Train Protection Strategy Version 1.2

Transcription

1 Train Protection Strategy Version 1.2 The strategy for train protection systems in operation on the GB rail network Document presented by the Train Protection Strategy Group (TPSG) on behalf of the Vehicle/Train Control & Communications System Interface Committee (V/TC&C SIC) 1

2 Table of Contents Executive Summary Introduction Train Protection Systems Train Protection and Warning System Overview Future Strategy Trainstop and Tripcocks Overview Future Strategy Great Western ATP Overview Future Strategy Chiltern SELcab ATP Overview Future Strategy TVM Overview Future Strategy KVB Overview Future Strategy ERTMS Overview Future Strategy Reliability of Train Protection Systems References

3 Executive Summary This document outlines the strategy for train protection systems on the GB mainline network. The strategy for TPWS is outlined in this document and the detail (as it is substantial) is covered in a separate document [Ref 1]. The strategy in this document has been developed by TPSG following the principles outlined in Taking Safe Decisions. This document covers the following train protection systems: Train Protection & Warning System (TPWS) Trainstop and Tripcocks Great Western ATP (GW-ATP) Chiltern SELcab ATP TVM-430 KVB European Rail Traffic Management System (ERTMS) The strategy for these train protection systems to remain effective for use on the mainline railway network for the next 25 to 35 years, can be summarised as follows: To ensure that the train protection systems detailed in this document continue to comply with the requirements of the Railway Safety Regulations 1999 (RSR1999) and the relevant exemptions. To ensure the train protection systems detailed in this document continue to be reliable and that they continue to meet or exceed the minimum availability requirements specified for them. To review the application of the train protection systems detailed in this document to infrastructure and trains on an ongoing basis to ensure that the risk mitigated by them, in conjunction with other risk mitigation measures, remains as low as reasonably practicable. This will include the GB rail industry transfer to ETCS or equivalent ATP system when signalling is renewed. This strategy is being overseen by the Train Protection Strategy Group (TPSG). This issue of the strategy covers the industry activities through Control Periods 5 and 6 and beyond. This document therefore details the long-term strategy for train protection systems in operation on the GB mainline network and it is anticipated that it will be updated during Control Period 6. 3

4 1 Introduction TPWS was implemented in the UK as an interim measure to reduce the consequences of Signals Passed at Danger (SPADs), pending implementation of full protection through systems that monitor driver performance continuously. In the Uff-Cullen report, it was envisaged that this higher level of protection would be delivered by the roll out of ERTMS. In 2004, following a series of reset and continue events in the early years of TPWS operation, the industry undertook a review of TPWS. RSSB, on behalf of the industry, issued a position paper on TPWS. The paper presented a proposed strategy for (a) minimising the possibility of reset and continue events in the future and (b) optimising the risk reduction achievable by considering a series of actions relating to TPWS fitment at PSRs and buffer stops, TPWS+, fitment at plain line signals, the design of the in-cab TPWS to driver interface to minimise reset and continue and system reliability and reporting. Since that time, progress on these issues has been made under the guidance of a number of industry working groups and Network Rail actions. At the same time, development of the implementation plan for the European Rail Traffic Management System (ERTMS) with its Automatic Train Protection (ATP) functionality, has progressed and it is now clear that TPWS will be a core railway system for several decades to come. According to the Department for Transport, on some routes, ERTMS fitment is not a priority and therefore TPWS is likely to remain the primary train protection system for these routes for the foreseeable future. At the operational risk conference held in July 2008, the ORR gave a presentation on Managing and Reducing Operational Safety Risk. In this presentation, a concern was highlighted that there is no clear strategy for the long-term future of TPWS. In response to these issues, the RSSB Board directed the Vehicle/Train Control & Communications System Interface Committee (V/TC&C SIC) to establish a working group to develop the long-term strategy for TPWS. In 2014, the group expanded its remit to consider train protection systems other than TPWS. The name of the group changed from the TPWS Strategy Group to the Train Protection Strategy Group (TPSG). This document outlines the strategy for train protection systems. The strategy for TPWS is outlined in this document and covered in detail in a separate document [Ref 1]. The strategy in this document has been developed by TPSG following the principles outlined in Taking Safe Decisions [Ref 2]. 4

5 2 Train Protection Systems Train protection systems 1 act to prevent or mitigate the risk from a train exceeding safe limits. To achieve this, a train protection system automatically applies a train s brakes should a driver pass the limit of movement authority i.e. a stop signal at danger or exceed speed limits on approach to a signal. Systems can also prevent a train s speed exceeding that permitted on specific sections of the route or at junctions. Figure 1 illustrates the different types of communication medium used to convey information to the onboard train protection systems. Figure 1: Train protection systems Figure 1 shows that train protection systems can be either intermittent (new information only available at specific sites) or continuous (information always capable of being updated). Intermittent communication update - checks the speed and movement authority at predetermined locations. With respect to TPWS these are fitted at spot locations whereas as the Chiltern and GW-ATP schemes continually monitor the speed and movement authority, which is regularly updated through either loops or beacons. Continuous communication update - verifies the movement authority of trains through their entire journey, which can be changed at any time to stop a train if an unsafe condition arises (such as another train exceeding its movement authority) 1 The text in this section has been adapted from a Network Rail document produced for the Crossrail Programme [Ref 3]. 5

6 and requires continuously updated signalling system information being sent to the train such as ETCS Train protection can be grouped into three broad categories; Basic (Train Protection) - protection at selected locations, can include selective speed supervision. Mechanical Trainstops and TPWS fall under this category. Beacon and loop based (ATP) the onboard system is updated at selected locations, plus provides continuous running profile (speed and distance) going forwards. ETCS Level 1, GW-ATP and SELcab fall under this category. Continuous (ATP) - provides continuous update and protection of speed and movement authority throughout. ETCS Level 2 and Level 3 fall under this category 2. 3 Train Protection and Warning System 3.1 Overview During 1994, following the decision by British Rail not to retrospectively fit Automatic Train Protection (ATP) across the railway network, Railtrack (now Network Rail) set up a project to examine alternative ways of preventing and reducing SPADs, including a more cost-effective method of providing train protection. An output of this work stream was the development of the Train Protection and Warning System (TPWS). TPWS evolved from the Automatic Warning System (AWS) which was introduced to the UK railway in the 1950s to help train drivers observe and respond to signals. AWS can also be used to warn the driver when approaching permanent speed restrictions as well as at all temporary and emergency speed restrictions. Trials of the TPWS system took place between 1997 and 1999 with widespread fitment of TPWS beginning in early 2000 to meet the Railway Safety Regulations The Regulations required that no person shall operate, and no infrastructure controller shall permit, the operation of a train on a railway unless a train protection system is in service in relation to that train and railway. Following the collision at Ladbroke Grove (1999), Sir David Davies, then President of the Royal Academy of Engineering, was asked by the Deputy Prime Minister to undertake an independent review of possible forms of Automatic Train Protection suitable for fitting to infrastructure and rolling stock to achieve improvements in railway safety and protection against SPADs. Sir David s conclusion was that in the longer term the solution lay in adopting the European Train Control System (ETCS), but that the best solution (irrespective of cost) to 2 These relate to ERTMS, see section 8 for definitions and more detail. 6

7 maximise safety by minimising the possibility of SPAD-related accidents over the next 10 to 15 years (written in 2000), was to fit TPWS. In the short term, it was expected that the development of TPWS +, with the addition of enhanced emergency braking on trains, defensive driving policies and a small change in regulation rules at junctions, would give added benefits. Fitment of TPWS was accelerated following the Ladbroke Grove Rail accident under regulatory requirements. The fitment programme was completed during TPWS uses transmitters mounted in the centre of the track which, when active, transmit one of 6 different frequencies in the range 64 khz to 67 khz. The frequencies emitted by these transmitters are detected by a receiver mounted on the train. The following figure shows a typical layout of the TPWS equipment installed on the approach to, and at a signal. Figure 2: TPWS typical layout for track-borne equipment The TPWS equipment installed at a signal generally consists of two elements: The train stop sensor system (TSS): this consists of two adjacent transmitters (the arming transmitter and the trigger transmitter), positioned at the signal. These transmitters are energised whenever the signal is at red, and will apply a brake application on a train passing the signal at danger, irrespective of train speed. The overspeed sensor system (OSS): this consists of two transmitters located on the approach to the signal (normally between 15 metres and 450 metres from the signal), and separated by a distance between 6 and 36 metres. The OSS operates on the principle of measuring the time taken for a train to pass between two points on the track. The distance between the arming transmitter and the trigger transmitter, in conjunction with a delay timer on the train (which is set to different values for passenger and freight trains), determines the set speed of the overspeed transmitters. The two transmitters are energised when the signal is required to be at 7

8 danger, and will initiate a brake application on a train which passes over the OSS above the set speed. At locations, other than signals, such as on the approach to a speed reduction or buffer stop where TPWS is required to be installed to ensure trains have sufficiently reduced their speed, an OSS alone is installed. This will be permanently energised so that it will initiate a brake application on any train passing above the set speed. 3.2 Future Strategy The future strategy for TPWS is set out in full in a separate document [Ref 1]. The following is a high-level overview of the strategy. For the Train Protection and Warning System (TPWS) to remain an effective train protection system for use on the mainline railway network for the next 25 to 35 years, the strategy will be for the railway industry to cooperate to: Ensure TPWS continues to comply with the requirements of the 1999 Railway Safety Regulations and the relevant exemptions and successor documents. Ensure TPWS continues to be reliable and continues to meet or exceed the minimum availability requirements specified in Railway Group Standard GE/RT8075 or successor documents. Review the application of TPWS to infrastructure and trains on an ongoing basis to ensure that the risk mitigated by TPWS, in conjunction with other risk mitigation measures, remains as low as reasonably practicable. The TPWS strategy document [Ref 1] sets out the actions that will be undertaken to achieve this over Control Period 5. 4 Trainstop and Tripcocks 4.1 Overview The tripcock system of train protection is an early attempt to provide mitigation against trains passing signals at danger and is still widely in use today. The system relies on the mechanical interface between a tripcock mounted on the train and a trainstop mounted trackside. The tripcock on the train is connected to a valve in the braking system (either mechanically or electrically) which when operated, alters the pressure in the braking system, causing the brakes to apply. The trainstop takes the form of an arm which may be lowered or raised. In its lowered position, the trainstop operating arm is below the tripcock and will not act on it. In the raised position, the trainstop arm will strike the tripcock, causing it to operate the brake valve. 8

9 The system is most commonly used in two-aspect applications and in Metro/LUL locations to stop trains passing signals at danger and as such, the trainstop is lowered when the signal is green and raised when the signal is at red. The trainstop is usually proved to have lowered before a green aspect is illuminated and other proving arrangements are used to prevent trains approaching red signals where the trainstop is not raised. The trainstop may be an electric or pneumatic/hydraulic device and the relays or valves to lower it are operated by the circuits used in signal aspect selection. The arm is usually sprung to provide a failsafe function which raises the arm. As the system provides a prime safety function, the tripcock on the train is usually proved to be in place when the train leaves a depot and at other locations on the running lines. This proving is done by a tripcock tester which proves the tripcock is in position within a given space envelope which will ensure it interacts with a raised tripcock arm. Testing the operation of the tripcock valve when operated is another safety test. Whilst primarily used at signals to provide a train stop function, the system may also be used to provide a means of speed control. An example of this is the London Underground TETS (Trains Entering Terminal Stations) system which was introduced following the Moorgate accident in In a speed control application, a trainstop is raised or lowered according to timed occupation of train detection sections. As this is done over a known distance, the average speed of the train can be inferred and the train tripped if its speed is too high. Again, this is not functionally dissimilar to TPWS applied at an OSS, although the means of operation is very different. To protect against acceleration following Tripcock activation, trains are often provided with a means of limiting the speed of the train for a given amount of time - on the London Underground, this referred to as SCAT (Speed Control After Tripping). Chiltern Trains are fitted with tripcocks for operation over London Underground Lines fitted with mechanical trainstops. 4.2 Future Strategy Where possible, trainstops and tripcocks are being removed through re-signalling schemes on both London Underground and Network Rail infrastructure. On Network Rail infrastructure, TPWS is largely replacing trainstops as it can provide the same functionality and has a proven reliability record. On London Underground, the conversion of the network to Communications Based Train Control (CBTC) is the main replacement. On areas of joint running (where mainline trains operate over LU infrastructure), tripcocks are being retained at present. Attempts to replace them with TPWS have been hampered by the 4th rail infrastructure. 9

10 5 Great Western ATP 5.1 Overview The Great Western ATP (GW-ATP) system fitment commenced on the infrastructure and Class 43 HSTs from 1989 onwards and was operated as a BR trial to the GWML until 1999 when the trial was completed. The system is now fully operational on all the GWR vehicles operating at 125 mph on the GWML fitted routes.. The infrastructure was initially fitted from: Paddington to Oldfield Park just short of Bristol Temple Meads Bristol Parkway to Paddington on both the Up and Down Main Lines A short section of the Berks. and Hants. line between Reading and Newbury The gaps in the infrastructure fitment were deliberate and used to familiarise the drivers with the transition between ATP and AWS operation. Although the system was capable of suppressing the AWS when operating in ATP, this was never enabled. The relief lines were also equipped between Paddington and Mile Post 12 (west of Airport Junction) in 1996 as part of the Heathrow Express scheme. Trackside equipment typically comprises an ATP enclosure containing electronic equipment capable of generating telegrams for transmission to passing trains via a beacon in the 4-foot. The ATP is connected to the conventional signalling systems by using a high impedance interface. The lineside ATP equipment contains duplicated processing elements which enhance the integrity of the system, in that both processors must generate identical telegrams before any data can be transmitted. The transmitted telegram includes information relating to: Signal aspect Routing Speed restrictions Distance to next signal Gradients Position light signal restrictions The permanent data for each signal location is stored in a programmable parameter plug containing a PROM (programmable read-only memory) device. Additional parameter plugs are used to provide temporary speed restriction data and to indicate emergency speed restrictions. 10

11 The beacon is comprised of a 1 metre long stainless steel loop, forming the secondary winding of a transformer (the primary connected to the line side electronics). The beacons are fitted in the four-foot, providing directionality by being offset to the left of centre by 150mm. To improve traffic flow, infill loops are installed in advance of the signals ahead to provide early notification of clearing aspects. Loops consist of a single-core cable installed in the centre of the four-foot, with the return leg clipped to the left rail. Infill is installed on approximately 65% of signals on GWML; in some locations where space is limited, infill beacons are used instead, to provide a single update. The infrastructure is dual fitted with AWS/TPWS for use by non-fitted trains. The following trains have been fitted ATP equipment although following vehicle cascade to other operators it may be decommissioned. Class 43 HST power cars (119 units) operated by GWR Class 180 (10 units) Class 3324 (14 units) operated by Heathrow Express Class 360/2 (5 units) operated by Heathrow Express as Heathrow Connect The GWR IET Class 800 Fleet will also be manufactured and delivered with the system fitted. The onboard system comprises an underbody antenna which receives information from the track-mounted beacons and loops. A wheel mounted tachometer to establish direction of travel and record distance travelled. The in-cab equipment consists of a driver's display to convey information to the driver and a data entry unit to facilitate the entry of non-standard data into the on-board computer. The onboard computer is contained in a large enclosure and is termed as the Vehicle On Board Controller (VOBC). The Heathrow tunnel requires the fitment of ATP or ERTMS to allow the train to run The system is jointly owned by Network Rail and TOCs with fitted trains and is managed through the RSSB GWML User Management Group. 5.2 Future Strategy The strategy in the immediate future for the ATP train is as follows: The current 119 Class 43 HST power cars will be moved to other routes and replaced during 2017/2018 with 186 Class 800 ATP fitted cabs. The current 10 Class 180 ATP fitted cabs in service will be reduced to 8 in 2017 and then cascaded to other routes. Class 334 (14 units) continue to use ATP and any replacement trains will be fitted with ETCS The class 360/2 units are being replaced with class 345 Crossrail trains 11

12 The new Crossrail trains are not fitted with ATP. ETCS is being fitted to provide the ATP functionality in line with the RSR1999. The system is now nearing the end of its design life. It was originally planned to be phased out by 2020, but it has been postulated that this can be increased to at least The system will need to be replaced by a system of equivalent train protection and which is assumed that this will be ETCS. 6 Chiltern SELcab ATP 6.1 Overview The Chiltern SELcab ATP system fitment commenced on the infrastructure and Class 165 DMUs from 1990 onwards and was operated as a BR trial to the Chiltern lines until 1999 when the trial was completed. The specific infrastructure fitted is: Marylebone Aynho Junction via High Wycombe Marylebone Aylesbury Vale Parkway excluding Amersham Harrow on the Hill The system is unique in the world, although closely related to the German LZB system. It was developed by ALSTOM signalling together with Alcatel (now Thales). Trackside loops provide fitted trains with detail of the signal aspects and permitted speeds. The on-train equipment carries out fault monitoring and provides rollback protection. The infrastructure is dual fitted with AWS/TPWS for use by non-fitted trains. The following Chiltern Railways fleets are fitted with the cab equipment: Class 165/0 (39 units) Class 168/0 (5 units) Class 168/1 (8 units) Class 168/2 (6 units) In 2012 Thales declared the system obsolete from 31st December 2012 and now only provide support on an ad-hoc basis. The system is jointly owned by Network Rail and Chiltern Railways and is managed through the RSSB Chiltern ATP Working Group. 6.2 Future Strategy Network Rail and Chiltern Railways have jointly considered the situation presented by obsolescence. There are a number of limiting factors and legal issues that constrain the strategic options including: Network Rail and Chiltern Railways funding situations. 12

13 The HSWA1974, political and moral obligation to not reduce the safety of the railway system. The RSR1999 which prohibit the removal of automatic train protection without an Exemption from the ORR. UK and EU requirements that the only permitted ATP system to be fitted in future is ETCS. Providing a suitable migration path to ETCS. A limited number of spares especially for the on-train equipment and the difficulties in developing modern alternatives without support of the system OEM. The ageing workforce and tooling & test equipment available to support the ATP equipment. Thus, the strategic approach is to: Develop Enhanced TPWS as a replacement for ATP on the ATP fitted infrastructure. Plan roll out of Enhanced TPWS from 2019 in line with CP6 funding and upgrade the on-train TPWS equipment to full RGS GE/RT8075 issue 02 compliance. This will be followed by ETCS fitment at a later date Develop an alternative means of rollback protection for the trains. Prepare a case to obtain an RSR1999 exemption from the ORR to enable this scheme to proceed in consultation with the ORR and stakeholders. Manage the spares levels by not extending fitment of the system to any further cabs and carrying out last time buys where possible and maintaining staff competency. Enhanced TPWS involves the installation of TPWS to all main signals on the ATP fitted infrastructure. The overall railway system safety level improves as a result of the improved collision protection provided to the increasing number of non-atp fitted trains. This more than offsets the speed and signal supervision benefits provided by ATP to the ATP fitted train. 7 TVM Overview Transmission Voie-Machine (TVM, English: track-to-train transmission) is a form of incab signalling originally deployed in France and used on high-speed railway lines. TVM- 300 was the first version, followed by TVM-430. The later version (TVM-430) is fitted to 13

14 HS1. This was developed for the new high-speed lines in France where the traditional signalling was not sufficient and also for the increased number of speed steps required for the Channel Tunnel routes. The TVM system was developed by the French group Compagnie de Signaux et d'entreprises Electriques (CSEE), now part of Ansaldo STS. TVM-430 allows a train's onboard computer system to generate a continuous speed control curve in the event of an emergency brake activation, effectively forcing the driver to reduce speed safely without releasing the brake. TVM-430 was developed from an intended "modular and flexible" range of signalling system levels from TVM-400 up to TVM-440 (optional automatic train control) and TVM- 450 (full driverless control). TVM-430 is fitted to Eurostar trains - both to the older class 373 (e300) units and the newer class 374 Siemens Velaro (e320) units built in The system is also fitted to the Southeastern s class 395 trains, which were built and are maintained by Hitachi and Class 92 locos operated by DB Cargo 7.2 Future Strategy The TVM430 on HS1 is planned to be replaced by ETCS which will be aligned to the replacement for the signalling on the French high-speed line between Paris and Calais which is believed to be after 2030 (according to SNCF). It is believed that Infrabel are looking to overlay the Belgium High Speed line in The new 374 Siemens Velaro (e320) trains are fitted with ERTMS so they can be used on the Dutch High speed line. The ERTMS on trains system would need an upgrade to be able to operate on Baseline 3 Release 2 (B3 R2) infrastructure to be used in the UK. 8 KVB 8.1 Overview KVB or Contrôle de Vitesse par Balisesis a train protection system used in France and in London St. Pancras International station. It checks and controls the speed of moving trains. This is the standard ATP system used in France and is technically similar to Ebicab, although the information provided on the driver s display is more limited. The system is installed on the conventional railway network, in particular on the routes where high speed trains (trains à grande vitesse or TGV) approach major termini. Some sections of the high-speed lines (ligne à grande vitesse or LGV) use the system in place of or 14

15 together with TVM for certain spot transmissions and for the supervision of temporary speed restrictions where appropriate speed levels are not available from TVM codes. Spot transmissions include such items as door release authority, overhead line section switches and radio channel changes. The system is overlaid on the conventional signalling system. The data is transmitted inductively between passive balises (between two and nine may be required per signal) and the on-board antenna which activates (powers up) the balise as it passes. The data transmission capacity is limited, hence the need for many additional balises. The driver must input train data unless the train is a modern, fixed formation unit, where data is automatically programmed into the on-board supervision computer. In the event of any over-speed, the driver will receive a warning and then an irrevocable emergency brake will apply. The brake cannot be released until the train is at a stand. This system is provided on Eurostar trains and it is installed on certain limited sections of the CTRL, most notably on the approach to St. Pancras International station. 8.2 Future Strategy The long term strategy is for KVB to be replaced by ETCS. KVB is comparable to ETCS Level 1 Limited Supervision because it offers a beacon-based speed control without any indication for the driver. 9 ERTMS 9.1 Overview The European Rail Traffic Management System (ERTMS) has the European Train Control System (ETCS) as its train protection element. ERTMS has been developed for the European Commission in response to the need to have one train protection system across the Europe Mainline Network. This is to support the single European market to allow the free movement of goods and services. The system was developed by the European Signalling Manufacturers with a specification set out the Command Control and Signalling (CCS) Technical Specification for Interoperability (TSI). This is different from the metro signalling system Communications Based Train Control (CBTC) which is not interoperable between suppliers and is designed for Metro type operation. ERTMS system will intervene if the driver of a train is going too fast or is likely to exceed the End of Authority. ERTMS has a number of levels, which reflect its functionality: 15

16 Level National Train Control Train is fitted but working over TPWS fitted infrastructure; Level 1 providing Automatic Train Protection with balises on the infrastructure proving updates to the train. Used with conventional signalling and relies on trackside train detection system; Level 2 providing Automatic Train Protection with updates to the train via GSM-R data link. Can be used with or without signals and relies on trackside train detection system; Level 3 providing Automatic Train Protection with updates to the train via GSM-R data link. Used without signals and does not rely on trackside train detection system. This is in development. System development started in the 1990s with the first major deployment for passenger services in 2003 between Olten and Luzern(Level 2 without signals). The system has been rolled out in a number of countries in Europe including: GB, Spain, Austria, Sweden, the Netherlands, Belgium and Italy. It has also become a global standard and is also used in Australia, Turkey, China and Saudi Arabia, amongst others. 9.2 Future Strategy The GB policy is to roll out ERTMS to provide a national train protection strategy in the long term in line with European legislation and because it is the globally recognised standard for a modern mainline train protection system. The rollout has proved to be expensive and complex, delaying implementation of recommendations from the original Uff- Cullen. In addition, the business case work undertaken by the National ERTMS Programme/Digital Railway programme has shown some cost and business benefits of ERTMS deployment including: improved safety, increased capacity, reduced journey times, improved performance and lower longer term signalling costs. It is GB policy to roll out Level 2 ERTMS when signalling needs to be renewed and where business benefits can be gained with additional capacity. It is planned to then roll out Level 3 ETCS rather than Level 2 ETCS when it becomes commercially available and proven It is the Train Protection Strategy Group s role to work with industry to make sure the present train protection systems remain effective until the introduction of ERTMS. 16

17 10 Reliability of Train Protection Systems The following table give details of the reliability of some of the train protection systems discussed in this document. Metric Trainstops and Tripcocks GW-ATP TVM-430 (Eurostar) TVM-430 (Southeastern) Time period 2016 (01/04/16 to 17/09/16) Number of failures in the time period Miles (millions) in the time period Miles per casualty Delay minutes in the time period ~ , , ,667 33, Table 1: Reliability of train protections systems 11 References 1. The Strategy for the Train Protection and Warning System (TPWS) Issue 2, TPSG, Taking Safe Decisions, RSSB, Crossrail Train Protection (Plan B) - Railway Safety Regulations 1999 Exemption Application Report, Network Rail, data/assets/pdf_file/0010/18856/paddington-0-12-exemptionapplication-report.pdf 17