assessed for human factors risks in both
normal and degraded modes of operation, to ensure that any change does
not create a greater overall risk.
R7 There is a need to ensure consistency in the human factors related features

of signalling design, to avoid confusion or ambiguity in the observance of
signals.

__________________________________________________________________
Recommendations relating to Signal Sighting are:

R8 Individual signals are elements in a continuous system and should not be
considered in isolation. Each signal must be considered in the overall context
of the driving task at that point, the information conveyed by the preceding
signals, and the driver’s likely expectations of what will be encountered
ahead.
R9 Signals should be spaced consistently and provide aspect sequences that

convey clear and unambiguous messages and which minimise the creation of
false expectations (see section 8.3).
R10 Signals must be considered in relation to speed changes and other signs and
infrastructure features affecting the driving task. This refers both to the risk of
sensory overload when a driver may be required to observe a number of
closely spaced markers and signs as well as a signal, and to other features
which require his attention, such as neutral sections or station platforms.
R11 Signal sighting times must take account of the complexity of the identification
and reading task at the signal concerned.
R12 The background against which a signal is viewed must be considered, and
additional measures such as large backboards should be provided where it is
not possible to locate the signal to be viewed against a satisfactory
background.
R13 AWS should be treated as part of the infrastructure directly associated with
the signal, both in relation to its audible warnings and its role as a visual
marker (see section 8.5).
R14 The signal post acts as marker and should be sufficiently conspicuous to fulfil
this role. Where signals are gantry mounted, the use of a stopping marker at
ground level should be considered.
R15 Signalling structures should be designed, constructed, and positioned to

maximise their visibility and ease of identification to the driver. All aids and
signs required to identify the position or aspects of signals (e.g. count down
markers, signal reminder boards, etc) should be consistently and universally
applied throughout the network.
R16 more research is needed to establish the relative importance of factors which
influence the reliable observance of signals. Recommended priorities in this
area are sighting time, and signal position, alignment, and intensity.

__________________________________________________________________
Recommendations relating to Driving Cabs are:

R17 Driving cabs should be designed and maintained to provide a good
environment for alert and stress free driving.
R18 The design of the cab and windscreen should ensure that the driver has clear
and uninterrupted sightlines to any position where signals may be located.
This should take account of the possibility of signals located in less than ideal
positions, e.g. to the right of the line.
Recommendations relating to People are:

R19 All people involved in signalling and layout design should be made aware of
human factors influences and how these impact on the final users of such
designs.
R20 The input of the final user should be an essential part of all design
development.
R21 Guidance should be prepared and published to assist engineers to

incorporate human factors in the development of signalling principles and in
the design of signalling installations.
R22 There is scope for human reliability to be improved through the selection,
training, and management of drivers. Signal engineers should assist by
producing guidance to operators on the significant factors relating to signal
observance.
R23 The fact that train drivers have other tasks to perform besides the observance
of signals (e.g. station duties, neutral sections, control of trains on gradients
etc) should be taken into account in signalling design.
R24 An understanding of the principles of railway signalling should be part of the

training of all drivers. This training should be updated when new and revised
signalling principles are introduced.
R25 It is important to ensure that all those involved in signal sighting, design,
checking decision making, and approval have a suitable knowledge and
competence in relevant human factors.
Recommendations relating to Further Work are:

R26 The work of this report should be extended to include other tasks such as the
activities of signallers and control room operators, and handsignallers and
others involved in degrade mode or emergency operation. It should also be
extended to cover in-cab signalling.

__________________________________________________________________
APPENDIX A
HUMAN FACTORS: FINDINGS FROM LADBROKE GROVE
DR DEBORAH LUCAS, HSE, UK
1 INTRODUCTION
On 5 October 1999 at 08.09 a Thames Train 3-car turbo class 165 diesel unit
travelling from Paddington to Bedwyn, in Wiltshire collided with a Great Western
High Speed Train travelling from Cheltenham Spa to Paddington. The accident took
place 2 miles outside Paddington station, at Ladbroke Grove Junction. 31 people
died and there were over 400 injured, some critically.
Inspectors from HSE's HM Railway Inspectorate went to the site to investigate the
causes of the crash. They reported that the immediate cause of the accident
appeared to be the Thames Train passing a red signal (Signal Passed at Danger -
SPAD) some 700 metres before the collision point. The initial report stated that 'the
reasons why the 165 passed the red light are likely to be complex, and any action or
omission on the part of the driver was only one such factor in a failure involving
many contributory factors.' (HSE, 1999a) The investigation considered human
factors issues in some detail as did the Ladbroke Grove rail inquiry chaired by Lord
Cullen.
2 DEFINITION OF HUMAN FACTORS

The focus of this paper is solely on the human factors aspects of this train crash.
Human factors is defined by HSE as: 'environmental, organisational and job factors
and human and individual characteristics which influence behaviour at work in a way
which can affect health and safety' (HSE, 1999b). A simple way to view human
factors is to think about three aspects: the job, the individual, and the organisation
and how they impact on people's health and safety-related behaviour. A key
message is that the interaction between these three aspects must be considered.
For example, the interaction between the human and the hardware interface such as
the driver and the signal. Human factors takes into account such aspects as the
strengths and limits of the human cognitive system (memory, attention, vision, etc.)
in the design of hardware. It also covers other important issues such as an
individual's skills and experience, fatigue and alertness, and so on.
3 THE HUMAN FACTORS EVIDENCE

AT THE LADBROKE GROVE RAIL INQUIRY (LGRI)
In the first part of the LGRI (which covered the immediate causes of the crash)
evidence was heard from a number of human factors experts. Some of these
experts had prior experience in the rail industry, others were academic psychologists
who brought to the inquiry theories from cognitive psychology or expertise gained in
the aviation or road transport sectors.

__________________________________________________________________
APPENDIX A
The evidence given covered a number of questions:

1. What aspects of the Ladbroke Grove rail crash appeared similar to situational
factors reported for other signals passed at danger?
2. What limitations of the human cognitive system need to be considered in relation
to the sighting and viewing of trackside rail signals?
3 What hypotheses might offer an explanation for why the driver of the Thames
Train passed the signal (SN109) at red?
The report from the inquiry is not yet available so this paper will only touch on some
of the evidence presented to give a flavour of the scope and depth. In particular the
next section considers those situational factors which are reported in previous
literature as being possible contributory factors to SPADs and which seemed
pertinent to the Ladbroke Grove rail crash. These were covered in my own
statement to the inquiry. This paper also gives some examples of the hypotheses
which were proposed as possible explanations for the driver of the Thames Train to
pass the signal at red. It must be stressed that these hypotheses are given only as
examples of human factors evidence. Readers should wait for Lord Cullen's report
for conclusions as to the causes and contributing factors of this rail crash.
4 GENERAL SITUATIONAL FACTORS

Some research into the causes of human error on the railways, including signals
passed at danger, has been conducted although it is not all available in the public
domain. However a review of such literature identified a number of situational
factors which have been cited and which appeared to be applicable to the
circumstances of the Ladbroke Grove rail crash. These are given below (the order
does not reflect any priority).
4.1 TIME OF DAY

Studies have found that SPADs are higher for morning hours (0400 to 0900).
Delays in responding to a vigilance device have been found during 0700 to 0800.
The rail crash at Ladbroke Grove occurred shortly after 0800.
4.2 SHIFT PATTERN

Drivers on early shifts have been identified as more likely to have SPADs. Driver
Hodder of the Thames train was on an early shift on the day of the accident. Studies
have identified that drivers may be drowsy or fall asleep. However this seems to be
more of a problem between midnight and 0800 i.e. during a night shift.
4.3 TIME INTO SHIFT

A number of studies have found that the incidence of SPADs is higher during the
second to fourth hour of a shift. This is not related to the shift pattern or time of day.
Driver Hodder booked on duty at 05.28 and the SPAD occurred during the third hour
of his shift.
__________________________________________________________________
APPENDIX A
4.4 ROUTE KNOWLEDGE

No significant effect of experience on SPADs has been identified in the available
literature. However drivers have claimed that poor route knowledge is a likely cause
of SPADs on running lines. Driver Hodder had obtained his train driver competency
certificate only 13 days prior to the accident. He had completed 9 shifts as the driver
in charge before the day of the crash.
Not knowing where a signal is sited has been identified as an error source. The
signal SN109 that Driver Hodder passed at red is located near other signals. A
confusion error between adjacent signals could be possible (however at the time of
the SPAD all the signals were set to red).
4.5 VISIBILITY OF SIGNAL

Certain signals have repeated (multiple) SPADs. One study found that many such
SPADs may have been due to reduced visibility as they were situated after a bend in
the track. SN109 had been passed at red previously. It also had reduced visibility
due to obstructions on approach by overhead wires and a bridge.
4.6 OTHER SIGNAL FACTORS

SN109 is situated on a gantry with other signals. Drivers have reported having to
'count across' the gantry to identify the correct signal. This could lead to confusion
between two signals. However at the time Driver Hodder saw SN109 all signals on
the gantry were set to red.
4.7 SPEED OF TRAIN

SN109 has a number of visual features in addition to the coloured aspect lights. The
visual complexity of a signal could lead to a high demand on the information
processing capacity of a driver. This might lead to an overload situation and hence
to errors particularly when there is limited time to view the signal. The impact of
such features of a signal on SPAD rates has not been studied. However the
literature does identify an increased SPAD rate after resignalling.
4.8 INCORRECT ANTICIPATION OF SIGNAL ASPECT

Researchers have identified that one reason for a SPAD is a driver incorrectly
anticipating that a signal aspect would be showing a proceed aspect. This is likely to
be on the basis of their past experience with that signal. Driver Hodder had not
previously been stopped at this signal.

__________________________________________________________________
APPENDIX A
4.9 DISTRACTION AND PREOCCUPATION

Many studies identify that SPADs may be attributed to distraction by activities or
objects outside the cab. A speed board was present near signal SN109 and there
were signals for adjacent lines nearby. These might have been a source of
distraction. A driver being inattentive or preoccupied has been identified as another
common reason for a SPAD.
4.10 SUMMARY
On the basis of this review I noted that a number of factors which have been
identified as causes or correlations of SPADs previously appear to be present in the
Ladbroke Grove rail crash. In my evidence I stated that 'this regrettable conjunction
of so many previously identified SPAD risk factors would have put Driver Hodder at
an increased risk of passing a signal at danger'. (Lucas, 2000).
I also pointed out that there have been limited findings linking organisational and
management aspects of SPADs. In particular, the following aspects have been
linked to SPADs: staff attitudes, the reliability, quality and usability of frequently
operated equipment, standards of maintenance of signals, compliance with signal
siting policy and practice and pressures to keep to the timetable.
5 EXAMPLES OF HYPOTHESES
During the evidence heard during part 1 of the Ladbroke Grove rail inquiry a number
of possible hypotheses were put forward to try to explain why the driver might have
passed the signal at red. Evidence from equipment on board the train indicated that
the driver had slowed down some distance before the signal but then speeded up as
though he believed that he had seen a 'proceed' (green) aspect. The hypotheses
therefore looked at why he might have had such a belief. One particularly important
feature to note is that the experts were clearly looking at how the design of the
signalling system may have interacted with the human information processing
system to lead to this erroneous belief. Some examples of the hypotheses are
outlined below. (Note that these have been simplified for the purposes of this
paper.)
5.1 VISUAL SWAMPING OF THE SIGNAL

The effects of bright sunlight on the signal may have led to the driver perceiving a
yellow aspect rather than the red.
5.2 NON-PARALLEL SIGNALLING

The pattern of signals in the 2 miles of track outside Paddington station contain
some locations where not all tracks are signalled. The location of signals near
SN109 is such that it might be possible for an inexperienced driver to fail to
appreciate that there is a signal for the route that he/she is on.

__________________________________________________________________
APPENDIX A
5.3 ANTICIPATION OF SIGNAL ASPECT

Since not all the signals on the gantry come into view at the same time there may be
a tendency to prejudge the aspect of those which appear later. Prior experience at a
signal of receiving a 'green' aspect could bias such prejudgement.
5.4 THE MEANING OF THE AUTOMATIC WARNING SYSTEM (AWS) HORN

The AWS horn is used to denote a cautionary or stop signal aspect. At certain
locations it is also used to indicate a speed restriction. As there is a speed board
near to SN109 a confusion might be possible.
5.5 THE USE OF THE DRIVER REMINDER APPLIANCE (DRA)

DRA is a manually set device in the cab. Drivers use it to remind themselves when
they are stationary that a signal has been set to 'red'. If they try to take power when
DRA is set they cannot. However if DRA is used at cautionary aspects then there is
the possibility that a driver may come to rely on it rather than checking for the red
aspect. There would be increased risk of a SPAD if a driver who was using DRA in
this way then forgot to set DRA at a cautionary aspect.
5.6 VISUAL OVERLOAD

The nature of the human visual system means that a driver's vision attention
switches between objects in the cab, and those outside on the line. The signal may
be only one of these sources. A signal can be a complex information source if it is
not easy to identify which signal applies to the route or if the signal has a number of
features. Depending on the number of attention sources, the time to focus on each
one may be very short. In some cases a signal may not be viewed within the signal
sighting time.
5.7 SUMMARY
The range of hypotheses proposed are indicative of the many facets of human
factors that were issues in the Ladbroke Grove rail inquiry. The report of the inquiry
will provide conclusions about why the crash happened. This paper has merely
stated briefly some of the hypotheses which were put in evidence to the inquiry. It
offers no preference over which of these may be more probable than others.
6 WHAT HAVE WE LEARNT ABOUT HUMAN FACTORS?

Part 1 of the Ladbroke Grove rail inquiry was followed by a joint inquiry into train
protection systems presided over by both Lord Cullen and Professor Uff. In the
course of this joint inquiry the human factors experts from the Ladbroke Grove (who
were also experts for the Southall rail inquiry) were asked to prepare a joint report.
The aim was to set out some general principles on human factors. I undertook to
pull this document together with inputs from Professor Neville Moray, University of
Surrey , Professor John Groeger, University of Surrey, Professor Helen Muir,

__________________________________________________________________
APPENDIX A
University of Cranfield, and Ms Emma Lowe, Railtrack Safety and Standards

Directorate. The 'consensus principles' which were developed are given in full
below. In my view they are an excellent summary of the key human factors issues
that came out of both the Southall and Ladbroke Grove rail crashes. The principles
apply to significant human factors issues which are relevant to reducing the number
of signals passed at danger.
7 HUMAN FACTORS CONSENSUS PRINCIPLES
7.1 DESIGN ISSUES

HF1 Human factors aspects of train driving cover not only the
characteristics of the driver (e.g. route knowledge, alertness, etc.) and
the equipment (e.g. signalling, train controls and instruments, etc.),
but also the interface between the driver and the equipment. Full
evaluation of this human-machine combination is vital for the reduction
of opportunities for human failures. This analysis should be done by
incorporating knowledge about human information processing, human
reliability, and good ergonomic principles into the design and
evaluation process. It is a serious weakness if well established
principles of ergonomics are ignored.
HF2 When implementing a fully (or a partially) automatic protection system

such as TPWS or ATP it is essential that its evaluation should include:
• whether the operators (signallers, drivers) fully understand how the
system works
• whether they understand its limitations (e.g. in terms of speed,
operating conditions)
• whether a study has been made of its failure modes and how the
operator will respond when the system fails. Sooner or later all
hardware and electronic systems fail. Operators must be taught
what will happen when the system fails, what are the symptoms
that show it has failed or is failing, and what actions they must take
HF3 The design process for new equipment e.g. cabs, interfaces of
equipment in control rooms, should consider human factors issues
explicitly. Building the needs of the users of systems into design
prevent human errors from arising. This requires early incorporation
of human factors thinking and involvement of future users of the
equipment in the design process.

__________________________________________________________________
APPENDIX A
7.2 SIGNAL SIGHTING

HF4 Signal sighting principles and practice and signalling design must
consider the limitations of human physiology and anatomy in
particular:
• the reliability of colour discrimination in the periphery of the retina
• the dynamics of visual attention especially where there are
several objects in a visual field, and
• the impact of temporary interruptions of previews of the signal
caused by changes of visual attention (e.g. between track, signal
and in-cab instruments), signal obscuration, and changes in
signal position on approach (e.g. when approaching a signal on a
curve)
HF5 Complex signal and track layouts impose higher demands on drivers'
route knowledge and attention. The designers of signals and signal
sighting arrangements must recognise that more complex designs
and minimal compliance with such standards as currently exist
impose additional demands on drivers and lead to more opportunities
for human failures. Presenting information in a consistent and
straightforward manner, avoiding anomalies, and reducing other
visual distractors at signals should be the normal good practice for all
signals. It should always be possible to identify a signal directly and
uniquely. There should be a requirement for an ergonomic
assessment of the 'driveability' of a route for new signalling layouts.
This is particularly necessary when such layouts are complex. The
process for derogations or authority for non-compliance with such
standards should consider carefully such human factors issues.
7.3 WARNING DEVICES

HF6 Warning devices should be designed according to known 'best
practice' ergonomic principles. This would ensure that it is clear to
drivers what the warnings are signifying and what action should be
taken. The inability of AWS to distinguish between cautionary and
danger aspects is an ergonomic design problem.

__________________________________________________________________
APPENDIX A
HF7 The use of existing warning devices to warn of other situations must
be considered very carefully (e.g. using AWS to warn of other non-
signal situations such as speed restrictions) since this may reduce its
effectiveness as a primary warning to the driver of the need to stop
the train. It is also important to consider the impact of other systems
on existing warning devices, for example, on the introduction of
TPWS or more advanced systems Warning devices which are fitted
in cabs to alert drivers to signals can give rise to a level of
dependence on the device. Such dependence, and the risks
associated when it is not provided, should be considered for existing
systems and during the design and risk assessments of new warning
devices.
7.4 TRAINING AND ROUTE KNOWLEDGE

HF8 A driver's knowledge of a number of 'routes' is a key element in the
prevention of signal reading problems particularly for complex
layouts. Human memory has known limitations. These limits need
to be recognised and, where possible, other means of support given
to drivers to reduce high demands on memory. The training and
assessment of such 'route knowledge' would benefit from increased
rigour, interactive, computer-based instruction and assessment
rather than relying on verbal reports for the assessment of
competence.
HF9 Drivers will rarely experience certain abnormal or degraded
situations (e.g. driving with warning devices isolated) or
emergencies (e.g. detraining passengers). Regularly encountering
such situations in a simulated environment will assist them in dealing
more effectively with any real-life occurrences. Simulators are
becoming more widely used across many industries for initial and
refresher training and for assessment of some elements of
competence. Their use in the rail sector would be beneficial. The
selection of the appropriate fidelity of simulation for such training
should be based on a suitable analysis of driver training and
assessment needs.
7.5 ALERTNESS AND FATIGUE

HF10 Reduced alertness due to the effects of fatigue or the repetitive
nature of a task is one of a number of influences on the human
performance of all safety critical staff. Good practice guidelines on
shiftwork and the timing of breaks within shifts exist and should be
used more widely within the rail industry.

__________________________________________________________________
APPENDIX A
7.6 DEVELOPING HUMAN FACTORS CAPABILITY IN THE RAIL INDUSTRY

HF11 Risk assessments should continue to consider those human failures
which may initiate incidents or mitigate the consequences of
accidents. Safety cases should consider fully the risks from human
failures and their associated control measures. The further
development, and use of, existing human reliability methods within
the rail industry would be advantageous. The numbers of staff in the
rail sector with sufficient knowledge of human factors would need to
be increased for such assessments.
HF12 Signal sighting committees should be able to call on expert human
factors assistance when complex layouts and signalling situations
are in question. Investigators of incidents should also have access
to suitably trained and experienced specialists.
7.7 INCIDENT INVESTIGATION

HF13 The investigation of incidents of signals passed at danger should be
informed by human factors theories cast in appropriate investigatory
tools. The causal analysis of such incidents and accidents should
consider possible combinations of human factors relating to
individual and system/equipment aspects and to the interface
between individuals and systems. The information provided by on
train monitoring recorders should routinely be investigated following
a SPAD. Statistical analysis of data from such accidents and
incidents should build on research already published including that
on the influence of organisational and managerial on incidents.
Suitable caution should be exercised when the attributed cause of a
serious SPAD is solely dependent on the recollection of those
involved. Information reported by traumatised individuals can be
unreliable and should be supported by other information sources.
7.8 INCREASING THE AWARENESS OF HUMAN FACTORS

HF14 There is an awareness of the potential threat to safety caused by
human factors. In order to understand the issues in more detail it is
advised that information about the causes of error, the influence of
different types of stress and workload on performance and the
potential for fatigue, health, communication, etc. to limit performance
is included in the training of safety critical staff and their managers.
Such a requirement for awareness training is already in operation for
pilots in the aviation industry.

__________________________________________________________________
APPENDIX A
7.9 CONFIDENTIAL REPORTING

HF15 The confidential reporting of safety related incidents provides an
important additional source of information to learn from. Such
systems of reporting also maintain a certain level of safety
awareness among staff.
7.10 MANAGEMENT OF DRIVERS

HF16 There are also issues around the management of drivers, particularly
those who have been identified as 'at risk'. The use of the ontrain
monitoring systems (OTMR) to proactively evaluate the driving styles
of such drivers would be a useful information source. The
management of new drivers, especially those who have been
recruited from outside the rail sector, is also a key area. Evaluation
of the suitability of training and assessment regimes for this category
of driver is recommended.
8 WHAT WOULD BE THE BENEFITS OF APPLYING SUCH PRINCIPLES?

Following the list of consensus principles the human factors experts concluded that:
'In proposing these principles we are fully aware that they cannot eliminate all
signals passed at danger and that a technical solution which would prevent those
human errors which lead to serious consequences is needed. The design of any
such technical solutions needs to consider human factors in order to avoid
introducing additional risks However, applying the above human factors principles
should reduce the variability in the occurrence of SPADs between signals and
between drivers and should therefore reduce SPADs overall. We are not able to
quantify the likely extent of this reduction; however we anticipate that paying
attention to these key human factors issues would prevent more of those SPADs on
running lines which are currently stated to be caused by 'inattention', 'misread signal'
and particularly 'disregard signal'. The latter category include many SPADs which
have had serious consequences.' (Joint inquiry, Human factors report)
REFERENCES
HSE (1999a), Train Accident at Ladbroke Grove Junction, 5 October 1999, Third
HSE Interim Report
HSE (1999b) Reducing Error and Influencing Behaviour, HSG48, HSE Books,
ISBN 0 7176 2452 8
Lucas, D A (2000) Human Factors Statement Presented to Ladbroke Grove Rail
Inquiry
Joint Inquiry (2000) Report of Human Factors Experts
Carnino, A., et al: “Man and Risks: Technological and Human Risk Prevention”,
Marcel Dekker, Inc, 1990
__________________________________________________________________
APPENDIX B
BIBLIOGRAPHY AND REFERENCES

BIBLIOGRAPHY
1 The Impact of Fatigue and Work Patterns on Safety (2000). Railtrack Safety &
Standards Directorate
2 Rogers AS, Spencer MB (1998) A Study of the Work and Rest Schedules of
aviation Security Screeners. DERA Report No DERA/CHS/PP5/CR/97280/1.0
3 Buck, L and Lamonde, F (1993) Critical incidents and fatigue among
locomotive engineers. Safety Science, 16, 1-18
4 Verhaegen, P.K. and Ryckaert, R.W. (1986) Vigilance of train engineers.
Proceedings of the Human Factors Society 30th Annual Meeting. Human
Factors Society, Santa Monica (California) Verhaegen and Ryckaert
5 Endo, T and Kogi, K (1975) Monotony effects of the work of motormen during
high speed train operation. Journal of Human Ergology 4 (2) Pages 129 - 140
6 Kogi, K and Ohta, T. (1975) Incidence of near accidental drowsing in
locomotive drivers during a period of rotation. Journal of Human Ergology, 4,
65-76
7 Austin, A and Drummond, P. (1986) Work problems associated with suburban
train driving. Applied Ergonomics, 17(2), 111-116
8 Lobban, MC and Tedre BE (1964) Report on the hours of work, shift patterns
and physiological diurnal rhythms of drivers. Committee on the Human Factor
in Railway Accidents. Medical Research Council, London
9 Cox, T and Haslam, R (1984) Occupational stress in train drivers. Department
of Psychology, University of Nottingham.
10 Gilchrist, AO (1990) An investigation into the causation of signals passed at
danger. Technical memorandum, British Rail Research, Derby. TM TAG 138
January 1990
11 Hildebrandt, G, Rohmert, W and Rutenfranz, J (1974) 12 – 24 Hour Rhythms
in Error Frequency of Locomotive Drivers and the Influence of Tiredness.
International Journal of Chronobiology Vol 2 Pages 175 - 180
12 Hutchings. BW (1987) Signals Passed at Danger – Hypothesis Testing. TTAC
Working Paper No 9/1
13 Wharf, HL (1993) Safety evaluation of working hours. Presentation by British
Rail to European Railways, UIC Paris, France 7 December 1993
14 The Visual and Mental Acuity of Drivers (2000) DERA CHS
DERA/CHS/PPD/CR000323
15 Vectra Ltd. (1999). Summary report on the Vectra/University of Birmingham
studies into the 2-4 hour shift phenomenon. Report number 1435-202-R01
16 Davis, D R (1966) Railway signals passed at danger: the drivers,
circumstances and psychological processes. Ergonomics, 9(3), 211-222
__________________________________________________________________
APPENDIX B
17 Andrews, M. (1979) Human factors in train operation. The Institution of
Railway Signal Engineers. 13 November 1979
18 Van der Flier, H and Schoonman, W. (1988) Railway signals passed at
danger. Applied Ergonomics, 12(2), 135-141
19 Baron, RS (1986) Distraction/conflict theory: progress and problems. New
York Academic Press
20 Furnahm, A (1992) Personality at Work: The role of individual differences in
the work place. Routeledge
21 Fletcher, S (1995) Maximising driver safety: Predicting the Driver at Risk: The
pilot findings and recommendations. The OPC
22 Fairburn, AS (1964) Survey of Signal Passing Incidents – Committee on the
Human Factor in Railway Accidents. Medical Research Council, London.
23 Williams, J.C. (1977) Railway Signals Passed at Danger - Some Further
Research. Paper presented at the 1977 Annual Conference of the
Ergonomics Society.
24 Akerstedt T, Torsvall L. Shiftwork. Shift-dependent well-being and individual
differences. Ergonomics. 24 : 265-273; 1981.
25 Monk TH. Shiftwork and safety. Professional Safety. 34: 26-30; 1989.
26 Foret J, Benisimon G, Benoit, Vieux N. Quality of sleep as a function of age
and shiftwork. In Night and Shiftwork: Biological and Social Aspects,
Reinberg A, Vieux N and Andlauer P (eds) Oxford, Pergamon Press, 149-
160; 1981
27 Summala H, Mikkola T. Fatal Accidents among Car and Truck Drivers:
Effects of Fatigue, Age, and Alcohol Consumption. Human Factors,
36(2):315-326; 1994.
28 Holland CA, Rabbitt PMA (1994) The problems of being an older driver:
comparing the perceptions of an expert group and older driver. Applied
Ergonomics, 25(1): 17-27
29 Williams, JC (1972) Signals Passed at Danger – Interim Report. British
Railways Board Ergonomic Unit Report No 10/72
30 Haitt (1985)
31 Mourant and Rockwell (1972) in Wickens, CD (1992) Engineering Psychology
and Human Performance. (2 edition) Harper Collins
32 Fletcher, S and Newton, D (1996) Predicting the driver at risk: Main study
findings and recommendations for improving safety. The OPC
33 Hockey, R (ed) (1983) Stress and Fatigue in Human Performance.
Chichester, John Wiley and Sons
34 Mandelbaum J and Sloan L.L. Peripheral visual acuity Am J Ophthalmol
1947, 30,581-588

__________________________________________________________________
APPENDIX B
35 Evidence submitted to the Ladbroke Grove Rail Inquiry by Professor Neville
Moray. A Simulation of the Visual Attention of Train Drivers in Relation to the
Time for Which Signals are in View. 2000
36 Callen, A and Cook, R (1996) Driver Distraction: Factors Which Influence
Driver Performance and Safety. The OPC
37 Warm JS. Sustained attention in human performance. John Wiley and Sons,
New York, 1984.
38 Dinges D. Probing the limits of functional capacity: The effects of sleep loss
on short duration tasks. In: Sleep, Arousal and Performance. RJ Broughton
and Rd Olilvie (eds), Birkhauser, Boston, 176-188; 1992.
39 May, JL and Gale, AG (1998) driving Without Attention Mode. In Hanson, M
(Ed) Contemporary Ergonomics 1998. Proceedings of the Annual Conference
of the Ergonomics Society 1 – 3 April 1998 Taylor and Francis, London
40 Haga, S (1984) An Experimental Study of Signal Vigilance Errors in Train
Driving. Ergonomics Vol 17 No 7
41 Halliday, M.W. and Porter, D.R. (1996) SPADRAM: Driver distraction (human
factors assessment.) Scientifics report number SHE 952046 March 1996
42 Branton, P (1979) Investigations into the skills of train driving. Ergonomics,
22(2), 155-164
43 Greenwald AG, Pratkanis AR, Leipe R, and Baumgardner MH (1986) Under
what conditions does theory obstruct research progress? Psychological
Review Vol 93 Pages 216 - 229.
44 Wilde, GJS and Stinton, JF (1983) The Monitoring of Vigilance in Locomotive
Engineers. International Journal of Accident Analysis and Prevention Vol 15
No.2 Pages 87 - 93
45 Fruhstorfer H, Langanke P, Meinzer K, Peter JH, Pfaff U. Neurophysiological
vigilance indicators and operational analysis of a train vigilance monitoring
device: a laboratory and field study. In: RR Mackie (ed), Vigilance: theory,
operational performance and physiological correlates. Plenum Press, New
York, 1997.
46 Mortagy AK, Ramsey JD. Monitoring performance as a function of work/rest
schedule and thermal stress. American Industrial Hygiene Association
Journal, 34(11): 474-480; 1973.
47 Beshir MH, El-Sabagh AS, El-Nawawi MA. Time on task effect on tracking
performance under heat stress. Ergonomics, 24(2): 95-102; 1981.
48 Bockel J. Elusive polluter. Science News. 96: 480-481; 1969. Bockel J.
Elusive polluter. Science News. 96: 480-481; 1969.
49 Buxton, AC, Bunting, AJ and King, S (2000) Environmental Factors in Train
Driver’s Cabs. DERA/CHS/PPD/CR000021
50 Sen, RN and Ganguli, AK (1982) An ergonomic analysis of Railway
Locomotive Driver Functions in India. Journal of Human Ergology 11, Pages
187 – 202

__________________________________________________________________
APPENDIX B
51 Buck, L (1963) Errors in the perception of railway signals. Medical Research
Council paper, Industrial Psychology Research Unit, University College
London.
52 Moynihan, P and Bowen, K (1987) Signals Passed at Danger Human Factors
Progress
53 Mashour, M. (1974) Human factors in signalling systems: Specific
applications to railway signalling. John Wiley: New York. ISBN 0470-57465-8
54 Mashour, M (1977) On designing signals and their meanings. Ergonomics,
20(6), 659-664
55 Mashour, M and Devine B (1977) Detection Performance and its Relationship
with Human Capacity for Information Processing. Reports from the
Department of Psychology No 495 The University of Stockholm
56 Grant J. Concepts of fatigue and vigilance in relation to railway operation.
Ergonomics, 14(1): 111-118; 1971.
57 Edwards, F and Halliday, MW (2000) Cowlairs Re-Signalling Investigation of
Increase in SPAD Incidences.
58 Kooi, F.L. and Toet, A. (1998) Conspicuity: an efficient alternative for search
time. TNO-report TM-98-B007.
59 Jenkins, S.E. and Cole, B.L. (1982) The effect of density of background
elements on the conspicuity of objects. Vision Research 22,1241-1252
60 Crawford A. (1962) The perception of light signals: the effect of the number of
irrelevant lights. Ergonomics 5:417-428
61 Crawford A. (1963) The perception of light signals: the effect of mixing
flashing and steady irrelevant lights. Ergonomics 6,287-294
62 Reason, J(1997) Managing the Risks of Organisational Accidents. Ashgate
Publishing Ltd
63 Edkins, G.D. and Pollock, C.M. (1997) The influence of sustained attention on
railway attention. Accident Analysis of Prevention, 29(4), 533-539
REFERENCES
HSE (1999a), Train Accident at Ladbroke Grove Junction, 5 October 1999, Third
HSE Interim Report
HSE (1999b) Reducing Error and Influencing Behaviour, HSG48, HSE Books,
ISBN 0 7176 2452 8
Lucas, D A (2000) Human Factors Statement Presented to Ladbroke Grove Rail
Inquiry
Joint Inquiry (2000) Report of Human Factors Experts
Carnino, A., et al: “Man and Risks: Technological and Human Risk Prevention”,
Marcel Dekker, Inc, 1990.

[Intentional Blank]
IRSE

A REVIEW
REPORT BY INTERNATIONAL TECHNICAL COMMITTEE
MEMBERSHIP OF THE COMMITTEE

Mr. W. J. Coenraad, (Chairman) Railcert, Netherlands
Mr. G. Cerullo Italferr, Italy
Mr. U. Dolder SBB
Mr. A. Exer Siemens Switzerland
Mr. E. O. Goddard LUL, UK
Mr. A. C. Howker Invensys,UK
Mr. F. Kollmansberger DB
Mr. J. Noffsinger GE-H-Vaughan Harmon, USA
Mr. R. D. Pascoe Union Switch, USA
Mr. H. Pfleger ÖEBB
Mr. J. Poré Alstom France
Mr. C. Sevestre SNCF
Mr. P. Stanley Consultant, UK
Mr. K. Stollte Alstom Holland
Mr. H. Uebel Alcatel, Germany
CONTENTS
The Comments of the Committee page 2
Annex A Signalling in German speaking countries page 5

Annex B SNCF Signalling as seen by the driver page 10
Annex C Brief Overview Of American Railroad Signalling Principles page 13
Annex D Signalling Principles in the Netherlands page 27

Report by International Technical Committee
__________________________________________________________________
THE COMMENTS OF THE COMMITTEE
INTRODUCTION
1. The IRSE International Technical Committee (ITC) was established to provide
useful information and guidelines for decision-makers within the field of Railway
Control and Command. It was asked to consider UK signalling practice in relation to
that applied in other countries and to highlight the important differences.
2. This contribution of the ITC comprises information on the legal framework and
signalling principles from Switzerland, Austria, Germany, France, the USA and the
Netherlands. The ITC members have collected and presented this information
under their personal responsibility and the information represented here does not
represent official positions from their national railways or safety authorities.
3. The committee considers that there is no world-wide common position on
signalling and therefore its comments reflect the experience of the countries
represented in the ITC only. Even in those countries represented the practices
differ.
4. In the following paragraphs the ITC makes some strongly felt points related to
UK practices. The contributions representing the various countries are added as
appendices.
ATP
5. In contrast to the position in the UK, in all the countries examined the fitment of
lines and trains with ATP is mandated by the government. The requirements are
satisfied by currently available commercial systems. In general, where passenger
trains are permitted to exceed a designated speed (e.g. above 79 mph in USA and
above 119 kph in Austria), lines and trains are fitted.
6. The present extent of network fitment varies from country to country, for example
all signalled lines in Germany and in the Netherlands are covered; in SNCF 80% of
locomotive cabs and signals are fitted.
7. Comprehensive train protection systems are more commonly known as
“automatic train protection” systems. They are provided to minimise the risk of driver
error (passing a signal at danger or travelling at excessive speed) leading to a
serious train accident (either a collision or a derailment).
8. To be regarded as comprehensive, such a system would:
a) be applied throughout all running lines within a defined area. Lines
operated entirely at very low speeds may be excluded provided there is no
possibility of creating a risk to traffic on other higher speed lines;
c) supervise the compliance of the train with the aspects displayed by lineside
running signals, or with the movement authority information given by a cab
signalling system;

__________________________________________________________________
d) supervise the compliance of the train with the aspects displayed by shunting
signals where disregard could lead to a collision on a running line;
e) supervise the compliance of the train with the permissible speeds on the
line, and all temporary speed restrictions, as applicable to the train type;
f) apply constraints to stop a movement in the opposite direction to that
intended.
g) take into account the characteristics of each type of train (braking
performance, length etc).
MANAGEMENT OF SAFETY STANDARDS

9. In the countries considered in appendices A-D the approval and enforcement of
railway safety standards (and systems and equipment) is the responsibility of a non-
commercial body.
ROUTE KNOWLEDGE
10. The UK route signalling system requires drivers to possess route knowledge in
order to understand and interpret the information presented to them by lineside
signals and to deduce the required speed or braking action.
11. The ITC believes that the extent of the route knowledge requirement constitutes
a major difference in practice between the UK and the countries examined.
12. A positive outcome of the fitting of ATP systems in the UK will be to take the
interpretation of information and the supervision of safety related actions into the
system, reducing the dependence on route knowledge and reducing the
opportunities for human errors to affect safety.
FUNDAMENTAL REQUIREMENTS
13. The ITC endorses the list of fundamental requirements drawn up by Working
Group 1 (WG1), together with the explanatory and qualifying remarks that are made
with them (in italics), but has identified two additional fundamental requirements that
must be added. The WG1 list is included here for completeness.
a) Before a train is been given authority to move onto a geographical stretch of line,
that stretch of line must be proved to be secure (to prevent derailment) and clear
of other traffic (to prevent collision). That security must subsequently be
maintained until the train has passed clear.
[The term “secure” actually refers to a limited set of safety requirements,
primarily relating to the positions and locking of points, and the routing of other
trains. The signalling system does not, for instance, prove that the line is clear of
all physical obstructions, or that the track or gauge is correct, however in special
cases there may be a need for the railway safety system to provide protection
functions in the categories excluded above. If these are required to have a
safety integrity level, as defined in EN50126, they can be part of a signalling
system].

__________________________________________________________________
b) The driver of the train must be given unambiguous, consistent and timely
information that enables him to control his train safely.
[This covers the requirement to give the driver clear proceed/stop information;
the provision of warning information regarding the approach to a stop signal
where necessary (ie. caution signals or equivalent); the provision of speed
information, which may be by the signalling system itself, or by the use of signs,
route information etc.]
c) Sufficient space must be provided between following trains, to allow each train to
brake to a stand safely. This space must be calculated on the assumption that
the train ahead is stationary.
• trains passing the limit of the movement authority given to them; and
• trains exceeding the maximum permitted speed for the train.
[This requirement covers overlaps, train protection systems, flank protection,
etc., the term permitted speed refers to limitations pertaining to the train as well
as to the infrastructure]
[This requirement could be met by the use of radio communication, rather than
by use of the signalling system itself; the speed and reliability with which a
message can be given to a train to stop it needs to be commensurate with the
risks associated with the emergency]
[Not all level crossings are necessarily protected by the signalling system itself;
in simple cases an independent means of protection may be provided].
g) In the event of a failure of the signalling system, the system must remain in, or
revert to, a state that preserves the safety of trains.
Additional requirements identified by the ITC:

h) Whenever the safety requirements, which had to be met before a train was
authorised to proceed on a given stretch of line, are no longer met, the authority
to proceed must be revoked
i) Protection shall be provided for people working on or near the track
RAIL INTEGRITY
14. In many countries the signalling system is not considered part of the process
for the assurance of rail integrity. If the signalling system is to be used for this
purpose, its expected role and the associated limitations must be clearly defined and
understood. For example, SNCF have a clearly laid down strategy by which the
contribution of track circuits to the detection of broken rails is defined. Other
administrations rely entirely on a system of track maintenance and non-destructive
testing for the identification and management of rail defects.

__________________________________________________________________
ANNEX A
SIGNALLING PRINCIPLES IN GERMAN SPEAKING
COUNTRIES (AUSTRIA, GERMANY, SWITZERLAND)
DEFINITION OF RAILWAY OPERATION (GERMANY)

1. There are two types of operation in railways:
• Classical main line railways, characterised by high speed, long braking
distances and heavy vehicles. These railways are regulated by the EBO,
(Railway Construction- and Operation Regulation, Eisenbahn- Bau- und
Betriebsordnung), which this report is based on.
• Light rail vehicles, trams and metros, characterised by relatively low speed,
short braking distances and in some cases also mixed traffic with road
vehicles, which means driving on sight. These railways are regulated by the
BOStrab (operating order for trams).
2. It is up to the operator to choose the appropriate type of operation. In practical
terms, there is only a choice for secondary lines, not being part of the DB network.
3. Similar arrangements are in force in Austria and Switzerland.
HISTORY
4. In the twenties, there was a general discussion in these countries if ATP should
be introduced. The argument against it was, that the driver's attention would be
lower if he had an additional system to supervise him. In the end, the obvious
arguments for ATP led to the general introduction of INDUSI in Germany and
Austria and Signum in Switzerland.
5. This introduction came with the definition of length of overlaps based on the then
existing brake and propulsion technologies (steam engines). The introduction of
ATP made it possible to allow for track layouts without flank protection points up to
certain speed limits. One of the basic principles is that INDUSI and Signum strictly
works in background mode, it does not indicate signal aspect information to the
driver in order not to lower the alertness of the driver.

__________________________________________________________________
ANNEX A
LEVELS OF DOCUMENTS:
Refer to the block diagram for comparison of the structure of legal documents in
Austria, Germany and Switzerland
Structure of Legal Documents Austria, Germany, and Switzerland
Austria Germany Switzerland
Bundesverfassung Grundgesetz Bundesverfassung

Constitution Constitution Constitution
Eisenbahngesetz Allg. Eisenbahnges. Eisenbahngesetz

Railway Law Railway Law Railway Law
EBO Eisenbahnverordng
Railway Railway Regulation
Construction
and Operation
Regulation Ausf-Bestimmungen
Applic. Rules
Rules Rules Rules Rules Rules Rules

Priv Railw. OEBB Priv Railw. DB Priv Railw. SBB
Germany as an example:
• Constitution (Grundgesetz)
• The federal government has the right for laws and regulations on railways
owned by the state (building, maintenance, operation)
• The Länder have the right for laws and regulations for railways not owned by
the federal government if the federal government does not use its priority
right, except mountain railways
• General Railway Law (AEG, Allgemeines Eisenbahngesetz)
• Valid for state owned and private railways
• Issues not covered can be regulated by the Länder
• Authorises the federal government or the Länder governments to edit
regulations on construction, operation and traffic
• Gives the right of supervision of railways not owned by the federal state to the
Länder

__________________________________________________________________
ANNEX A
RAILWAY CONSTRUCTION- AND OPERATION REGULATION (EBO -
EISENBAHN- BAU- UND BETRIEBSORDNUNG).
6. As an example, the paragraphs relevant for signalling in the German EBO are
given in Appendix 1.
• Edited by the federal minister of transport
• Valid for state owned and private railways
• Last version 18 December 1981
• Existing systems can be operated to version 17 July 1928, updated
23 July 1943
• Specific regulations, such as on signal aspects. These regulations were set
up by DB and approved by the Ministry of Transport
• Internal regulations of DB AG and private railways
COLLECTION OF DIFFERENCES TO UK SIGNALLING PRINCIPLES

(OUTSIDE EBO)
• Speed signalling is generally introduced. Routes are only indicated in special
cases where wrong setting of routes could be hazardous, for example a route
for a freight train into a tunnel for suburban trains. The driver has to watch
the destination indicator and stop in case of wrong destination.
• Indusi (Germany and Austria) and Signum (Switzerland) was introduced in
the thirties, in the meantime it has been upgraded by adding a continuous
supervision in time and distance on-board (introduction of ZUB in critical
locations in Switzerland). In Germany, the upgraded Indusi is still upward
compatible to the original equipment, but it complies with EBO § 45, which
means that for all speed range a single driver in the cab is sufficient.
• Track circuits are not considered as an adequate means of broken rail
detection, as only an interruption of the current flow would be indicated.
Following UIC studies, the probability of detection of a broken rail by track
circuits is so low, that it is not considered appropriate. Instead, regular
maintenance of rails by ultrasonic inspection is the standard, which would
normally detect a defect before the rail breaks. The inspection intervals
depend on the line traffic (frequency of trains and axle loads). Axle counters
are consequently widely used providing a better reliability and noise immunity
than track circuits.
• Critical speed reductions in the network are supervised by trackside speed
checking equipment, leading to a forced braking in case of overspeed.

__________________________________________________________________
APPENDIX 1 ANNEX A
GERMAN EBO (EISENBAHN- BAU- UND BETRIEGSORDNUNG)
PARAGRAPHS AND RULES RELEVANT TO SIGNALLING / OPERATION
§1 Validity
• distinguishes between main lines and secondary lines
• regulations valid for new railways
• regulations also valid in case of major changes
§ 2 General requirements
• Fixed installations and vehicles have to be in such a state that they comply with the
requirements of safety and order. To fulfil this requirement, they have to comply with
this regulation or, if nothing is specified, with the acknowledged rules of technology.
• From the acknowledged rules of technology can be deviated, if it is proven that at least
the same level of safety is achieved
• Instructions on erection and maintenance of installation and vehicles and safe operation
can be given by:
• EBA, Eisenbahn-Bundesamt for railways of the federal state and railway enterprises of
foreign countries
• Länder authorities for railways not owned by the federal state
§ 3 Exceptions and authorisation

Same responsibilities as §2
§ 4 Definitions
• Stations (Bahnhöfe) are installations with minimum one point where trains can start, end,
change direction or cross. They are usually limited by the entry signal.
• Blocks are characterised by the rule that only one train is allowed.
Many further definitions follow
§ 11 Level crossings
• not permitted for line speeds above 160 kph
• Priority for railway vehicles, priority indicated by Andreas cross
• Rules, where technical installations have to be used such as
• Lights
• Half barriers
• Full barriers
depending on density of road traffic, visibility and other factors
§ 12 Railway crossings
Not permitted for new installations outside signalled areas such as stations
§ 14 Signals and Points

• Only signals as defined in the railway signal regulation may be used. Cab signals can
be used instead of lineside signals, they may replace lineside signals
• Home main signals for speed above 50 kph
• Starter main signals for speeds above 60 kph
• Normal position of signals is STOP, exception automatic block
• Signals are also required for all sorts of points, crossings etc. for speeds above 50 kph
__________________________________________________________________
APPENDIX 1 ANNEX A
• Flank protection means have to be provided for all installations where passenger trains
with more than 50 kph circulate.
• Flank protection points have to be provided for lines above 160 kph in stations and
blocks
• Distant signals have to be used for speeds above 60 kph
• The distance between distant signals and main signals has to be minimal the braking
distance
§ 15 Block, Train Protection / Train Control

• In railways with dense traffic the block entry signal must be controllable by the next
station.
• Lines with speeds above 100 kph have to be equipped with installations which can
automatically stop a train (ATP)
• Lines with speeds above 160 kph have to be equipped with installations capable of
automatically stopping and guiding a train (Cab signalling, ATC)
• Lines with speeds up to 100 kph have to be equipped with ATP when ordered
§ 28 Equipment of trains
• ATP / ATC as defined in § 15
• Driver vigilance supervision for speeds above 20 kph
§ 34 Definitions, kind and length of trains
§ 35 Brakes of trains
• Trains above 50 kph shall have brakes in the whole train
• Brake tables are authorised by the transport ministry respectively by the responsible
Länder
• Maximum braking distances are 1000 m (main lines) and 700 m (secondary lines)
• For trains equipped with ATC according to § 15 specific braking distances apply
• The last or the last but one vehicle has to have an operational brake
• Brakes have to be tested when trains start or when the configuration is changed.
§ 38 Operation rules
• On dual track railways the right hand track has to be used
• There are exceptions, for example in stations, bi-directional signalling etc.
§ 39 Sequence of trains
• The network operator is responsible for the sequence of trains
• Above 30 kph trains are not allowed closer than train reporting stations
• Trains may run on sight in case of failures and blocked tracks
• Train movements may only be authorised when the line is clear. If the track monitoring
system has failed and no visual proof is possible, this can be delegated to the train
personnel (secondary lines)
• Sections with speed reductions have to be announced with signals or written
instructions.
§ 45 Personnel on board of traction units and trains

• Operating traction units must have a driver in the cab, exception remote control
An assistant driver has to be in the cab for speeds above 140 kph if there is no ATP
supervision of speed reduction in time and distance.

A Review from the Institution of Railway Signal Engineers
__________________________________________________________________
ANNEX B
SNCF SIGNALLING AS SEEN BY THE DRIVER AND

COMPARED WITH BRITISH SIGNALLING PRINCIPLES
SNCF SIGNALLING AS SEEN BY THE DRIVER
Stopping Signalling
1. On main lines, colour light signals are capable of showing green, yellow and red,
only one colour at the time.
2. Green means line clear.
3. Yellow means that the next signal is red (at danger) ; a flashing yellow means
that the after-next signal is red, this indication being used when the distance
between the next yellow indication and the red light can be shorter than the braking
distance for one or several categories of trains.
4. There are two kinds of red lights on SNCF:
a) a single red -the “sémaphore”- usually shown with an “F” board, for
“franchissable” = that can be passed, driving on-sight, and after having
stopped, if anything is against it;
b) two reds –the “carré”- shown with an “Nf” board, for “non franchissable” =
that cannot be crossed; it is an absolute stop.
5. The red light could be flashing. This indication can be passed, without stop, by
the driver at the maximum speed of 15kph. It is used :
a) Instead of the steady red, when a stop can be an inconvenience (rising
gradient, platforms, etc.)
b) As an announcement indication when the next signal showing red is at a
distance less than 500m.
6. Outside the high speed lines –operated with TGV trains- SNCF, maximum speed
is 160kph on most mainlines, and even up to 220kph on several lines equipped then
with an additional indication, the flashing green, which indicates to the driver that he
has to reduce the train speed at 160kph, for example at the beginning of a stopping
sequence, the next signal showing a caution aspect (yellow or flashing yellow).
SPEED SIGNALLING
7. All speed limits (on points; on the mainlines for permanent and for temporary
speed restrictions) are announced by the corresponding warning indication.
8. For the permanent speed restrictions, the driver encounters an advance speed
restriction sign, an execute speed restriction sign and a sign “R” at the end of the
section of line to be run at the restricted speed. A speed restriction sign can show
different forms, depending on the train category (eg Multiple Unit, passenger train,
parcels train, freight train, etc.)

__________________________________________________________________
ANNEX B
9. For the speed to be applied for a diverted route at a set of points, there are two
types of signalling depending of the speed:
• For 30kph and 60kph, an additional indication is added to the protecting
signal by means of two vertical yellow lights (steady for 30kph, flashing for
60kph); this indication is announced on the signal in rear by two horizontal
yellow lights (steady for 30kph, flashing for 60kph).
• For speed higher than 60, a numerical indicator giving directly the speed
value (“120” for 120kph) is added to the protecting signal. This speed
restriction is announced by a speed restriction signal located at the braking
distance in rear.
• On SNCF, the use of Main Route Approached Released from Red (MAR) for
a diverted route with speed restriction is forbidden, due to the possible habit
for the driver to see a red aspect becoming green every day.
10. There are no overlaps on SNCF. However, for trailing points, the protecting
signal shall be located at a minimum distance in rear of the fouling point; this
distance depends on the approaching speed.
11. The principles used in the wiring of layouts and in the interlockings on SNCF
mean that any failure in a signal (such as a burnt out bulb) will result in showing a
more restrictive indication.
12. SNCF has then a “block signalling” and not a speed signalling, for the block
system operation.
13. The driver is always sure of the block indication to follow; but several speed
limits can be added and they may overlap each other; such as one speed limit for a
set of points, another speed limit which can be a permanent line speed limit and a
temporary speed restriction, for track works for instance.
14. A driver on SNCF has not to know by heart the positions and values of speed
restrictions:
• the point speed limits are shown by the signals and/or specific indications,
always with a warning indication;
• the line speed limits are given by trackside boards and/or by the driver’s road
map (the “feuille de route”).
15. To avoid any confusion, after Argenton-sur-Creuse accident in 1985, SNCF
decided to install KVB on all electrified mainlines, mainly for main junctions and
speed restrictions (permanent and temporary), the program being extended to all
other mainlines and all junctions after Melun accident in 1988.
16. Today, end 2000, >80% of vehicle cabs (that is over 5,000 vehicles) and >80%
of signals and speed limit positions (that is over 25,000 places, including for instance
over 130,000 balises) have been equipped with KVB and >95% of passenger x km
and tons x km which are transported are protected by KVB. Since then, it is
considered that over 100 passenger lives and many more injuries have been saved,
at the cost of not a single railway man hurt by a train when installing KVB.

__________________________________________________________________
ANNEX B
SOME CONCLUSIONS ABOUT SNCF EXPERIENCE THAT COULD BE
ADAPTED TO BRITISH SIGNALLING
17. SNCF flashing yellow is equivalent to Railtrack double yellow; but, on SNCF, it
can be combined with any warning or repeat indication for a speed limit, avoiding
many possibilities of misinterpretation about the value of the speed limit and its
starting point.
18. SNCF speed limit rules could certainly be applied in the UK; this could clarify
the speed to follow at any place.
19. Last but not least, ATP (ie “KVB”) has now been implemented on most SNCF
lines; ATP has been considered in France as the only way to ensure the safety of
the traffic on a railway having so much increased its speeds and traffic.
20. Other differences between SNCF and Railtrack principles include the following
ones:
a) in the vicinity of a main station such as Paddington in London, with the high
speeds run by trains in opposite directions, SNCF would have built a flyover
bridge; trains crossing at level would not have been allowed;
b) With a track layout such as the one in Ladbroke Grove, a flank protection
with a track leading to a buffer at a distance of probably more than 200m
would have been implemented. If it is not possible to implement such a
track, the head-on movements should be protected in priority by the flank
protection, instead of the converging movements.
_________

__________________________________________________________________
ANNEX C
A BRIEF OVERVIEW OF AMERICAN RAILROAD

OBJECTIVE
1. It is the objective of this paper to provide a brief overview of current general
principles of railroad signalling in North America and to provide some comment on
the relationship of those principles to the regulatory, economic and operational
frameworks. Focus will be on the United States, however the principles of signalling
used in Canada and Mexico are very similar. The discussion is applicable to main
line freight and passenger operation, as well as suburban commuter rail to some
extent.
2. This is a complex topic and this brief paper is not presented as a comprehensive
catalogue of all principles. Since there are no detailed national design standards for
the many individual railroads, there may be many exceptions to the principles
presented here.
OPERATIONAL FRAMEWORK
TYPES OF TRAFFIC
3. US railroad operations have mixed traffic. A typical main line operated by a
Class 1 freight railway may contain-
• Freight Trains at 50 mph
• Mineral Trains (coal, coke, stone) at 40 mph
• Intermodal Trains (containers and stacked containers) at 60 or 70 mph
• Amtrak intercity or commuter passenger trains at 79 mph
Certain corridors support high-speed passenger services, up to 150 mph.
“RULING” TRAIN CHARACTERISTICS

4. At the risk of stating the obvious, it is necessary to say that the nature of US
Railroad operations is quite different than UK Railway operations. The majority of
routes are freight only operations. Others have mixed passenger and freight traffic.
While perhaps 5% of the value of intercity cargo transported in the USA goes by rail,
approximately 50% of the tonnage is transported by rail. This is a driver for a train
make-up of very long, heavy freight trains, which in turn results in certain
considerations for signalling principles and practices.
• Trains may be two miles or more in length
• Trains may weigh 10,000 tons or more
• Trains may require 2 miles (3.2 KM) equated stopping distance for a normal
stop.
• Quickly braking trains may encounter very high buff and draft forces

__________________________________________________________________
ANNEX C
REGULATORY AND LEGAL FRAMEWORK
REGULATOR
5. Regulatory responsibility for safety on the US railroads lies with the Federal
Railroad Administration (FRA), a regulatory agency in the executive branch of the
Government, under the US Department of Transportation. This agency has statutory
power initially granted by the US Congress in the Rail Safety Act to promulgate rules
necessary for the safety of interstate railroad operations, or any rail operations in
special cases where safety is a concern. The agency has a cadre of inspectors,
including specialists for signals, track, and operating rules. Enforcement is by
monetary fine on railroads and individuals for specific violations. In rare cases an
individual may be disqualified from safety critical work in the industry by the regulator.
The agency has powers to issue emergency orders in critical situations not covered
by existing regulations.
6. Some individual state transportation agencies have implemented regulations
regarding railroads, particularly concerning grade crossing warning systems, traffic
control devices, and the interfaces between them.
7. Where federal regulations exist concerning the same topic, and those regulations
are equal or more stringent in their requirements, state regulations are pre-empted by
the federal regulations.
SPECIFIC REQUIREMENTS FOR SIGNALLING

8. Pertinent signal and train control regulations are set forth in the United States
code of Federal Regulations, Volume 49, Parts:1
§ 233 Signal systems reporting requirements
§ 234 Grade crossing signal system safety
§ 235 Instructions governing applications for approval of a discontinuance or
material modification of a signal system or relief from the requirements of part 236
§ 236 Rules, standards, and instructions governing the installation, inspection,
maintenance, and repair of signal and train control systems, devices, and
appliances
9. These regulations are a mix of basic standards, prescriptive testing requirements,
and responsibilities. They are not intended and do not constitute a comprehensive
set of detailed design, build and maintenance standards. Much is left to the
discretion of the railroads to maintain safety, however these regulations on the whole
do not permit risk-based approach to safety.
10. Deviations from the regulations may be granted to a railroad on application to
the FRA through a formal waiver process.
1
Available online at http://www.access.gpo.gov/nara/cfr/waisidx_99/49cfrv4_99.html

__________________________________________________________________
ANNEX C
11. A rulemaking is currently in progress to update part 236 and include specific
rules for processor based signal and train control systems. A similar process is
underway to evaluate whether mandatory enforcement (positive train control) and is
required on certain corridors.
TEST FOR BURDEN

12. All new federal regulations must meet specific tests for necessity of the
regulation, minimum burdens placed on the regulated party, and cost benefit tests.
ECONOMIC FRAMEWORK
FREIGHT RAILROADS
13. North American freight railroads are profitable public share companies.
Generally, there are no direct or indirect subsidies. These companies pay both
income taxes and property taxes to the governments. They are responsible for
financing investment in the infrastructure for both ongoing maintenance and any
improvements. While the railroads are profitable they have difficulty earning their
cost of capital. For the industry as a whole, the high re-investment required to
sustain the infrastructure yields a negative economic value added (-EVA) calculation.
This makes any infrastructure improvement project, including signal and train control
projects, subject to stringent cost versus benefit analysis.
14. Freight Railroads are therefore focused on asset utilisation. Bi-directional
running is the norm on most lines. On heavy tonnage lines, the head of the rail is
literally worn down in a few years. Track circuits, frequent inspections with analyser
vehicles, and profile grinding, are used to manage rail breaks. The economic
objective is to get as much use as possible out of the investment without
compromising safety.
15. A global view often expressed is that the objective of signal and train control
systems is operational safety. An alternative view from an economic perspective
might be: Safe operations are mandatory and a threshold condition for a railroad.
The purpose of signal and train control systems is to improve capacity, efficiency,
and asset utilisation while maintaining safety.
PASSENGER RAILROADS
16. Amtrak, the national passenger carrier, receives subsidies from the federal
government that terminate by the year 2003. Additionally, some Amtrak operations
may receive support from state and local government agencies. Amtrak supports
major infrastructure projects with public funds.
17. Suburban commuter operations are subsidised by the various state and local
government agencies. These agencies may also be the conduit for federal funds.

__________________________________________________________________
ANNEX C
SAFETY RESPONSIBILITY
18. The responsibility for the safe operation of the railroads is with the railroads.
The railroads must plan and execute whatever steps are necessary to maintain safe
operations. Freight railroads still have integrated infrastructure, rolling stock, and
operations.
OPERATING RULES
19. There is no standard set of railroad operating rules in North America. Each
railroad is responsible to maintain its own rulebook, which is filed with the regulator.
Groups of railroads have joined to consolidate rulebooks, usually adjacent railroads
whose crews may operate on another railroad's territory. Examples are the rulebook
from the Northeast Operating Rules Advisory Committee (NORAC) or the
Consolidated Book of Operating Rules. Certain requirements are propagated from
the federal rules that must be contained in the railroad rules. Examples:
• No signal aspect may be used with two differing indication names.
• If more than one crewmember is in the drivers’ cab of a train, they must clearly
communicate the indication on the next signal to each other as soon as it is
distinguishable.
SIGNALLING PRINCIPLES - SYSTEM CONCEPT AND

RULES 2
MANUAL BLOCK -
20. Manual Block System (MBS) is the most elemental type of "signal system" used
on main track in North America. Some railroads do not refer to manual block as a
signal system. This type of operation has various names under different rulebooks.
This system is bi-directional, usually on single line of track.
21. The most common implementation has block stations designated by
reflectorised signs. Similar approach signs are located braking distance from the
block station (in each direction). Authority is typically granted verbally by radio from
one block station to another by a controlling train dispatcher (signaller). The authority
is repeated by the train crew and confirmed by the train dispatcher if correct. The
train proceeds, approaching the next block station prepared to stop, unless authority
for additional blocks was granted or is subsequently granted.
22. Application of manual block is on low-density freight lines, usually designated as
“secondary “lines. Passenger operations are not prohibited, but would be unusual
today. Permitted maximum speeds are 50 mph (80 kph) for freight trains, 60 mph (97
kph) for passenger trains.
2
Throughout the signalling principles sections of this paper typical examples will be used as
representative. There are many variations of rules and signal aspects in use due to the historical
installed base.

__________________________________________________________________
ANNEX C
Advantages:
• Very low investment cost
Disadvantages:
• High human dependence
• No broken rail detection
• No enforcement
• Higher dispatcher workload
• Low capacity
• No Point detection
• Encroachments on authority undetected.
AUTOMATIC BLOCK
23. Automatic Block Systems (ABS) and rules are typically applied to double track
lines with single direction running. Some variants support bi-directional running. The
lines are continuously track circuited for train detection. All point correspondence is
detected. Signal sequence information is passed from one signal to another by one
of the following means:
• Polar DC track circuit
• Line circuits on Pole Line
• Line circuits in buried or aerial signal cable
• Relay coded track circuits
• Electronically coded track circuits
24. Trains operate by signal indications, although some railroads may also require a
"warrant" given either in writing or verbally by radio.
25. Permitted maximum speed under Automatic Block rules is 79 mph (127 kph)
(without automatic cab signals, train control or train stop- see IX -Cab Signals / Train
Control).
26. The system structure consists of interlockings with automatic signals between
them.
Advantages:
• Point detection
• Broken rail detection
• Improved capacity over MBS system
• Improved dispatcher workload
• Encroachments on authority detected
Disadvantages:
• No enforcement unless used with cab signals
• Usually single direction running

__________________________________________________________________
ANNEX C
TRAFFIC CONTROL SYSTEM
27. Bi-directional running is the norm in North America. Traffic Control System
(TCS) signals and rules are the prevalent method for signalling main lines. Trains
operate on authority solely from signal indications.
28. The system structure consists of “control points (i.e. interlockings) with bi-
directional automatic signals between control points.
29. “Direction of traffic” is a key system property. The TCS systems are fully bi-
directional with control points establishing the limits of established direction of traffic
at any given time. Trains in the same direction of traffic follow each other by signal
indication. Direction of traffic between control points may not be reversed until the
section between control points is unoccupied.
30. The lines are continuously track circuited for train detection. All point
correspondence is detected. Signal sequence information is passed from one signal
to another by one of the following means:
• Line circuits on pole line
• Line circuits in buried or aerial signal cable
• Relay coded track circuits
31. Permitted maximum speed under TCS rules is 79 mph (127 kph) (without
automatic cab signals, train control or train stop- see IX -Cab Signals / Train Control).
Advantages:
• Point detection
• Broken rail detection
• Improved capacity over MBS and ABS system
• Improved dispatcher workload
• Encroachments on authority detected
• Bi-directional running
Disadvantages:
• No enforcement unless used with cab signals

___________________________________________________________________________________________________
ANNEX C
SIGNALLING PRINCIPLES- DESIGN AND OPERATING CONSIDERATIONS

SIGNAL INDICATIONS
Signal Rules
32. Signal Rules are contained in each railroad’s rulebook. They follow the following format:
“Aspect” = Green
“Indication Name” = Clear
“Indication Rule” = Rule 281 Proceed at authorised speed. Approach next signal at authorised speed.
A colour picture of the aspect is included with each signal rule.
33. Each indication conveys two pieces of information, either expressed or implied in the rules; the action for the driver at
the displaying signal, and the action to take approaching the next signal.
34. The rulebook will also define speeds:
“Authorised speed” = Maximum speed for the location / rolling stock
“Limited speed” = Not exceeding 45 mph (72 kph)
“Medium speed” = Not exceeding 30 mph (48 kph)
“Slow speed” = Not exceeding 20 mph (32 kph) 3
“Restricted speed” = Not exceeding slow speed, prepared to stop short of next signal, train, or obstruction
35. From these terms, we can construct a table of typical signalling design (see Table 1 on next page).
36. Instead of the Slow / Medium / Limited speed scenario, some railroads replace lines 4 through 9 in Table 1 to
“Approach Diverging” and “Diverging Clear” indications.
37. The application of the type of signalling rules given in Table 1 relates primarily to “route signalling” practice. Whether
the civil speed authorised for a track is 20 mph (32 kph) or 79 mph (127 kph), a “Clear” indication will be displayed. Civil
speeds are charted in the timetable. Temporary speed restrictions are marked by signs (approach, speed, & resume
signs), and also listed in daily bulletin orders. All train crews reporting for duty must have current bulletin orders in their
possession.
3
For freight trains this may be defined as 10 MPH or 15 MPH (16 to 24 kph) to avoid resonant “rock-off” speed on jointed track.

___________________________________________________________________________________________________
ANNEX C
Sample Signal Indication Methodology
INDICATION ACTION AT SIGNAL ACTION AT NEXT SAMPLE SITUATION ASPECT

NAME DISPLAY
1 Stop Signal Stop Not Applicable Interlocking or control Red
point with signal on.
2 Stop and Proceed Stop Prepared to stop Automatic signal Red + marker light
following another train or number plate
closely.
3 Restricting Restricted speed Prepared to stop Following another Red/Red/ Lunar
train upgrade White
4 Slow Approach Slow speed through turnouts Prepared to stop Through 10:1 turnout Red/ Red/ Yellow
at next signal following another train
1 block ahead
5 Slow Clear Slow speed through turnouts Approach next Through 10:1 turnout Red/ Red/ Green
signal at 2 blocks ahead
authorised speed unoccupied
6 Medium Approach Medium speed through Prepared to stop Through 15:1 turnout Red/Yellow/ Red
turnouts at next signal following another train
1 block ahead

___________________________________________________________________________________________________
ANNEX C
7 Medium Clear Medium speed through Approach next Through 15:1 turnout Red/ Green/ Red
turnouts signal at 2 blocks ahead
8 Limited Approach Limited speed through Prepared to stop Through 20:1 turnout Red/Flashing
turnouts at next signal following another train Yellow/ Red
1 block ahead
9 Limited Clear Limited speed through Approach next Through 20:1 turnout Red/ Flashing
turnouts signal at 2 blocks ahead Green/ Red
10 Approach Begin reduction from Prepared to stop Approaching a “Stop” Yellow/ Red/ Red
authorised to medium speed at next signal or “Restricting” signal
on tangent track
11 Clear Authorised Speed Authorised Speed Unoccupied tangent Green / Red / Red
track –next signal is
“Approach” or better
12 Medium Medium Speed through Approach next Turning out at Red / Green /
Approach Slow turnouts signal at Slow consecutive Yellow
Speed interlockings
13 Approach Authorised Speed Approach next Distant signal to Yellow/ Green /
Medium signal at Medium interlocking with route Red
Speed lined and first block
unoccupied
14 And so on

__________________________________________________________________
Annex C
38. Instead of the Slow / Medium / Limited speed scenario, some railroads replace
lines 4 through 9 in Table 1 to “Approach Diverging” and “Diverging Clear”
indications.
39. The application of the type of signalling rules given in Table 1 relates primarily
to “route signalling” practice. Whether the civil speed authorised for a track is 20
mph (32 kph) or 79 mph (127 kph), a “Clear” indication will be displayed. Civil
speeds are charted in the timetable. Temporary speed restrictions are marked by
signs (approach, speed, & resume signs), and also listed in daily bulletin orders. All
train crews reporting for duty must have current bulletin orders in their possession.
OTHER CONSIDERATIONS
Signal Spacing
40. Design of signal spacing is driven by desired line capacity. It is typically 2 miles
(3.2 km), slightly longer than freight train braking distance. It may be longer for
investment economics reasons if predicted traffic density is not high. Spacing will
not usually exceed 3 miles (4.8 km). Over-braking is not a primary consideration in
design. For additional capacity, spacing may be closer than two miles, using the
additional signal indication of “Advance Approach” (Yellow/Yellow/Red), meaning,
“proceed prepared to stop at second signal”.
41. Un-equated signal spacing distance is measured from signal to signal. No
allowance is made for preview distance.
Overlaps
42. Overlaps are not used. A stop signal means STOP PRIOR TO THE SIGNAL.
Another train may be immediately in advance of the signal.
Signals Passed at Danger (SPAD)

43. The term SPAD is not used in the USA. The term “run-by” is commonly used.
Centralised computer aided dispatch systems log and/or give an alarm if a controlled
signal is passed without a prior request for the signal. Since the operating rules
require all crewmembers in the cab of a locomotive to communicate every signal
indication to each other, their fate is joined in the event of a SPAD. Discipline for a
crewmember will range from 30-day suspension to dismissal for a first offence. A
second offence always results in dismissal. Some railroads require drivers to “call”
each signal indication over the radio. This is a re-enforcing task for the driver, and
results in a remotely recorded voice record of the trip.
Technical SPAD
44. The term Technical SPAD is not used in the USA. A signal system failure
results in a “false restrictive” signal. Since there is significant probability of
derailment of a large freight train in an emergency brake application, freight drivers
may be trained to evaluate the situation and make a controlled stop if there are no
intersecting tracks and the way ahead is known to be clear.

__________________________________________________________________
Annex C
Wrong Side Signal Failures
45. Wrong side signal failures are extremely rare. They are termed “false proceed
signals”. The FRA requires false proceed signals to be reported within 15 days.
The FRA will conduct a follow-up investigation on most reported incidents. Special
training is provided to most railroad signal maintenance employees on false proceed
signal causes, prevention, “make safe” response to a report, and investigation
procedures. Performance appraisals from Chief Engineers through line employees
target a zero-tolerance goal. Discipline for signal maintenance and construction
employees involved in a false proceed signal includes dismissal. Each employee in
a group may be held responsible for adequate testing of disarranged signal systems
before placing them back in service.
Conveying Signal Indications.

46. Signal indications may not be conveyed to the driver by anyone other than a
member of his train crew. Unlike UK control offices, USA control offices do not
indicate which aspect is displayed. The signal mimic will only indicate conditions of
“stop” and “not stop”.
Signs
47. Non-lighted signs may modify signal indications. They will only indicate
upgrades to the indication, so that a missing sign makes the indication more
restricting.
Lamp Detection
48. Lamp out protection is required where a lamp out may result in a better aspect
being observed. When a signal is downgraded with a lamp out the previous signal
will downgrade only as necessary to control approach speed to the signal with the
lamp out. The prior signal will not be set to stop, as it may be in the UK. A dark
signal must be taken as conveying its most restrictive aspect.
LEVEL CROSSINGS
49. Due to the extremely long braking and acceleration distance required for freight
trains, it is not practical in most cases to design level crossing interfaces to hold
signals on trains for crossing clear condition. The public would not tolerate the
barrier closure time necessary to do so.
50. The public has an expectation of 25-35 seconds between activation of the
crossing warning system and arrival of a train. Constant warning time systems are
used for lines with traffic of mixed speeds. However on certain high-speed
passenger lines, the signals are held for advance crossing start, and then cleared.
51. Signals may interface with level crossing systems in other ways. Signal control
circuits may check the health of a crossing, or battery condition, or that directional
circuits do not have the crossing locked out. These practices vary between
railroads. Pro-active monitoring of crossing warning system health outside of the
signal system framework is another risk mitigation method used.

__________________________________________________________________
Annex C
52. Where trains may stop to perform work adjacent to a level crossing and
crossing activation has been inhibited, signal circuitry may check barrier-down
condition before clearing the signal.
SIGNALLING PRINCIPLES- CAB SIGNALLING / TRAIN

CONTROL
53. A number of US Railroads use continuous carrier cab signal systems. Signal
indications are given in the cab and correspond to the wayside signal indications. A
simple two aspect Go / No-Go approach is used by some railroads. Others use
multiple aspect systems. The most complex is the nine aspect multi-speed system
on Amtrak’s Northeast Corridor between Boston, New York, Philadelphia, and
Washington.
54. Cab signal systems support some on-board train stop or train control
functionality that provide enforcement of signals. Various enforcement
characteristics of some of these systems include:
a) A warning sound occurs whenever the cab signal indication downgrades.
b) The driver must operate an acknowledgement device when the cab signal
indication downgrades or brakes will be applied within 8 seconds.
c) The driver must stay within a profile-braking curve following downgrade of
the cab signal indication or brakes will be applied.
d) Some cab signal systems provide enforcement down to restricted speed.
Others enforce stop signals.
55. Some lines are designed as “Cab Signal without Wayside” systems. There are
no automatic signals between interlockings. In case of on-board cab signal system
failure, the interlocking home signals contain a special aspect. This indication is,
“clear to next interlocking”.
56. A cab signal / train control system enables operation at 80 MPH or higher under
the FRA rules.
57. If a signal ahead upgrades, the cab signal in a train instantly upgrades. If cab
signals upgrade from a “restricting” indication, a train may not accelerate until
travelling the length of the train after the upgrade occurs. This is required since the
upgrade may have occurred when the locomotive passed over a broken rail.

__________________________________________________________________
Annex C
SIGNALLING PRINCIPLES- BUILDING BLOCKS
Some of the signal system "building blocks" commonly in use in the USA.
58. Fixed Signals
• Signs
• Colour Light Signals
• Position Light Signal
• Colour Position Light Signals
59. Track Circuits
• DC track circuits
• AC track circuits
• AC phase selective track circuits (Electrified Territory)
• Audio frequency overlay track circuits
60. Interlockings
• Mechanical / electro-mechanical (estimated ~ 2%)
• Relay interlockings – remote controlled
• Microprocessor based Interlockings – remote controlled
61. Other
• Audio frequency constant warning devices (highway at grade crossings)
• Presence detector loops (at Rail-Rail crossings)
• In Cab Signalling Systems
• RF Transponders / Balises
62. The following common UK and/or European devices are RARELY OR NEVER
USED by North America railroad signal systems:
• Axle counter block
• Treadles / electronic pedals
• Single rail track circuits
• Inductive transponders
• Shunt enhancers
• High voltage impulse track circuits
• Longitudinal wire loops on sleepers
AMTRAK NORTHEAST CORRIDOR

63. The Northeast Corridor is the highest speed line in North America. The
passenger trains operate with cab signal speed control. Freight trains are required
to be equipped with Locomotive Speed Limiter (LSL), which uses changes in cab
signal aspects to enforce braking profile curves.
64. Advanced Civil Speed Enforcement System (ACSES) is being implemented by
Amtrak on the line in conjunction with the nine aspect cab signal system. A similar,
__________________________________________________________________
Annex C
compatible system is being implemented by New Jersey Transit. ACSES is an
Automatic Train Protection (ATP) system utilising balises to enforce stop signals and
speed changes. A radio is used to release braking when a signal has upgrade. The
implementation is similar to the eurobalise / euroloop approach.
65. Signal Systems elements in use on Northeast Corridor:
• Wayside Colour-Position Light Signals
• Continuous dual carrier cab signals
• ACSES balise bases ATP
HOT AXLE BOX DETECTORS

66. Due to the heavy axle loads, bearing failures are not unusual on freight trains.
Spacing of wayside detectors is chosen by individual railroads as appropriate for
their operations. Standards for spacing vary between 6 and 25 miles. The detector
alarms may or may not be designed to control signals. If not, the alarms are given
by synthesised voice over radio to the train crew. If a train passes a detector and
does not hear a “no defects” message action must be taken.
67. The Association of American Railroads (AAR) sets a “scan-ability” standard for
bearings that applies to all rolling stock permitted to interchange between railroads.
This insures that detectors from different suppliers can scan bogies of different
designs.
68. HABD sites may incorporate other train inspection systems, such as dragging
equipment detectors, over-height or over-width detection, and hot wheel and wheel
integrity detection. Wheel impact load detectors are also used by some railroads.
ADVANCED SYSTEMS
69. This paper has focused on mature signalling principles in the installed base of
American railroads. There are a number of systems in development and/or
installations that are new approaches to railroad operations and train control. These
systems use various combinations of transponders, Global Positioning Satellite
receivers, radio ranging, data radio, inertial navigation systems, GIS databases, and
on board, wayside, and central office computers. The approaches to improve safety
vary from vital (safety critical) to non-vital overly systems. Some provide overall
management of the railroad operation, including planning and pacing of trains.
Others are intended only to enforce the limits of authority of the train.
70. The concepts and language of signalling principles are being challenged and
changed.
REFERENCES
1- http://www.access.gpo.gov/nara/cfr/waisidx_99/49cfrv4_99.html (United States

Code of Federal Regulations Volume 49, 1999)

__________________________________________________________________
Annex D
SIGNALLING PRINCIPLES IN THE NETHERLANDS
REGULATORY FRAMEWORK
1. Railways in the Netherlands are regulated by the railway law4 (Spoorwegwet)
and several more specialised regulations issued by the ministry of transport and
waterways. The railway law was amended recently to incorporate the requirements
of the EC interoperability directive 96/48 and is presently being rewritten to suit the
new regulatory regime, briefly outlined below.
2. The minister of transport and waterways has decided that three bodies now still
part of the NS holding will be directly under her control. Formerly integrated in NS,
these bodies were given a separate status under the NS holding in 1996. As of
January 1st 2001 the shares in what are now three independent companies (BV’s)
will be transferred to the ministry. At present these three bodies are:
RAILNED SPOORWEGVEILIGHEID
3. Railned’s department Spoorwegveiligheid (railway safety) is responsible for
railway safety, safety specifications an targets. The inspection tasks formerly
allocated tot the rail inspectors have been transferred to Railned as of July 1st 2000.
4. This department also houses the Rolling Stock admission group (BMT).
Department Capaciteits management (capacity allocation), approves the yearly
timetable proposals and allocates network capacity to the operators Department
innovation, responsible for strategic studies and innovation of the rail system
NS RAILINFRABEHEER
5. NS Railinfrabeheer is the Dutch infrastructure provider for the NS network.
Within NS Railinfrabeheer, the Product Management group is responsible for
Verification and Validation of systems and products, whilst Certification Group is
responsible for authorisation of specifications and acceptance for in service use of
new infrastructure and systems
NS TRAFFIC CONTROL
6. NS Verkeersleiding (NSVL) provides all traffic control functions, i.e. they operate
the signal boxes and signal control centres.
4
Under the new railway law local tram and subway systems will also be regulated by
the ministry of transport, however they are not dealt with in this paper.

__________________________________________________________________
Annex D
LEGAL FRAMEWORK
HIERARCHY OF DOCUMENTS AND REQUIREMENTS

7. Legal aspects are covered by the railway law (Spoorwegwet) the local railway
and tramway law (Locaalspoor- en Tramwegwet) and a number of subordinate
regulations, a.o. Rules for service on main and local railways (RDHL) and the
regulations for (private) rail connections (Reglement op de Raccordementen (Rrac)).
Most of these legal documents are somewhat outdated and do not describe the
present organisation of the railways and regulation. The ministry of transport is
currently producing new legislation.
8. Railned spoorwegveiligheid has incorporated most rules for the operation of the
railway in its Reglement Railverkeer (RRV), including the relevant aspects of the
aforementioned laws. Furthermore relevant parts of general legislation, e.g health
safety at work (Arbo-wet), legislation on working hours (Arbeidstijdenwet), legislation
for road etc. traffic apply to the railway as well.
9. The RRV tries to set goals and targets and expects regulated companies to
implement these. Only where aspects of safety, uniformity or efficiency require this,
more detailed Railned standards are issued (RnV-normbladen.) A guidance note to
the RRV (toelichting) explains the why and how of the regulations.
10. Apart from the RRV and Railned standards, the Railned signals (Seinenboek),
which is considered to be part of the RRV list all Dutch signals and their meaning.
11. The RRV provides for supplementary local rules to be set by NSVL.
12. NS Railinfrabeheer has its own set of rules and regulation for design, installing,
testing and commissioning, maintenance etc of infrastructure systems. The (old)
signalbook is a special case. While Railned’s seinenboek supersedes the old signal
book ands effectively is “the law” for drivers etc., for NS Railinfrabeheer, the signal
book is still officially valid as far as technical aspects are concerned.
COMPLIANCE
13. When a part of the railway is in operation, access to the track and/or network is
restricted to certified staff, operators and trains.
14. Where the body of rules or technical standards cannot be fully applied, e.g. in
possessions and on building sites, the operator of a (work) train is responsible for
safety (in this respect contractors operating work trains have to be certificated as
operator of those trains).
15. Nedtrain consulting is the only operator allowed to operate non-certified trains
on the operational railway, e.g. for testing and trials and when doing so they are
responsible for maintaining the safety of the railway including the signalling
installations.

__________________________________________________________________
Annex D
16. Signalling for railway traffic is understood to mean the facilitation of the safe
and efficient running of this traffic as far as possible with the use of technical
facilities, supplemented with regulations.
17. The government oversees safe traffic on the basis of the requirements it has
issued. From these requirements, Railned generates standards to be used by NS
Railinfrabeheer (RIB) in the renewal and maintenance of the technical railway
infrastructure.
18. For RIB this implies continuous optimisation of the safety measures to be
taken. These must be structural in nature and be durable. As a rule, taking
measures to combat problems at source should be preferred, but this can never be
sufficient. Wear and tear and component defects are unavoidable and the costs of
combating problems at source can be unacceptably high. In turn, preventive
measures, corrective measures and ways of dealing with consequences are also
possible. The measures chosen must guarantee a required minimum level of safety
in which feasibility, cost and practicability are weighed against the benefit of more
than minimum safety. Government requirements are an absolute minimum. Any
perception on the part of RIB regarding the specification of safety measures may not
conflict with these.
PRIMARY FUNCTION
19. For the safe passage of rail traffic, there must be a guarantee that it is safe to
run trains over a line. This guarantee is obtained if the primary functions that
determine safety, as listed below, are achieved. It concerns the prevention of:
• Collisions between rail vehicles;
• Derailments;
• Collisions with other types of traffic;
• Collisions with of staff along the track;
• Particular risks of various types, for example when running through tunnels.
20. If the track is safe to run on, then the driver can obtain permission to run over
the intended route section. This permission can be given:
• By line side signals and/or by cab signalling;
• Verbally or in writing, as a rule when a full guarantee of safe running cannot
be given by technical means.
21. This permission is limited to the distance ahead and contains an indication of
the maximum running speed.
RULES AND REGULATIONS

22. Requirements for the safety of rail traffic are laid down by the government in
legislation and regulations. On the basis of these government guidelines NS is
responsible for the specification of supplementary rules and procedures, parts of
which in turn require government approval. NS Railinfrabeheer itself is responsible
for drawing up requirements concerning the technical design of the infrastructure.

__________________________________________________________________
Annex D
SAFETY REGULATIONS
23. The signal aspect giving access to the route incorporates guarantees for safe
running. It complies with the following safety conditions:
• The route is clear; there could also be checks to see if this is unobstructed,
i.e. the physical space for the train is clear;
• Points, movable bridges, etc. along the route are in the correct position;
• These track installations are locked, i.e. temporarily inoperable;
• Conflicting movements are excluded;
24. Automatic level crossing systems and warning equipment for staff on and near
the track are operable, i.e. will indicate approaching trains in time; manually
operated level crossings are closed and locked.
25. Supplementary requirements such as flank protection and the overlap distance
are laid down for certain situations.
26. The conditions listed must be complied with until the train has completely
passed the danger point in question. The locked equipment becomes operable
again when the train has passed it completely. As a safety requirement, the release
of equipment along the remaining route of the train is permitted only if it may be
assumed that the train has come to a halt. Once this is the fact, the train may not
proceed without permission.
27. Route setting and signal-clearing in the opposite direction is only possible c.q.
allowed if the train has come to a halt past the starter signal for the opposite
direction.
SIGNALS
28. The purpose of signalling is to give instructions to the driver concerning the
safe and efficient running of trains; it optimises the rapid passage of traffic and
prevents unintended stopping and speed reduction.
29. Where line side signals and cab signalling are provided, regulations determine
which kind of signal takes precedence. As a rule the line side signal has
precedence over cab signals. The signals provide information concerning train
speed and indicate that route elements are correctly positioned and locked and no
conflicting movements are in progress.
30. NS employs a speed-signalling system; maximum permissible speeds are
shown on signs, and colour light signals show:
• Permission to run at the speed shown on the signs or possibly at a lower
speed;
• Permission to increase speed to a given value;
• Instruction to maintain a certain lower speed;
• Instruction to drive "on sight";
• That proceeding is prohibited.

__________________________________________________________________
Annex D
31. There are three indications concerning speed:
• Permanent restrictions;
• Variable restrictions;
• Temporary restrictions.
32. For each instruction a separate signal aspect is needed; all signal aspects
together form the system of related signal aspects.
33. Instructions given by line side signals have to be obeyed when the signal is
reached. A speed reduction imposed must be carried out immediately; speed may
only be increased once the train has entirely left the section of track for which the
lower speed was required.
34. The content and significance of the signal aspects, including any regulations for
application, are given in the Signalling Regulations approved by the government and
in the Signals Rule Book issued by Railned.
35. The standard for the colours used in colour light signals is British Standard
1376:1976 (BS 1376:1976).
SHUNTING
36. NS do not have or use shunting routes and shunting signals at all. All shunting
movements are signalled in the same way as a train movement. What is called
shunting in the Netherlands is moving of trains or cars in isolated shunting areas, in
which signals are switched off (i.e. the show an auxiliary white aspect) and the
shunting staff manually controls points. Signals leading to or from the shunting area
are kept at danger and wherever possible flank protection is used to protect the
tracks outside the shunting area.
FLANK PROTECTION AND OVERLAP

37. Where the possibility of the unintentional passing of a signal at danger is
considered to be disproportionately great and the consequences of this could be
especially serious, the taking of measures is prescribed by applying:
• Flank protection
• Overlap.
38. Flank protection is preventing a train or wagon coming on to a (another) route
via points. Means of flank protection are: coupled points, derailers, derailing points
and points with a preferred position leading away from the route to be protected.
39. In principle, flank protection is not required, but it must nevertheless be applied
in case loose wagons can move unintentionally, or where wagons could come onto a
protected route as the result of a shunting movement.
40. Overlaps are achieved by placing signals at a safe distance from a danger
point. This method is used at junctions with main routes and also – if there is
sufficient spacing – at signals for movable bridges.
41. Overlap created by having the route set extend to a required distance beyond
the target signal for the route, reduces the capacity of the area involved and is
therefore not used by NS.
__________________________________________________________________
Annex D
LEVEL CROSSING
42. Most level crossings are protected by Automatic level crossing equipment.
Manually operated, local or remotely controlled, level crossings are required for
crossings with three or more tracks. These installations are to be phased out and
only three or four remain.
43. Automatic level crossing equipment is categorised according to road type/road
traffic density. Automatic Flashing Light equipment is still widespread but will be
supplemented by additional half barriers. Automatic Half Barriers are the norm and
in some special cases Automatic four quadrant barriers will be used.
44. Automatic level crossing protection equipment is autonomous, in that design is
required to be fail safe and correct operation in not checked in signals, the only
check in signals being that no impediments, e.g. due to incorrect direction of traffic
detection bridging strike in zones, exist.
PROTECTION OF STAFF ALONG THE TRACKS

45. Where safety at work of staff working in or near to the tracks is concerned, the
presence of staff is considered to be equal to the presence of train traffic. This
means that separation in terms of space and/or time must be provided with the same
level of safety as for the protection of trains:
• By inhibiting the setting of any route giving access to the section of track
concerned, or;
• By using warning systems when train traffic is given priority during the
presence of staff near the track.
46. The implementation of the automatic warning systems is therefore required to
be fail-safe.
SIGNALLING EQUIPMENT
47. The signalling system includes all field elements (points, signals, etc.), the use
of which enables safe rail traffic for which the requirements are described above.
Specific requirements have to be laid down for construction of the equipment. As
well as working safely in "normal" operation, signalling equipment has to be
constructed in such a way that safety is guaranteed at all times, even in the case of
any defect. The installation as a whole has to be fail-safe.
OPERATING THE SIGNALLING SYSTEM

48. The signalling system checks whether all requirements for a safe running of
trains have been complied with. In principle, there are checks as to whether by
operation of the system, the setting of routes and the individual operation of points,
interlockings, etc. is possible.
49. Carrying out operations that have consequences for safety is not part of the
operator's task. Where such operations are necessary as a consequence of not
passing the complete locked route or of the breakdown of any part of the installation,
the signalling should offer optimum guarantees against the occurrence of danger
during emergency operations.
__________________________________________________________________
Annex D
BLOCK SYSTEMS
50. The function of a block system is to control the spacing of running trains. As a
rule the line is divided into blocks, which means that more than one train can use the
line at any one time. The number of blocks into which the track is divided
determines the required capacity of the line.
51. The signals on the open track do not work independently; they are operated
automatically. Only one train at a time may be admitted to a block; this is the reason
open track block signals may not display the signal "Run on sight".
52. In principle, only the open block system is used in the current (all-relay)
signalling system, i.e. routes on an open track come about automatically. Signals
operating automatically will not be used in future systems. The intention is to have
the entire open track operated. As a result, the systems will provide optimum
flexibility in the running of trains.
AUTOMATIC TRAIN PROTECTION

53. Finally, the safety of rail traffic is dependent on the correct response of the
driver to instructions given. The train protection system checks whether these
instructions have been obeyed and if not, the system has to apply the train's brakes.
54. The First Generation train protection system (ATBEG) checks only at speeds in
excess of 40 kph; it does not prevent, for example, a train departing wrongly and
thereby passing a signal at danger. Neither is there any check on whether a train is
braking sufficiently after an instruction to reduce speed has been received. The New
Generation system (ATBNG) addresses these drawbacks.
55. The requirement for introduction of ATP was introduced in the regulatory
framework by the ministry as a result of the serious rail crash at Harmelen in 1962.
After a period of selection of a system and trailing, nation wide fitment started in
1968. At the time all lines where passenger traffic was allowed at speeds of 100 kph
or over, and logical links in that network were to be fitted as well as all trains
operating on these lines. During the rollout, two-yearly exemptions of the
requirement for fitment were granted by the ministry for certain train/loco classes
aimed at successively phasing out non-fitted rolling stock. As of January 1st 2000,
the requirement for fitment has been expanded to include all lines where traffic at
speeds of 40 kph or over is allowed (effectively all signalled lines).
56. Before the split-up of NS, the ministry funded both wayside and train borne
equipment. Presently fitment of ATP train borne equipment is a condition for
admission onto the network
57. The government has also made data logging compulsory for new train
protection systems.

__________________________________________________________________
Annex D
SAFETY CLASSIFICATION
58. In observance of the new European regulations, NS Railinfrabeheer uses the
published guidelines when installing new systems.
59. Four safety levels are defined in CENELEC standard pr EN 50126. The
arrangement of this standard is independent of the technology and implementation
of the system. NS conforms to the arrangement of pr EN 50126 and specifies its
system safety requirements on this basis.
60. The introduction of new systems will be in accordance with pr EN 50126 and a
Safety Certificate has to be supplied; in this certificate it has to be stated that the
requirements of pr EN 50126 have been met.

IRSE Signalling Philosophy Review 2001

Uploaded by

Copyright:

Available Formats

You might also like

IRSE Signalling Philosophy Review 2001

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

IRSE Signalling Philosophy Review 2001

Uploaded by

Copyright:

Available Formats

IRSE

Institution of Railway Signal Engineers

MAINLINE RAILWAY SIGNALLING IN THE UK

Questions and enquiries for further material may be addressed to:

K W Burrage, IRSE Chief Executive

February 2001 Page 1 of 39

Concerning the Current Standards

Concerning the Application of Signalling Principles

February 2001 Page 2 of 39

5. In order to minimise reliance on human elements, the degree of protection

CONCERNING SUBSEQUENT WORK

February 2001 Page 3 of 39

February 2001 Page 4 of 39

LANGUAGE & GLOSSARY

February 2001 Page 5 of 39

SCOPE, PURPOSE & TIMING

14. The agenda covered was:

February 2001 Page 7 of 39

INTRODUCTION TO THE ISSUES

February 2001 Page 8 of 39

February 2001 Page 9 of 39

33. Despite the differences between signalling systems, it is possible to identify

THE RAILWAY AS A SYSTEM

February 2001 Page 11 of 39

COMPETENCY AND MANAGEMENT OF PROCESSES

THE DRIVER'S TASK

TRAIN PROTECTION SYSTEMS (ATP)

February 2001 Page 14 of 39

78. The UK mainline signalling principles address a broad range of requirements,

February 2001 Page 16 of 39

THE ENGINEER'S TASK

February 2001 Page 17 of 39

These conclusions and recommendations are interdependent,

95. Improvements are needed to the body of existing UK signalling principles.

February 2001 Page 19 of 39

101. Existing signalling principles and their promulgation, application and

February 2001 Page 20 of 39

February 2001 Page 21 of 39

Automatic Train Protection

February 2001 Page 22 of 39

B.1 The Working Groups were established as part of a collaborative project

WORKING GROUP 1 - SIGNALLING PRINCIPLES

February 2001 Page 23 of 39

b) How signalling principles and related standards should be made intelligible

WORKING GROUP 2 - HUMAN FACTORS

February 2001 Page 24 of 39

SYNOPSIS OF WORKING GROUP 1 REPORT

February 2001 Page 25 of 39

SIGNALLING SYSTEMS ARCHITECTURE AND MANAGEMENT

2. Consideration should also be given to the need for a systems authorities

4. The relationship of international standards (IEC61508, EN50128, EN50129) to

5. Consideration should be given to the practicability and benefits of designing

6. When planning the next generation of systems, the assumptions associated

SIGNALLING PRINCIPLES – GENERAL

February 2001 Page 26 of 39

11. Risk assessment should be mandated in signalling principles documents only

12. Where signalling principles mandate risk assessment as the means of

14. The effects of change on the validity of signalling principles should be